In 2004 you had a website. In 2014, you have a marketing cloud. You interact with your customers across thousands of channels and device types and rely on hundreds of vendor partners to do so. If you are like most enterprises, your marketing cloud is out of control. An out-of-control cloud sends customers to competitors’ stores, dilutes your customer data value, opens security breaches, and slows down your site. Good cloud management ensures that you keep and grow your customer base, secure your data, and improve site performance. In this research series, we will define the marketing cloud and provide benchmark data and best practices for marketing cloud management. This is part two of the three-part series. • Defining the Marketing Cloud • Marketing Cloud Management: Best Practices • Benchmarking Your Marketing Cloud

1. Emily Riley, COO, Ghostery
10 East 39th Street, 8th Floor, New York, NY 10016 Ι 917.262.2530 Ι ghosteryenterprise.com
sales@ghostery.com Ι @ghosteryinc
MARKETING CLOUD MANAGEMENT BEST PRACTICES

2. 1
YOU NO LONGER HAVE A WEBSITE;
YOU HAVE A MARKETING CLOUD.
In 2004 you had a website. In 2014, you have a marketing cloud.
You interact with your customers across thousands of channels
and device types and rely on hundreds of vendor partners to
do so. If you are like most enterprises, your marketing cloud
is out of control. An out-of-control cloud sends customers to
competitors’ stores, dilutes your customer data value, opens
security breaches, and slows down your site. Good cloud
management ensures that you keep and grow your customer
base, secure your data, and improve site performance.
In this research series, we will define the marketing cloud and
provide benchmark data and best practices for marketing cloud
management. This is part two of the three-part series.
• Defining the Marketing Cloud
• Marketing Cloud Management: Best Practices
• Benchmarking Your Marketing Cloud

3. 2
Marketing departments are
in the middle of a spending
frenzy. eMarketer predicts
worldwide digital ad spending
to reach $137.53 billion in
2014, an all-time high.1 Of
course, marketers are not
just buying ad space with
their money. Laura McLellan
of Gartner estimates that
CMOs will spend more on
technology than CIOs by 2017.
While digital marketing in
particular holds great promise,
without proper management,
it is risky at best, and hugely
unprofitable at worst.
Ghostery finds that a long list
of digital marketing vendors
have worked their way into a
company’s digital assets, often
indirectly through relationships
with other vendors. The
average enterprise site has
more than 75 vendors on
it, only 20% of which are
directly placed by someone
at the company. All digital
marketing vendors bring real
risks and costs to a company’s
online business, including
data security breaches, poor
website performance, and
data leakage to competitors.
These problems will only
continue to rise in time.
According to a study by the
Corporate Executive Board
(CEB), more than 70 percent
of executives are now willing
to run their own technology
projects, partly due to changes
in the ease of data integration
and user interface design,
further challenging Corporate
IT’s monopoly as the internal
arbiter of technology.2
MARKETING CLOUD MANAGEMENT IS AN
ENTERPRISE DISCIPLINE
1 “Digital Ad Spending Worldwide to Hit $137.53 Billion in 2014,” eMarketer, 4/3/2014
2 “Executive Guidance, Harness Business-Led IT,” Corporate Executive Board, Q2 2014
“The average enterprise site has more than 75
vendors on it, only 20% of which are directly placed
by someone at the company.” - Ghostery

4. 3
The first person in an
enterprise to notice problems
caused by vendors is often
someone responsible
for maximizing online
performance for the business.
After noticing that his sites
were slowing down, Martin
Van Der Meij, Head of Revenue
Development at De Telegraaf,
looked into the matter.
His analysis revealed that
“ironically, it was an individual
campaign that Telegraaf had
sold directly that was leading
to a larger proliferation
of unknown tags — and
consequently, slower pages.”
Chad Westfall, Director of Web
Delivery for InterContinental
Hotels Group (IHG), similarly
noticed that a marketing
technology was causing
problems that needed to
be addressed. “Being a
leader in marketing cloud
management became a
priority for our business
last year as we realized the
effort held benefits across
IT, marketing, legal and
security,” Westfall said. Other
early movers like Procter &
Gamble are considering ways
to decrease the company-wide
costs of working
with so many marketing
technology partners.
When individual issues from
digital vendors start to add up,
it is a sign that the problem
is systemic. IT-oriented
leaders who support these
marketing technologies
are the logical leaders of
marketing cloud management,
but departments must work
together to weigh the costs
against the benefits of working
with various partners. As
Accenture’s annual CMO
Insights survey illustrates,
smart CMO’s are leveraging
their IT counterparts’
technical expertise to
improve the overall value
of their digital spend.3
“Being a leader in marketing cloud management became a
priority for our business last year as we realized the effort
held benefits across IT, marketing, legal and security.”
- Chad Westfall, Director of Web Delivery,
InterContinental Hotels Group
3 “CMO’s Time for Digital Transformation,” Accenture, 2014

