ERP, CRM and eCommerce Blog

 In last four months, we have been hard at work restructuring support services for our flagship software solution – Ignify eCommerce. We have been looking deep internally after our public announcement to become the best customer service of all technology companies. This post shares my experiences working with our support customers, our customer support team, as well as my own support requests where I am a receiver of support and not a provider. Feedback and comments are most welcome as we continue to strive towards “wowing” the customer.

There were two fundamentals for our customer support strategy that we agreed upon at the very outset 4 months back:

1. End User (not necessarily same as customer) is the king. If end user isn’t satisfied, customer support has failed.
2. We would treat every customer as a SAAS customer even if the customer has purchased an on premise license and is operating Ignify eCommerce in their own facility. After all the customer and end users are interested in the service that the software provides and not the software itself.

We also established three simple metrics around customer satisfaction. These included – First Call Resolution, Turn Around Time (Measured as average time taken to close an issue) and Total Open Issues at any point of time for a Customer.

Putting end user at the center of affairs cleared confusion around scope of the work. In quiet a few cases Ignify eCommerce is customized to meet specific customer’s business needs. Customer support earlier had questions whether these customizations have to be supported as a part of Ignify eCommerce Enhancement Plan. Since Enhancement Plan is charged as a % of license cost, it was an obvious question. The answer we arrived at was – “yes, we would support all customizations since the end user really doesn’t understand this difference between standard and customized. He cares about his day to day opeations”. This led to a challenge around retaining knowledge around these customizations. There is usually only one support analyst who is familiar with such customizations, in case this analyst becomes unavailable then knowledge retention as well as end user experience is impacted. We solved this problem by putting a minimum of two support analysts who would know each customization. It did over the short term increase the cost of support but led us closer to our goals of wowing the customer.

Treating all on premise licensed customers as SAAS customer threw a serious challenge of managing environments. Maintaining any software usually requires maintaining multiple environments – a DEVELOPMENT environment where troubleshooting and fixing can be done, a TEST environment where quality assurance team can provide sign offs, a UAT environment where end users can sign off and finally a PRODUCTION environment. While some of our customers were maintaining these environments, most of them didn’t have all four environments in place.

To avoid burdening our customers with environment creation (Note that in a SAAS solution, that burden doesn’t exist), we took an initiative to create DEVELOPMENT and TEST environment for all of our support customers. For DEVELOPMENT, we leveraged Front Page Extensions to create a single environment for multiple support customers and support analysts to troubleshoot / debug on. Each eCommerce Solution was extended using Front Page Extensions, these extensions enabled remote publishing and debugging of multiple eCommece solutions. For TEST – a new virtualized environment using Windows Server 2008 R2 Hyper V on Dell PowerEdge R 905 with Dell MD3000i was created for several hundred eCommerce Solutions. An automated build and deploy process was configured to build these web solutions every night so QA can provide sign off without any dependency from developers.

This solved our DEVELOPMENT and TEST environment problem but we still had to push any software releases on UAT and PROD environment manually. This was done via a semi-automated custom built tool that took care of these deployments.

While working on customer satisfaction metrics, I came across a January 2008 article published by Wired Magazine. This was similar to various other customer feedbacks that we found on user experience with support services. Wired magazine spoke about support being a problem since support analyst is not “emotionally invested” in customer's business. It also spoke about an average customer service rep being uncreative, having low incentive, and demonstrating limited empathy. We took some specific action items to ensure that we do not fall in the same trap:

1. We decided that 50% of our support plan revenues would be invested in customer support salaries.  This allowed us to design attractive incentive plans and compensation structure for our support analysts.
2. We took our entire support team through a battery of presentations to explain how they play a role in our customer’s day to day operations. “The emotional investment” came from the pride taken by increasing store revenues. A reward system based on such a revenue trend helped improve the emotional investment.

The results have been extremely encouraging; we have managed to improve our First Call Resolution by 50%, Turn Around Time (Measured as average time taken to close an issue) by 70%. And average Open Issues have gone down to 0.5 from 5 – almost a 90% decrease.

