What is CPNI

CPNI stands for Customer Proprietary Network Information. Per the Federal Communications Commission (FCC), this is defined as:

• Information about a customer’s subscribed services (call detail) including:
• Quantity – Number of minutes used.
• Technical Configuration – type of service: wireless or wireline.
• Type – local or long-distance calls.
• Destination – where a call terminates.
• Location – where a call originates.
• Amount of use – call time (length).
• Information made available to the carrier by virtue of the carrier-customer relationship.
• Information contained in customer bills such as telephone exchange service or toll service, number of lines, long distance carrier, and subscription length.

The FCC mandates that telecom carriers follow guidelines to ensure this information is protected, for example, from pretexters who pose as someone else to obtain records for illicit gains.

How CPNI Works in the IDI Platform

CPNI compliance in the IDI platform applies to specific account types established as part of CPNI setup. For CPNI-compliant account types, the system will protect account information by requiring customers to verify their identity before customer service associates share account information or make changes on the customer’s behalf. On accessing an account in IDI Desktop Client or Customer Care, the customer must provide security information as proof of their identity, and the service associate must acknowledge the security information has been provided. When certain account information is changed, the system will send the customer a notification. Notification delivery methods (Email, SMS, or letter) and other rules governing notifications are also specified as part of CPNI setup.

The following is a quick summary of how CPNI works in the IDI platform.

Setup Overview

Setup for CPNI functionality exists in both IDI Desktop Client and Customer Care.

• CPNI-related permissions are configured separately for IDI Desktop Client and Customer Care.
• CPNI configuration settings in IDI Desktop Client apply to both the client and Customer Care. This includes:
  • Applicable Account Types
  • Required CPNI Data
  • PIN and Password rules
  • Security Questions
  • Notification settings (templates, delivery methods, etc)

Note: CPNI notifications need to be separately enabled from Customer Care to use this capability as described in Setup. When enabled, Customer Care sends notifications based on the setup from IDI Desktop Client.

• Customer Care has more robust CPNI Verification options than IDI Desktop Client as described in Verification below. Configuration for this verification is in Customer Care.

Adding/Editing CPNI Information for Customer

For designated account types, when you add a new account, fields are provided for capturing CPNI security information and keeping it up to date including authorized users, passwords, and security questions. CPNI fields that are selected as Required CPNI Data in CPNI configuration will be required on accounts of the designated CPNI account types.

Verification

Customer Care lets administrators configure the account verification experience by specifying what user groups receive a verification pop-up prior to opening an account. User groups are configured in Admin Console > Security. Furthermore, the administrator can configure what fields are used for verification and whether the account can be accessed if it is not verified. CPNI PIN verification is supported with this configuration, along with the other CPNI fields.

IDI Desktop Client functionality is more limited. PIN verification is supported. Any other CPNI verification must be a manual process that is not enabled or enforced systematically.

CPNI Notifications

The system sends customers a notification for the following account changes:

• Account password, authorized user, or authorized user password.
• Security question/answer.
• Primary billing contact email or contact address (or address changes on primary customer contact if billing contact is marked same as customer).

The notifications can be sent via email, text message and/or letter (hard copy). The system verifies the applicable notification template has the required information. Email notifications require an email address. Letter notifications require a postal address. If all required information is in place, the notification is sent; otherwise, a follow-up is sent to the designated user group.

Logging

The following information logged in the IDI platform for each notification sent:

• Date & Time
• Time
• System user ID of person who initiated the notification
• Account number of the account where the change occurred

Templates

IDI Desktop Client BackOffice Management > Customer Notifications provides core (default) templates for applicable delivery types for PIN, Account, and OnlineBill CPNI notifications. Template Management also supports creating custom CPNI templates.

 

Managing CPNI Compliance

Routine checks are made to ensure all required customers have the necessary CPNI data on file. This is done via IDI Desktop Client CPNI search tools that facilitate this.

Setup

The setup covered here is to be completed by your designated CPNI administrator. IDI will complete other setup on your behalf for settings you cannot access.

