FISMA Role and Responsibilities

The assignment of roles and responsibilities for information security within the federal government was clarified or reiterated within FISMA to cover policy, procurement, standards, and incident response. Although FISMA was the last major legislative framework, over the years the foundation has been built upon by a series of Executive Orders, directives, policies, regulations, standards and guidelines. Within FISMA, several specific roles were identified: 

• Director of the Office of Management and Budget (OMB).

• National Institute of Standards and Technology (NIST).

• Federal Agencies:

• Head of Agency or equivalent.

• Chief Information Officer (CIO).

• Senior Agency Information Security Officer (SAISO).

• Secretary of Defense (SecDef).

• Director of the Central Intelligence Agency (CIA). 

Introduction to FISMA

The Federal Information Security Management Act (FISMA) was signed into law on December 17, 2002 as part of the E-Government Act of 2002 (Public Law 107-347). FISMA permanently reauthorized the framework laid out in the Government Information Security Reform Act (GISRA) of 2000, which expired in November 2002. FISMA is divided into multiple sections, each of which will be briefly described in this section.  

Purpose

FISMA was built upon several existing federal laws designed to ensure the security of federal information and information systems. These federal laws include the Computer Security Act of 1987 (Public Law 100-35), Paperwork Reduction Act of 1995 (Public Law 104-13), and Information Technology Management Reform Act of 1996 (i.e., Clinger-Cohen Act, Public Law 104-106, Division E). The purpose of FISMA, as outlined in Section 3541, is covered in six major objectives

1. Establishment of a framework for ensuring the effectiveness of security controls; 

2. Development of mechanisms for effective government-wide management and oversight of security-related risks; 

3. Development and maintenance of a minimum set of required security controls; 

4. Improvement of oversight of information security programs; 

5. Utilization of commercially developed information security products for protecting critical information infrastructures; and 

6. Selection of commercially developed information security solutions should be left to individual federal agencies. 

CRM Integration Capability/API/Web services

Making an analogy, a dialer is a machine gun of calls, and the CRM database is the ammo depot. Therefore it is important to make sure that the correct agent is calling the list of names or leads that are most appropriate to his or her skills or location as fast as possible. This is the reason why one of the fundamental questions to ask when specifying a dialer solution is if the organization requires the integration of the dialer solution with an existing or future CRM.

It is important to know if the dialer system comes with a list or lead-management database (or integration with an existing one is required) and offers an API or Web services capability to easily move data in and out as required.  

Therefore, when writing the RFP, it is crucial to make sure that all requirements linked with the integration with the support application are very well defined. In addition to clearly stating your needs, you must ask the potential vendors about their experience integrating their products with other clients and ask for references (and, of course, check those references). 

Conventional Dialers (power-dialers)

Conventional dialers (also known as power-dialers or autodialers) execute the basic function of dialing at a constant rate and transferring the call to a human attendant. The dialer device can also perform several other tasks, such as announcing verbal messages, leaving messages on answering machines, or transmitting digital data (like SMS messages). There are typically three types of power-dialers:  

• Conventional 

• Voice-message dialer 

• Click-to-call dialer  

Conventional: This type of dialer executes the basic functions of dialing from a list and transferring the call to a human attendant. In addition, these devices usually can monitor the dialed numbers and change them to seamlessly provide services such as least-cost routing. 

Voice-message dialer: This type of dialer is basically a conventional dialer that automatically dials a list of numbers and detects a live answer or fax/answering machine and plays a prerecorded voice message at the appropriate time. This is often called a voice-messaging dialer, or voice-message broadcasting. It completely automates the dialing process and is able to play a prerecorded message to hundreds or thousands of people in a short period of time. 

Click-to-call dialer: The agent sets the pace, and the function is minimal. This dialer provides very little leverage in that all it does is save the time to dial the phone number from a list. 

