What Is CPNI?

Customer Proprietary Network Information is the data a carrier obtains about a customer by virtue of providing service. Numbers called, services purchased, account configuration, usage patterns — information the customer never volunteered but the network generated. Federal rules restrict how it may be used, disclosed, and protected.

The distance between a policy and a program

This is where most companies discover a gap. A compliant CPNI program is not a document; it is a set of operating facts, each of which has to be demonstrable: written policies that match actual practice, customer authentication applied consistently, access controls, trained employees, an incident response process, an annual review, and records proving each of those occurred.

A policy can be produced in an afternoon. The record showing it operated for two years cannot be produced at all, retroactively.

The annual certification sits on top of all of it

Covered carriers file an annual certification stating that adequate operating procedures exist, with a statement explaining how those procedures work. Note the order that implies: the certification is a statement of fact about a program that already existed throughout the year. Building the program in the week the certification is due inverts that relationship, and produces filings that are difficult to defend afterward. See what the certification actually asserts.

Where programs fail their first real test

• Template policies describing systems, roles, or controls the company does not have
• Training that never reached the support and sales staff who actually handle accounts — including outsourced staff
• Authentication practice that drifted, where one accommodation for a frustrated caller quietly became the norm
• No records, so compliance activity that genuinely occurred cannot be demonstrated
• Certification filed without anyone confirming the described program still matches operations

Why remediation is not a documentation exercise

Rebuilding a CPNI program means reconciling what the policy says, what the systems permit, what employees actually do, and what the company has already certified in prior years. Those four things are usually in tension, and the sequence in which they are reconciled affects the company's position on filings already made. That is a judgement problem before it is a drafting problem.

EquiTel builds and repairs these as CPNI practice work, with training delivered through Compliance Academy™. If a CPNI question has already arrived from a regulator, treat it as an enforcement matter.

Frequently Asked Questions