Are we done with this journey? Not quite – customer support is a fulcrum that can swing end user experience either ways. While we see a much larger debate going on support contracts and their value, we continue to quietly move towards our goal of becoming the best customer service technology company around. How close are we towards that goal? – only our customers can tell .

Pankaj Kumar is the CTO of Ignify. Ignify is a technology provider of ERP, CRM, and eCommerce software solutions to businesses and public sector organizations. Ignify eCommerce is the only PCI certified eCommerce solution in the market that integrates with the Microsoft Dynamics ERP and Sage ERP solutions.  Ignify has been included as the fastest growing business in North America for 3 years in a row by Deloitte, Inc Magazine and Entrepreneur Magazine.

Data Security has been top of our minds at Ignify. We spent over 18 months strengthening the security for Ignify eCommerce including taking it through its PCI compliance. I am glad to report that the PCI Standards Council passed Ignify eCommerce on the PA DSS II standard and makes us the only eCommerce platform that offers integration with mid-market ERPs to have achieved that. Based on my experiences in leading this effort – I came up with some trends and tips that can help you and any business that is looking or is selling online. Some background first – per the DataBreaches website,  2009 has been the first year that the number of data breach incidents recorded has actually dropped, since 2005. If that makes you feel a little more secure – there is a counter side. The same site reports on personal records that have been exposed – 220 million records in 2009 as compared with 35 million in 2008.

There are two important trends to note here. The first – Technology advancements (and simplifications) have made breaches increasingly difficult. Second – The people side of the equation; where small entry errors have lead to large scale breaches sometimes becoming more difficult to manage than technology issues. The fact is that there are people involved with keeping information secure. It is extremely critical that processes such as implementing an immediate access termination when employees leave an organization, are well oiled and working at all times.

My prediction is that 2010 will see more breaches due to human errors rather than technology errors. For example, there have been 11 breaches reported on privacyrights.org in November 2009. Out of these 8 breaches are human errors while 3 are technical holes or hacks. 

With a poor economic state and online shopping becoming a necessary tool for tough times, merchant readiness for handling confidential data both on the technology and people front is critical for a successful online presence. As the New Year approaches, it is important to review the lessons learned from the past year and reflect how we can use past trends to correct and innovate data security in 2010.

What have we learned in the past year?

Lesson 1: Be ready to handle confidential data before you turn on the switch

The healthcare industry was attacked with a flurry of data breaches in 2009. Most recently and noticeably in August, Anthem Blue Cross and Blue Shield of California was involved in a data breech of more than 850,000 physicians throughout the United States including critical personal information such as; Social Security, taxpayer ID, and NPI numbers, may have been compromised when a laptop containing sensitive data was stolen in Chicago.

What can we learn from this very basic case of information theft? Anthem and Blue Shield were not prepared to handle confidential data. Carrying secure data on physical media has specialized security needs and merchants should have those processes well tied together. At times, it boils down to simple processes that include how authorization and communication is carried out in an organization.

Technology has matured thanks to collective learning becoming a part of the technology itself; but organizations do not assimilate best practices at the same pace – people unfortunately make mistakes and security mistakes can be fatal to your business.

Once the switch is turned on and systems start humming, there is a human tendency to start focusing on day to day operational issues and data security begins to take a back seat. As a merchant, it’s important that you have your people related systems in place to conduct regular audits and trainings to keep data security in the front. Does it have to be expensive – No – Simple devices such as funny posters on the wall or creative emails do a great job of reminding everyone of the threat.

Lesson 2: Think about Data Security upfront while working on your online initiatives

Whether you are working with a vendor or in-house staff, ensure that you have proven expertise on board. With a vendor this could mean checking if their systems have necessary security certifications. As an example – PCI PA Certification applies to all software vendors handling card data in any form or fashion and the certification body has published information of certified software for public access. For in-house staff, there are a couple of options – SSCP certifications for network administrators and CSSLP certifications for developers.

Using these public initiatives – you can learn about data security and make decisions that have the data security green light.

