Gantt Charts for grants and cases

If you're using CiviCRM for grant management or case management, you migh appreciate this new extension:

CiviGantt — Gantt Charts for CiviGrant and CiviCase.

Here’s a screenshot:

As the extension author Lauren explains:

Almost every question I get asked about Cases and Grants turns out to be a question about time. Which of these have been open longest? What's overlapping? What's due next, and how much of it lands in the same month?

CiviCRM knows all of this. Cases have start dates and end dates, grants have decision and due dates, activities have dates on them — the data is sitting right there. But every built-in way to look at it is a list or a table, and a table is a bad instrument for "when." You can sort a column by end date and still not see that four of the six items finish in the same fortnight.

Sure, you can export data to Excel and build charts there. Doing it once is fine. But doing it every time is painful. Says Lauren:

What I wanted was to have these Case and Grant charts inside CiviCRM, drawing on the live records, respecting the same permissions as everything else, so the person looking at it sees exactly the cases they'd see anywhere else in the system. That's what CiviGantt is.

You can install CiviGantt right from within CiviCRM, through the Extensions management page.

Give it a try. If you like it, send a thank-you to the developer @Lauren, over at the project's main page: https://lab.civicrm.org/extensions/CiviGantt

All the best,
A.

Locked out of the bathroom

Imagine coming home to find that your key no longer opens the front door.

Or maybe it opens the front door, but for some reason you need (suddenly) a completely new key to get into the bathroom.

What the heck is going on?!

OK, that’s unlikely.

But you could be putting your website users in a similar position -- staff, members, and anyone else -- if you're not careful about making changing to user permissions on your website.

That's because your site permissions aren't quite as simple as managing access to rooms in your own home.

It's more like managing all the locks on all the doors in a large office building:
The maintenance crew needs to access the bioler room, but not private offices.
Tenants need to access their private offices and the front door, but not the loading dock.

Switching up the access controls on any of those, if not done carefully, could grant too much access to the wrong people, or prevent critical access for people who really need it.

Would you really want the general public having access to your building’s critical infrastructure?

That's why it's important to document your access levels:
What are the different access levels you need to maintain?
What should each one be able to do?
Can we assignmore than one access level to any given user?
Who's affected if we change the permissions for this access level?

Maybe you're not sure how to get started with this.
Maybe it feels low-priority for now (and won't become a priority until someone has a problem).

But you can start addressing this now, without taking a whole day out of your week and calling meetings with 13 different people.

1. Here's a sample document that can serve as a template.
You can copy that document, add, remove, and edit sections to describe your needs.
Then consistently refer to it going forward, and update it over time.

2. You could just take 15 minutes to list out what you think are the various access levels.
Keep that handy, and work to improve and flesh it out (by referring to it and updating it) over time.

Either way, I expect it's worth a few minutes of your time.

Definitely better than finding out you've given the general public access to your building's elevator control room.

All the best,
A.

The art of curiosity

When was the last time you felt genuinely curious?

Not just "hey, is my favorite show going to have another season?"

I mean the kind of curiosity you might remember having as a kid.
Where you say "I wonder if ..."
and then actually want to spend time finding out.

Lots of folks haven't felt that way in a very long time.

Which is sad.

Because genuine curosity is thrilling.
It's exciting.
It's productive.
And its results are very satisfying.

But it doesn't co-exist well with fear.
Of failure, or of being overwhelmed.

And it doesn't thrive in a world
where any little question
can get immediate (if low-quality)
answers from
the Anything Machine in your pocket.

But we can cultivate it.
By allowing the wonder to linger.
By putting aside fear for a time.
By practicing the art of finding out for ourselves.

And in return, we get
new insights
new relationships
and surprising results that matter to the people we care about.

Sure, your CRM and your other systems have a ton of ways to give you information.

But here's the thing:

None of us are struggling from a lack of information.
But we do struggle with getting all that information to make sense.

The good answers are not instantaneous.
They only come by sitting with the question,
and exploring with curiosity.

All the best,
A.

Are you connecting?

I can email a thousand people in a moment, anytime I want.

But if that's all I've done what did I accomplish?

I'd trade that moment to spend an hour making a genuine connection with one person.

If your outreach is helping you build connections, keep that up.

If it's not, it might be time to rethink your methods.

All the best,
A.

Online admin training

There's a multi-day CiviCRM Admin Training happening in Paris in a couple of weeks.

But maybe flying to Paris isn't on your agenda.

I've been chatting with the CiviCRM Core Team about the possibility of producing an online admin training for CiviCRM.

