CRM data theft: are you ready?

What would you do if you discovered today that all of your CRM data may have been accessed by criminal hackers?

How would it impact your organization, and your constituents?

What are you doing to prevent such a breach? And what are you prepared to do, if and when it happens to you?

I know — it’s not fun to think about. But believe me, it happens. I've seen it happen, even to organizations who were sure they were “just too small to be a target.”

So it's absolutely worth thinking about.

But it’s a big complex issue. Where would you even start?

Starting anywhere is better than not starting, but this article from the National Council of Nonprofits outlines 3 steps to get you going:

1. Perform a generalized risk assessment: Ask yourself, "What data do we collect about people? What do we do with it? Where do we store it? Who is responsible for it?" — and document those answers.

2. Consider the law: Know whether the data your organization collects and maintains is covered by federal or state regulations as specially protected “personally identifiable information.” If so, you'll have an additional duty to report any unauthorized disclosure of that data.

3. Drill down on the risks: Consider using the US National Institute of Standards and Technology (NIST) Cybersecurity Framework to help you identify risks, and make management decisions to mitigate those risks. Also consider how the use of third-party technology and service vendors can create holes in your data security.

Here's the thing:

Criminal theft of your constituent data is a serious situation. Naturally you're working hard to prevent it.

But there are no guarantees. Try a quick web search on “data breach lawsuit” to see how often such things are happening.

So, yes; do what you can to prevent it.

And beyond that, be prepared for what you must do if it should ever happen to you.

All the best,
A.

The upside of staff turnover

We can say to our team, “Join us if it works for you, leave us when it doesn't. And if you leave with more knowledge than when you came, it's a symptom we did well together.”

in his recent book The Song of Significance: A New Manifesto for Teams, Seth Godin poses this beautiful point-of-vew attitude about staff turnover, a topic that every community-driven organization has to face sooner or later.

it’s easy to spot the downsides of staff turnover. If you’ve recently lost a valuable staff member, I don’t have to name the challenges you’re probably facing as a result.

But the alternative could be worse: You could have people working for you who really are not happy about it. Or who are only on your team because they can’t find anyone else who wants them.

Planning well for staff turnover has significant upsides:

• Folks who are not a great fit are more easily able to move on to a place that’s right for them.

• Your team is full of people who get your mission and feel fulfilled by the work you’re doing together.

• Your team and your mission continue running smoothly when the changes come (because they will come, sooner or later).

So:

Document your processes. Help your people grow. Let them see you care about them as individuals.

And when it’s time to let them go, you’ll be all the more ready to welcome a new and inspired member to your team.

All the best,
A.

Wait, our site is down?

Are you monitoring your websites to be sure they're up and running properly?

If you happen to notice that one of your sites is not responding, are you sure it's offline for real, or is it just unreachable from your local internet connection?

Here are two tools you can use — for free — to make sure your sites are up and running:

• Uptime Robot will send you an alert — by email or on your mobile device — if your site goes offline. At Joinery, we use this service to monitor all the sites we host for our clients, so we can react quickly if there's a problem.

• FreshPing lets you type in any web address to check whether it’s really offline for everyone. If it says your site is up and running, but you can’t access the site yourself, then it’s not everybody — it’s just you. Try reconnecting your wifi or rebooting your router. (FreshPing also appears to offer some kind of paid monitoring service, but the pricing is complex; and anyway, I recommend you go with uptime robot for that.)

You can read more about these and other tools on Joinery’s Resources and tools page.

All the best,
A.

Diversifying your funding sources

You already know the old standbys of funding for community driven organizations: contributions, membership dues, and grants are probably your bread and butter.

But there are other possibilities.

Today I spoke with a fellow board member at the local non-profit where I serve, and she mentioned an exciting idea we’re considering.

As an organization, our primary work is in offering free or low-fee mental health services for families in crisis.

We'd like to implement some additional treatment methods, some of which are relatively expensive and thus hard for us to justify financially.

But what if we could offer some of those treatments as a paid service to clients outside of our current demographic — people who can afford the service and want help before they're in crisis?

Could we offer that paid service with the understanding that it would help to fund an equivalent service for our free or low-fee clientele?

It's quite possible that we could.

Several smart minds are working on this as I write.

Here's the thing:

Just because we've always gotten our funding in one way, doesn't mean we'll always have to do it that way.

Creative solutions can help us further our mission, diversify our funding sources, and help more people in new ways.

It's not guaranteed to be easy, but with careful planning it can certainly be worth the effort.

All the best,
A.

The magic button

With a little practice, you can start to notice when your “system improvement” ideas are getting bogged down in feature planning without identifying the desirable outcomes first.

But it can still be hard to distinguish. After all, whatever you build will eventually consist of certain features and functionality, right?

Here's a question I sometimes ask my clients to help make the distinction:

Let's say I build for you a magic button. It will be ready tomorrow.