Lesson 3: If you are an eCommerce merchant, get PCI certified

PCI over years has become a leading authority for merchants to learn around data security threats and mechanisms to prevent those. As a merchant you can get PCI DSS certified by ensuring that you meet all criteria laid out by the Security Council. The cost for such certifications has been coming down but they may still be prohibitive for some merchants. In such cases there is self assessment available that any merchant can use to ensure that they can handle confidential data.

Treat PCI certification as a fixed asset purchase, it would serve you over a longer period and would get you a benefit – trust of your customers – that has a very definite ROI over a period of time.

Lesson 4: Compliance is not a golden ticket: Secure your systems: once, twice, three times.

In July, Network Solutions LLC, a web hosting firm announced a data breach of approximately 574,000 individuals’ credit card information. The company claimed that it discovered unauthorized code on servers that supported its e-commerce merchants' websites. It was determined that the transaction data of about 4,343 of its merchant websites was breached sometime between March 12, 2009 and June 8, 2009. In a statement release by Network Solutions, the firm claimed to have been violated despite is PCI compliance status.

What can we learn? Being compliant is the minimum bar required to switch your online systems. Remaining compliant means you work carefully with your team and processes that handle confidential data. Security standards and guidelines are great to learn from but they are not a solution in itself. Data security is fast becoming a people problem and not a technology problem. Having right people in your team to do regular audits and compliance checks becomes a very difficult and expensive lesson to learn after a data breach occurs.

Lesson 5: Be transparent with your customers at all times!

So what if a breach finally happens? What should you do? First thing is to inform everyone who got affected and immediately reach out to law agencies for help.
Anthem was heavily criticized for not notifying the victims of the theft (mostly healthcare providers) in a timely manner. Reports indicated that several states, of the 50 states affected, were not notified until up to two months after the breach, giving cyber criminals more than enough time to wreak a significant amount of damage with your personal information, under the radar.

Transparency is important if a data breach incident occurs. The quicker response you have to a data breach, the faster and easier the issues can be resolved and data can be recovered and/or protected. It is critical that your customers are educated and aware of the dangers of the marketplace. There are free resources that allow consumers to monitor, freeze and simply check their credit status with the three major reporting agencies Equifax, Experian and TransUnion to protect themselves from personal data breaches; putting the power in their own hands.

As a merchant or data custodian, it is your responsibility to educate all affected parties on the steps they can take to avoid the damage.

The future of Data Security: Where do we go from here?

Finally, the law seems to be catching up – With the recent pass of The Data Breach Notification Act (Bill S. 139), introduced in January by Senator Dianne Feinstein, D-Calif., data security has become a hot topic discussion with all types of businesses. The Data Breach Notification Act will require any federal agency or business entity to notify an individual of a security breach involving personal information without “unreasonable” delay, meaning “any time necessary to determine the scope of the security breach, prevent further disclosures, and restore the reasonable integrity of the data systems and provide notice to law enforcement when required.” The bill also requires that major media outlets notify residents of respective states that are affected by the breach.

A complimentary bill to the Data Breach Notification Act also passed concurrently, the Protecting the Privacy of Social Security Numbers Act (Bill S.141), introduced in July by Sen. Patrick Leahy, D-Vt. This bill sets notification requirements and tighter criminal penalties for identity theft and willful concealment of a breach and requires businesses to implement preventive security standards to guard against threats to their databases.

Data Security now has increasing legal ramifications as well. Just the way you would invest in your business to comply with local laws of the land; data security is another investment being made mandatory by law, which is good. The maturity of technology and related people challenges means that merchants of all sizes have to continuously worry about the people they put in charge for keeping the systems secure and handling confidential data.

Let 2010 be a year when you commit to train and educate your people to make your organization ready to handle confidential data. Rework your processes next year to have a continual audit of your systems to make sure that they remain ready. At the end of the day; your processes should NOT be like this one.

