IT Policy/CPNI/3

From CSWiki
Jump to: navigation, search

Regarding paragraph 3 (routine transfers of CPNI), I think the ideas are in slight conflict with what my group says in the Auditing section. Specifically you mention transfers between marketing and billing, which we refer to as internal uses or accesses of CPNI which should be logged. We agree that consumers shouldn't be notified of all such transfers/accesses, but we say that the customer should have a right to request a copy of the full audit log which contains this information. We also think keeping a log of all internal accesses for each account is not very costly when part of the complete auditing system. --Jeff D