You won't really know how it works, but when you press the button, it will solve this problem.

What do you get out of that? And why is that important to your mission?

Those two questions represent your desired outcome and its value to your work.

And once you know those two things, you'll be able to build that magic button in a way that does what is needed within an appropriate level of investment.

That’s how you make improvements that really matter, and leave the alluring “it would be so cool” stuff alone.

All the best,
A.

It’s the story

I spoke recently with the Director of Development at a local organization, and I asked her how she would summarize her work.

She said:

"My role here is simple: Money in, stories out."

Here’s the thing:

Donors — like volunteers, members, and even staff — are surely interested in your cause.

But what moves them is not just the cause itself.

It's the stories you can tell about the impact you're making in the lives of real people.

Are you telling the right stories to the right people?

When you do that, the funding becomes a while lot easier.

All the best,
A.

Getting buy-in from your team

One of the biggest challenges in rolling out a new CRM or a new set of features is getting your team to buy into the plan.

Your team will have to invest a lot in the change. They'll need training, and they'll need to change their way of working to fit the new features.

That's not easy for them. And they know it.

The best way I've ever seen to overcome this is pretty simple (though not always easy or obvious):

Start with their pain. Understand how your current systems are limiting their work. Name the specific pain points they’re experiencing now, and demonstrate how the new system will solve those problems.

For example, they may already feel that they're

• Wasting time on boring and tedious tasks, or

• Dealing with too many complaints from members, or

• Unable to get the information they need to do their jobs well, or

• Struggling to hit their monthly goals.

Naturally, your whole team feels a duty to do whatever is best for the organization, so you could just try explaining to them that your changes “are awesome for all of us.”

But we're all human, and what's best for the group is not always enough to make us feel good about change. Because change is difficult.

If you can show them how your changes will help them, they're much more likely to be excited about what you're building for them.

All the best,
A.

CiviCamp Montreal: First presentations announced

CiviCamp Montreal is just four weeks away now, on February 28.

And the organizing team has accounced the first presentations lined up for the day. Whether you’re just getting started with CiviCRM or have been using it for years, it sounds like there’s a lot of value here for you.

Very cool: The event this year includes an Ask an Expert clinic, so you can sit with an experienced CiviCRM specialist who’ll help answer any questions you may have. (See more below.)

Here’s what’s on the agenda so far:

• CiviCRM Core Team and Community Council Update
  A review of recent developments and upcoming plans for the CiviCRM Core Team and CiviCRM Community Council.

• How to use CiviMobile
  CiviMobile is a native mobile application that allows CiviCRM users to leverage the combined benefits of CiviCRM with their smartphones.

• Overview of Search Kit and Form Builder

  SearchKit and FormBuilder are recent additions to CiviCRM that make a huge improvement to how you can get data into and out of CiviCRM.

• Custom shopping cart for events

  How to leverage Drupal Commerce's powerful user experience with CiviCRM's data structure and reporting capabilities for event registration management.

• How to use the CDN Tax Receipt extension

  A powerful extension used by over 1000 charitable organizations across Canada.

• Case study on a CiviCRM WordPress implementation

  Learn about features and processes implemented with CiviCRM and WordPress for a French nonprofit organization.

CiviClinic: Ask an Expert

This is a series of open question-and-answer sessions led by experienced CiviCRM specialists who’ll help you to solve a CiviCRM issue you are experiencing or just to ask questions.

Specialists will include CiviCRM core team members and CiviCRM partners from US and Canada.

Are you going?

All of the above sounds like great value to me.

I myself have a scheduling conflict so cannot make it this year. But if you can make it, I strongly encourage you to consider the investment.

Early pricing ends on February 10, so if you’re going, now’s your chance save a little. You can (and probably should) register now, right here.

All the best,
A.

Problem definition

Last week I spoke with a gentleman who’s looking for someone to build a new CRM for his team.

It was a great example of how surprisingly difficult it can be for folks like you and me to define the problem we aim to solve.

On our first call, I asked him to name the business goals he was trying to achieve and not just the features he was looking for.

So he put thought into that, and we met a second time.

He had a lot of ideas on what the solution should look like: Lists of workflows to improve; flowcharts of processes to support.

But he had not named any actual business outcomes: Headaches he was trying to solve; opportunities he wanted to capture.

We talked for a while, and I pointed out that under “Goals” he had listed a few outcomes, but they were all phrased in terms of a solution, not in terms of a problem.

There was a wonderful pause in the conversation.

And after a few moments of silence he said, and I quote ...

"Oh. Right. I'm not the solutions expert here. I'm the problems expert. Dang it!"

Jackpot! Now we could get down to discussing his real problem. Only after that can we discuss solutions that truly matter.

Here's the thing:

Defining the problem is surprisingly hard.

It's definitely not as fun as dreaming up a solution.