5. 4
The first step a company
should take to evaluate the
costs and benefits of its
marketing cloud is to audit
digital vendors and see how
those vendors gained access
to the cloud. As Chad Westfall
of IHG explains, an audit of
all third parties across the
company’s sites determined
“who owned each and how
they got to our properties.
This very much helped us to
police which digital vendors
should be on our sites, who
they are allowed to bring with
them, and, most importantly,
how each vendor fits into our
overall website strategy. The
auditing also helped us
identify any slow tags and
benchmark how they perform
across the rest of the web.”
The best way to start an audit
is with a map of all of the
vendors in your marketing
cloud. From there, you can
determine who owns the
relationship with each vendor
as well as the reason for
working with the vendor.
STEP 1: MARKETING CLOUD MANAGEMENT
STARTS WITH AN AUDIT
Step 1: Determine who works with each vendor and why
Marketing
Web Ops
IT
Legal
Your Site

6. 5
STEP 2: MARKETING AND IT
WORKING TOGETHER
The first thing most companies notice when they perform an audit is that the relationships with vendors in their marketing cloud are dispersed across many groups, both within and outside the company. Most of these relationships ultimately fall under the management of the CMO, so it’s no surprise the CEB estimates that three times as much money is spent on technology innovation outside the IT budget as within.4
Still, data management, targeting, advertising and social media vendors will be dispersed across the media team, agencies, and even multiple brand groups. Just as likely, analytics, video and content vendors might fall to the eCommerce teams or website operations.
There are often several vendors that:
•
Provide overlapping services
•
Have no direct relationship with the company
•
Still access the marketing cloud despite expired contracts
•
Have expired contracts
•
Create data leakage risks
MarketingWeb OpsNon-SecureExpiredContractSlowRedundantExpired ContractWorks withcompetitorToo many indirect callsITLegalYour Site
4 “Executive Guidance, Harness Business-Led IT,” Corporate Executive Board, Q2 2014
Step 2: Assess the value of each vendor

7. 6
The audit should not be used
as an opportunity to blame
departments for poor vendor
management. Rather, the
audit is a chance to create
a fresh start and improve
communication across groups.
It is a great opportunity for
marketing to include the
eCommerce and IT teams in
the marketing technology
decision-making process,
and for all three departments
to share their general
philosophies and determine
a way to meet in the middle.
Some company cultures
deliberately exclude IT
from marketing technology
decisions, considering the
department too risk averse
and slow to keep up with
marketing progress. A recent
Accenture study reflects
this hesitation: “Notably,
CMOs expect much quicker
turnaround and higher quality
from IT, with a greater degree
of flexibility in responding to
market requirements. CMOs
view the CIO organization as
an execution and delivery
arm at a time when they
should consider IT as a
strategic partner and involve
CIOs when planning new
marketing investments.”5
Good marketing cloud
management makes the
marketing/IT collaboration
a reality. The cosmetics
retailer Sephora has a single
executive who serves as both
Chief Marketing Officer and
Chief Digital Officer, because
merging the two teams allows
the brand to make the most
of its investments across
all channels while moving
quickly and efficiently.6
The point of collaboration
is not to simply increase
speed and efficiency. Inter-department
cooperation must
inspire goals that benefit the
bottom line as well. One big
box retailer included members
from IT in the approval
process of all marketing
vendors after it estimated
that the cost of customer data
leakage was higher than the
revenue provided by many of
their partners. By enforcing
a more thorough evaluation
process early in the vendor
relationship, that retailer’s
online business became more
secure and more profitable.
6 “ How Sephora Reorganized to Become a More Digital Brand,” Dan McGinn, Harvard Business Review Blog, 6/26/ 2014
5 “ CMO’S Time for Digital Transformation,” Accenture, 2014
“CMOs view the CIO organization as an execution and
delivery arm at a time when they should consider
IT as a strategic partner and involve CIOs when
planning new marketing investments.” - Accenture

