CPNI IBC Telecom Corp1

8/3/2019 CPNI IBC Telecom Corp1

1/11

A,Rnual47C.F.R.Q64.2009(e)CPNI CertificatioEEB Docket 06-36

Exhibit A

IBC TelecomCorp.

ComplanceRequirements


2/11

IBC Telecom orp.26FlremensMemorialDrive,Ste.107PomonarNework 10970

Compliance equirements

IBC TelecomCorp. "Company")maintainshefollowingoperating rocedureso ensurecompliancewith therequiremorts et orth n Section64,2001et seq.of theCommission'sules.

$ 64.2005 Use of customer proprietary network information without customerapprovaL(a) Any telecommunicationsanier mayuse,disclose, r permitaccesso CPNI for thepurposeof providingor marketing erviceofferingsamong hecategories f service i.e. , local,interoxchange,ndCMRS) o which thecustomer lready ubscribesrom the same arrier,withoutcustomer pproval.(1) If a telecommunicationsarrierprovidesdifferentcategories f service, nda customersubscribeso more han onecategory f serviceofferedby the carrier, hecarrier spermittedc,shareCPNI among he carrier's ffiliatedentities hatprovidea seryice ffering o thecustomer.(2) If a telecommunicationsarrierprovidesdifferentcategories f service, ut a customer oesnot subsoribeo more hanoneofferingby the carrier,he carrier s notpermittedo shareCPNIIwith its affiliates,exceptasprovided n $6a.2007(b).(b) A telecommunicationsaniermaynot use,disclose, r permitaccesso CPNI to market o acustomer erviceofferings hat arewithin a category f serviceo which he subscriber oesnotlalreadysubscriberom that carrier,unless hat carrierhascustomer pproval o do so,exceptasdescribedn paragraphc) ofthis section.(1) A wirelessprovidermayuse,disclose, r permitaccesso CPNIderived rom its provisionofCMRS,withoutcustomer pproval,or theprovisionof CPEand nformationservice(s).wirelinecarriermay use,disclose r permitaccesso CPNIderived rom its provisionof localexchange erviceor interexchangeervice,withoutcustomer pproval,or theprovisionof CPIIandcall answering, oicemail or messaging,oioestorage nd ehievalservices,ax storeandforward,andprotocolconversion.(2) A telecommunicationsarriormaynot use,disclose r permitaccesso CPNI to identifoortrackcustomerslat call competing erviceproviders.For example, localexchange a:rier marynot use ocalserviceCPNIto trackall customershat call localservice ompetitors.(c) A telecommunicationsarriermay use,disclose, r permitaccesso CPNI,withoutcustomerapproval, s describedn thisparagraphc).


3/11

(l) A telecommunicationsarriermayuse,disclose, r permitaccesso CPNI,withoutcustomerapproval, n its provisionof insidewiring installation,maintenance,nd epair services.(2) CMRSprovidersmay use,disclose, r permitaccesso CPNI for thepurpose f conductingresearch n thehealtheffectsof CMRS.(3) LECs, CMRSproviderqand entities hat provide nterconnectedoIP serviceas hat term sdefined n $9.3of this chapter,may useCPNI,withoutcustomer pproval,o marketservicesformerlyknown as adjunct-to-basicervices, uchas,but not limited o, speed ialing,computrr-provideddirectoryassistance,all monitoring,call traoing,call blocking,call return, epeatdialing,call tracking,call waiting callerLD., call forwarding andcertaincentrex eatures.(d) A telecommunicationsarriermayuse,disclose, r permitaccesso CPNI to protect he riglntsor properlyof thecarrier,or to protectusers f thoseservices ndothercarriers rom fraudulentl,abusive, r unlawfuluseof, or subscriptiono, suchservices.[63FR 20338,Apr.24,1998, samendedat 4FR 53264,Oct.1, 1999:,67 R 59211,Sept'20',2002;72FR 31962, une8,20071

The Company has adoptedspeciJicCPNI policies to ensure hal, in the absenceof customerapproval, CPNI is only usedby the Company o provide or market serviceofferings among thecategoriesof semice(ie., Iocal, inlerexchange, and CMRS)to which the customer alreadysubssibes, The Company'sCPNI policiesprohibit the sharing of CPNI with afJiliatedcompanies,ercept aspermitted under Rule 6a.2005(a)(l) or with custotnerapprovalpursuantto Rule 64.2007(b). The only exceptions o thosepolicies are aspermilted ander 47.U.5.C.S222(d) and RuIe 64.2005.

