So hi, hi everyone. So my name is Herve and I'll be talking to you about the data at rest encryption How is it? implemented in MariaDB my scale and the preference server, so we call you so Main goal of this talk is to provide like Well all the features that you can get encrypted like first why why use it? What's getting written to disk what's getting and not getting encrypted a bit about key management and how to do backup So what do we mean when we say data at rest data at rest in information technology means Inactive data that is stored physically In any digital form, so it's like databases spreadsheets offset backups so Most of the data That's collected It is being collected because it has some value So even if you're just holding the data, it has like some something sentimental value. I guess so So data at rest encryption or The other term is that I've seen is like a transparent Data encryption it provides a like a layer of security For the files that are stored on the on the disk This means like if your data gets stolen Or someone that gets like access to a server even if he They copied the data. They still can't can't use it without the without the encryption. So You know that or like maybe you have like you know what you don't want to like the Center operators If you have like a hosting somewhere, you know, you don't want them to get the access to the data. So so this is like getting more popular with the GDPR and Even like in the like past Like in the last few years you've seen like lots of data leaks from the from the databases So So what's really what's getting written to this? So some table space the most familiar file is IB data one. So it contains double right right buffer change buffer and data dictionary so under table space most famous files are undo zero zero one and undo zero zero two and You can have like your own like Is a red table spaces File per table space. This is if you're using like in the bee fire file per table option Read the log I do log files zero so then general table spaces and Temporary table spaces. So other log files these are like Analog General log audit log if you have the audit log plug-in So what's getting written to this but it's not encrypted encrypted. So currently data address encryption only covers In a DB So other storage engines are not supported like my rocks. Toku DB my my ism Soqware log, general log, analog are not also being encrypted audit log is not encrypted But as always we have like exceptions. So Aria Storage engine is in Maria DB if you're using my Maria DB is getting encrypted. It can be encrypted But only the storage engine not the area looks so audit log so in the conserver and Maria DB audit log plug-in is like a community based it's like free to use but it's not there is no option to that you can like Encrypted but in my scale 8 audit log plug-in is enterprise feature and They also Have like an option to to encrypted so So key management so in order to enable the the encryption We need to configure the cell to use the Sounder key management plug-ins. So these plug-ins are responsible for both the management of the encryption and and for the management of the encryption keys and the actual encryption and the encryption of the data, so So there's like a One one one important thing is like All of them like support multiple caring plug-ins, but Only one caring plug-in should be enabled at a at a time. So Enabling like multiple caring plug-ins is like not supported and it can result in the data loss So and like the the real thing is like the server won't if you like enable multiple server won't won't complain. So So During plugins in Maria DB We have like three file key management. It's like It's like a basic key management plug-in it reads the key from the plain text file So and Maria DB also offers like they have like a nice tutorial on how to encrypt this encrypt this file So it's not It's not readable by users. So Ah AWS key management so You can use this with the AWS key management service. So The ePeri key management. So I got this from the documentation Maria DB documentation, but when I got to the links of the ePeri It shows like 404. So I'm not sure if it's like supported or not So Preconocer also provides caring file plug-in. So it's like a plain text file, but Currently, it doesn't work If you encrypt it so it's not it's only like a plain text file. So Because I also provides the HashiCorp carrying load plug-in. So if you use like HashiCorp's vault You can store the the keys there. So Yeah, so my skill also provides the caring file plug-in But they have like few more. I think like five or six, but these are only available as enterprise so so like so when you encrypting the production data, you need to make sure that He you don't lose the key. So if the key is lost You get you lose all the access to the files. So they're good but also I've seen this in like in a few cases people backup the key With the data. So it's like, you know, working your house But leaving the key in the in the door or so that's not a not a good idea is also so on the top that's encrypted in MariaDB system table space encryption So it stores the double double right buffer and the change buffer It can have like one or more data files, but the the most popular ones is IB data. So It's encrypted in MariaDB since 10.1. So it was G8 in October 2015. So it's like Like to four and a half years. So it's also available in pre-conserve Five seven country is Experimental. So this is the in a dbc stable space encrypt variable can be used to encrypt it. So There we are also available in Pre-conserve 8 or 13 but not available in a toe In my scale later. So there's like an important limitation with this So You can use this only when you are like initializing the database So it's like you cannot convert the system table space from the encrypted state to the unencrypted I mean unencrypted or vice versa. So if conversion isn't like needed You create a new instance with the initialize You set up the inner db tables table space encrypt in your code file and then you like start the service and then you move your data To that instance, so my scale system table space encryption. So This is like this is like a ito specific In a toe mice in my scale a toe and precursor a toe System table space my scale system table space Contains the my system database and the data dictionary files. So so To enable it you can just do the auto table space and set the database and So yes, so this is like not available in the Maria db because Maria db is like Doesn't have doesn't doesn't separate the my scale system table space from the system table space So under the under table space encryption. So these are like most popular files are undo zero zero one undo zero zero two from the Also available in Maria db. So like most of these features are like available in Maria db for like four years. So in precursor country Experimental you can use this variable to do it but g8 in my scale eight and G8 in precursor so That's all limitations when you use this so When it's like once you enable it You can't actually disable it. So I mean you like you'll you'll always need the caring file to be caring plugin to be loaded because What once it's turned on The server can't guarantee that there are not any privacy record in the in the under table space. So Like this is not something we want to test on your like production so File the table space. This is one like One of the earliest Features available. So it's available in 5711 my scale And same in pre-connoisseur. We got it by the option merge. So how to use it? So really log encryption so like if you like encrypting the inner db tables and Don't have like encrypted real log. So data written to the Encrypted table still may be found in the read the log. So So, yeah, okay, you know table space Also available since In like this is like g8 most g8 feature as well. So You can use it by creating the table space Something at just, you know, at the encryption option on so Temporal table space encryption. So this one is like fun. So available also in Maria DB a while ago with these two option In pre-connoisseur 57 it's still still experimental These are the variables that you can use in 80 Available in it's like g8 in pre-connoisseur, but this is still not available in the in the in the my scale so These are like what was getting encrypted here. So it's like it's like the IB temp file This is the file that gets created on the on the server side. So And the temp files What's covered? It's like file sort That's like for example when you want to select with the statement like this case like a scale big result and with in hints like and like binary log Transaction caches and group application cache. So a replication so Money lock contains the sensitive information, right? So That's used to copy data between the service so In other words, so like If you get if you get everything encrypted, but you don't encrypt the belong you someone can still see all of your all of your data Yeah, it sucks. So but the thing is like This is only like You know is being encrypted on the disk. So you still need to do the like TLS if Set up the TLS