AtHoc IWSAlerts

Contact Data Management Best Practices

Best Practices Whitepaper • October 2011

© 2011 AtHoc, Inc. All rights reserved. AtHoc, the AtHoc logo and AtHoc IWSAlerts are trademarks of AtHoc, Inc.
All other trademarks are the property of their respective companies.
 AtHoc IWSAlerts Contact Data Management Best Practices

Table of Contents
1. Introduction ............................................................................................................................................................................. 2
2. Executive Summary.................................................................................................................................................................. 3
3. Contact Data Management: Challenges, Myths and Facts ...................................................................................................... 4
4. Contact Data Management: The Process ................................................................................................................................ 4
4.1 Four-Point Process Phase: ................................................................................................................................................. 5
5. Best Practices for Contact Data Management ......................................................................................................................... 6
5.1 Data Sourcing Approach .................................................................................................................................................... 6
5.2 Active Directory ................................................................................................................................................................. 6
5.3 The Self-Service Module .................................................................................................................................................... 7
5.4 Education and Internal Communications........................................................................................................................... 8
5.5 Administrative Input .......................................................................................................................................................... 8
5.6 Disable and Delete End Users Software Module .............................................................................................................. 8
5.7 Recurring Alerts ................................................................................................................................................................. 8
6. Best Practices in Action .......................................................................................................................................................... 10
7. Conclusion .............................................................................................................................................................................. 11

1. Introduction

The effectiveness of an Emergency Mass Notification System (EMNS) is directly associated with the quality of
the contact information contained within its database. To ensure that all targetable individuals are successfully
reached during a crisis situation, up-to-date contact data that covers all personnel is a highly critical and an
essential component in the notification process that cannot be compromised.

Many emergency managers will concede that one of their biggest problems in deploying a large-scale
emergency notification system is obtaining, managing and maintaining personnel contact information.

In this whitepaper, we will examine the challenging aspects that organizations face with this highly complex
task, observe common misconceptions and follow up the “myths” with facts. We will introduce a foundational
four-point process phase in the planning and preparation of contact data management, delineate best practices
and articulate a combination of technological and operational solutions. We’ll also give examples of how
organizations have introduced communications and educational programs to obtain personnel contact
information, integrate new standard policies and procedures and put best practices into action in response
to these pivotal issues.

©2011 AtHoc, Inc. All rights reserved. Page 2 of 11

 AtHoc IWSAlerts Contact Data Management Best Practices

2. Executive Summary

Challenge
Obtaining, managing and maintaining quality, up-to-date contact information for all applicable personnel
within the enterprise and sustain a sound, effective, long-term contact data management process.

Solution
 Identify the myriad of challenges and difficulties that accompany such an endeavor
 Acknowledge and accept the challenges and analyze existing resources

 Overcome the misconceptions and “myths” and recognize the facts regarding contact data management

 Design a system based on tools, processes, education, and awareness plans

 Lay the foundation for best practices by planning and preparing for a thorough and effective user data
management process throughout the EMNS lifecycle through a Four-Point Process Phase: 1. Design
2. Implementation 3. Roll-out 4. Maintenance

 Best Practices Implementation:

 Data Sourcing
Use of Active Directory for core network-based data, supplemented with a blend of approaches
 Active Directory
The means to manage the identities and relationships that make up an organization's network
 The Self-Service Module
Allows end users to provide comprehensive contact data through a web-based portal
 Education and Internal Communications
Instruct and inform alert recipients on the purpose of the AtHoc IWSAlerts system and provide
encouragement to enter personal data
 Administrative Input
Manual input or update of user contact data via the AtHoc IWSAlerts Management System
 Auto-Delete Software Module
Software module can automatically disable and ultimately delete user contact information of an
inactive user
 Recurring Alerts
Send alerts on a frequent basis as a requirement to all personnel to verify and update their contact
information
Results
Integration of new standard policies and procedures enabling successful management and sustainment of
accurate, current, and comprehensive contact information, ultimately to reach the right people at the right
time for protection and preservation of life and property during an emergency.