But it's a critical first step, if you want to build a solution that solves problems that actually matter to you.

You can be the solutions expert later, or find someone else to fill that role.

But first you must be the problems expert.

All the best,
A.

Problem awareness

If the first part of defining a problem is awareness ("No data, no problem”), it's worth asking:

How are you becoming aware of problems in your systems?

• Are you asking your staff about pain points they experience?

• Are you making it easy for your constituents to report any difficulties they may have?

• Are you tracking error messages that may appear at various points in user workflows?

• Are you monitoring and measuring all of those inputs to make high priority issues more visible?

Of course, there’s an alternative: Just a wait until an issue becomes so painful that it has to be addressed immediately. But that's never fun.

Here’s the thing:

Proactively gathering information puts you in a position to address any issues or opportunities before they become urgent.

How are you making that happen?

All the best,
A.

No problem, no project

We've established that if you don’t have information on a problem, then you really don't have an actionable problem at all. ("No data, no problem")

The corollary to this is that if you don't have an actionable problem, then you don't have a worthwhile project either.

No problem, no project.

This may sound trite and obvious, but it's remarkably common for folks to start working on a project without having defined the problem they're trying to solve.

You've probably done this. I know I have.

You can spend hours on it, or days, or more — without ever having clearly identified the pain we're trying to solve, the opportunity we're trying to secure, or the actual value of getting it done.

Why do we do this?

I suspect it's just because tinkering with things is fun.

In some ways it's a lot more fun than gathering data, clarifying the problem, and estimating its value. Those are all so technical it's almost boring.

But you know what's really fun?

This: Working to solve a problem that you know is important, implementing a solution within an appropriate budget, and celebrating that measurable victory.

That's actually way more fun than fiddling around for a month on a problem you haven't carefully defined.

All the best,
A.

No data, no problem

There are countless problems in the world, and you probably run across dozens of them everyday.

But you can't solve everything. You'll have to pick some things to fix first, plan to handle some later, and leave the rest for "maybe someday."

So how can you tell if a problem actually merits your action, or even your attention?

1. Awareness: First, you must be aware of it. That seems obvious, but I'll touch on that later.

2. Definition: Next you must be able to define it. What exactly is the pain you're trying to solve? (Not the cause of it, just the pain point.)

3. Severity: Finally, you need to know how serious it is, so you can assign it a priority.

Say, for example, some members are having trouble registering for events.

• Awareness: If they're having trouble, how likely are you to find out about it?

• Definition: What problem are they actually experiencing? Are they not finding the event registration page? Do they not understand some questions on the registration form? Are they seeing some error in the registration process?

• Severity: How serious is this? How many users are having this particular problem? How often? And more importantly, how much does this impact your mission or your goals?

Without these three things, you don't really have a problem you can solve.

It may exist in theory. It may even exist in someone's experience.

But it doesn't exist in a way that you can respond to it.

And if you can't respond to it, it is literally not worth thinking about.

Although, if you are thinking about it, it might be worth gathering the information that would actually make it into something you could act on.

All the best,
A.

CiviCRM Montreal: February 28!

CiviCRM Montreal is just around the corner.

Though I've got a schedule conflict and cannot make it, Joinery is an even sponsor, because I very much believe in the value of these in-person events.

I've heard from the event organizers, and they're planning a wide variety of presentations targeted to an end-user audience such as executive directors, fundraiser or event managers.

These presentations are aimed at helping help you:

• Better understand how CiviCRM can facilitate your daily operations and create more efficient workflows.

• Improve your current use of CiviCRM.

• Learn from recent case studies, best practices, pointers to extensions or other resources you can leverage.

So this is not a "tech-fest" or "geek out". It's for folks like you who want to leverage CiviCRM in accomplishing measurable goals in your organization.

I encourage you to make plans to attend, if you can. Learn more here: https://civicrm.org/events/civicamp/montreal-2024

All the best,
A.

You still have it when you give it away

You’re a hard worker and diligent learner.

You’re always looking to gain some new knowledge that will help you master your systems and reach your goals.

And you try to fill your team — small as it may be — with folks who have that same drive.

So, while you’re busy learning and improving, who else is gaining from your knowledge?

Are you sharing it with your team, in a way they can easily use it?

They’re as driven, and curious, and goal-oriented as you are.

Wouldn’t they be happy — and more effective — if they could access what you’re learning?

Funny thing, though:

Everything you've stored in your brain is still hiding there, unless you've recorded it somewhere and shared it with someone.

Skills and knowledge are like gold for your team. If you’ve got it, find a way to share it. Unlike actual gold, you don’t lose it when you give it away.

All the best,
A.

Win or lose

This weekend I competed at a local sports tournament.

I won about as many matches as I lost. Some players lost all their matches, others won them all.

Sure, everyone felt great when they won and disappointed when they lost.