$ 64.2007 Approval required for use of customer proprietary nefwork information.(a) A telecommunicationsarriermay obtainapprovalhroughwritten,oralor electronicmethods.( I ) A telecommunicationsarrier elyingon oral approval hallbear heburdenof demonstratingthat suchapprovalhasbeengiven n compliancewith the Commission'sules n thispart.(2) Approval or disapprovalo use,disclose, r permitaccesso a customer's PNI obtainedby'atelecommunicationsarriermust emain n effectuntil the customer evokes r limits suchapprovalor disapproval.(3) A telecommunicationsarriermust maintain ecords f approval,whetheroral,writtenorelectronic, or at leastoneyear.In all circumstanceswherecustomer approval is required to use,d.isclose r permit access oCPNI, the Company'sCPNI policies require that the Companyobnin customerdpptovalthrough written, oral or electronic methods n compliancewith Rule 64.2007. A cuslomer'sapproval or dhapproval rcmains in effect until the customer cvokesor limils the approval ordisapproval The Company maintains reeordsof customerapprcval (whether writlen, oral orelectronic) or a minimum of oneyean


4/11

(b) Useof Opt-Outand Opt-InApprovalProcesses. telecommunicationsarriermay,subjeotoopt-outapprovalor opt-in approval,use ts customer'sndividually dentifiableCPNI for thepurpose f marketing ommunications-relatederviceso that customer.A telecommunicationscaniermay,subjecto opt-outapprovalor opt-inapproval,disclose ts customeCsndividuallyidentifiableCPNI,for thepurpose f marketingcommunications-relatederviceso thatcustomer,o its agents nd ts afFrliateshat providecommunications-relatedervices.Atelecommunicationsarriermayalsopermitsuchpersons r entities o obtainaccesso suchCPNI for suchpurposes. xcept or useand disclosure f CPNIthat s permittedwithoutcustomer pprovalundersection$64.2005, r that s describedn this paragraph, r as otherwis,eprovided n section222of theCommunications ct of 1934,asamended, telecommunicationrlcarriermay only use,disclose, r permitaccesso its customer'sndividually identifiableCPNIsubject o opt-inapproval.The Compmy doesnot useCPNIfor anypurpose (including marketing communications-related semices)and doesnot discloseor grflnl access o CPNI to anyparty (including toagentsor affiiates that provide communications-relatedervices), xceptaspermittedunder 47U.,S.CS 222(d)and Rule 64.2005.

S64.2008 Notice required for useof customerproprietary network information.(a) NotiJication,Generally. l ) Prior to anysolicitation or customer pproval,atelecommunicationsarriermustprovidenotification o the customer f thecustomedsight torestriotuseof disclosure f, and accesso that customer's PNI.(2) A teleoommunicationsarriermustmaintain ecords f notification,whetheroral,writtenorelectronic,or at leastoneyear.(b) Individualnotice o customersmustbe providedwhen solicitingapprovalo use,disclose, rpermitaccesso customers' PNI.(c) ContentolNotice. Customer otificationmustprovidesufficient nformation o enable hecustomer o makean nformeddecisionas o whether o permita carrier o use,disclose,orpermitaccesso, the customer's PNL(l) The notificationmuststate hat he customer asa right, and hecarier hasa duty,underfederal aw, to protecttheconfidentialityof CPNL(2) The notificationmust specifuhe typesof information hatconstituteCPNI and he speoificentities hatwill receive heCPNI, describehe purposesor whichCPNIwill be used,andinformthe customer f his or her right to disapprovehoseuses, nddenyor withdraw accesst>CPNIat any ime.(3) The notificationmustadvisehe customer f theprecise tepshe customermust ake n ordlerto grafltor denyaccesso CPNI,andmustclearly statehat a denialof approvalwill not affect theprovisionof any serviceso which the customer ubscribes. owever,caniers mayprovideabrief statemengn clearandneutral anguage, escribing onsequencesirectly resulting rom thelackof accesso CPNI.(4) The notificationmustbe comprehensiblendmustnot be misleading.