©2011 AtHoc, Inc. All rights reserved. Page 3 of 11

 AtHoc IWSAlerts Contact Data Management Best Practices

3. Contact Data Management: Challenges, Myths and Facts

Any emergency alerting system, regardless of its technological capabilities and sophistication, is only as
effective as the quality of its personnel contact information. Having the ability to manage and sustain
personnel contact data is a key foundation for any mass notification system.
Without a sound contact data management practice in place, the likelihood increases that wrong or inaccurate
information will be used during emergencies. A major challenge in deploying a large-scale emergency mass
notification system is the management and maintenance of personnel contact data. In military organizations
where personnel frequently change jobs and locations, contact information rapidly becomes outdated without
having the right tools in place to manage data updates.
These difficulties soon become obvious after the implementation of the alerting system. Emergency managers
are very aware of these complex challenges for which this study will propose recommendations, outlined
below:
 Obtaining accurate, current, comprehensive contact information
 Integrating contact information from multiple, disparate sources
 Maintaining accuracy over time, once data is initially acquired
 Locating missing contact information
 Correcting bad data
 Tracing and eliminating obsolete data, (i.e. for those who leave the organization)
 Educating, persuading participants for “buy-in” to take responsibility in providing user information
 Protecting the privacy of personal information
There are also several misconceptions about contact data management as summarized in the myths below,
followed by facts:

Myths + Facts
A. Myth: Accurate personnel information is readily available in all organizations.
Fact: With little exception, personnel data found in organizational data repositories is partial and
more often than not, mostly outdated.
B. Myth: The main challenge – and obstacle - is integration.
Fact: The main challenge is getting the right data, not necessarily from other systems, and possibly
directly from the end users.
C. Myth: There is one authoritative repository or several corresponding repositories to draw from.
Fact: There are usually several repositories and most have serious gaps in coverage.
D. Myth: When multiple directories exist, integration of these is a key solution for obtaining data.
E. Fact: Integration of user directories is highly complex, time-consuming, and often quite an
organizationally challenging process. In practically all cases, it should be a separate project and
completely decoupled from the EMNS effort.
F. Myth: “Once we figure out a proper source for user data, we’ll be all set!”
Fact: Proper user data management is a critical part of EMNS deployment and requires placing the
right resources and attention not just at the beginning of the process, but as an ongoing practice.

©2011 AtHoc, Inc. All rights reserved. Page 4 of 11

 AtHoc IWSAlerts Contact Data Management Best Practices

4. Contact Data Management: The Process

Staying on top of contact information is difficult for any organization, but it is extremely challenging for large
organizations such as military commands, government agencies, commercial enterprises, healthcare facilities,
or universities. The first step in moving toward a solution is acknowledging that there is no single “silver
bullet” resolution: these complex difficulties need to be addressed through a combination of methods that
include tools, procedures, testing, and the cooperation of the end users - the alert recipients.
Planning and preparing for appropriate user data management throughout the EMNS project life cycle are
important requirements. One must plan for: Design, Implementation, Roll out and Maintenance.
AtHoc’s vast experience in implementing EMNS systems across a variety of organizations has helped in the
development of best practices for each implementation phase, accompanied by tools and capabilities provided
by the AtHoc IWSAlerts platform.
4.1 Four-Point Process Phase:
1) Design. The Design phase entails the following:
a) Define user data requirements: what we should know about users; for example: user contact details,
personnel details (such as rank, profession, expertise, team assignment, unit, etc.).
b) Survey and find possible organizational data sources and repositories as sources for user data, including
availability and quality of data, integration APIs, data sharing agreements, etc.
i. User data may include organizational structure as well as data about end users.
ii. Ideally, obtain organizational chart/structure information from an external system or source. If
the above is not obtainable, the information must be compiled manually.
iii. Obtain user data from an external system, i.e., Active Directory or by Self-Service registration.
iv. Design, implement, communicate and drive processes to gather data from users or from
operators (for example, by team/department/unit, using export/import).
c) Assess personnel coverage: how well do you cover all target personnel?
d) Determine common user identity (common user-ID key) which is the means of unique identification of a
user across integrated systems and for user authentication.
i. A common user-ID key could be a common org key (EDIPI, PIP, Smart Card key) or LDAP/Active
Directory user name.
ii. Sensitive user ID keys such as social security numbers are not recommended.
e) Design and implement periodic processes to test reach of data.
f) Design and implement periodic cleanup processes for keeping data current, complete, accurate, and
removing obsolete information.
g) Assess privacy and security concerns, as well as needed agreements with data owners.
h) Plan for outbound communication to end users, stakeholders to ensure their “buy-in” and cooperation
while deploying and rolling out the EMNS capability. These must be maintained on an ongoing basis.
2) Implementation. The Implementation phase entails the following:
a) Implement user data configuration by creating custom user attributes.
b) Integrate with external systems (as applicable).
c) Customize user self-service screens.
d) Create scheduled and recurring test alerts.
e) Create outbound communication material and processes.
f) Test end-to-end integration, data load and processes.