This would be a structured, self-paced, video based curriculum for folks who need to manage CiviCRM for their organization.

So I'm curious:

Is that the kind of thing you or your staff members would actually use, assuming the price is not prohibitive?

The last thing we want to do is produce something that nobody uses, so any reaction you have would be much appreciated.

All the best,
A.

Engagement means nothing

Engagement itself is valuable.

But as a word, saying you want "more engagement" is almost meaningless.

Unless you define it for yourself:

Decide what you hope people will do;
Form an idea of how your actions will lead them to do it;
And test whether that idea fits reality.

Once you're doing that, you'll have something measurable to improve upon.

And continual improvement is your secret weapon, isn't it?

All the best,
A.

Import/export pro tip

Your CRM's export and import features are pretty powerful and useful, once you get to know them.

List member Emily passed along a great tip in conversation today:

Always export the Contact ID.

Because you're probably going to do something with that exported list.

And sooner or later, you'll want to import some of those contacts back into the CRM.
To update their info,
or to put them in a group,
or to send them a mailing.

If your spreadsheet already includes the Contact ID, that import will be pretty easy.

If not, you'll have a little adventure trying to get them all imported without creating duplicates.

Thanks, Emily!

All the best,
A.

“Social” media?

Remember when social media was, you know, social?

When you could actually communicate with it, create connections, build community?

I'm almost sure I can remember it.

But now I think that time is just as gone as knowing your neighbors.

So ...

Since we need connections and community now, no less than we ever did ...

And "social" media just might not be cutting it ...

How are you building connections with the people who matter to you?

All the best,
A.

P.S. That’s not an entirely rhetorical question. I’m trying to figure this out, too!

Over-committed

You ever feel over-committed?

I think I’m pretty good at not over-promising to my clients (and hey, if you're reading this, let me know).

But with family, and home, and volunteering in the community, and helping out a friend, and taking care of my own damn self...

Yeah, sometimes I feel it.

And often, for me, the way through that is surprising.

It's not (usually) going back on my commitments.
It's not (usually) doing less.

Usually, it's enough to take time every day or two to reflect on
why I care about those commitments,
how they're enriching me and the people I care about.

How do you handle it?

All the best,
A.

Not silly

Once you've solved a long-running problem, it might feel silly that it took so long to address.

But it's not.

If at the beginning you had understood the cause, and known the solution, you would have fixed it.

But you didn't.

Working through problems over time is not silly.

Often, it's necessary.

All the best,
A.

Downtime at 3am

This is a little silly, but I'll share it, because it might matter for you.

I have several online systems that help me run my business, and early on I found they'd sometimes go offline -- and stay that way until I noticed and rebooted them. I was not happy.

Lesson learned:
Systems go down.
When they do, I need a way to respond quickly.

So I arranged for monitoring that would send me a text message if anything important went offline.

Once in a few months or so, I'd see a downtime message, take corrective action, and be happy.

But then I noticed that if a text came in while I slept -- like at 3am -- I simply wouldn’t hear it. So a system might stay offline for hours. I was not happy.

Lesson learned:
Timely alerts need to be noisy,
interruptive,
hard to ignore.

So I arranged for downtime alerts to come in through a dedicated phone app with attention-getting alert sounds.

Once in a few months or so, I'd be awakened by an urgent alert, take the same old corrective action, and be happy.

Recently, I’ve found a couple of those systems triggering late-night alerts multiple times a month. I was not happy.

Lesson learned:
The downtime was unpredictable,
but the fix was always the same.

So I arranged for an extra step in my downtime monitor: before alerting me, try the standard fix a couple of times (and email me about that), and only alert me if that doesn't solve the outage.

This morning, I found an email from the monitor.
It had solved the problem while I was asleep.
All systems were live, and the downtime was less than a minute.

Maybe sometime I'll explain why this is a little silly (but only a little).
But for now, I think there's a winning pattern here:

Making everything run perfectly all the time
is an expensive proposition.

Often it's enough
to ensure you notice when something's amiss,
and to take corrective action.

And when the patterns reveal a consistent fix
for a common problem that's keeping you up at night (literally or figuratively),
automating that fix is surely worth the effort.

All the best,
A.

I hired a coach

I recently started working one-on-one with an expert coach, and it's made a huge difference for me.

I've spent several years trying to figure this stuff out on my own. And that's been fine, as far as it goes.

But now I have someone who:

• Points out little things I'm doing that limt my results.

• Suggests specific alternatives that actually help.

