A marketer’s data is their most valuable asset, so protecting data is vitally important. Eloqua’s Contact Level Security (CLS) is a data security label for contacts that ensures only the right people can access the appropriate contacts. Data Security labels are valuable because they…

• Prevent the wrong people from accessing data they shouldn’t.
• Prevent the wrong contacts from being marketed to (emailed or edited)
• Prevent different teams in Eloqua from stepping on each other toes
• Help multiple in-house marketing teams using the same Eloqua Instance collaborate better

Contact Level Security is mainly for companies that have many in-house teams inside Eloqua and that have a lot of contact data or an Enterprise org.

Eloqua Contact Level Security (CLS) Dictionary

Before we go any further into CLS, let’s establish some common terminology:

User: Anyone that has a Eloqua login, or who can create assets and activate campaigns.

Contacts: Any available email-able record in Eloqua, usually a prospect or customer. Contacts can have data labels associated with them.

Security Group: Controls Eloqua access to functionality assigned to each user inside applications.

Labels: Controls access to contacts by tags/labels. Can be applied to Security Groups. Only Eloqua users that have assigned labels can view those specified contacts.

The 8-Step Guide to Implementing Eloqua Contact Level Security

For Eloqua CLS to work, all contacts in the Eloqua instance need to have contact labels. Contacts without labels will be “naked” for anyone to see inside Eloqua.

Naked contacts or contacts without labels can be quick-labeled by having a default contact label during net new creation to the Eloqua database. In other words, the default label will serve as an interim label until the appropriate label is stamped. But when it comes down to it, appropriate labels are the end goal, and knowing how to implement them is key to running a well-oiled marketing automation engine.

Step 1: Understand your data quality and define contact labels that need to be protected. You will be highly limited by your data quality when it comes to how many labels segments you can break your database into.

Step 2: Iron out the users or what teams will get access to what contact labels. And assign security labels to these contact groups ( Setting→ Users → Contact Security → Assign Labels).

Step 3: Map out the flow of level security groups in the Program Builder, which will stamp the contacts label onto the contacts.

Step 4: Create a test Program Builder and check that it’s stamping appropriately. This program will need a program feeder and should always be on so that net new contacts to the database are always being fed into it. An example would be a Shared Filter Criteria inside the feeder (see below).

Make sure to have an initial step in the program that removes all contacts labels, too. That way, if a contact is brought in a second time, the contact record won’t get stuck with legacy labels but will use the correct ones.

Initial Step

Remove All Labels (default action)

Step 5: Run test contacts through your program builder to make sure they are being stamped correctly.

Step 6: Once you have successfully completed your CLS program, you will need to run all contacts through your program and make sure you have the program builder feeder turned on. You will have to create a one-time feeder for this. You might have to break it up into small pieces because if you load over 10 million contacts into a program at once it will probably crash.

Step 7: Create a “Default Label” upon net new contact creation that will serve as an interim label while contacts are being processed.

Step 8: Make sure all contacts in the Eloqua database have a CLS Label, and familiarize your marketers with CLS to avoid any confusion. You can check contacts by label at (Setting→ Users → Contact Security → Contacts By Labels).

Easier than you thought it would be, right?

Eloqua Contact Level Security Tips

CLS will affect who can access contacts in Prospect Profiler, Eloqua APIs and all Eloqua users of the Eloqua System. So make sure you take this into consideration before implementation so that certain key personnel don’t lose access to contacts. This happens fairly often during big implementations, and is one of the most common problems I end up firefighting.

Contact Level Security Challenges

Of course, no CLS implementation is as easy as it looks on paper. Unforeseen challenges are bound to crop up, and you should be ready to deal with the most common ones.

1) Bad data quality: Bad data quality inside Eloqua makes slicing contact data into different segments for labels very challenging. Eloqua CLS works most efficiently when contacts can be automatically assigned labels by contact field or other attributes. Bad data quality prevents you from breaking down labels by region, and important contacts will disappear from many regional demand centers.

Solution: Don’t create too many contact labels with bad data quality or your CLS implementation will fail. Be aware of your data quality and map out your desired security labels accordingly. If you want CLS to work automatically and not manually based on contacts that enter the database, make sure you clean up your data quality first. Manually labeling contacts on Excel or by attribute will not work and is definitely not scalable in any enterprise organization.

2) Enterprise learning curve of marketers: Once Contact Level Security is implemented, many marketers struggle with understanding what CLS is and often think that things are broken when the system is working fine. For example, when a net new contact is created and a marketer doesn’t have the default label upon creation, he or she will have to wait 20 minutes for the contact to show up. Or a marketer uploads 100 contacts into Eloqua, then wants to email all of them. The marketer can only see 95 contacts due to bad data quality, and wonders if CLS is working correctly.

3-Part Solution:

• Create training documentation and familiarize marketers with what CLS is and how it works at an enterprise level.
• Host basic informative training sessions for Marketing to understand CLS so they don’t get confused. Hiring a dedicated best-practice trainer and troubleshooter may be worthwhile.
• Answer Q/A email threads that arise and share answers with the community.

3) Processing and overhead: Net new contact uploads will take time to be seen in the system and will show up at different times for certain teams that don’t have the default label upon creation.

Solution: Govern and coordinate thoroughly whenever uploading massive contact lists. I cannot overstate the importance of this precaution. When you’re dealing with contact lists that number into the millions, you can’t afford to make even small mistakes.

Are there alternatives to Contact Level Security?

Good question! An alternative to CLS is to deploy multiple instances of Eloqua for various teams. Many enterprise organization using Eloqua have successfully deployed multiple instances of Eloqua, but there are certainly both pros and cons.

Advantages of multiple instances:

• Flexible in deploying multiple instances if it’s under your contract.
• Less of a chance of wrong contacts being marketed to or accessed.
• Prevents opt-out loss. For example, someone who opts out of one communication that affects your ability to deliver another type of communication (e.g, a B2B contact that is also a Partner Contact).

Disadvantages of multiple instances:

• Extra pipework for integrations between multiple Eloqua production instances and other applications.
• More pipework for setting up data flows.
• Additional admin work between instances required for setup.
• Can be a strain on IT resources or the team/admin that manages Eloqua.

The Bottom Line

Eloqua CLS can be very helpful when you have many marketing teams under the same roof. CLS makes sure that only the right people can access the right contacts and that there isn’t a bad email marketed to the wrong contacts.

Having CLS automated is absolutely vital to successful implementation. You want your contacts automatically assigned labels based on certain contact attributes. Manual identification of a contact’s appropriate contact level security label is not scalable and will not work at an enterprise company.

Skip CLS if you are startup or only have one team using Eloqua. But if you’re an enterprise organization or a company with a lot of data, you require quality, dependable data protection, and you’d be selling yourself short without CLS.

Additional Resources

Eloqua Contact Security and FAQ