5/11

(5) lf writtennotification s provided, he noticemustbe clearly egible,usesufficiently argetype,and beplaced n an areasoas o bereadilyapparento a customer.(6) If anyportionof a notification s translatednto anotheranguage,henall portionsof thenotificationmustbe ranslatednto hat language.(7) A canier may state n thenotification hat he customer's pprovalo useCPNI mayenhancethe carrier'sability to offerproduots ndservicesailored o thecustomey'seeds'A carrieralso'may state n the notification hat t maybe compelledo discloseCPNI to anypersonuponaffirmativewrittenrequest y the customer.(8) A carriermaynot include n the notificationanystatement ttemptingo encouragecustomero freeze hird-partyaccesso CPNI.(9) The notificationmuststatehat any approval,or denialof approval or theuseof CPNIoutsideof theservice o whichthe customer lreadysubscribesrom that carrier svalid until ttrecustomer ffirmatively evokesor limits suchapprovalor denial.(10) A telecommunicationsarrier's olicitation or approvalmustbeproximate o thenotificationof a custome/sCPNIrights'The CompanyCPNI policies require that customcrsbenotifted of theit rights, and theCompany'sobligations, with respect o CPNI prior to any solicitationfot castomer approvalAII required customernotices(whether written, oral or electronic) complywith therequirementsof Rule 64.2008. The Companymaintains recordsof all required cuslomernotices(whether writlen, oral or eleclronic)for a minimum of oneyear-(d) NoticeRequirements pecific o Opt-Out.A telecommunicationsarriermustprovidenotification o obtain opt-outapprovalhroughelectronicor written methods, ut not by oralcommunicationexceptasprovided n paragraphf1of thissection).The contents f any suchnotificationmustcomplywith therequirements f paragraphc) of this section.( I ) Carriersmustwait a3}-day minimumperiodof timeaftergivingcustomers oticeand anopportunity o opt-outbeforeassuming ustomer pprovalo use,disclose, r permitaccessoCPNI.A carriermay, n its discretion, rovide or a longerperiod.Carriersmustnotiff customersas o the applicablewaitingperiod or a response eforeapprovals assumed.(i) In the caseof anelectronioorm of notification, hewaitingperiodshallbegin o run fromthedateon whichthe notificalionwassent;and(ii) ln thecaseof notificationby mail, thewaitingperiodshallbegin o run on the hird dayfollowing the date hat henotificationwasmailed.(2) Carriersusing he opt-outmechanismnustprovidenotices o their customers very woyears,(3) Telecommunicationsarriershat usee-mail o provideopt-outnoticesmustcomply with thefollowing requirementsn addition o the requirementsenerally pplioableo notification:(i) Caniersmustobtainexpress,erifiable,prior approval rom consumerso sendnoticesvia *mail regardingheir servicen general, r CPNI in particular;