But every single player at that tournament had this in common:

Win or lose, they went back and re-watched their videos to learn more about what they did right and what they did wrong.

At least, I hope they did.

Because that's where the real win happens: in long-term improvement.

Here’s the thing:

Hitting your goals is nice. But analyzing and improving your systems will position you for continually improving your results.

That's the long-term value of setting goals, whether you win in the short term or not.

All the best,
A.

Where to?

Whatever road you’re on, wherever you’re starting, the journey is better when you know where you’re going.

It's more effective, it's faster, and it’s more enjoyable along the way.

Sure, sometimes it’s nice to just wander about, but that’s not a journey. It’s just wandering about.

If you’re working hard to accomplish something good, it’s worth taking the time to define what you’re really after.

If you can get there, then you can decide what to go for next; and if you don’t quite make it, you’ll have some good context for understanding what stopped you, so you can do it better next time.

All the best,
A.

In it for the income?

If you’re a leader in a community-driven organization, I’m guessing you’re not in it for the income.

But I bet you are — at least a little bit — in it for the outcome: the impact you make in the lives of people you care about.

What outcome are you hoping to see? And what transformation will you need to make in your organization to make that happen?

If you’re focused on that, getting what you want is just a matter of time (plus a little consistent effort and iterative improvement).

All the best,
A.

Goal-setting is a practice

Setting and achieving goals will probably require you to hone your skills, and maybe learn some new ones.

But it turns out setting goals is a skill in itself.

And like any skill, it only gets better with practice.

All the best,
A.

Cold calculation: cost vs value

Say you’re considering a new project or improvement to your systems.

And let’s assume you also want to get a healthy return on investment so as not to waste precious resources.

So you’ll have to consider both the expected cost of this project and the expected value of completing it successfully.

Here’s a good reason to consider the value first:

As human beings, we are generally — and unfortunately — not as always honest with ourselves as we think we are.

There's quite a bit of truth behind the saying that people buy based on emotions and then justify that purchase based on logic.

It's just part of who we are as human beings.

And usually we don't even notice it.

So let's say you calculate the cost first. Now that you have some number in mind representing the cost, it's very easy to let that influence your calculation of the value.

The more excited (emotionally invested) you are about this project, the easier it will be for your brain to inflate the expected the value until it's higher than the cost, in order to justify the project.

On the other hand, if you calculate the value first, there’s no such temptation; since you haven’t spent a moment on estimating the cost, there’s just no way for that to influence your value estimation.

Here’s the thing:

Our excitement and emotions are powerful things. They can be one of the most effective motivators to carry us to completion when things get tough.

But when it’s time for cold, rational calculation, letting them sneak in is usually a mistake.

Do what you can to keep your business decisions objective and rational. Calculate the value before the cost.

All the best,
-A.

Consider the value before the cost

When you consider starting a new project, do you like to think of the cost first, or the value?

Naturally, before undertaking a new project you’ll want to consider both cost and value. If the value isn't worth the cost, you can just avoid wasting the resources.

But for me, something odd happens at this point:

Before I spend even 2 seconds thinking of the value, my mind leaps into a calculation of the cost. And that leads quickly into a flurry of ideas about how I could get it done:

• Who I can hire, and how much that might cost

• Technologies I might use, and the ease of maintaining them after launch

• All the features or systems I'll have to build, and how much of my own time that might take

Frankly, that's a lot of fun to think about.

But all that planning takes time. And that time is an investment all by itself.

And if I go that route, I'm making that investment without ever once thinking about the value of what I'll get at the end.

So I've learned to stop doing that.

The better way:

First I think about the value.:

If I complete this project successfully, what will it get me, and what is that worth to me?

In dollars, or hours saved, or in some measurable unit, I want a specific number that tells me the value of this investment.

Only then is it time to think about cost.

There are two reasons why this way works better:

1. Expected value determines maximum investment.

As fun as it is to dream up the “right” way to solve a problem, the truth is there are a million ways I could do it.

By putting a real number on my expected value, I can put a realistic cap on what I'm willing to invest.

That allows me to focus on solutions that will get me most or all of what I want, within that cost, instead of some “ideal” solution that may cost far more than the value I'm expecting.

2. Cost analysis is an investment in itself.

The lure of building solutions in my head is so attractive that it's easy to begin, even if there turns out to be zero measurable benefit.

It's so easy to run off and begin something that just seems like it would be nice to have.

But by exerting the discipline of calculating the benefit first, I can quickly decide if it's worth the time to workout even a rough sketch of a solution.

Here's the thing:

This isn’t just a story about me.

I see the same “rush to solutions” mindset in the words and actions of my friends, colleagues, and clients.

Maybe, if you pay attention, you'll even see it in yourself.

Don't let it get you.

Put a number on the value first.

And only then allow yourself the fun of planning the investment.

All the best,
A.