There've been a lot of changes in The Raiser's Edge 7.91 and we know there are a lot of questions. Here are a few we've been hearing a lot.

One of the first changes you'll notice is that we've made changes to passwords. After you update to 7.91 or higher, you'll have to enter your password using all capital letters (e.g., ADMIN1 instead of admin1. After you log in using all capital letters, we recommend that you change your password by going to Edit, Change Password. If you don't change your password, you'll have to keep using all capital letters to log in. The password changes are a requirement of the Payment Card Industry Data Security Standard (PCI DSS). Check out Knowledgebase solution BB608912 for more info.

Another big change is the 15 minute inactivity setting, which is another change made in accordance with PCI DSS, which requires users to re-enter passwords when a session has been idle for more than 15 minutes. When someone is locked out due to inactivity, processes like reports, mailings, exports, and queries will continue to run, and the user license will still be used. Knowledgebase solution BB620558 has more on this setting.

The most significant change is that The Raiser's Edge 7.91 now integrates with the Blackbaud Payment Service (BBPS) to store credit card numbers. Credit card numbers will be replaced with reference tokens and credit card information is kept in this secure, PCI DSS-compliant environment and only the last four credit card digits will display in The Raiser's Edge. When you process credit card transactions, your software will connect to the BBPS service. The reference token in your database will summon the stored credit card number to be used in the transaction.

Check out the Version 7.91 FAQs and post any questions you have here! I'll be answering questions all day

Was there an official Software Update Notification sent out to Raiser's Edge users announcing that 7.91 was available?  I don't remember seeing an e-mail like I normally receive for any RE upgrade.

 Thanks!!

Hey Gayle,

We did not send the regular Software Update Notification for The Raiser's Edge 7.91. With all the changes in The Raiser's Edge 7.91, we anticipated a lot more questions with this release. To make sure that these questions are answered promptly, we are staggering the notifications so that everyone doesn't receive them at once. Check out the notification - it has loads of useful information!

Great first question, what else do y'all have on your minds?

I do not expect the changes to be well received.  I think the 15 minute inactive thing is totally unnecessary and I cannot fathom the advantage of it. 

I work for an organization that has 18 Raiser's Edge sites, each with their own Blackbaud site ID.  My role is to provide RE / Blackbaud support to all 18 sites.  Since the 7.91 Software Update Notification is being staggered rather than globally sent to all clients at the same time, is there a way for me to find out when each our our 18 sites will receive the 7.91 notification? 

Tricia Bouton 

Beth: Thanks for your feedback! The driving force behind the timeout feature is security, which is at the heart of PCI DSS. You may be interested in checking out this discussion as well.

Tricia: Even though the message is staggered, The Raiser's Edge 7.91 download is available for all of the organizations you work with. Is that what you're concerned about?

Keep the questions coming!

I have not wanted to update to 7.91 and, after reading your post, I REALLY don't want to update. Someone mentioned this before, and I agree, that these changes should be made available in RE, but optional. We don't keep any credit card info in Raiser's Edge, so I don't feel like I have deal with these nuisances to comply with regulations that just don't pertain to the information in my database.

Two questions:

1) I assume that all subsequent updates will include the changes in 7.91, so eventually I will have to do this upgrade.I hope that BB implements the optional version as mentioned above.

 2) Regarding passwords: we use WIndows authentication for RE login...how will this affect that? Will that just not work anymore, if someone's Windows password isn't all caps?

Douglas Clinton:

Another big change is the 15 minute inactivity setting, which is another change made in accordance with PCI DSS, which requires users to re-enter passwords when a session has been idle for more than 15 minutes. When someone is locked out due to inactivity, processes like reports, mailings, exports, and queries will continue to run, and the user license will still be used. Knowledgebase solution BB620558 has more on this setting.

 Unfortunately, plugins do NOT continue to run, even if they were built by BB (We're using the Duplicate Constituent Merge Utility for mass merges, and that cuts out after 15 minutes).  As we're doing a massive DB integration in 6 weeks, we're implementing a hardware solution where the mouse continues to move on a turntable so as to mimic user activity.  (yes, we will go that far to make it work).

 I've been discussing this with a tech, but I think it's important to mention this on the forums as well; Hopefully this will be fixed soon.

How does this affect membership scanning.  Will a person still be able to scan in if the Raiser's Edge locks and if sounds are set up for drops, lapsed, etc, will they still work.

Great to see all the traffic on this forum thread!

Nicole: To answer your first question, subsequent versions will include the changes in The Raiser's Edge 7.91. To make our software PCI DSS-compliant we aren't able to make the inactivity timeout optional. Your users who use Windows Authentication will not be affected by the password changes.

Kirk: The customizations team is aware of the issue with custom plugins, and is working to address the issue.

Beth: The membership scanning functionality will not change. Users will need to unlock The Raiser's Edge to keep scanning.

Keep the questions coming!

Maybe this can be addressed at a different level in the security rights.  If we as users of RE do not use the functionality that makes the PCI DSS-compliance necessary we could be provided with the opt out option for the timeout.  We currently do not use RE to store CC # and do not plan to in the future.

I agree with Jackie, we do not use RE for this type of information nor do we expect to do so in the future.  For us this new feature will cut productivity.  Any chance BB is listening to us and will work to make this an optional feature for only hose companies who need to be compliant with PCI DSS?  Plase? 

I second that plea for optional feature capability.  This change will be extremely burdsome for us.

Thanks for the feedback, everyone!  We understand that this change will be an adjustment for a lot of people, but for The Raiser's Edge 7.91 to meet the PCI DSS, we are not able to make the inactivity timeout optional.

I'll second (third, fourth) those unhappy about this change. It's surely not impossible to have a security setting which would disable both the ability to store credit card numbers and the 15 minute time out, so you can't have one without the other but those who need neither wouldn't have to have them. And not working with plugins is just ridiculous!

Has anyone at Blackbaud actually bothered to do any investigation of how many organizations using RE actually store credit card numbers? I would guess it's a fairly small minority - and yet everyone is being inconvenienced for this.