8. 7
Companies ready for a more
rigorous vendor selection
process would do well to
follow the best practices
of Equifax. Equifax uses a
vendor questionnaire to rate
vendors on data management
practices, compliance with
online advertising governance
and relationships with
Equifax’s competitors, among
other things.
Once a vendor is selected,
it is monitored regularly to
ensure continued compliance.
In a recent webinar, Nicole
Keiter, Director of Media
Strategy and Optimization
within Marketing at Equifax,
noted, “We monitor vendor
redirects and data collection
closely. Our vendor
questionnaire, which must be
completed before a company
can be added to our website,
asks a vendor to outline any
tag redirects or data collection
that may occur. We then
make sure this aligns with
our privacy policy. If they are
outside of our guidelines,
then we may flag and say
this will or will not work.”
STEP 3: FORMALIZE VENDOR
SELECTION PROCESS

9. 8
SAMPLE DIGITAL VENDOR QUESTIONNAIRE:
Vendor Name:
Date:
Parent Company
Secure Tax/Pixel Code:
In the box below, please list all code that will need to be placed on (Company)
properties, breaking out each section of code with an appropriate designation as
necessary (ex: <!-- retargeting--> <img src=…>, <!-- conversion--> <img src=…>, etc.).
Purpose of Pixel: __________________________________________________
Pixel Code:
PRIVACY & DATA SECURITY:
1. Is your company a member of the NAI? (Network Advertising Initiative)
(Y/N): _____
2. Is your company a member of the DAA? (Digital Advertising Alliance)
(Y/N): ______
3. Is your company a member of the IAB? (Interactive Advertising Bureau)
(Y/N): _______
4. (Company) does not allow PII collection of its website and web properties. Please
confirm that no PII information will be collected on (Company) web properties:
5. Does the proposed media buy incorporate OBA? (Online Behavioral
Advertising/Behavioral Targeting) (Y/N): _______
If yes, please answer the following questions:
a. If media buy incorporates OBA, do you provide an opt-out option for consumers?
(Y/N): _______
b. Do you apply the Advertising Option Icon (Ad Choices) to all of your OBA-targeted
ads? (Y/N): _______
6. Does the proposed media buy incorporate retargeting and/or data
collection off of any (Company) web property? (Y/N): _______
7. Can you provide secure image pixels? (Y/N):
8. Do you have SSL Certification? (Y/N):
Can you confirm that your SSL Certificates will be active throughout the (Company)
campaign? (Y/N): ______

10. 9
9. Does your pixel redirect or make any additional calls? (Y/N): ______
If yes, please answer the following questions:
a. How many additional calls will your pixel(s) make? _______________
b. Please provide the following information for all additional calls:
HTTP Call Purpose
All redirects or additional calls must be secure.
Vendors will have to notify (Company) about any update that it might make to its pixel.
If the pixel has been altered after it has been placed and (Company) has not been notified of this
change and if (Company) deems it unfit, we will remove this pixel.
10. Does your technology employ the use of any technologies (including but not limited
to Flash local storage objects/“Flash cookies”, Indexed Database API, Web SQL
Database, Google Gears, Web storage or DOM storage) to persist user data after
a user has cleared the HTTP cookies from their web browser? (Y/N): ______
PERFORMANCE AND TECHNOLOGY:
11. Will your pixel work with all browsers (Internet Explorer, Firefox; Chrome, Opera,
Safari etc.)? (Y/N): ______ Yes and No are acceptable answers.
If no, list the browsers on which your pixel doesn’t fire: ___________
________________________________________________
12. Are there server redundancies in place for your pixels? (Y/N): ______
Please explain how this is handled: ____________________________________
13. What is the expected load and response time for your pixels?
14. In the event the pixel does not load or respond, please describe what we can expect
to see: _______________________________________________________
15. Please provide contact information and hours available (please
include name, phone, e-mail address and time zone):
a. Do you have a 24/7 support (contact) for problems relating to pixels?
(Y/N): ______
16. What best practices, if any, does each script use (i.e.: deferral, asyn loading, etc)?
17. What is your average monthly downtime?
18. Do you use a CDN? If so, where are your caches located?
19. Please provide a list of all the pages on which you will place scripts. ___________
________________________________________________________________