Preparing a Dialer Specification (RFP)

It is important to understand your specific needs in order to prepare an adequate RFP that guarantees you get what you need for the right price. Therefore, you need to define your dialing requirements, and based on them, identify the right technology and ideal contracting strategy. Only after that can you search for the adequate vendor. In other words, you can write the RFP only after you have defined your goals clearly. It is advisable to use a systems approach that encompasses: 

Analysis→ Design→ Implementation→ Evaluation  

When writing the RFP, you should be aware that vendors sometimes package their products and services in such a way as to make it difficult to make an easy comparison. For example, some hosted-dialer companies charge by the minute, others separate their charges by dialer port and local/long distance or VoIP minutes, and so on. In addition, vendors usually combine features and functions differently. Some charge more but include more functions, others break out and charge for each individual module or feature. The RFP is your instrument to define what you need and how you want to pay for it (trying to force some sort of the standardization in the proposals). It also helps to avoid paying for unnecessary features or functions. 

Dialing Rate Asynchrony

When there is an asynchrony between the dial rate and the available agents, you have a situation with two possible outcomes:  

1) There are more live parties on call attempts than there are agents available. 

2) There are more agents available than there are live parties on call attempts.  

Usually, when you have a situation like that, both situations occur intermittently.  

If we have more live parties on call attempts than there are agents available to take those calls, the dialer will disconnect or delay distribution of calls that cannot be distributed to an agent. This is known as a silent call or a nuisance call. The called party hears only silence when the predictive dialer does not at least play a recorded message. 

The experience for the clients who receive a silent call can be very unsatisfactory when we have an appreciable period of silence before a call is routed to a sales representative. This annoys people and also gives them a chance to hang up. A high rang-up/dropped calls rate is a clear indicator of asynchrony between the dial rate and the availability of agents. This is a big problem and we should be aware of the following facts:  

1) A very small percentage of the mailings are actual clients, and reaching them and then having no way to treat them is very disappointing from the company perspective. 

2) The client gets upset for getting a silent call. 

3) These calls have a cost which, depending on the hang-up rate, can be very significant. 

Some countries even regulate the number of silent calls that a company can make within a certain time frame. A good reference point on this problem is that a maximum of 3 percent of the calls, measured as a percentage of live calls made, may be dropped. More than that, and you may have a problem.  

In some countries there are regulations defining the need for a mandatory abandon message to be played when no agents are available and there is an obligation to inform the caller ID.  

If you have more agents available than there are live parties on call attempts, you will have agents idle, which reduces your productivity.  

Therefore, it is important to keep in mind that the asynchrony causes problems in both ways. If your predictive dialer is not able to adjust the dial rate properly, you will have moments in which you will have more calls than agents (silent calls and hang-ups/dropped calls) and moments with more agents than calls (low productivity and idle agents).  

It is worth mentioning an aspect, which, although operational, tends to have a big impact in the dialers’ productivity: if you mix databases of numbers already used several times (in which the concentration of bad numbers tends to be higher) and new databases in the same campaign, the results tend to be worse than if you keep them separated. 

How a Predictive Dialer Works

In a conventional dialer system, if you have a hundred agents working on it, for example, the dialer will dial a number of calls sometimes crudely based on the phone line to agent ratio—let’s say two to one. This means that for each available agent, the system will dial the phone numbers of two potential customers. The dialing ratio doesn’t change.  

In a predictive-dialer system, the dialer will monitor each call and determine the outcome of the call. The system will immediately strip out any unproductive results, such as busy calls (these are usually queued for automatic redial), no answers, and invalid numbers, verify the number of agents available and the typical call duration, and adjust the dial rate. 

Some predictive dialers incorporate also fax/answering machine detection, which tries to determine if a live person or a machine picked up the call. Today, most dialers have some sort of recognition feature; however, be aware that tuning the device to the public network is the key to making it work properly.  

The adjustment of the dial rate is necessary because if not enough calls are made ahead, agents will sit idle, whereas if there are too many calls made and there are not enough agents to handle them, then the call is typically dropped. A predictive dialer system will adjust the dial rate appropriately to avoid both situations.  