for the application to get the data encrypted across the network. So Yeah, so in case so when the Yeah, one of the things if you do the You can encrypt this like this this feature encrypts both of the binary and the relay lock so if you if you set the feature on and Even if you don't have the binary logs on by default early logs will still get encrypted So once you get those encrypted the problem is like like not the problem like Limitation is that my scale be look cannot read them directly. So but you can use them It can you can read them by setting up the read from remote server options. So But this option like requires the server to be running. So In 5.7 and Maria Maria DB 10 If you keep the be look it requires the server to be restarted for Changes to take effect take effect in 8.0 in both my my scale my scale and Precran server implementation once you set the binoc encryption Server Automatically rotates the log and the new logs get encrypted So backups You can back up the encrypted data. That's probably a good feature. So you can use Picon extra backup to backup the my scale and Picon server Maria backup for Beking up the Maria DB stuff and you can use my scale dump to backup for All three of them. So the thing is like with my scale dump if you do the backup it won't be encrypted by default so so How does this look like so encrypt all things in Maria DB so features this is like the nice one so how to set up the how to encrypt the file key management and is like In concern, it's like this is this is the example with the HushCorp HushCorp world. So URL secret All the features in My escalate I use the king file. So and this is what but let's get encrypted or not All of them so The Maria DB team takes the crate for leading the way With the data-addressing encryption most of the most of their features have been here since 10.1 release and That's like as it like that's like four and a half years probably more so Nothing that's important is like all these features are disabled by default So you have to set up the hearing file your hearing plug-in and enable each each of these so Also like each of these have to have like a special option that you can that you need to set So it get so they get encrypted. So come to it.  That's still nothing so So in the Period of like a year year and a half so This this table Complete completely different except the Maria DB things But the PS the concern 5-7 Sound the feature features were available, but for only experimental and From my scale it can only file per table five file per table table space encryption and we do on the log encryption. So So like if you want to know how the sausage is made There is like a talk from my colleague Robert in the UA to room He will have like a more detailed talk about implementation of this of this feature in the my scale and precondition This is like more internal-oriented talks Even if you don't want to attend the talk you can watch the recording if you're interested in this These are the resources and thank you Questions Yeah, so regarding the performance I Haven't done any benchmarks, but from the like money I've seen from the money DB documentation They say like three to five percent and I've seen someone like around six. So Okay Yeah, you can you can I didn't tell this because you can like rotate the keys. So there is like a separating Depends on the implementation I mean, is it sorry? Yeah, so the thing is like it depends on the on the curing plugin you are using so Yeah, any more questions So, yeah, so the question was how does this complain compared with the Falsitum encryption so you can do that, but this is like more granular granular so you still have the encryption This like makes sense if you're like You're if you're like in the hosting environment So you have like someone that get needs to get the access to the data the other data That's not the my scale like my scale data. So that's the separation So so you can get you know, you can manage all the stuff, but you can you can't see the the data Okay, thank you


Welcome everyone. My name is Susan Hope Bard. Welcome to our webinar IT Staffing. Who are you going to call? And today we do have an exciting and fun filled presentation brought to you by Sam Chenkin at Tech Impact and Frank Babbitt here at TechSoup. So before we get started with the formal presentation, I did want to go over our ReadyTalk platform. This is simply our webinar platform. The chat box in the lower left hand corner is where you can chat all your questions. There is really no need for you to raise your hand. You can simply chat in a question at any point in time. And I will queue those questions up for Sam or Frank to answer during the event. Hopefully we will also have some time at the end for question and answer. All the lines are muted. If anything happens and you lose your Internet connection, you can simply reconnect using the link that you got in your confirmation email or the reminder email today. If you lose your phone connection, if you have called in by phone, you can simply hang up and dial the number that is displayed in the chat area. As I mentioned, we are recording this event. This webinar archive will be made available to you on the TechSoup website along with all our past webinars. I will be forwarding out an email likely a little later on today with the recording and the PowerPoint presentation so that you can review this with other staff members or share it with colleagues. Once the archive is available, you can also see that on our website or our YouTube channel. You can also join us and tweet using our hashtag TSWebinars. Just a brief introduction to our presenters. Sam Chenkin is our main presenter today. He is the Tech Impact. Sam is an integral part of a lot of the content we develop and deliver to you out there in nonprofit and library land. He is very well-versed in all types of IT, staffing, and also technology including we were talking about SharePoint and Microsoft Cloud offerings. So you may have heard Sam speak before. We also have Frank Babbitt here from TechSoup and he is going to be talking about some of our new programs that we offer to help you out there in nonprofits and libraries. And I'm Susan Hope Bard. I'm the Training and Education Manager. I'm here simply to facilitate our presenters and to help get your questions answered. So it's important that at any point in time during this event if you have a question you do chat it in. Sam is usually very responsive. He kind of keeps an eye on the chat box and he pauses from time to time to get questions as well. We're here for you. This is your time so we want to make sure you use it wisely. We're here, actually Frank and I are here in San Francisco and Sam is joining us from Philadelphia. We'd like to know where you are. So let's practice using the chat box and tell us what city and state you're joining us from or what country you're joining us from. And as you're doing that, oh, Indiana. Great. Thanks Erin. Connecticut, LA, New York City. Thank you. We've got a few folks from Pennsylvania as well. Great. Ohio, Oregon, lots of places. All right, welcome everyone that's joining us today. We are going to do our first poll before I turn it over to Sam. We'd like to know how you identify yourself within your organization. So what role that you see up here on your screen most relates to what you do? If you could take a moment to go ahead and plug in which one you can continue to respond, and you can also see all of the responses as people are clicking them. So it looks like a lot of you are IT staff, 50% of the folks that responded so far, great. Great. A couple of managers. Okay, I see some people, librarians, go library. Administrative assistance, office managers, great. Great. All right, I'm going to give you five more seconds to respond. Five, four, three, two, one. And I'm going to close the poll. So it does look Sam like we have more than 50% of our audience, our IT staff. However, we do have probably about 40% of folks that are just outside of that. And then a couple folks have indicated that they're librarians or administrative assistants. So that is our audience today. And I'm going to turn it over to you now. Take it away. Thank you, Sam. Sam Good. Thank you. Okay, hello everyone. So today we're going to be talking about IT staffing. Is it advancing to the next slide? It is. It's not on my screen. Okay. You may want to refresh your screen. Right now it is your picture and your title. Always something. Okay, I'm going to do that. Always something. Okay, you're sharing your screen? I'm going to try now to go back. Okay. Sometimes these things happen, folks. Even during the practice everything worked fine. But yes, the screens are blank right now. Sam should be exiting the stopping sharing. Stop sharing. Do you see? Everyone should now see Sam's picture and his title. Just a brief description. Yes, good. And the other thing we could do, Sam, is if you have your PowerPoint open then you can follow it on your PowerPoint and I can just arrow through the slides as you go through. I'm just going to go ahead and reconnect here. Okay. So as we're waiting and Sam's