11. 10
STEP 4: CREATE A CENTER OF EXCELLENCE
LED BY A TECHNICAL EXPERT
Several early adopters of
marketing cloud management,
including Equifax and IHG,
have designated an individual
stakeholder to lead and
manage the process. The best
candidate is part of the IT
organization, or the Marketing
IT organization. This digital
technologist should be in
charge of a cross-functional
committee, or official center
of excellence, with direct
communication to both
digital marketing leaders
and IT leaders. As one home
improvement retailer put
it, “We made sure our MCM
leader answered to the IT team
and had technical chops, but
was business savvy enough
to act as a true mediator
across departments.”
An empowered center of
excellence operates under
the mandate that it will
“control the marketing
cloud.” This group should
consist of marketers who
need technology on the site,
as well as, analysts, data
governance professionals,
and IT managers who handle
website performance and
security. The group should
have incentives objectively tied
to overall business success,
and not the special interests
of individual departments.
“We made sure our MCM leader answered to the IT team and had
technical chops, but was business savvy enough to act as a true
mediator across departments.” - Head of Digital Marketing and Data
Management Platforms, Fortune 100 Retailer

12. 11
GHOSTERY HAS FOUND THAT A GOOD MCM
CENTER OF EXCELLENCE:
• Is headed by an IT leader who supports digital marketing
• Evaluates and approves all vendors
• Owns vendor contracts
• Monitors all active vendors
• Enforces security and performance best practices with all vendors
• Performs initial and ongoing cost-benefit calculations
• Owns the removal of vendors
• Leads a group of cross-departmental stakeholders
Marketing Cloud Management Leader
Analytics
Data Governance
Legal
IT
Web Ops
Marketing
eCommerce

13. 12
STEP 5: THE FOUR PILLARS OF A GOOD DIGITAL VENDOR
MANAGEMENT PROCESS
While a rigorous vendor
management process is
common in IT organizations,
the discipline hasn’t yet found
its way to digital marketing.
Most vendors are compared
and evaluated by the marketing
team, or the media agency,
simply for their benefits. Very
rarely are vendors penalized
for the hidden costs to the
business – costs that often
outweigh the benefits. Once
implemented, vendors are
only monitored for top-line
marketing performance—not
against SLAs common on the IT
team, or against revenue and
order size metrics common
to the commerce team.
Good digital vendor
management will have
material impacts to the
marketing department, but
it should increase overall
ROI for the company. Martin
Van Der Meij shared that his
team at De Telegraaf has
“removed the presence of
detrimental tags by 76 percent
and improved tag speed by 62
percent, which has created a
better user experience and
more value for advertisers.”
In your vendor management
process you’ll want to focus
on four pillars to keep
everyone aligned for:
• Security
• Performance
• Governance
• Competitive Intelligence
De Telegraaf has “removed the presence of
detrimental tags by 76% and improved tag speed
by 62%.” - Martin Van Der Meij, Head of Revenue
Development, De Telegraaf

14. 13
SECURITY
Non-secure third
party scripts placed
on Hertz.com
7 “Into the Breach: Identity Theft Protection,” Annamaria Andriotis, The Wall Street Journal, 1/24/2014
8 “Content Widget Maker Taboola Is Hacked On Reuters,” Tim Wilson, Dark Reading, 6/24/2014
Your terms and conditions,
as well as most vendor
contracts, contain legal
obligations to keep user data
secure. Keeping your own
assets secure is a business
imperative. According to the
Identity Theft Resource Center,
the number of data breaches
is on the rise. More than 600
known breaches occurred in
the U.S. in 2013.7 There are
several security indicators to
monitor within the marketing
cloud including tracking non-secure
connections occurring
between your vendors and
your secure pages. The
average secure web page
deploys over 35 vendor tags.
If this code were to make
unencrypted calls or otherwise
become compromised, all
of the data transmitted by
the page would be put at
risk. It is also imperative to
monitor any code or script
changes that happen by your
vendors. The recent hack
into Taboola’s widget on
Reuters.com demonstrated
that “websites need to
think long and hard, not
only about the security
of their own servers, but
whether the companies
who are providing widgets
and plugins that power the
websites are taking security
as seriously themselves,”
according to Graham Cluley,
a computer security expert.8

15. 14
PERFORMANCE
Place cost/benefit assessments front and center. Quantifying risks and costs up front
goes a long way toward establishing better vendor management. Mandate that the team
requesting a new vendor relationship present a description of the service the vendor
will provide, as well as a revenue or benefit estimate. Once a vendor is approved, ask
the marketing team to monitor the revenue created by that vendor quarterly.
A good process continually quantifies the following:
1. Does the vendor slow down the website?
2. Is the vendor breaching its SLAs?
3. Is the vendor’s technology working properly (for example, does it always load fully)?
4. Is the vendor limiting the functionality of your website (for example, is it breaking your
video player)?
Determine the path dependency and load times for each of the digital vendors