An advanced predictive dialer determines and uses many operating characteristics that it learns during the calling campaign and adjusts automatically to the pattern of an ongoing campaign. Examples of such statistics include call-connection rates (both current and average for recent past days by hour of the day), average agent connection time, and geographic location dialed. It uses these statistics continually to make sophisticated predictions so as to minimize agent idle time while controlling occurrences of nuisance calls (and consequently dropped calls), which are answered calls without the immediate availability of an agent. An advanced predictive dialer can readily maintain the ratio of nuisance calls to answered calls at less than a fraction of 1 percent while still dialing ahead. However, this level of performance may require a sufficiently large critical mass of agents. Conversely, it becomes increasingly difficult to maintain a high talk-time percentage with a lower number of agents without increasing dropped calls. 

Autodialers versus Predictive Dialers

Power-dialers are usually best suitable to business-to-business (B2B) applications, in which more ability from the sales agent is required to navigate receptionists, auto attendants, and voice-mail systems. No current dialer technology is able to navigate the multiple options of a voice menu in a business environment without the guidance of a live representative.  

Differently from the predictive dialer, a power-dialer automates the dialing functions in a very simple way by just dialing sequentially a list of numbers. Here we may differentiate power-dialers from a solution widely known as preview: the term “preview” usually refers to a solution in which each user commands the dialing process—almost as a speed-dialing process. The power-dialer, on the other hand, generates the calls independently of the user command and has a ratio of number of user versus number of trunks other than 1:1.  

Talk time and total call attempts are not quite as high as a predictive dialer; however, if you deploy a power-dialer in a B2B or multiple calls B2C environment and associate it with guided-voice messaging technology and a CRM or lead management database, the power-dialer shows its full potential.  

Power-dialers are best suitable for telesales, inside-sales, or outside-sales organizations in which the sales process is more complex and requires multiple calls for closure. It is also optimal for organizations that invest heavily in their lead sources and can’t afford to abandon a single call with the resulting negative perception from the person at the other end. This translates to all B2B environments and specific B2C call centers that invest in high-value leads.  

Predictive dialers, on the other hand, are the best alternative when volume of calls and time on the phone are the main requirements. The predictive algorithm requires a group of agents large enough to be able to effectively leverage the “predictive” effect with multiple lines. The group of agents concurrently logged must be at least twenty to thirty. If this is the case, there are case studies where predictive dialers are able to keep agents productively talking on the phone from forty-seven to fifty-two minutes of an hour.  

Predictive dialers are specifically designed for business-to-consumer applications because they require short and consistent lengths of calls and direct-dial phone numbers. They are best when used in a one-call close type of telemarketing, short surveys, or prequalification of consumers. They are not designed to navigate the phone systems, auto attendants, or receptionists of a business environment. The predictive dialers are not suitable for a B2B environment, and even in a B2C environment it is not advisable to deploy predictive dialers for expensive or valuable leads. 

Predictive dialers should not be used with leads that require multiple attempts to ensure contact. They are best for single-script, telemarketing operations and are rarely effective in telesales or inside-sales organizations that require a multiple-call or complex sale. 

Call Center Predictive Dialers

An evolved form of automated dialer are called predictive dialers. In addition to automatically dialing a list of phone numbers for customers or prospective customers, as traditional dialers do, the predictive dialers execute two sets of activities, which increase enormously the productivity of the dialing process: 

1) Screens out no-answers, busy signals, standard information tones (SITs), and fax/answering machines, only sending calls that reach a live person to a sales agent. Here it is interesting to note that to be able to screen such things it is necessary to have a fine tuning between the public network signalling and the device. That means lengthy installation times and a very high level of sensitivity in any shift of trunks and operators. 