reconnecting a couple of other things, we've recently produced a couple of video logs with Tech Impact for those of you that are in IT staffing that are interested in either cloud security. We just released a series of videos and an article about that and things that you can do in nonprofit land to better secure and to operate more securely if I can. All right. And I am promoting you again, Sam. So you can check that out and I will chat that out in the chat box as well. So Sam, you should be promoted one more time and I think you should be okay now. I'm not. It looks like this is not going to work. So why don't you share or you go through the slides and I will follow along on mine. All right. Great. We'll decide to start working at some point. Okay. There we go. Okay. I think I'm good. Let's see if I can move to Z. I can change slides here. Great. Can you see that? Yep. Perfect. Wonderful. Well, thanks everyone. Sorry for the hiccups. So today we're going to talk about IT staffing which is possibly the most boring topic we could be talking about today but I think also one of the most important. And hopefully you're all here because you have realized that the IT staffing landscape for nonprofits is changing. The role of IT within nonprofits is changing and the way in which we need to support nonprofits is changing. So today we're going to be talking about the needs in the nonprofit space around that and how you can work with external vendors, internal vendors, volunteers, etc. to fill those roles. My name is Sam Chankin. I'm Director of Consulting Services at Tech Impact. Tech Impact is a nonprofit, a 501c3 that provides technology services to other nonprofits. I lead our data and strategy group that provides data support, strategy consulting to nonprofits. We also do provide managed services, support services to nonprofits. And all of this is to say that I have an idea of what works and what doesn't work in the nonprofit space. So I'm going to be really honest with you through this presentation about when hiring an external group might work and when it's not so successful. So let's start by talking about the IT staffing landscape. And I want to ask a quick question here. We've got a poll question. So why don't you go ahead and type in here. Has your technology staff or if you're outsourcing your technology expenditures increased or decreased over the last 4 or 5 years? We're going to compare this to what other nonprofits are saying. So you can just take a minute here and log a response. So has your technology staff expenditure or the number of staff you have increased or decreased? I've got nine responses. I'm going to hold out for a few extra awkward seconds to get everyone to answer. I'll take it. So let's go ahead and let's take a look at the results. And 57% of you say that your IT staff has increased. And that really holds pretty true with some of the data available. So this is a graph that shows the last several IT staffing reports from N10. If you're not familiar, N10 produces annual or semi-annual IT staffing reports. It's survey data from nonprofits reporting on how many IT staff they have, how much they're spending on IT, the roles available, etc. And what we can see here is that IT staffing has increased, not decreased. We see a little blip there around 2015 around the recession. And then it's right back up raring to go in 2016. So nonprofits are increasing IT staffing. This particular graph is percentage of staff who are IT staff of various types versus the overall staff of the organization. This is I think kind of surprising to some nonprofits. There's been this message that's being put out, this narrative that technology is getting simpler. It's being commodified. There's less to worry about. It's simpler. Things work now. So if we have that message, why is IT staffing actually increasing? I think the major drivers are that managing desktops is easier. Your computer works better. Your printer works better. Maybe it actually works. Your email probably actually works now where that likely went down once or twice a month even four years ago. So some of that stuff is better. But on the other hand, users, funders, and constituents expect a lot more than they used to. So in the old days, technology was either broken or working. We either called the ghostbusters or we didn't. It was calling the guard, calling everything you got, or everything was kind of fine. Technology itself was a commodity. And I get some pushback from this sometimes because there's this new idea that new technology is commodity. That's certainly how the startup world thinks. But back then you had a computer and that computer could be replaced with another computer. You had a printer. You could replace it with another printer. There was nothing really specific about that computer or that printer to your organization. It was really a commodity. Now we live in this really complicated, interrelated world where technology is an enabler of everything you do. It's a driver of change. It's really tightly integrated into your workflow and your process. You can't function without technology. And the people are really important. They're doing a lot of the work, but the technology is what glues these processes together. So while the underlying computers and the networks might be more reliable, might be easier to manage, the truly important technology has just become data systems, analytics, all the rest. And that really relies on technology even more. So just as a really basic example, yesterday your nonprofit used paper records. Your core technologies were word processing and email. The processes themselves were done by people. People taking the paper from the printer to the folder. People taking the fax and then typing some of that into an email. Or maybe filling out an Excel spreadsheet if you were really fancy. Today everything is built into the data tools. Everything is built into all your processes automated. It's all technology driven. So technology is becoming a much more integral part of the work that you're doing. So given this, given that technology has been really tightly integrated into how we work and that it's no longer a commodity, what do we need to do in order to be successful? And when I say be successful, I don't really just mean be successful with technology. I really mean be successful as a nonprofit. And I think this is a little bit, maybe it's sad in some ways, but technology is no longer just something that you kind of need to have on the side, just something you need to check off. Really in order to be successful as a nonprofit these days in order to compete for funding, in order to work effectively with your constituents, you need to be good at technology. Why is that? Well the first wave of technology for nonprofits is I think really the basic paper and email that I was talking about before. So using technology to support work as you were already doing it, email versus fax, file share versus paper, folders. This technology is a commodity. It's easy. You probably used to have maybe an IT guy, some person who would come and visit your office periodically. I mean not necessarily a guy, but the work wasn't particularly well integrated with your workflow, with your process. The second wave of technology which I think we're well through at this point, this is not cutting edge anymore, is using technology to better tell stories, to better help convince funders and constituents that the work you're doing is meaningful. Implementing service delivery, databases, doing dashboarding, analytics, that sort of thing. The second wave of technology I would say really started maybe around five years ago. Funders really wanted nonprofits to differentiate themselves and start to tell how they were doing their work. Was their work successful? What were the interventions that were effective? What were the quantity of interventions? Everything was data, data and analytics. And here we start to see technology becoming deeper integrated into our workflow, deeper integrated into our process. And we start to see that nonprofits need to take more ownership of technology. Your IT person or even your outsourced company is not going to be able to help you integrate technology into your workflow or your process. So we're starting to see technology need to be something that you think about in a deeper way for your nonprofit. The third wave of technology is I think about to hit us. It's not quite there yet, but we're close. And that's really fundamentally changing how we work as nonprofits through technology. So rather than just supporting and adding efficiencies and telling stories better about how we're doing work, we're talking about using technology to change how we work. And that could take a few different forms. One really common one is to build apps, build websites, or mobile apps, build tools that your constituents can use to interact with you more efficiently or effectively, or interact directly with each other, solve their own information needs. These are really changing the way you work as a nonprofit. Another is using statistics and machine learning AI to predict outcomes, to intervene