• Reminds me to stay focused on my goals and actually improve specific things, not just "keep trying stuff."

• Shares his own expertise and experience about what's actually possible or worth pursuing -- and what isn't.

• Adapts our work together to fit my own goals, not some generic roadmap he imagines for “most people.”

We meet once a week, and after a month I can already see improvements I just wasn't getting before.

So who's this coach?

He's a black belt at the gym where I train in Brazilian Jiu-Jitsu.

Sure, this is a hobby.

It's not my job.

It's "not that important."

But the things is:

If you can find the right coach for you, one-on-one coaching has huge benefits.

And not just for hobbies. For any area where you believe your results really matter.

It's just night and day different from trying to figure it out all by yourself.

All the best,
A.

Easy segmentation by county

Doing geographic segmentation by county — rather than proximity like “within X miles of Y” — can make a lot of sense.

But how do you know the right county for any given contact address?

• It's not a question you'd normally ask on a form, e.g. next to City and State.

• You can't really expect your staff to look up the county for every single address they enter.

Fortunately, in CiviCRM, you can make the right county populate automatically.

• You’ll need to use Google as your geocoder service.

• You'll need one of these CiviCRM extensions: County Lookup or Geocoder

Once you have that, CiviCRM uses its existing geolocation fetures to automatically assign a county to every address, right when it's entered.

No manual lookups, no requiring your constituents to fill in yet another field.

Just correct counties for every address, automatically, for easy segmentation when you need it.

Easy!

All the best,
A.

P.S. If your CiviCRM setup doesn't yet have all the counties you need (that is, you can't even manually specify the right county for any given address), and if you're dealing with US addresses, you can install the US County Loader extension. Merely installing it will make all US counties available for your contact addresses.

Segmenting by location?

Your CRM probably lets you find contacts by geographic proximity (CiviCRM does).

The problem is, "X miles from Y" is the formula for a circle.

And your constituents don't live in perfectly round geographic areas.

If you're segmenting by circular areas, your segments will have either big overlaps or big gaps.

Fortunately, there are better options, namely:
ZIP codes
and counties.

Any contact with an address will appear in exactly one of those.

Configure a few smart groups -- e.g. a "North Texas" group for anyone with a primary address in one of "these 36 counties" -- and your geographic segments are set, automatically updated for as long as you need them.

With no overlap, and no gaps.

Not bad, right?

All the best,
A.

When “clever” means “messy”

Making your CRM do something just the way you need it ... that can be a great thing.

But making it do things it was specifically designed NOT to do ... that can be a big mess.

Things like:

• Intentionally maintaining duplicate contact records

• Tracking "do not contact" in the Nickname field

• Maintaining one Individual contact as "Mr. and Mrs. Smith"

Usually, these clever arrangements are meant to solve one important problem or another.

But because they go against some core assumptions in the CRM software (CiviCRM in this case), they also wind up creating new problems. Usually in ways you don't anticipate.

Sometimes it's hard to know whether your clever solution is really a winner or just a bad idea that goes against the core assumptions of the software.

Sometimes you can ask a trusted advisor beforehand and avoid trouble.

Sometimes you just try it, and find out later.

But this may be worth remembering:

If it feels like you're getting more then your share of surprises from your CRM, it may be that you're trying to make it do something it was designed not to do.

All the best,
A.

You have to do this

It seems like every few months I run into somebody who's having trouble with bounced emails.

And by “having trouble” I mean:
they're actually not tracking them.

This is totally understandable
because it might be one of the most overlooked bits of CRM configuration.

But it's also trouble
because failing to track bounces can make you look like a spammer.

And looking like a spammer is a good way to ensure nobody receives your messages.

Here's a quick test you can do right now if you're not sure you've covered this base:

1. Create a CiviCRM scheduled mailing that includes an address you know will bounce.
   (For example, as of today, I happen to know that wJ04jxBqlfdYNQWwR5CR@gmail.com is a bogus address that will bounce; probably any random address like that will work as well -- and to verify that, you could just try manually sending an email yourself and see if you get a bounce.)

2. If that address doesn't appear in the "Mail Bounces" report within a day or so, there's a good chance your bounce handling isn't configured correctly.

A test like that just takes a few minutes, and it can save you a ton of grief.

And if you're having trouble with this, I recommend you take a look at the docs here, or reach out to someone who can help you with this. (Heck, just hit reply here and ask me.)

All the best,
A.

No system is risk-free. But…

In yesterday's security-related email, I made an analogy with some holes in it:

If my house gets robbed, I can't really prevent it happening again just by moving to a different house.