6/11

(ii) Caniersmustallow customerso replydirectly o e-mailscontainingCPNI notices n order1loopt-out;(iii) Opt-oute-mailnotices hatare eturnedo thecanierasundeliverablemustbe sent o thecustomer n anotherorm beforecarriersmayconsider hecustomer o have eceivednotice;(iv) Caniers hatusee-mail o sendCPNI noticesmustensure hat hesubject ine of the messal4eclearlyandaccuratelydentifies hesubjectmatterof thee-mail;and(v) Telecommunicationsaniersmustmakeavailableo every customer method o opt-out hatis of no additionalcost o thecustomer nd hat s available24 hoursa day,sevendaysa week.Carriersmay satisfu his requirementhrougha combinationof methods, o ongasall customershave he ability to opt-outat no costandareable o effectuatehat choicewheneverheychoose'The Companydoesnot currently solicit "opt oal" cuslomerapprovalfor the use or disclosuretof CPNI. TheCompanydoesnot use CPNIfor anypurPose(including marketingcommuninations-relatedservices)and doesnot discloseor grant accesso CPNI lo anyparry(including agentsor affiiates that provide communicalions-relatedservices),exceptaspermittedunder47 A.S.C.S222(d)and Rule 64.2005.(e)NoticeRequirementspecific o Opt-In,A teleoommunicationsarriermayprovidenotification o obtainopt-inapprovalhroughoral, written, or electronicmethods. hecontents fany suchnotificationmustcomplywith therequirementsf paragraphc) of this section.The Company doesnot carently solicit $optin" caslomerapprovalfor the ase or disclosureofCPNI. The Companydoesnot ase,discloseot grant accesso CPNIfor anypurpose,to anyparty or in any mnnner lhat would require a castomer's "opt inD approval under theCommission'sCPNI Rules.(f) NoticeRequirementspecifico One-TimeUseof CPNI. 1) Caniersmayuseoralnotice oobtain imited,one-timeuseof CPNI for inboundandoutbound ustomerelephone ontactsorthedurationofthe call, regardlessfwhethercarriersuseopt-out or opt-inapprovalbased n thenatuteofthe contact.(2) Thecontent$ f anysuchnotificationmustcomplywith tho requirementsf paragrapho) ofthis section,excepthat elecommunicationsarriersmayomit anyof the following noticeprovisionsf not relevanto the imiteduse or which thecarrierseeksCPNI:(i) Caniersneednot adviseoustomershat f they haveopted-outpreviously,no action s neededto maintain he opt-outelection;(ii) Caniersneednot advisecustomershat heymayshareCPNI with their affrliatesor thirdpartiesandneednot name hoseentities, f the imited CPNI usagewill not result n usebyoordisclosureo, an affiliateor third parly;(iii) Carriersneednot disclosehemeans y whicha customer andeny or withdraw utureaccesso CPNI,so ong ascaniersexplain o customershat the scope f the approvalhecarrierseekss limitedto one-timeuse;and(iv) Carriersmay omit disclosure f the precise teps customermust ake n order o grantordenyaccesso CPNI,as ong as hecarrierclearlycommunicateshat hecustomer an denyaccesso hisCPNI for thecall.


7/11

In instanceswhere he Companyseeksone-time customer approvalfor lhe use or disclosureofCNPI, the Comparytohtains such approval in aceordancewith the disclosures,methodsandrequirementsconlained on Rule 2008fl.

$ 64.2009 Safeguards equired for useof customerproprietary nefivork information.(a) Telecommunicationsarriersmust mplement system y which the statusof a customer'sCPNI approvalcanbeclearly establishedrior to the useof CPNLTheCompanfs billing systemallows authorized compan! personnel I0 eastly determine hestatus of a customer's CPNI approval on the customeraccountscteenprior to the use ordisclosure of CPNI.(b) Telecommunicationsarriersmust raintheirpersonnel s o when hey are andarenotauthorizedo useCPNI,andcarriersmusthavean express isciplinaryprocessn place.The Company hasesnblishedCPN| compliancepolices that include employee raining onristrictions on the useand disclosuteof CPNI and required safeguards o protect againstunauthorircd use or disclosureof CPNL Employecshwe signedthal they understand heCPNI policies and a violation otthose policies will result in disciplinary f,ction.(c) All carriers hallmaintaina r@ord,electronically r in someothermanner,of their own andtheiraffiliates'sales nd marketing ampaignshat use heir customers'CPNI.All carriers hallmaintaina recordof all instances hereCPNIwas disclosed r provided o third parties,or wherethird partieswere allowedaccesso CPNI.The recordmust ncludea description f eachcampaign,he specificCPNI thatwas used n the campaign, ndwhatproductsandserviceswereofferedasa partof thecampaign.Caniersshall retain herecord or a minimumof oneyear.The Company's CPNIpolicies require that all sales and marketing campoigns ncluding thoseutilizing CPNI be recordedand kepi onfilefor at least oneyear. Recordsare alsomaintained