earlier and more effectively based on deep learning of the data that you have coming in. So this third wave, this using technology to really transform how you work is the future. And it's not the far future. It's the future in the next year or two. And this, even more than the second wave, even more than just data systems and analytics and dashboarding, really, really requires that you integrate technology planning and technology itself deeply into the way that you work. So the message here is that technology must be a core competency of your nonprofit. And when I say a core competency, I don't necessarily mean that you have to have full-time staff dedicated to technology. That's not feasible for many nonprofits. But it does mean that at every level of your organization you need to be thinking seriously about how technology can help you work more effectively, help you change how you're working with your constituents. And if you can't do that, if you can't figure out how to use technology more effectively, you're just not going to be relevant, or it's going to be hard to be relevant in the world where funders want increasingly data, increasingly they want you to prove that you're doing something innovative and new. I'm not entirely convinced that this is a positive force in the nonprofit space, not claiming that progress is always a good thing. But I think it's hard to deny that this trend is coming and that in order to stay ahead of it, we really need to make technology a core competency of our organization. Okay, so with that kind of bleak outlook, let's talk about how we can build this competency, right? What does it take to make our organization have this core competency of technology? So when I talk about this with nonprofits, I like to divide it up into a pretty chart because I'm a consultant so everything has to be a pretty chart. These are the four different categories that I tend to use when I talk about it. So for the rest of the presentation, we're going to use these categories to talk about IT support, IT staffing models, and working with external vendors. So we're going to go through each of these categories. We're going to talk about what they are, what you need to be making sure that you're thinking about and doing in order to be making effective use of technology. We're going to talk about which of these things are well supported by external consultants versus full-time internal staff versus volunteers or shared staff, talk about which of them work well with that model and which of them don't. And then we're going to give you some tips for working with external vendors in each of these areas so that if you do choose to outsource, you can do so effectively. So let's get started by talking about infrastructure. And infrastructure is kind of break-fix support for your desktops and servers. It's also probably maintaining basic cloud-based collaboration tools like Office 365 or Google Apps. And maybe enabling mobility so that your users can access their files and their emails from wherever they are. This is the really boring stuff. This is the thing that used to be all of IT for nonprofits in that first wave. This was it. This was it. But now it's really changing. This is a very small part of what we do. So we're going to talk about some models for supporting this in the organization. But I want to spend some more time talking about these other components and what they are. Information security is a pretty brand new concern for nonprofits and it's a real one. Nonprofits are actually active targets of a lot of scams and attacks these days. At least once a month, I talked to an organization whose executive director's email was intentionally hacked and then they used that to try to initiate bank wire transfers or whose office manager receives targeted phishing attacks trying to get their credentials so that they can reveal which banks they are working with and try to initiate transfers that way. This is real. It's happening. And nonprofits that deal with particularly sensitive data are under attack as well from foreign governments and all the rest. There are practical steps you can take to make your nonprofit relatively secure against these kinds of attacks even from large actors. There's work you can do to protect your organization but you have to think about it and you have to integrate it into your organization. So when we talk about information security, we talk about the sort of technical side of preventing unsafe or unauthorized devices from accessing your data. How do we keep someone from using a stolen credential or a user from accessing something that they shouldn't access? More importantly in the information security space probably is training staff on best practices and tools, how to detect when someone is trying to get their credentials, how to use secure email tools to send confidential information, and then protecting against accidental or intentional data loss which often just means training your staff in policies and procedures. So we'll talk about how external companies can help you with that but information security is definitely something that you as a nonprofit should be thinking about today. This is something that you need to figure out how to support within your organization. Okay, data and application management is I think a little bit more familiar probably to most of you here on the call today. This is supporting your databases, so supporting your Razor's Edge or Salesforce, whatever your funder database is, your donor management system, supporting your case management system, your constituent management system, your outcomes database. These are all data applications that you might need to support. But it actually goes a bit beyond this. It also goes into making the best use of the tools you have, and maybe configuring or adding on little bits and pieces that maybe aren't so much about your programs or your services but are more about organizational efficiency. So for instance, my organization recently implemented a new expense management system. So we have an app that we go to. We can take a picture of our receipts and it categorizes the expense and there's a website we go to to clean it up and add comments. And then that gets pushed automatically to our accounting system. Well picking that system and implementing that system was actually really hard for us to do because we don't have like a dedicated application manager. We're a dedicated data manager within our organization. So in our case we did it a bit by committee because so many of us have that expertise. But this is something you need to think about.  Or maybe make tweaks to existing systems like SharePoint or email so that you're taking advantage of some of the automation or the efficiencies that you could have there. So again, this is a really, really important thing for having technology competency for using technology effectively. The last component of a healthy technology integrated organization is IT strategy. And this is a bit of a hard one to understand. So some of it is kind of simple, like budgeting, how much are we spending on IT? Is that going up or is that going down? A little bit more complicated, how are we picking projects that we're working on and how are we prioritizing them? Making sure that IT projects actually align to our mission. So if our mission is to provide the best shelter experience possible and as part of that we know that we're less interested in providing services to a large volume of people and we're much more interested in providing services to a very high touch services, then I don't want to be moving towards some kind of IT project that maybe increases our reach but doesn't increase the quality of our services. So making sure that any IT projects we're undertaking are really moving towards the mission. It's a really important part of this role. So I think vendors and hiring IT staff, maybe managing IT staff is an important part of this role. I think more importantly and increasingly importantly, and this relates back to that third wave of nonprofit technology that I was talking about, nonprofits need some kind of role within the organization to be identifying opportunities for really changing the way that you're working through technology. So who is it that's sort of sticking their hand up and saying, hey, I hear that we're having trouble getting this outcomes information from our constituents because every time I call them, they don't pick up the phone. Who's picking up their hand and saying, hey, maybe we should look into texting them and allowing them to text back that information. They have phones. They tend to be good with text messaging. How do we use technology to address that problem? So if you don't have this IT strategy, this high level perspective within your organization, you're going to miss out on the opportunities that technology can offer to improve your services, to increase your efficiency, to change how you work. So it's really important that this is a role that you're thinking about intentionally because again, keeping on that cutting edge is going to be a big part of how you stay relevant as a