Permissions

For IDI Desktop Client

Permissions in Admin Console > Security > Profiles > Permision Profiles restrict access to CPNI management functions in the IDI Desktop Client. The path is: Applications > CostGuard Client > Customer Management > CPNI:

 

Permission	Description
Address History – Accept Reject Changes	Restricts ability to accept/reject changes in Address History search results in IDI Desktop Client via Applications > CPNI > Address History Search.
Address History – Search	Restricts ability to perform Address History search in IDI Desktop Client via Applications > CPNI > Address History Search.
Configuration – Edit	Restricts ability to edit CPNI data in IDI Desktop Client via Applications > CPNI > CPNI Configuration.
Email History – Accept Reject Changes	Restricts ability to accept/reject changes in the Email History search results in IDI Desktop Client via Applications > CPNI > Email History Search.
Email History – Search	Restricts ability to perform an Address History search in IDI Desktop Client via Applications > CPNI > Email History Search.
Notification Audit – Search	Restricts ability to perform an Address History search via Applications > CPNI > Notification Audit Search.
PIN – Remove PIN	Restrict the ability to manage PINs for an account in IDI Desktop Client via the Customer Summary.
PIN – Send PIN
PIN – Verify PIN
Security Saturation – Search	Restricts ability to perform a Security Saturation search in IDI Desktop Client via Applications > CPNI > Email History Search.

For Customer Care

To support using CPNI in Customer Care, there are three SaaS Security settings provided with the Customer Care Admin role:

• Manage Settings – This lets users enable CPNI notification in Customer Care and configure CPNI Verification settings.
• Edit CPNI Information – This lets you grant users the ability to edit CPNI information without also granting them full access to customer information.
• View CPNI Information – This lets users view CPNI information on an account

CPNI Configuration

In IDI Desktop Client

Access to CPNI configuration in IDI Desktop Client is via Applications > CPNI > CPNI Configuration. This displays the Configuration dialog. Use the CPNI Data and Notification tabs to establish CPNI rules.

Note: All setup on the CPNI Data tab applies to using CPNI in both IDI Desktop Client and Customer Care.

Section	Description
Required CPNI Data	This section lets you specify which fields are required when you add an account type designated to use CPNI.
PIN Rules	Specify length (4–25) and number of retry attempts (0 = unlimited). You can also choose to always show the verification form when a PIN exists.
Password Format	Specify minimum and maximum length (2–49).
Security Questions	The context menu lets you add, remove, enable and disable any of the listed questions. You can also choose to allow custom subscriber questions.
Account Types	The context menu lets you add and remove account types that require CPNI. Note: Clear the system cache (Tools > Clear Local Cache) to save changes.

On the Notifications tab you establish rules that govern the CPNI notifications process. This setup applies to both IDI Desktop Client and Customer Care. Note: Notifications must also be enabled in Customer Care via MANAGE > Settings in Customer Care.

The setup here involves:

• Adding and ranking delivery types for PIN and Account Change notifications in their respective sections.
• Specifying other related parameters in the lower fields.

PIN and Account Change Notification Delivery Types

PIN and Account Change notifications can be sent by email, SMS (SMTP or SMPP), and letter (hardcopy). When you add multiple delivery types in a section, the types can be ranked (prioritized). A delivery type with a rank of 1 means it will be used first. If the delivery type fails for some reason, the system goes to the next ranked delivery type. For example, if email is ranked #1 and Letter is ranked #2 for Account Change Notifications, and there is no email address on the account, the notification will default to postal mail. You can also set a threshold on Letter delivery type for Account Change notifications. A threshold establishes the time (as specified in number of hours after the change) the letter must be sent.

• To add a delivery type, right-click in the white space of the applicable section – PIN or Account Change Notifications – and choose Add to display a dialog for selecting the Delivery Type. The context menu also lets you remove an already selected delivery type.
• Delivery types are ranked in the order they’re added. To adjust the rank of a delivery type, select it and then use the section’s up/down arrows.