for disclosure or access10 CPNI by third parties. The records nclude the required inlormattbnIisted n Rale 64,2009(c).(d) Telecommunicationsarriersmustestablish supervisoryeviewprocessegarding arriercompliancewith the rules n this subpart or outboundmarketingsituations nd naintain ecordsof carriercompliance or a minimumperiodof oneyear.Specifically, alespersonnelmust obtilinsupervisory pprovalofany proposed utboundmarketing equestor customer pproval.The Company'sCPNI policies require employees0 obtain approvalfrom the Company'sCPNI Compliance Officer far all marketing campaigns ncluding those utilidng CPNI,priorto initiating that campaign Record of the marketing campaigns,along with the appropriatesupervisoryapproval is maintainedfor ut least oneyear.(e) A telecommunicationsarriermusthaveanofficer, asan agentof thecarrier,sign and ilewith the Commission compliance ertificateon an annualbasis.The officer muststaten thecertification hat he or shehaspersonal nowledgehat he companyhasestablishedperatingprocedureshat are adequateo ensure ompliancewith the rules n this subpart.The carriermuLstprovidea statement ccompanyinghe certificateexplaininghow its operating rocedures nsu;rethat t is or is not in compliancewith the rules n this subpan. n addition, he caniermust ncludean explanation f any actions akenagainst atabrokersand a summaryof all customer


8/11

complaints eceivedn thepastyearooncerninghe unauthorizedelease f CPNI.This filingmustbe madeannuallywith the Enforcement ureauonor beforeMarch I in EB DocketNo. 0,6-36, for dafapertainingo thprevious alendar ear.The reqaired officer certifi.cation,actions taken against data brokers andsammary of customercomplaint documentsare includedwirh this accompanyingstatemenr The Company witlftlethesedocuments on an annual basison or beforeMarch I for datapertaining to thepreviouscalendaryear.(fl Carriersmustprovidewritten noticewithin five business ays o the Commissionof anyinstancewhere he opt-outmechanismso not work properly, o sucha degreehat consumers'inability to opt-out s more han an anomaly.(1) The noticeshall be n the form of a letter,and shall nclude he canier'sname,a descriptionofthe opt-out mechanism(s) sed, heproblem(s)experienced,he remedyproposed ndwhen twill be/was mplemented, hether he relevantstatecommission(s) asbeennotified and whetherit has akenany action,a copy of the noticeprovided o customers, ndcontact nformation.(2) Suchnotice mustbe Submiftedven f the carrieroffersothermethods y which consuniersmay opt-out.The Company does nol currently solicit aopt out" customerapprovalfor the useor disclosweof CPNL

$ 64.20f0 Safeguardson the disclosureof customerproprietary network information.(a)SafeguardingCPi//. Telecommunicationsarriersmust akereasonable easureso discovr:randprotectagainstattemptso gainunauthorized ccesso CPNI.Telecommunicationsarriersimustproperlyauthenticate customer rior to disclosingCPNIbased ncustomer-initiatedtelephone ontact,onlineaccount ccess, r an n-store isit.The Companyts CPNI policies and employeeraining include reasonablemeasures o discov,erandprotect agoinst activity thet is indicative of pretexting and employees re instructed tonotily lhe CPNI Compliance Ofricer if any such activity is suspected(b) Telephone ccess o CPNL Telecommunicationsaniersmay only disclose all detailinformationoverthe elephone, ased n customer-initiatedelephoneontact, f thecustomerfirst provides he carrierwith a password, s describedn paragraphe) of this section, hat is nrctpromptedby the canierasking or readilyavailablebiographicalnformation,or accountinformation. f thecustomer oesnot providea password,he elecommunicationsarriermayonly disclosecall detail nformationby sendingt to the customer'sddress f record,or bycallingthe customer t the elephone umberof record. f the customers able o provideoalldetail nformation o the telecommunicationsarrierduring a customer-initiatedall without thetelecommunicationsarrier's ssistance,hEn he elecommunicationsarrier s permitted odiscuss he call detail nformationprovidedby the oustomer.The Company'sCPNI policies ensare hat a customer s only ahle to accesscall detatlinformation over the telephone n one of the ways isted in RuIe 64,2010(b). If the customercannot remember their password, hey areprompted lo answer a secarityquestion,Neither tlbepasswordnor the securityguestionsare basedon readily availablebiographical information or