nonprofit, good or bad. I would say that that's the way that it is. So we're going to continue and we're going to take each of these four areas and we're going to talk about how different IT staffing models work well or don't work well for each of those. Before we do that, Susan, do we have any questions that we should answer? Susan I haven't had any questions chatted in yet. So I think we are good so far. We can move forward with this next series of polling questions. Susan Sounds good. If anyone does have any questions, please feel free to type them into the chat window and we'll take more questions throughout. Okay, so before we talk about IT staffing models, I want to hear from you how you are staffing these various areas if you're doing it at all. So we're going to go through four quick polling questions. I'm not going to wait a long time on each one. We're just going to power through. But if everyone could have their hands hovering over their mouth at this moment, that would be great. Ready, set, go. So the first question is, how do you currently support your infrastructure, the boring basic stuff, your desktops, your phones, your email file shares, et cetera? You can see here we're talking about volunteer, done by program and admin staff, dedicated IT type staff, by some kind of committee, by an outsource vendor, maybe a managed services company or an IT person contract, or you just don't really do this at all. And let's move on to the next question. We'll revisit these answers. How do you currently support your information security? So protecting against data loss, providing staff training and oversight, the policies and procedures that are important. I'm guessing most of you probably don't do this, but why don't you let me know how you're handling information security right now. We can do a little better. Anyone else want to chime in here? Help us out. Okay, we're almost done. The next one is, how do we currently support data and application management? So how are you supporting your programmatic databases or your admin databases? Maybe supporting some of that workflow automation. How are you managing that right now? So chime in here. What we're going to do is we're going to switch back to these results when I talk about each area so we can see how your peers are actually handling these kinds of support. So please do take a moment to chime in. It will make it a more interesting conversation. Okay, last one. How do you currently support IT strategy? So aligning technology with your mission, looking for opportunities for change. You do this, you do by committee, dedicated staff, volunteer, outsourced vendor. If you have no idea what I'm talking about, I think it's safe to say you don't really do this.  So we'll return to these at the end of this portion and we'll go over the results. So what we're going to do is we're going to go through each of those different options that you answered, volunteer, internal staff, etc. We're going to talk about how well those work with various components of your infrastructure of your support. What works, what doesn't work. And let's start with volunteers. And basically I'm going to tell you that having volunteer IT anything is not a good idea. And I mostly stand by this. When you have volunteers, they tend to not be as responsive as you want. They're really good one day and then they get busy and that's not a knock on them. It's just a hard relationship to maintain. That volunteer relationship, it's hard to find people who really have the time and the capacity to help you in a meaningful way. That is especially true around infrastructure. It's especially true around information security. And I cannot tell you how true it is around data and application management where deep involvement in your organization is critical. Volunteers very rarely work in these areas. Now there is a shining ray of hope here for volunteer work which is IT strategy. When we talk about that IT strategy around identifying opportunities and making sure that your projects are aligned with your mission, that's work that can be done pretty effectively with just a few hours a month. So let's say you have a committee. We'll talk about committee structures later or you have an admin like someone on the administrative side or the management side who is thinking about and sort of collecting these different possibilities for IT. They can work and get a lot done in just a few hours a month with a real IT expert, with a real technology expert to make sure the organization is aligned on IT strategy. So I would say that that is one good place to use volunteer labor if you can find someone with the right skill set. Let's continue. Let's talk about what works well when you're supporting it through program and admin staff. Again infrastructure does not really work very well. This is the accidental techie idea, right? Someone just sort of falls into the IT support role. I've seen it work relatively well for two or three person staff who really don't have that complex needs or particularly pressing needs. But once you get beyond that level this tends to not work. It's just really hard to get good support to have the knowledge you need and the availability you need to provide good infrastructure support. And it's just not that hard to get elsewhere. Data and application management and IT strategy tend to work fairly well. You may need help with those too. You might need an external contractor who's going to help out with like third level support for your database in case you get stuck or who's going to help answer some of those questions about IT strategy provided, you know, answer as a resource. It does work. Information security does intend to work well in this particular area although if you're well supported by external vendors it can maybe work. Okay, let's talk about using dedicated staff. So the first thing I want to say is that dedicated staff is often not ideal for supporting infrastructure, servers, and desktops. And that might be a little bit of a challenging thing to hear on this webinar because so many of you are IT people. But what I want to stress is that that doesn't mean that the role of the IT person is going away. It just means that it shifts into some of these other areas. Okay, so dedicated staff in infrastructure not so great in our experience and that's mostly because you can do better with economies of scale. So if you're outsourcing you're going to be able to get a help desk that has a bunch of people on it that are able to take calls at any time. You know, they might not know quite as much about your organization but they're available. And they have a broader range of expertise than you're going to possibly be able to maintain in-house unless you're a huge organization of several thousand staff. It's going to be hard to maintain that. Dedicated staff work really, really well for data and application management. So data and application management is where a dedicated staff person would go and they would be maybe your database manager, your database analyst, and be able to support the organization with any workflow or process or questions that come up. A dedicated staff member works quite well for this because they're very integrated into the way that your organization works. They're meeting with staff members, they're available, you go down the street, you call the phone extension, and for that reason dedicated staff works quite well in this area. Information security and IT strategy is a little harder to manage with a dedicated person because it's hard to keep someone with the expertise needed. So with information security, IT strategy, those are often very – to be able to wholly manage that in-house is maybe a CIO type role or even a Chief Security Officer type role, CSO. And that's going to be really hard to attract from nonprofits of most sizes. So normally those two roles are better supported through a combination of external vendors and internal staff or maybe tying together the pieces. Okay, let's continue and let's talk about by committee. So committee is I think a way that nonprofits often try to answer questions about – often try to manage particularly that IT strategy part. How do we prioritize our projects? How do we budget? Having an IT committee within the organization is a common approach. And while I haven't seen that work well for infrastructure or information security, I see it work really well for IT strategy because you're bringing together a group of people from across the organization who have some kind of interest in technology, some kind of interest in making technology work for the organization. This might need to be supported by an external person who has expertise, a volunteer or a consultant depending on your organization's situation. But the committee model works really well for that IT strategy area. Okay, if we talk about outsourced vendors, which I think is the most common place that nonprofits think about when they think about filling these competencies, infrastructure works quite well when you're trying to outsource it. If you want desktop support and server support, supporting Office 365 or Google