• Threshold can only be set on the Letter delivery type for Account Change notifications. Threshold is optional. To set it, right-click the Letter delivery type in the Account Change Notifications section and choose Modify Threshold. Then enter Threshold Hours.

Other Notification Parameters

SMS Email Domain	Domain name to be used for SMS text messages.
Email From Address (Required)	Sender address for all PIN/account change notifications.
Provider Name (Required)	Provider (carrier) name to be used for a given pin/account change notification.
Support Phone (Required)	Phone number to be used for all PIN/account change notifications.
Test Mode	Check to use the system in test mode. When checked, notifications are sent to the Test Email or the Test SMS. By default, it is unchecked.
***Test Email***	Test email address.
***Test SMS***	Test SMS number for SMS messages.
Notification Follow-Ups Assigned To	User group to handle notification follow-ups created when a notification cannot be sent to an intended recipient (for example for m issing email address).
Confirm Account Change Notifications	Check to have the system let users know and confirm that an account change notification will be sent to a subscriber. By default, it is unchecked.
Notification on Numeric Edits Only	Check to have the system evaluate address changes that are either numeric modifications or text changes. It checks for numeric edits including Street 1, Street 2, Street 3 or zip code. It also does a text comparison of street names. For example, if a customer’s address is changed from 2 West Main to 77 High Street, a notification is sent; or if an address is changed from 10 Elm Street to 10 Grove Terrace, a notification is also sent. By default, it is unchecked.

In Customer Care

Settings for CPNI in Customer Care are available via MANAGE > Settings. The CPNI settings section lets you configure:

• Notifications – Clicking CONFIGURE NOTIFICATIONS creates a trigger and several Workflow actions to support CPNI Notifications. Once enabled, to disable, the Workflow actions must be deleted. Note: The actions use the notification setup as configured in IDI Desktop Client.
• Which Customer Care users see the Require CPNI Verification Dialog – CPNI Verification can be required for specific user groups. Groups are created and users are assigned to groups via Admin Console Security. Create groups and then assign users to groups as needed.

The groups you create populate the Display For drop-down menu. You can select one or many user groups. When a user in a group that is configured to Require CPNI Verification Dialog, the CPNI Verification dialog will open prior to opening the account.

• Checking the Deny Access to Unverified Accounts option will prevent the account from opening if the user does not verify CPNI information. On denial, you’re returned to the Account Search page.
• Which CPNI Verification Fields are required – This section lets you select the fields used for CPNI verification. This defaults to Account Password, Security Question/Answer, Authorized User Password, Authorized Users, and CPNI PIN.

You can select any combination of fields. At least one field must be checked to save the setting.

Entering CPNI For New Customers

Enter this information on the respective Add/Edit Customer pages in IDI Desktop Client and Customer Care for applicable account types:

Password	Guidelines are set on the CPNI Configuration form (2 to 49 characters).
Security Question	Select one from the drop-down list.
Security Question Answer	Enter the answer here (limited to 80 characters).
Authorized Users	Click Add and enter the customer’s name and phone number in the CPNI Add Authorized User window. Add additional users as needed. To delete an authorized user, select the name, then click Remove.
Authorized User Password	This is an optional field that you may use if there are additional authorized users whose ID you want to verify. The same password is used for all additional users.
SMS Number	Enter the customer’s SMS number. This does not apply to wireline.
Internal Marketing External Marketing	These are optional and company specific. They may be used for reporting; however, they do not drive any functionality

IDI Desktop Client:

Customer Care:

Managing CPNI on an Account

This covers verifying customers on accessing their account, as well as viewing and editing CPNI information on an account.

In Customer Care

CPNI information is available on the Account Summary page. This page lets you:

• Verify (authenticate) the customer before sharing account information.
• View CPNI information and verification history via the CPNI Information panel.
• Edit CPNI information (requires Edit CPNI Information permission). With this permission, the panel will have an edit (pencil) icon to display the Edit CPNI Information dialog.