©2011 AtHoc, Inc. All rights reserved. Page 5 of 11

 AtHoc IWSAlerts Contact Data Management Best Practices

3) Roll-out. The Roll-out phase entails the following:

a) First expose the system to end users and test user data coverage and quality.
b) Use outbound communication to ensure all participating parties are aware of the newly deployed
capability and of their expected actions.
4) Maintenance. The Maintenance phase entails the following:
a) Set up ongoing procedures to assess data coverage and quality by using tools provided by AtHoc IWSAlerts.
b) Assess data quality and adjust processes as needed.
c) Repeat outbound communication at regular intervals to ensure users are kept informed as to what is
expected from them.
In the next section, we will see how AtHoc IWSAlerts supports these EMNS deployment phases by best practices
and tools.

5. Best Practices for Contact Data Management

5.1 Data Sourcing Approach

We have learned that while the concept of integration of multiple directories seems to be the logical course of
action, in actuality, this complicated approach has proved to be ineffective and many organizations are opting
to disengage integration and decouple it from the MNS program rather than risk delaying its implementation.
The success of integration has been limited and in cases where it has worked, i.e., as with Active Directory,
it’s mainly used for network-based information. Universities typically have a better source of personnel
directory information, but this is also limited to only very basic information.
Our experience has led to the conclusion that much of the information that an MNS system requires only
partially exists in organizational directories. The most successful best practice is the use of Active Directory for
core network-based data, supplemented with a blend of approaches:
A. Self-Service Module
 Education and communications programs for staff buy-in
 Embedding processes for new standard procedures, making participation mandatory
 Instituting step-by-step instructions, online or via other means
 Help Desk technical assistance
 Face-to-face tutorials
B. Administrative Input: manual updating of contact information by emergency managers/operators
C. Auto Delete software module
D. Recurring testing alerts
Privacy is also key – organizations must comply with governing policy regulations, starting from the Privacy Act
of 1974 and industry-specific acts pertaining to Education, DoD, GOV, etc. Protection of privacy must be
assured where personal information is concerned. Therefore, any integration with an organizational user
directory and storage of this information for notification purposes must be handled in a highly secure manner;
ensuring only assigned, cleared and trained personnel have access to sensitive user data.