2) Using intelligent algorithms, these devices can detect when an agent is wrapping up a call; they’ll then begin dialing the next number and send the call to that agent as soon as a dialer reaches a live voice on the other end. These algorithms are also capable of detecting the number of available telephone lines, available operators, and average length of each call. Therefore, these devices predict the dialing rate in order to match it with the number of available agents. 

While the basic autodialer merely automatically dials telephone numbers for call-center agents who are idle or waiting for a call, the predictive dialer uses a variety of algorithms to predict both the availability of agents and called-party answers, adjusting the calling rate to the number of agents it predicts will be available when the calls it places are expected to be answered.  

By using a dialer to filter out these unproductive calls and to spare the agent from having to wait (adjusting the dial rate), call centers can improve productivity enormously. Agents can now spend on average around 80 percent of their time talking to customers and only about 20 percent of their time waiting for the next call.  

Compared with the conventional dialer (known in some countries as autodialer or power-dialer), predictive dialers have shown increases in talk time from twenty minutes in the hour to almost fifty (25 percent to 85 percent). However, predictive dialers are more suitable for low-quality mailings and large numbers of agents, and we should be aware that an unexpectedly high contact rate can overwhelm the system, leading to a high rate of call abandonment. We should be aware that the ability to identify bad numbers, answering machines, and fax machines isn’t what defines a predictive dialer—sophisticated power-dialers may do those things also—but rather it is the ability to use this information, plus the average duration and available agents, to adjust the dial rate.  

In operational terms, we have to understand that before running a campaign, the call list data (this is usually called a mailing or campaign), is loaded into the dialer. Then, the dialing process starts, and statistics are kept about what is happening. Most predictive dialers generate reports that indicate call attempts and unsuccessful calls by type. Unsuccessful calls are often analyzed to determine if the number called needs to be called back later or needs special treatment, such as a manual or autodialed call by an agent to listen to an answering-machine message.  Some companies adopt the practice of what is called “cleaning the mailing,” which consists of using dedicated dialers to call the numbers very quickly. The call duration is just enough to check if the number is valid (whatever the reason) and separate it from the mailing. Only after performing this cleaning are the separated numbers loaded in production dialers. Usually, the devices used for cleaning the mailing lists are connected to service providers whose charging granularity doesn’t exceed 18s as the minimum time charged per call, regardless of the real duration of the call. This practice maximizes the productivity because it allows the separation of the different kinds of situations in a more dedicated form. As examples, fax machines may receive a predefined fax message, and answering machines may receive a prerecorded message. Of course, it could be done by the same dialer in the first place, but very often infrastructures are not uniformly built and, depending on the situation, this strategy may be very useful

Call Center Dialers

The outbound operations usually are extremely challenging for telecom managers. These are the kind of operations in which just keeping the lights on is not enough, and usually the difference between a good installation and a bad one can make a huge difference in terms of productivity and influence directly the company’s bottom line.  

The deployment of devices called diallers (British English) or dialers (American English) designed to automatically dial telephone numbers, can generate significative productivity gains. However, you should not have the delusion that just buying the devices generates the productivity gains by default. The telecom manager has to understand that the productivity gains come from a well-balanced combination of three factors:  

• Well-chosen equipment 

• A good installation and proper configuration 

• A good management of the tool in the day-by-day operations  

Dialers are crucial tools for outbound call centers, because they free the agents of the work of dialing and make it possible for them to concentrate their effort in actually talking with the clients. If badly implemented, dialers may produce lackluster results and increase operational costs.  

In addition to the basic function of dialing and transferring the call for an human attendant, the dialer device can also perform several other tasks, such as announce verbal messages (called a robocall in the United States) or transmit digital data (like SMS messages).  

In addition, these devices usually can verify the dialed numbers and change them to seamlessly provide services that otherwise require lengthy access codes to be dialed.  Typically, a dialer can automatically insert and modify the numbers depending on the time of day, country, or area code dialed, allowing also the selection of the service providers who offer the best rates.