9/11

accoant information. Cuslomerservice representatives re instructed to aulhenlicatecustomercover the telephone n all instuncesexcept n the casewherethe customerprovidesthe call daail information withou the assistanceof the Company-(c) Online accesso CPNLA telecommunicationsarriermustauthenticate customerwithoutthe useof readilyavailablebiographicalnformation,or acgountnformation,prior to allowingthe customer nlineaccesso CPNI related o a telecommunicationserviceaccount.Onceauthenticated,he customermay only obtain onlineaccesso CPNI related o atelecommunicationserviceaccounthrougha password, sdescribedn paragraphe) of thissectionhat s notprompted y the carrierasking or readilyavailablebiographicalnformation,,or account nformation.The companyauthenticatescustomerswithout the useof readily available biographlcal oraccoanl information prior to allowing on accesso CPNI relatedto an accounL Onceaathenticated, he customer may only obtain accesso CPNI through apassword, that is notprompted by readily availuble biographical or account nformnlion.(d) In-storeaccesso CPNL A telecommunicationsaniermaydiscloseCPNI to aoustornerwlro,at a carrier's etail tocation, irst presentso the elecommunicationsarrieror its agenta validphoto D matching hecustomer's ccount nformation.The Companydoesnot haveretail locations.(e) Establishmentof a PasswordandBack-up AuthenticationMethodsor Lost or ForgottenPasswords. o establish password, telecommunicationsaniermust authenticatehe customerwithout he useof readily availablebiographical nfonnation,or accountnformation.Teleoommunicationsarriersmay createa back-upcustomer uthenticationmethod n the eventof a lost or forgottenpassword, ut suchback-upcustomer uthenticationmethodmay notprompt he customeror readilyavailablebiographicalnformation,or accountnformation. f acustomer annotprovide he correctpassword r tle conect esponseor the back-upcustomerauthentioation ethod, hecustomermustestablish newpassword sdescribedn thisparagraph.The CompanytsCPNI policies allowfor afew ways o establlsh apassword, all of which ensurecompliance wtth the aboveparagraph. Each methodalso allows the customerto establish aback-upor securityquestion n thc event hat they orget thelr password, n no eventdoes heCompany rce readily available biographical information or account informffiion as a back-u:pquestionor as a means o establishaposswordor authenticate he customen(f) NotiJication f accountchanges. elecommunicationsariers mustnotify customersimmediatelywhenever password,ustomeresponseo a baok-upmeans f authenticationorlost or forgottenpasswords,nlineaccount, r address frecord is created r changed. hisnotification s not requiredwhen he customer nitiatesservice, ncluding he selectionof apassword t servicenitiation.This notificationmay be hrougha carrier-originated oicemailortext messageo the elephone umberof record,or by mail to theaddress f record,andmust notreveal he ohangednformationor besent o the new acoountnformation.Thecompanywill notify d castomer mmediately whenaccount changes occur, including apassword,& response o a back-up meansof authentication, or addressof record. Thenotilication will bethrough a carrier-originated voicemoilor text messageo the telephonenumber of rccord, or by mdl to the addressof record, and wiII nol contain the changedinformation or be sent to the new flccount informilion


10/11

{g} Business ustomer xemption. elecommunicationsarriersmaybind themselvescontractuallyo authenticationegimesother han hosedescribedn this section or servioesheyprovide o theirbusiness ustomershathavebotha dedicated ccount epresentativend acontracthat specificallyaddresseshe caniers'protectionof CPNI.The Company doesnot utilize the businesscastomerexceptionot this time,