Apps, you can find an external vendor who can do that really, really well. You'll see that all the other areas are yellow. And that's because it's not really possible for an outsourced vendor to 100% replace these competencies within your organization. That doesn't mean that you need internal staff. It just means that you have to figure out some combination of a program admin person or maybe a dedicated person who doesn't have the entire skill set to support this. So most nonprofits that I see be really successful with technology using outsourced vendor for infrastructure. They have a full-time data manager or application manager, and even small organizations increasingly have that role who's being backed up by some kind of external consultant who is being paid to help with some of the more complex issues. They have an admin group, maybe like a chief operating officer, or if you're smaller, like an HR person or an office manager who's keeping track of information security at least the basics, making sure that users go through trainings, automated trainings, etc. In IT strategy we see work really well with a committee in combination with either a volunteer or an external consultant. So again, this is our experience as a nonprofit that supports 200 nonprofits every day, 5,000 end users through our managed services, and several hundred more a year through our various services. This is what we find works well and what doesn't work well. And you'll notice that outsourcing is often not the answer, or at least outsourcing in its entirety is often not the answer, and you need to back that up with internal structures. So if we move on, I really want to spend a few minutes before we close talking about some secrets to managing your vendors. What can you do to be more effective in working with vendors in each of these areas? And these are coming from Tech Impact. We're a vendor. I mean, that's just the reality of it. So I think we have some expertise in what we see work well and what we see does not work so well. So in terms of infrastructure, working with an external infrastructure vendor, you want to look for some kind of service level agreement. Sometimes it's called a service level objective. Those are a little bit different, but they're both common terms. You want to know how long you should be expecting to wait for answers for your issues to be resolved. And this is something that should be in the contract. It should be something that you know ahead of time. It should be something that you can actually hold your support vendor responsible for. So that's a really important thing. The other thing that you need to really have in order to be successful with an outsourced infrastructure vendor is some kind of internal staff member. The common term is a service manager, although you're not going to have a dedicated service manager in most cases, who is responsible for escalating tickets and maybe serving as a point of contact if your outsource vendor can't reach someone or has a question. Having that dedicated point of contact goes a long way to keeping a relationship with an external vendor really healthy and effective and allowing you to hold that vendor accountable. That person should be going through a case list every couple of weeks or every week depending on your size, making sure that issues are being followed up on promptly, making sure that internal staff are being responsive. So that active engagement is really important to be successful with this. With information security, external vendors can do a great job at implementing specific tools. Most nonprofits are not going to be able to afford an information security vendor who is going to be able to monitor those tools. Monitoring for data access or data loss, monitoring these tools, requires usually somewhere between $1,000 and $2,000 a month even for simple environments to an external vendor. And that's because the risk is really, really high. So that dedicated information security monitoring that is maybe done to a PCI standard or to another sort of common standard is going to be quite expensive. So usually what we see happening is external vendors implement tools. Internal staff will monitor those tools to some extent and might reach out to that external vendor if something needs to be investigated in more detail. One thing I really want to stress is that a lot of the work has to be done internally and isn't even necessarily technology related. Doing data classification, understanding what kinds of data you have that's sensitive and where that data is supposed to live, writing policies and enforcing those policies about that data living there. Technology can help you identify people aren't doing what they should be doing but it's still really on you to have the policies and enforce the policies. And user training on what's safe behavior and what's not safe behavior is really, really important in this area. There's a good vendor that we use called Know Before which provides some really nice automated testing tools and training tools for organizations who want to provide something to their users to learn about security. That's a nice sort of drop-in option. We move on to talk about data and application management. You really are going to have to have some kind of internal staffing around this. It could be shared. It could be someone who's on the program side or someone who's on the admin side. But an external vendor isn't going to know enough about your internal processes to just be able to replace this. So external vendors are going to be really effective in helping you pick new systems, implement new systems, and support someone inside of your organization with more complicated or bigger picture issues. But it's got to be supporting someone inside of your organization who has day-to-day responsibility for this. It just doesn't really work without that. And we've tried it. We've tried all kinds of different models. If you don't have one person who's primarily responsible within the organization, it doesn't have to be a dedicated staff member but someone, you're not going to be successful. And finally with IT Strategy, external consultants, virtual CIOs are sort of the common model for outsourcing this. And this works well. Volunteers often work just as well. It depends on if you can find someone with the right skill set. But you really need to make sure that they're integrated with some kind of system within your organization, either someone on the admin side or a committee who's going to be able to raise the question, be able to look across the whole organization and understand where those gaps are, where those opportunities are around technology, and then have that conversation with this person. So this is one of the harder areas to outsource, but it is something that nonprofits really need to be thinking about in order to stay relevant. Okay, so with that, just a few general tips. Trust your nose. If you feel like someone is selling you something that's not real, don't take it, walk away. You should trust that instinct. You should remember that working with external vendors is a relationship, and it's a relationship that needs some work. Both the vendor and you should be doing that work. You're also paying for the service, but if they don't know how to help you be successful, it's not going to work out. And if they're not doing what they should be doing to really help you understand the challenges, help you meet your mission, then that's not going to work either. But both sides do require some effort. Don't mistake formality for good service, so fancy PowerPoints, nice PDFs, that's not the same thing as providing you with good service, but also friendliness is not the same thing as competency. And then just remember that internal ownership is important. You're not going to find a vendor who's going to be a drop-in replacement for having IT or technology competency within your organization. This is really something that you're going to have to own moving forward in one way or another. And hopefully some of the different structures we talked about today can help you brainstorm how you actually want to build this competency within your group. That's it. That's what I have. I think we have a little more content coming up. That's my email address right there, Sam at TechImpact.org. If you do have any questions, please feel free to reach out. Great. Thanks, Sam. I am actually going to go back and just see if we can show – Yeah, that's okay. I don't know if you want to talk through some of those because it's some interesting responses all together. So if we take a look here at the infrastructure piece, I'm really pleased to see that no one is using volunteers to support their infrastructure. I think that's great. It doesn't surprise me that a lot is being done by program or admin staff. That's sort of the accidental techie model. I'm a little surprised that so many organizations are having dedicated IT staff doing this versus an outsourced vendor. But my guess is that those dedicated staff are doing things besides just this. So I think we'd find that those dedicated staff are also probably doing databases