©2011 AtHoc, Inc. All rights reserved. Page 6 of 11

 AtHoc IWSAlerts Contact Data Management Best Practices

5.2 Active Directory

Active Directory provides the means to manage the identities and relationships that make up an organization's
network, and to periodically authenticate user access to the network. It also provides the functionality needed
to centrally configure and administer system, user, and application settings. AtHoc IWSAlerts is capable of
performing a one-way synchronization with many different LDAP (Lightweight Directory Access Protocol) v3
directories, as well as with Active Directory.
Using an out-of-box LDAP add-on Module for AtHoc IWSAlerts, data can be synchronized from an LDAP or Active
Directory on a recurring basis. The LDAP Module is very extensible in nature and can be configured to obtain
a variety of standard user attributes, extended user attributes, security groups, distribution lists, and
organizational unit hierarchy. The LDAP Module is also capable of pulling data from more than one directory
service at a time.
The system designer must determine a foundation of user data that can be collected from an available data
source, i.e. Active Directory and the common user-ID key. Data retrieved needs to be limited to information
that is populated across the user base, uniform, usable by the alerting system (commercial phone vs. DSN
phone), and most likely to stay current. For example: username, first name, last name, display name, work
phone number, and email address are the most common user attributes obtained from Active Directory. It is
paramount to consider user privacy and data protection while importing data from external sources, as well as
proper agreements (if necessary) with data owners.

5.3 The Self-Service Module

To resolve the dilemma of missing or inaccurate contact information within an LDAP directory (e.g. personal
cell phone number), AtHoc’s Self-Service Module is a useful self-registration solution, allowing end users to
provide comprehensive contact data through a web-based portal as shown below. Users may view their profile
and user attributes; update (read/write) permissions are centrally configured.

Self-Service Module Tip:

Viewable fields are configurable. Limiting the number of fields visible to the end user is highly encouraged. If
there are 30 fields and only 15 require user input, reconfigure to those 15 fields only, otherwise the task may
seem overwhelming and burdensome to the user. Limit fields to only what’s needed for the user to verify or
update. Additionally, group fields in user-sensible sections, by context of the user data fields, for easier
navigation and user experience. Use additional self-service tabs, if needed.
©2011 AtHoc, Inc. All rights reserved. Page 7 of 11
 AtHoc IWSAlerts Contact Data Management Best Practices

Self-Service Module Tip: Create a policy. Another helpful suggestion is to institute user policy guidelines that
compel a new end user in the course of receiving a network account to spend an additional 5 minutes
populating the self-service fields in the initial phase of employment. For example, require users to process the
self-service form as part of the initiation process.

5.4 Education and Internal Communications

The effectiveness of the Self-Service practice relies on the individual’s sense of responsibility to carry out the
procedure, so “buy-in” is important. AtHoc recommends educating your alert recipients on the purpose of the
AtHoc IWSAlerts system and providing encouragement to input personal data in exchange for the safety that
the AtHoc solution gives them. Educational materials should be created and distributed via Intranet web pages,
emails, flyers, and table tents in cafeterias or other common areas. Briefings and awareness campaigns during
personnel meetings are also an effective means of education and these must be held on a recurring basis for
consistency, as well as providing and circulating videos of leadership explaining the process and its importance
for personnel protection.
Embedding Processes
Directives to take part in the Self-Service program can also be placed in the organization’s procedural
handbook and integrated into initial training to instill policy in new staff is also recommended. Creating a
mandatory procedure will compel each alert recipient to participate in this practice.
Instituting Step-by-Step Instructions
Encouragement can also be accompanied by publishing simplified step-by-step instructions, further easing
participation. This training may be standardized and posted online for easy access. Offering contact
information for Help Desk technical assistance is also beneficial.
Face-to-Face Tutorials
A proactive and effective approach, a face-to-face tutorial not only drives familiarity with the Self-Service
module, but will also underscore the importance of participation on a personal level.

5.5 Administrative Input

As a viable option to further mitigate missing/inaccurate data, the emergency managers/operators manually
input or update user contact data via the AtHoc IWSAlerts Management System. This option should be used
when alert recipients aren’t able to update their own contact information either via an LDAP or the Self-
Service Module. To update recipient contact data, an operator may simply log in to the AtHoc IWSAlerts
Management System, go to the End User Manager, choose a user, and update their information. This process
can be segmented on a unit or sub-unit basis, where every team unit leader is responsible for updating their
own personnel information; AtHoc IWSAlerts user-based permission capabilities prove to be instrumental in
promoting this approach.
Another recommendation for importing data into the system is through a CSV file from an Excel spreadsheet,
if all other options have been used.