For example, a dialer could be programmed to use one service provider for international calls and another for mobile calls. These processes are known as prefix insertion and least-cost routing.  

Although most dialers can execute the least-cost routing, it is interesting to note that in large installations it may not be ideal to do so because that usually means the number of trunks (T1/E1) supported by each dialer box may not be enough for all dialing circumstances.

For example, if in a particular moment you have lots of fix-to-mobile calls, the number of mobile trunks available in each box may not be enough. This is the reason why it usually makes more sense to pool the trunks groups in a large voice switch and do the routing from there.  

Dialer systems are commonly used by telemarketing organizations involved in B2C (business-to-consumer) calling, because it allows their sales representatives to have much more customer contact time. Market-survey companies and debt-collection services that need to contact and personally speak to a lot of people by telephone may also use dialers.  

More commonly, dialers are now being used as a quick and easy way to automate all types of calls that would otherwise be made manually by a call center, such as welcome calls for new customers, customer service call backs, appointment confirmations/reminders, or even for the automation of large numbers of ad hoc calls that might need to take place (such as by a taxi company or a parcel-delivery service). The basic idea behind the device is that if a person were to sit down and manually dial one thousand people, a large percentage of these calls will not result in contact with someone at the other end. 

Out of one thousand calls made, typically only about 25 to 35 percent would actually connect to a live person. Of the rest, a large number (often 40 to 60 percent) won’t be answered at all, around 10 percent might be answering machines, faxes, modems, or other electronic devices, around 5 percent of numbers would be busy, and the rest will result in network errors or be identified as invalid numbers. For call centers that need to make large numbers of outbound calls, this represents a big problem. Typically, in manual-dialing environments, any given agent will spend around 90 percent of his or her time listening to the phone ring, waiting to talk to someone, or dealing with invalid numbers, or answering machines, and only about 10 percent of the time actually doing what they are really there to do.  

The benefit of dialers in general is that they can make many more calls in a much shorter period of time than an agent manually dialing each phone number. If the dialer encounters a busy signal or no answer, it will schedule itself to dial the number again later without human intervention. The system can also keep track of an entire campaign’s progress in real time—which would be nearly impossible if attempted manually. 

Call Center Billing Auditing

Billing auditing is the process of verifying carefully in the bill if what was charged by the service provider was what was agreed to in the contract. This verification includes the recalculation of each call and the verification of every item charged in the bill.  

Typically, most organizations don’t do the complete recalculation of all calls every month; usually they do that only for the ones in which big discrepancies between what was identified by the billing system and what was actually charged were spotted.  

Nevertheless, verifying the bills is a necessity in a large call center. Verification identifies charge discrepancies and enables the organization to get the due reimbursement for overcharging from the PTT providers. Experience shows that savings between 5 percent and 12 percent are usually attainable through regular auditing of the bills. Considering the expenditures with telecom of large call centers, 5 percent can mean an enormous amount of money, and therefore auditing the bills usually is worth the effort.  

Here it is interesting to mention that when we say verify the bills most people think about re-calculating the value charged for the calls. Although this is no doubt an important part of the verification, there are several other things that should be checked:  

• Verification whether the charges are associated to trunks that actually belong to the organization 

• Verification if there are undue charges for installation or trunk subscription 

• Verification if there are penalties for late payment unduly charged 

• Verification if there are charges for not achieving the minimum-committed volume  

Whether the charges are associated to trunks that actually belong to the organization should be verified. Although it may seem a bit obvious, the first and basic verification (very often not executed) is to check if the bill belongs to the organization, and the resource is actually being used. It is not uncommon to receive bills that don’t belong to the organization or previously belonged but the resource was cancelled or deactivated. In large operations with several sites (sometimes in different countries), just to be able to check if the bills belong to the organization and verify if the amount charged is compatible with the historical value is in itself a difficult task.  

Verification if there are undue charges for installation or trunk subscription is a very common problem. That includes all sorts of charges ranging from installations fees to trunks subscriptions and special services. Those charges sometimes are a large percentage of the bill and their verification is far from easy.  