Note: When the system is configured to deny access to unverified accounts, you will not be permitted to open the account until the customer is verified. On denial, you’re returned to the Account Search page.

Verifying/Authenticating the Customer

For account types that require CPNI, you must verify/authenticate the customer before you share/discuss account information. This process is governed by CPNI verification requirements configured via MANAGE > Settings.

The CPNI Verification dialog will open automatically for users configured to require CPNI Verification. Users that are not configured to require CPNI verification, the dialog can still be used to verify CPNI information by clicking the shield icon at the top right of the account page. The orange banner indicates Not Verified status.

The Verify Customer dialog displays the fields specified in the CPNI settings.

Check one or more fields to verify. At least one field must be checked to enable the Verified button. You can also send, update, or remove the PIN information when applicable. When you are ready to verify the CPNI information, click Verified.

On successfully verifying the CPNI information the orange Not Verified banner is replaced by a green Customer Verified banner, and the blue Verify Customer badge is removed. These badges reset each time you access the account.

To view the Verification History, click the link in the CPNI Information panel. The history shows you dates, user, and fields used to perform the verification.

Editing CPNI Information in Customer Care

This requires Edit CPNI Information permission. With this permission, the panel will have an edit (pencil) icon to display the Edit CPNI Information dialog.

Monitoring CPNI Notifications on an Account in Customer Care

CPNI notifications are sent to a customer when their CPNI information is updated by virtue of the CONFIGURE NOTIFICATIONS setting (MANAGE > Settings). Enabling this setting automatically configures the CPNI Information Updated Workflow trigger which fires and initiates the applicable Workflow action when CPNI information is modified in Customer Care. The actions use the notification setup as configured in IDI Desktop Client.

You can monitor notifications activity on an account via Account > Notifications.

In IDI Desktop Client

CPNI customer/verification is available on the Account Summary page. This page lets manage the customer’s PIN and use it to verify the customer’s identity before sharing account information. For customers designated to use CPNI, there’s a CPNI menu and corresponding icons for sending, removing, and verifying a customer’s PIN.

Note: Sending PINs to individual customers or multiple customers is also supported via the Security Saturation Search results as described in Managing CPNI Compliance.

To verify a customer’s identity:

• Click the verify PIN icon (key with green symbol) or select Verify PIN from the CPNI menu.
• Ask the customer to provide their PIN.
• Enter the PIN in the dialog.

Verification takes place when the customer provides the correct PIN and the system performs a match.

The customer’s CPNI information is provided in the CPNI Information panel. The information is read-only here; however, you can use the Edit Customer form to edit their CPNI information.

Managing CPNI Compliance in IDI Desktop Client

The Notification Audit, Security Saturation, CPNI Address History, and CPNI Email History search tools in IDI Desktop Client let you perform routine checks to ensure all required customers have the necessary CPNI data on file. These searches are permission-based.

Notification Audit Search

This lets you view notifications that have been sent out based upon the selected criteria.

You can refine the search results to show/hide a specific notification type, delivery method or filter the search results using the right-click (context) menu. Select a row and column, then right-click and choose Filter > By Selection or Excluding Selection. The filter below would filter the list to show just PIN Requests.

Security Saturation Search

This lets you identify accounts that are not in compliance (need CPNI data). From the search results an authorized user can send a PIN to one or more customers. To select contiguous rows, hold down ctrl–shift and then click the start and end rows. To select multiple individual rows, hold down shift and click the rows. To select a single row, simply click on it.

CPNI Address History Search

This lets you review all address changes that have been made to the main billing contact record. An authorized user can accept or reject any result by selecting the row in the search results and then using the right-click context menu. Whether you can accept or reject depends on the current status indicated in the far-right Accepted column (not shown below).

CPNI Email History Search

This lets you review all e-mail changes that have been made to the main billing contact record. An authorized user can accept or reject any result by selecting the row in the search results and then using the right-click context menu. Whether you can accept or reject depends on the current status indicated in the far-right Accepted column.