and the rest, which I think is great. So nothing too shocking here. I'm sorry for those of you who just don't have this kind of support at all. If we take a look at supporting information security, we don't really do this 36%. Yes, that totally makes sense. That absolutely makes sense. And I'm guessing your dedicated staff, that's an IT person filling that role. That's great. So if you have an IT person who has the competency to understand what a phishing attack looks like, what different kinds of malware attacks look like, how to do training and data classification, that's great. Otherwise you should train your IT staff on how to do those things or find someone else who can help you do that work to supplement your internal staff. But again, I think here we're seeing that those dedicated staff, those hard-working IT people are managing quite a few different things in every organization. I bet we're going to see that trend continuing. So if we take a look here, how do we support data and application management? Dedicated staff, again, very high percentage. This is the point where I think it's hard to do this as an IT person because you have to be really integrated into the workflow of the organization. It's certainly possible, but it takes a lot of running around, a lot of really understanding everyone's needs to be able to do that. I'm a little surprised to see so many people are using outsourced vendors to do their data and application management. I'd be curious to hear how that's working for you. Otherwise I'm pretty not surprised by the volunteer or the not doing this category. Finally, if we look at IT strategy, we don't really do this is common. That's sort of the most common response and that doesn't surprise me at all. So very interesting results here. I guess what I would take from this is that organizations that do have IT people are expecting a lot from their IT people. I would really like to see those organizations shift the role of that IT person away from the infrastructure piece and into more holistic, more strategic implementations of technology. So that IT person isn't spending all their time running around troubleshooting desktops and printers and that server on-premise or that access database from 1997. They're going to have a lot more time to really help you do more with technology. I think that's an important takeaway from this. Thanks, Sam. We do have a couple of comments in the chat box. I'm going to let Frank deliver his content about those managed IT services and then we'll have some time to address some questions. Well, great. Thank you. My name is Frank Babbitt and I'm a Director of Operations here at TechSoup. I'm working on developing our IT services in the organization. I also manage our refurbished computer initiative, so many of you may have purchased refurbished computers from us. If so, we thank you. Well, let me first start by saying that I really enjoyed the way Sam really laid out the kind of progression of technology and nonprofits. I think it makes a lot of sense especially if you look at these different waves. And clearly nonprofits of different sizes are at different waves as this goes. And so TechSoup's goal, of course, is to help you reach your objectives through the use of technology. And so we have launched a program called IT Assist, which is a managed IT services program. And we're doing this in partnership with Tech Impact. And we have a number of orgs that are using the service, but we are obviously eager to have more if you take advantage of it. And some of what I've laid out here in my slides, we've kind of talked about already, and thank you Sam because I think you've explained it really well. But essentially what we're talking about here is outsourcing your IT to a third party. And this is often provided remotely. In the case of this particular IT service, IT Assist, it is in fact provided remotely. And in addition to that, the benefit is of course that you do get this expertise, a much greater amount of expertise. But of course you do pay for it. However, if you're comparing that to a dedicated person, we feel like that's going to be a better use of your funds. So in our next slide we're talking about have you outgrown your accidental techie, which is often how we describe people who are doing the tech role but aren't necessarily trained to do that. I'm not going to read through every single one of these bullets. You'll get a copy of this presentation. And you can see are any of these bullet points you? I think that's the thing to think about. And this is all a process, right? You don't necessarily jump in feet first on everything, but maybe you start with one of the aspects that we've been talking about today and see how that works for you. Because things are indeed changing, I think that we're trying to help nonprofits to make those change both in using the data and using the technology that they need and taking better advantage of the cloud. So that's something else to be thinking about. But essentially the way that I think this all makes a lot of sense is that you're trying to achieve your mission. And there's a lot that goes into doing that and a lot that you've been doing for a long time. But some of it is rather new and it just makes sense to get some expert help to make that happen. So that's kind of what we're talking about here. So IT Assist again is the name of the service. You can find it on our website techsoup.org slash it-assist. And the service is provided by trusted partners Tech Impact is our partner today. And this program is designed only for nonprofits and public libraries. So it's not for any company out there, any commercial company. It's really built with your needs in mind. The services are provided remotely which of course keeps the costs down. And as Sam said, it's really important that whoever you engage with, whether it's through this program or another program that you find on your own, that they work directly with your staff because your staff is going to know your needs. It's truly a partnership. And I think that's really important to keep in mind. Some of the services that we provide are help desk support as part of this program. Obviously computers break as you saw at the beginning of this presentation. Things weren't quite working right. So you need to have somebody who can help you with that. There can be monitoring of both security and performance issues. System backups are extremely important because again hardware goes down. And so you need to have backups. I'm sure you are all backing up your computers, but what about the servers? Are those all being backed up? And in addition to actually executing regular meetings where you are doing planning I think is extremely important. And all of this is going to be done with your needs in mind. So it's not that people would be suggesting services or methodologies that are too big, too fancy, too expensive for you. It's really what are your needs. And I think it always makes a lot of sense to start as simply as you can, tackle a few basic problems, and then see how that's working for you, and then expand your use of these services as you go. A couple of benefits within the program. There is an optional hardware update program. So desktops, laptops, servers, and the like can be updated on a regular basis. So that's a possibility, and we can work through using some of the refurbished hardware. And in addition, anyone who uses our IT assist program also gets a subscription to TechSoup Boost. And I don't know if you guys are familiar with that, but it's a program where you pay a fee and you get a number of benefits throughout the year. In a way, it's like the Amazon Prime program where you get a bunch of benefits that help you enhance your use of the service. So that's the way that works. So let's talk about the financial side of things. So as in most services for computers, it's all based on seats. That's the number of computers that you're getting that service for, number of servers. And so it's simply a matter of figuring out what your needs are, how many people you have, how many servers, how many systems that need to be managed. And then the price varies just as a rough, rough estimate so that you could do some calculations. You're looking at something maybe from $40 to $150 per month per seat. Again, very typical kind of pricing geared towards nonprofits. It's lower pricing than you're going to find for many commercial providers. And then some services are kind of a per incident type of service. And so that would be something that's based on your usage. And so that's something that you would be able to work out and learn more about. Again, going to that page on our website and beginning to engage with Tech Impact. Generally, the contracts that we do are one-year contracts, but there's no long-term commitment for that. So you can definitely sign up, see how it works for you. If you're not happy, the last thing that we at TechSoup want you to do is to continue with a service that you're not happy with. We think we built something that will work for you, but that's really for you to decide. So talking about the value