FCC Customer Proprietary Network Information (CPNI) and Data Breach Rules (47 CFR 64.2001-2011) CPNI-64.2009: Safeguards required for use of CPNI (47 CFR 64.2009)

Section 64.2009 establishes safeguards on CARRIER'S USE of CPNI: (a) TRAINING - carriers must train their personnel as to when they are + are not authorised to use CPNI; carriers shall have an EXPRESS DISCIPLINARY PROCESS in place + carriers must include in the disciplinary process consequences for failure to follow CPNI procedures including immediate dismissal where appropriate. (b) MAINTENANCE OF RECORDS - carriers must maintain a record of its sales + marketing campaigns that use the customer's CPNI for a minimum of 1 YEAR; the record must include a description of each campaign + the specific CPNI that was used + what products + services were offered as part of the campaign. (c) SUPERVISORY REVIEW PROCESS - carriers must establish a supervisory review process regarding carrier compliance with the rules for outbound marketing situations + maintain records of carrier compliance for a minimum period of 1 year (the 'OBM' Records). Specifically, sales personnel must obtain SUPERVISORY APPROVAL of any proposed outbound marketing request for customer approval. (d) ANNUAL OFFICER CERTIFICATION - a corporate officer with personal knowledge must SIGN AN ANNUAL COMPLIANCE CERTIFICATE stating that the officer has personal knowledge + the carrier has established operating procedures adequate to ensure compliance with Subpart U; this is the EB-CPNI-2009 annual filing.