5.6 Disable and Delete End Users

Trace and eliminate obsolete data
A newly developed AtHoc IWSAlerts product enhancement is Disable and Delete End Users. This software
module can automatically trace, disable and ultimately delete a user account and corresponding contact
information after a certain amount of time based on criteria established by the administrator, e.g., users not
logged in for 60 days. This innovative tool improves the accuracy of alert delivery reports by controlling
outdated contact data, ensuring the system doesn’t attempt to contact inactive users.

©2011 AtHoc, Inc. All rights reserved. Page 8 of 11

 AtHoc IWSAlerts Contact Data Management Best Practices

5.7 Recurring Alerts

“Update Your Contact Info” Alert
Another method in keeping contact information current and relevant is to use AtHoc IWSAlerts for more than
just emergencies. During initial roll out of the emergency notification system, publishing an “Update Your
Contact Info” alert is a quick way to populate the database with current personal contact data. By sending
alerts on a quarterly or semi-annual basis and requiring all personnel to verify and update their contact
information, the challenge of obsolete contact data can be mitigated.
If the Self-Service module is used, recipients may be directed to the Self-Service pages. If an LDAP is used as
the central source of information, recipients should be directed to verify/update their information in the LDAP.
In addition to the monthly or quarterly alerts for update purposes, some organizations set up daily recurring
alerts. Using AtHoc IWSAlerts’ powerful alert targeting capabilities, the criterion for the daily alerts may be
targeting users who have not updated all required fields. The target list is created through a distribution list in
which a specific field is blank, i.e. work phone number, and the recipient is informed that once the work
number is filled out, they will cease to receive the daily alert; otherwise it will continue until this particular
information has been received. (See sample under Best Practices in Action, p. 11).
Alert Tip: One more way to control obsolete user data: if an alert recipient has moved on and yet is still
receiving alerts, a suggested course of action is to configure the response: “I have left the organization.”
This will help keep data current and updated, and will assist in processing the auto-delete capabilities.
Periodic Testing Beyond the Desktop
Periodic test alerts to the entire organization and using devices beyond the desktop alerting client is also a
suggested method to verify the accuracy and coverage of contact information. These should occur once a
quarter, although some organizations opt for once a month. A phone alert can be published and once the alert
tracking report has been generated, a detailed list of targeted recipients and phone numbers are available for
review.
Predictive Alert Targeting
AtHoc IWSAlerts also supports (patent pending) device
coverage reports post alert as well as prior to publishing a
notification that disclose how many users will be reached
when an alert is activated. These reports allow an
operator to make spontaneous judgments for the optimum
method in reaching recipients based on the current
contact data in the system. See the graphics below and at
right for an example of a device coverage report.

©2011 AtHoc, Inc. All rights reserved. Page 9 of 11

 AtHoc IWSAlerts Contact Data Management Best Practices

6. Best Practices in Action

Leaders within AtHoc’s customer base are providing creative ways to improve contact information accuracy.
Below are three examples of resourceful and practical methods in use today:

The U.S. Navy

The U.S. Navy has developed the Shore Wide Area Alert Network (WAAN) for Sailors, Navy civilians, and their
families to receive emergency information regardless of their location at the time of a crisis. To receive these
emergency notifications while away from the workplace, anyone assigned ashore with an NMCI or OneNet
Computer must register their emergency contact information on their computer.
WAAN was developed to provide Navy installations with an effective and reliable mass notification system that
covers 400,000 personnel. The WAAN consists of four subsystems: Computer Desktop Notification System
(CDNS), Automated Telephone Notification System (ATNS), Giant Voice (GV), and Interior Voice (IV).
CDNS and ATNS have been rolled out to each NMCI and OneNet user via the AtHoc Self-Service client, which
starts automatically on computers at startup. Users are automatically registered for CDNS messages when they
log into an NMCI computer via their Common Access Card (CAC). All NMCI users must manually register their
emergency contact information via the AtHoc Self-Service client in order to receive WAAN ATNS or e-mail/text
notifications.
As WAAN was being implemented, Navy leadership sponsored a communication plan and internal campaign to
raise personnel awareness, attaching a call to action in all materials for self-registration. Videos, web postings,
and email blasts served as effective marketing tools which also featured step-by-step instructions in the use of
the Self-Service Module. Help Desk contact numbers and an email address for anyone requesting further
technical assistance were included.
Additionally, scheduled alerts for personnel input information were also supported.