Pankaj Kumar is the CTO of Ignify. Ignify is a technology provider of ERP, CRM, and eCommerce software solutions to businesses and public sector organizations. Ignify eCommerce is the only PCI certified eCommerce solution in the market that integrates with the Microsoft Dynamics ERP and Sage ERP solutions.  Ignify has been included as the fastest growing business in North America for 3 years in a row by Deloitte, Inc Magazine and Entrepreneur Magazine.

I attended PDC 2009 last week and enjoyed every moment of it. Things seem to be changing for Microsoft with far too fast changing competitive landscape. And Microsoft has an interesting challenge to play catch up or be thought leaders in computing technology. They seem to be doing both and trying hard to be thought leaders. The significant theme in this PDC was Windows Azure – a platform meant for cloud computing. And there are some interesting bits about the platform in terms of how Microsoft is approaching it.

There is a much different strategy to Azure if you compare it with Amazon EC2 and there are similarities with Google App Engine. Azure is a computing platform and is not meant to be used as a server bank with on demand elastic availability unlike EC2. To Microsoft credit, that is a very attractive idea in .NET world and has merits in a number of scenarios – as an example avoid human dependence for server/application management. Azure seems to be the next biggest bet that Microsoft is taking and so far I think they are on the right track. There were some very interesting talks from Azure team, an outstanding presentation by Manuvir Das that explained Azure’s past and talked about it’s future. One of the key differences in Microsoft offering though is - SQL Azure. There is nothing from Amazon or Google that really comes close to SQL Azure. With a very well crafted scale out strategy, SQL Azure may be the the key winner for Microsoft. But due to scale out nature, it has limited application to existing applications unless re-architected.

So what does all this mean to mid size customers running Dynamics ERP, CRM, Sharepoint, Exchange and custom written .NET applications or plumbing. This question has two different answers for home grown or otherwise written .NET applications and non .NET applications from Microsoft Dynamics stable

For .NET applications, there are two key areas where all CIOs in these mid size organizations should consider Azure. Azure would also significantly change how mid size IT operations would be run in future:

1. Cost Saving – I am calling this out first given the current economic scenario and the continual pressure to fulfill customer demands while reducing the cost at the same time. Setting up Development, Test & Staging environments and providing global access has been a friction factor for launching many application initiatives. With Azure, that problem is pretty much gone. You can fund a new project with a very minimal upfront cost in infrastructure or time. The billing model for Azure when running in Production is likely to be much lower than what it would cost internally or with a hosting company. Our recommendation for new applications is to evaluate Azure as the first platform option for all future .NET initiatives. A natural question would be about existing infrastructure – right now Windows Azure has limitations on what all you can deploy and you might end up doing expensive evaluation or trial and error. There are offerings on the card that would make EC2 like fully controlled Windows instances a reality on Azure. Our recommendation for existing applications is to wait till 3rd quarter of 2010 before moving existing applications to Azure. 
2. Enterprise like scale up and fault tolerance capability – This would be my number 1 reason had the economic condition been different. With Windows Azure and the deep investment behind this, there are significant gains for mid size companies to get enterprise like scale up and fault tolerance capabilities at zero upfront cost and very reasonable operating cost. Capability to launch additional instances of web servers (called Web Roles in Azure world) on demand is extremely attractive.

Does Azure change the way I run Dynamics ERP and CRM software today or how I would run it tomorrow? – Official Microsoft word is that yes, some day all Microsoft Products would transition to Azure. My personal opinion is that this is unlikely to happen – there would be changes in the way Microsoft would offer these products to end customer but moving to Azure may be far fetched given the current technology platform and existing customer base. Dynamics CRM is already offered via Microsoft Online Services. Other Dynamics Offerings would be either coming from Microsoft or other partners.

So get Azured and start preparing for the next generation always available apps!

Pankaj Kumar is the CTO of Ignify. Ignify is a technology provider of ERP, CRM, and eCommerce software solutions to businesses and public sector organizations. . Ignify is a Microsoft Dynamics Inner Circle Partner  and ranked in the top 18 Microsoft Dynamics partners. Ignify has been included as the fastest growing business in North America for 3 years in a row by Deloitte, Inc Magazine and Entrepreneur Magazine.