Table of Contents

Best Practices to Remain CPNI Compliant

Mitchell Ivany Updated by Mitchell Ivany

Read Time: 2 mins

What is CPNI Compliance?

CPNI stands for Customer Proprietary Network Information. It includes private details related to a customer’s phone service, such as:

  1. Phone numbers called or received
  2. Call date, time, and duration
  3. Account numbers
  4. Email addresses
  5. Mobile numbers

Because this information can identify a customer, it must be protected.

To stay compliant, the FCC requires telecom providers to verify a customer’s identity before sharing, confirming, or changing CPNI-related information.

Providers must also notify customers right away when certain account details are created or changed, including:

  1. Passwords
  2. Security questions or backup authentication answers
  3. Address of record
This notice is not required when a customer first starts service and creates a password during sign-up.
For more details, see the FCC brief or Public Notice DA-24-125A1.

How to Stay CPNI Compliant

To stay compliant with FCC CPNI requirements, telecom providers should protect customer information and verify the customer before sharing or changing private account details.

The two basic requirements are:

  1. Protect customer data with a PIN
    A customer’s PIN should be confirmed before any private information is shared or changed.
  2. Notify customers when certain account information changes
    Customers should be notified when protected account details are created or updated, such as passwords, authentication information, or the address of record.

Staying Compliant in Sonar

You can support CPNI compliance in Sonar by using:

  1. Sticky Notes with Confirmation: Add a note to the account that requires staff to confirm the customer’s PIN before continuing a call or email thread.
  2. Triggered Messages: Send notifications when important account changes are made.

Recommended triggers include:

  1. A contact’s password is changed
  2. An account address is changed

Customer Portal Permission Consideration

If the Sonar Customer Portal is enabled, you may choose to disable the UPDATE_CONTACT permission for the customer_portal_api user. This prevents customers from editing private profile information directly in the portal and requires them to contact your support team, where their PIN can be verified before changes are made.

Disabling the UPDATE_CONTACT permission also prevents customers from resetting their Customer Portal password, because portal login credentials are tied to account contacts in Sonar.

How did we do?

API Changes for Voice Billing

Billing Voice Services in Sonar

Contact