proposition for you, our nonprofit customers, so we're a nonprofit obviously. Tech Impact is a nonprofit. And so we're right in the space. And so we understand the unique needs and challenges there. So I think that's something that's really important when you're selecting a vendor. And again, we're really trying to bring you the service that you need. You get to decide how much service you want and the pricing is at the lowest possible price for you. And so we feel like this service will actually help you to bring down the cost of IT management. We can do migration to the cloud. We can source and implement voice over IP solutions for you, and then do strategic planning. And things are changing, right? And I just think it makes a lot of sense for you to start looking at this. Again, maybe one of these services that I've mentioned here today are something that you have a need for today. So my suggestion would be to give it a shot and see if this would work for you. This is what the page looks like on our website. Again, techsoup.org-it-assist is a form at the bottom of this page that you would fill out where you would identify some of your issues, and then we'll be in touch with you, the folks at Tech Impact will, and be in to determine if this makes a lot of sense for you. And so that was really just, I just wanted to take a moment to take you through our program that we've developed. We're again eager to have you consider using this. We want to get your feedback so that we can continue to evolve the program and add new programs as we go forward. Thank you so much, Frank. That was a nice detail and a good follow-up to what Sam talked about. Sam, I'm going to tap you very quickly. I know we're almost out of time. We only have 2 minutes. But Sam, there were a couple of chats in the chat box about budgeting for this. And I'm not sure if this goes with the SLA, the Service Level Agreement, or just a human-centered element of building a relationship with the external vendors. But we also had a question about what accounts for the difference in the price range for Tech, the pricing range for TechSoup IT Assist. I don't know if you're able to jump in and address that. Sure. So budgeting for IT Support is really difficult. It's something that many nonprofits have just gotten away with not doing for a really, really long time. And honestly, I don't have an easy answer. The answer is you're probably going to need to figure out how to pay for it, at least for a year or two. And generally you'll find that it will pay off, particularly if you have internal staff who are doing IT in addition to other things, suddenly not needing to do IT is going to allow you to take that time and do much more impactful things. IT is not that expensive to outsource. One really useful tool in helping with that is to do a time study of whoever it is who is providing IT services, maybe it's more than one person in your organization documenting how much time they are spending working through issues can go a long way to helping tell that story and getting buy-in to spend the money on an IT vendor. You know, nonprofit budgets are always squiggly. There's always money in the budget. It's just a matter of how you prioritize different things. And maybe IT just needs to be prioritized. Or maybe you can't afford it and you just need to limp along. There's not a magic bullet for that particular solution. The pricing difference depends basically just on what kinds of services you have that need to be supported. So the simpler environments are less expensive, the more complex environments are more expensive. And that pricing is transparent. You'll understand where that's coming from. Perfect. Thank you. Yes. I appreciate all of the information. I can tell a lot of folks that had these questions are satisfied with that answer. And I did want to just very quickly, I know we're almost at the end, and actually it is 12 o'clock. But very quickly chat in what you learned. I did talk about a couple of free courses that we do offer. And I did chat out the website for our learning management system so you can actually take some of these courses for free. And we also have other webinars, so I'm chatting that out as well. Our TechSoup course catalog does contain mostly free courses and in particular the Tech Planning course which is really all about tactical tech planning and some of the things that Sam addressed today can really, you can kind of walk through some of those steps with the folks at IdealWare who helped us create that course. And I chatted out that link. It looks like a lot of folks learned things, so go ahead and chat one thing you're going to share with folks or one thing you learned. Our upcoming webinars, we've got a tour of our site next week and we also have a special library event coming up at the end of this month and we'll have more webinars scheduled towards the end of June and beginning of July after the 4th of July holiday. I have a huge thank you to give to Sam because Sam has always been so giving of his time and of his expertise. He put together this presentation to help not just folks that are using IT Assist but also just to help nonprofits understand what's available and what may or may not work best based on his life experience. They're a tech impact. So Sam, thank you so much for your time. I really appreciate it. Thanks for having me. And Frank, thanks for jumping in too. You've been amazing. A pleasure.  I know we're a little over, so thanks for all of your time. I know it's your most valuable resource. If you have any additional questions, go ahead and chat them in the box. We'll leave that open a little. We will be closing the event itself and you will get a survey. Please do complete the survey for us so we can continue to get better. Or we can also address other questions you have and other content. Thanks everyone. And I hope you have a great rest of your week and a good weekend. And thanks to ReadyTalk, our sponsor. Bye-bye. Thank you. And this concludes today's call. You may now disconnect. No.


We have a number of ways of measuring this in the classroom and you'll have the opportunity in the laboratory hopefully to explore pH through pH meters, through data loggers, and also through universal indicator. Now it's important that you think about the relative degrees of accuracy of each of these devices, particularly when we talk about things like calibration, whilst we can just use a solution like universal, which is very convenient either as a solution or as a paper. We get a lot more accuracy out of our pH meters and data loggers, but if we don't calibrate them properly, if we don't standardize them to what we would expect for solutions of non-concentration, then the values can be very accurate, but invalid. So important that we make sure that we're aware of how to use these devices and how to get the most out of them. This is just a quick scale to give you a bit of an idea of what we talked about before the fact that battery acid, for example, is an extraordinarily strong acid. It has a pH of zero and yes pH, I guess, commonly goes from zero to fourteen, but we can have values that extend beyond that both into the negative range below zero as well as above fourteen. But this is pretty much the scale that we tend to look at and tend to think about. You'll find some common substances on this pH scale and the colors pretty much correspond to the sorts of colors you might expect from a universal indicator. And also they give you an idea of the concentration of hydrogen ions with a comparison to distilled water. So if we set an arbitrary value of zero and of course we don't have zero hydrogen ions in distilled water, so just important when we look at comparative scales that sometimes we set standards in order to make comparisons which are not necessarily the absolute ones. We'll look at how we calculate pH later in this part of the module and then you'll see obviously that the concentration of hydrogen ions into distilled water is not zero, but this just gives you a bit of an idea. So ten times as many hydrogen ions in a pH of six as there is in water, a hundred times in a pH of five and one tenth in a pH of eight. So just gives you a little bit of a comparison without looking at the absolute numbers at this stage. What's more important is to have a look at some of these examples. Cleaners, soaps, drain cleaners, ammonia all up in the base range. There's a few different things that we use commonly like toothpaste which is slightly basic counteract the acid of our saliva or at least some of the foods that we eat and that the bacteria that grow on our teeth hopefully not may produce, but also things like coffee, acid rain and acid rain can actually get well below five, hopefully it won't. Tomato juice, different types of juices, vinegar and then stomach acid that we've talked about previously and battery acid. So just a range of different substances. As I said this particular one is more about the practical, so getting the opportunity in class to look at a number of different types of substances common and otherwise and to measure and record their pHs. Thanks for watching.