$ 64,2011 Notification of customerproprietara network information security breaches.(a) A telecommunicationsarriershall notify law enforcement f a breachof its customers' PNIasprovided n this section.The carriershallnot notify its customers r disclosehe breachpublicly,whether oluntarilyor understateor local aw or these ules,until it hascompletedheprocess f notifoing aw enforcement ursuanto paragraphb) of this section.(b) As soonaspraoticable, ud n no event ater hanseven 7) business ays,afterreasonabledetennination f thebreach,he telecommunicationsarriershallelectronically otifo the UnitedStatesSecretService USSS)and heFederalBureauof Investigation FBI) througha cenrralreportingacility. The Commissionwill maintaina link to the reporting acility atht p /www.fcc.got'/eb/cpn .(l ) Notwithstanding ny state aw to the contrary, he carriershallnot notiff customers rdisclose he breach o the publicuntil 7 full business ayshavepassed fter notification o theUSSSand heFBI exceptasprovided n paragraphsb)(2)and (b)(3)of this section.(2) If the cauier believeshat here s an extaordinarilyurgentneed o notiff anyclassofaffected ustomers oonerhanotherwise llowedunderparagraphb)(l) of this section,n orderto avoid mmediate nd rreparable arm, t shall so ndicate n its notificationandmayproceedoimmediately oti$ its affectedcustomers nly afterconsultationwith the relevant nvestigatingagency.The carriershallcooperate ith therelevant nvestigating gency'sequesto minimiz:any adverse ffectsof suchcustomer otification.(3) If therelevantnvestigating gencydetermineshatpublic disclosure r notice o customers,would mpedeor compromise nongoingor potentialoriminal nvestigation r nationalsecurity,suchagencymay direct he carier not to sodisclose r notif, for an initial periodof up to 30days.Suchperiodmaybeextended y theagency sreasonably ecessaryn the udgmentof tlheagency.fsuch direction s given, heagency hallnotifu the carrierwhen t appearshat publicdisclosure r notice o affectedcustomers ill no longer mpedeor compromise criminalinvestigation r nationalsecurity.The agency hallprovide n writing ie initial direction o thecarrier,anysubsequentxtension, nd anynotification hatnoticewill no longer mpedeorcompromise criminal nvestigation r nationalsecurityandsuchwritingsshall becontemporaneouslyoggedon the same eporting acility tlratcontains ecordsof notificationsfiledby carriers.(c) Customer otification.After a telecommunicationsarrierhascompleted heprocess fnotifuing aw enforcement ursuanto paragraphb) of this section,t shallnotif, itscustomersifa breachof thosecustomers'CPNL(d) Recordkeeping.ll carriers hallmaintaina record,electronicallyor in someothermanner,of any breaches iscovered, otificationsmade o the USSSand heFBI pursuanto paragraphb)of this section,andnotifioationsmade o customers. herecordmust nclude, f avaiiable, ites


11/11

of discoveryand notification"a detailed esoription f theCPNI thatwas he subjectof thebreach, nd he oircumstancesf the breach.Caniersshall etain he record or a minimum of 2,years.(a) Definitions.As used n this section,a *breach"hasoccurredwhena person,withoutauthorization r exoeeding uthorization, as ntentionallygainedaccesso, used,or disclosedCPNI.(0 This sectiondoesnot supersede ny statute, egulation,order,or interpretation n any State,except o the extent hat such statute, egulation,order,or interpretation s inconsistentwith theprovisionsof this section,and hen only to the extentof the nconsistency,The Company haspolicies andprocedures n place to ensare compliance with Rule 64.2011.lVhen it is reasonably determined hat a breachhas occarred, the CPNI ComplianceOffrcerwill noffi law enforcementand its customer n the required timeframes. A record of thebreach will be malntainedfor a minimum of twoyears and will include all informatinnrequired.byRuIe 64.2011.

CPNI IBC Telecom Corp1

Documents