Verification is necessary if there are penalties or interest for late payment unduly charged. Such charges very often are wrongly calculated and don’t correspond to what was defined in the contract. The bill verifier has to check if the penalties and interest are due and if they were rightly calculated as defined in the contract.  

Verification if there are charges for not achieving the minimum-committed volume is important to verify if there are charges for not achieving the minimum-committed volume and if these charges were properly calculated as defined in the contract. Usually, the difference between what was committed and what was actually used has to be paid in full.  

These kinds of problems very often provoke more overcharges than the mistakes in the calculation of the calls. Besides the direct financial gains, auditing the bills enables the evaluation of many other important aspects linked with the management of a large call-center operation: 

• Identifying the delicate balancing act between the minimum volume commitment and tariffs 

• Identifying volume and duration of the calls, which is crucial to negotiate charging granularity 

• Identifying the point at which least-cost route configuration in the PBXs needs adjustment due to changes in tariffs 

• Knowing when it becomes feasible to have a private-voice network (interest of traffic concentrated in some specific area code) 

• Accurately calculating the number of trunks and circuits (capacity planning)  

Analyzing the voice bills enables accurate answers to all these questions, and the telecom manager should be aware that the analysis of a telecom bill is much more than just checking the tariffs. It is also about verifying the traffic and comparing the current prices against available alternatives.  

The process of verifying the bill usually follows these steps:  

• Verify if the bill and the resources belong to the organization. 

• Verify if the value charged is compatible with the historical value. 

• Verify if the minimum-committed volume was achieved (if not, recalculate the penalty and check if it was rightly charged). 

• Verify if there is any penalty and interest for late payment being charged. 

• Verify if the charging period is correct and if there is any additional fee being charged for unsolicited services, such as installation or subscription. 

• Identify resources not in use, such as trunks without any calls.  

After verifying these basic items, you should check the calls, recalculating the value and checking the traffic interest:  

• Verify from and to where each call was made. 

• Identify the area codes from and to each call. 

• Verify how much each call is supposed to cost, based on the organization’s specific contract, and identify the discrepancies. 

• Identify if the taxes were properly applied. 

• Verify if there are calls charged outside of the admissible charging period.  

When auditing telephone bills, it is important to consider that this procedure is effective only when there is a process in place to define how and when the organization will be reimbursed. Contracts must have dispute clauses, and, ideally, the contracts in place should foresee that. If errors were spotted in the bills before the payment due date, the organization can notify the service provider and pay only what was considered due. The values over which there is disagreement must be discussed jointly. If the charges prove to be right, the organization pays the service provider without penalties for delaying the payment (interest is due).  

The organization musts define a formal process through which all invoice disputes are treated. The process needs a definition of time frames for each party involved and should mirror the dispute resolution clauses of individual contracts or master agreements. Typically, the whole process of disputing a bill from identification to solution should not exceed three months.  

The SLA must consider that the invoice payment doesn’t imply acceptance of the charged values. Ideally, the organization should have at least one year to audit the values charged, and the SLA should foresee that. If the errors identified exceed 5 percent of the total value of the bills, the service providers must reimburse the organization for the costs involved in auditing the bills. This is a considerable cost and a good mechanism for keeping service providers accurate.  

The organization must define clearly the time after which charges are not acceptable (in some countries it is defined by law). For example, services provided more than six months ago should not be charged.  

The organization must schedule regular meetings with the service provider invoice team. Such meetings should be forums to discuss problems with the invoices and items added, changed, and cancelled.  

The organization should try to define standardized invoice cycles and guarantee that all invoices are due on the same day; this simplifies the billing and payment process.  

Of course, all these recommendations depend on negotiation at the contract stage and arguably these points belong in the negotiations chapter. However, these clauses only become meaningful if actual billing verification is done; without it you will have no recourse or knowledge of billing errors.