FCC Customer Proprietary Network Information (CPNI) and Data Breach Rules (47 CFR 64.2001-2011) CPNI-Personnel: Personnel training and disciplinary process (47 CFR 64.2009(a))

Section 64.2009(a) requires telecommunications carriers to TRAIN THEIR PERSONNEL as to when they are + are not authorised to use CPNI + to HAVE AN EXPRESS DISCIPLINARY PROCESS in place. Specific requirements: (a) initial training for new employees + contractors with CPNI access prior to commencement of CPNI duties; (b) ongoing / refresher training (typically annual); (c) role-specific training (call center + sales + technical operations + retail + third-party vendor training where contractors have CPNI access); (d) DISCIPLINARY PROCESS - the carrier must include consequences for failure to follow CPNI procedures including IMMEDIATE DISMISSAL where appropriate; the disciplinary procedures must be communicated to personnel; (e) records of training + disciplinary actions; (f) annual certification must include statement on training programme. The 2007 + 2009 CPNI Orders + subsequent FCC enforcement findings have repeatedly cited inadequate training + disciplinary processes as contributing to CPNI breaches.