Well, maybe. Sure, merely moving to a new house doesn't necessarily change things.

But in truth, moving to a different house absolutely can reduce the risk -- especially if the first house had crappy locks, no alarm, and was in a high-burglary area.

Likewise:

Changing CRM vendors or architectures can materially change security risk.
"No system is risk-free" does not imply "choice of system doesn’t much affect risk."

The stronger lesson is that security is risk management, not a simple "yes-or-no" attribute of a given product:

architecture,
maintenance,
access controls,
hosting,
backups,
organizational practices,
incident response,
the amount and type of data you're storing,
whether a single breach could expose many organizations at once (as in the Beacon CRM case) …

Improving any of them can reduce your actual level of risk.

All the best,
A.

Planning for the worst

So yesterday I mentioned that a major subscription-based (paid) CRM for UK nonprofits recently had a security breach with complete data disclosure.

In other words, the full CRM data of all the nonprofits who were using that CRM was copied out by attackers, and could potentially be misused.

There's a great write-up about it on the CiviCRM blog, if you'd like to read more — including some thoughtful views on what this means for folks like you and me using open-source CRM solutions.

Beyond that, I think this is a good example of an important point:

No matter what system you decide to use, there's always some chance that the bad guys will find a way in.

It’s just as true as for our own personal security:

If my house gets robbed, I can't really prevent it happening again just by moving to a different house.

If my neighbor's house gets robbed, it doesn't necessarily mean that my house is any less at risk than his was.

Instead:

• We do what we can to keep ourselves secure.

• Meanwhile, we make a plan for how we'll handle it if something does go wrong.

Here’s the thing:

Life is full of risk, but that doesn't stop us from enjoying it as we go along.
Not in our own homes, nor in our work.

If you have questions about how to keep your constituents' data safe,
shoot me a reply and we can get into the details.

In the meantime, you might take a few minutes today to consider:

How would you and your constituents be affected if your CRM data were compromised?

How much damage could that cause to your mission?

How could you handle it, if it happened?

Uncomfortable as it might be, it’s worth some consideration.
These question can actually be answered.

And having the answers is a lot better
than not having them
when you really need them.

All the best,
A.

AI’s dark side

I've been getting lots of questions about security.

WordPress has dropped more than one significant security fix in the past few weeks.

Beacon CRM -- a major subscription-based (paid) CRM for UK nonprofits -- announced a serious security breach and data disclosure at the end of last month.

There's more, and folks in the geeky circles I run in are taking about it.

What's going on?!

Part of it is just normal life.

Hackers gonna hack, defenders gonna defend, sometimes it be like that.

But...

AI-driven threats are on the rise.

Just as you're probably using AI tools to try and make your work easier, the bad guys are doing the same for themselves. Because of this, I think we can expect security threats -- and security fixes on supported software -- to come out with increasing frequency.

What this means for you and me:

Keeping your software up to date just keeps getting more important.

I've worked with organizations who’ve been bitten by this.

It's no fun for them. At all.

So...

Check your backup processes.
Check your update procedures.
Check your system monitoring.

If you stay on top of it, you might look back later and wonder what the hubbub was about.

But if you don't, you'll probably find out, sooner or later.

All the best,
A.

Easy emergency account recovery

Most organizations have at least a handful of user accounts for critical outside services.

Web hosting, payment processors, and more. Usually much more.

What happens when the person who manages one of those services leaves your organization?

How are you going to login to manage that service without the password that person was using?

But you've already decided to be smart and not store those passwords in a shared spreadsheet or document.

Your staff are each using a proper password vault for that, of course.

So there's a problem: your passwords are secure, but it's not easy to share them.

Here's the easiest solution I've found:

1. Make sure any outside service account uses an organization email -- not a staff member’s (or vendor’s) personal email address.

2. Record, in a shared spreadsheet or other document, which email address is used for each service account.

That's it.

If things really get bad, and the person who manages the account is inaccessible for whatever reason, at least you'll have a way to recover your access.

You'll know which email address to use, if you can reset the password by email.

And you'll have a way to access that email inbox, because it's an organization email address and not a personal one.

Sure, it's not perfect.

You might wish for a way to have secure password storage that can be easily shared across your organization.

But it's very likely that such a setup is more expensive or more complicated than your small organization wants to handle.

Still, just by documenting the email address for each service account, you get shareable documentation that can be pretty easily kept up to date, and you get a recovery method that works.

Not a bad compromise, I'd say.

All the best,
A.