Langley Air Force Base

At Langley Air Force Base, part of Air Combat Command, AtHoc IWSAlerts is actively engaged as the base’s
emergency mass notification system and although contact data acquisition may be challenging with 5,000
personnel, organizational processes have been adapted as standard data gathering procedure. For example,
with the onboarding of new people, the departure of others, transfers to a new unit of assignment, or for those
about to go on leave, it has become common practice to collect/update all pertinent contact data during such
transitions through instituted procedures that are now mandatory.
Other methods include linking recall activities to contact information in the database; those who miss recall
are identified in the follow-up report as persons whose information is absent from the system. They are
subsequently instructed to use the Self-Service Module to add their contact data.
“Langley places emphasis on educating its personnel on the importance of using the Self-Service Module” says
Gerald Trujillo, Chief, 633 ABW Command Post, “briefing is done in person every 2 weeks, so everyone is fully
informed of the significance of keeping the system current, which is now a requirement. Personal responsibility
is heavily underscored.”
Rather than assigning a dedicated manager to keep the base informed on self-service procedures, Langley
advocates dispersing the information across the board; briefing those in command positions during staff
meetings and they in turn address personnel directly with a 10-slide PowerPoint presentation rather than

©2011 AtHoc, Inc. All rights reserved. Page 10 of 11

 AtHoc IWSAlerts Contact Data Management Best Practices

distributing printed materials. The presentation is a practical review of the AtHoc IWSAlerts emergency mass
notification system and offers a step-by-step tutorial on the Self-Service Module.

Patrick Air Force Base

Patrick Air Force Base is located in Brevard County, Florida. In addition to its "host wing" responsibilities at
Patrick AFB, the 45th Space Wing also controls and operates Cape Canaveral Air Force Station (CCAFS) and the
Eastern Range. Additional tenant activities at Patrick AFB include the 920th Rescue Wing, the Air Force
Technical Applications Center and the Defense Equal Opportunity Management Institute (DEOMI).
The base has implemented AtHoc IWSAlerts into operation for the protection of more than 40,000 military,
dependents, civilian employees and contractors on base. Patrick AFB has actively pursued the best practices
method of recurring alerts to their personnel.
The following is an actual contact data alert from Patrick AFB:

AtHoc IWS Alerts requires your updated contact information

Accurate and up-to-date contact details are crucial in order to assist in AtHoc IWSAlerts
implementation. Please right click on the purple globe in the task bar and click "Access Self Service".
Once the Patrick AFB INWS window is open, update your contact details in two tabs "My Info" and
"Devices". You will continue to receive daily alerts until your contact information is updated.
Thank you,
Patrick AFB INWS

7. Conclusion

An effective and successful emergency mass notification system requires accurate and comprehensive
personnel contact information. Managing and maintaining this information is imperative for any large scale
mass notification system, but this also carries many logistical challenges, especially within highly complex
environments.
With a successful data management practice in place, organizations can be assured that the appropriate
individuals or group will be alerted during a crisis situation.
The key is acknowledging the challenge, properly analyzing existing sources, designing a solution based on
tools, processes, education and awareness communications plans, creating standard processes, and
continuously assessing the quality of data.
By following proven best practices, the full benefit of this powerful system can be realized.

©2011 AtHoc, Inc. All rights reserved. Page 11 of 11