16. 15
GOVERNANCE
The most important reason for creating a vendor management process is that your enterprise
should own the contract relationship. If a third party controls the contract, you have signed
away the rights to communicate with your own customers. By implementing a vendor
management process, you are also setting the guidelines for vendor monitoring and removal,
further empowering your center of excellence to maintain marketing cloud standards.
Several elements to mandate in your contract are:
1. Business ownership: Basic governance can only occur if problems can be solved. The MCM
leader in your organization should know precisely whom to call — both inside and outside
the company — when a vendor issue arrises. For example, if your Website Operations
Manager and its agency counterpart both have responsibility for your Tag Manager, you
should have contact information for both of them, as well as for the vendor account manager.
2. White lists and black lists: One of the easiest ways to know if you’re working with a new
vendor is to create a living white list of approved vendors that is shared across the company.
Similarly, if a vendor has been rejected from your site, placing them on a black list ensures
they stay away. Implementing a real-time alert mechanism that is shared across the
company and with partners — such as the tag manager and ad agency — is essential.

17. 16
GOVERNANCE
PointRoll
PointRoll
DoubleVerify
InsightExpress
Turn
Global Adsense
Experian Marketing Services
Sizmek
Voice Five
Double Click
ScoreCard Research Beacon
Ghostery Privacy Notice
3. Child tag limits: Several companies put strict
limits on the number of additional vendors a tag
can call from their website. This restricts the flow
of customer data away from the website, reducing
latency and security issues.
4. Data collection and resale restrictions: Many
vendors, especially advertising agency trading
desks and retargeters, use standard contract
language that gives the vendor, not their clients,
ownership over customers. In a vacuum, vendors
will assume control, to the point that they own
your customer — not you. Unless it is in your
contract that they cannot resell your data, assume
that they are doing just that.
This illustrates the child tag relationship across digital
vendors, and how they were brought on to a site

18. 17
COMPETITIVE INTELLIGENCE
Marketing cloud management
starts with an audit, but it
doesn’t end with one. Vendors
change; they bring in new
partners, stop working,
work more slowly after a
code change, or change their
data management practices
overnight. You must be
monitoring their performance
against competitors’ sites to
understand the scope of these
changes. For example, if they
are causing site latency on
your website, is it isolated or
web-wide? Additionally, if you
start working with a vendor
who has few retail customers,
competitive data leakage is
not a large risk. But over time,
the vendor might add new
retail customers, increasing
the risk considerably, and
putting the overall cost-benefit
into question.
Company A
Page Latency
Company B Company C Company D
900 ms
800 ms
700 ms
600 ms
500 ms
400 ms
300 ms
200 ms
100 ms
0 ms
Aug 10 Aug 11 Aug 12 Aug 13 Aug 14 Aug 15 Aug 16
Benchmark your company’s website performance against others in the industry

19. 18
CONCLUSION
Marketing cloud management is a growing discipline. If you
are like the MCM champion at most enterprises, you are just
beginning to understand the costs associated with the vendors
in the marketing cloud. Whether you work with Ghostery
Enterprise, with another provider, or develop the process
in-house, the key to success is considering the costs and
benefits to the whole business before allowing any marketing
vendor access to your website or customer data. The only way
to achieve this kind of balanced analysis is to work across
departments. The sooner teams can objectively work together
to better manage their marketing cloud, the sooner revenues,
market share and profits will grow.

20. 19
Ghostery is a technology company that empowers consumers and
businesses expose and eliminate the digital blindspots in the Marketing
Cloud - the collection of digital technologies that power, measure,
socialize, and optimize performance. Over 40 million people globally rely
on the free Ghostery browser extension to see and control the tracking
technologies that follow them across the web. Businesses rely on Ghostery
Marketing Cloud Management to drive ROI by maximizing the security,
performance, and profitability of their digital assets. Key clients like
Equifax, Intercontinental Hotels Group and Procter & Gamble depend on
Ghostery to take their digital business from chaos to control. Ghostery also
is the leading global provider of privacy governance services, powering
compliance for more than $2 billion of advertising and e-commerce
transactions annually. Founded in 2009, Ghostery is headquartered in
New York City with a technology office in Salt Lake City and sales offices in
London and San Francisco. The company is backed by Warburg Pincus LLC,
the global private equity fund.
ghosteryenterprise.com
sales@ghostery.com
/ghosteryinc
@ghosteryinc
/ghosteryinc
10 East 39th Street, 8th Floor, New York, NY 10016 Ι 917.262.2530
ABOUT GHOSTERY ENTERPRISE