4.2 ERMUSR 08-08-2017 Elk River
Municipal Utilities UTILITIES COMMISSION MEETING
TO: FROM:
ERMU Commission Troy Adams, P.E. - General Manager
MEETING DATE: AGENDA ITEM NUMBER:
August 8, 2017 4.2
SUBJECT:
Information Security Committee
ACTION REQUESTED:
Appoint a Commission representative to the Information Security Committee
BACKGROUND:
In 2017 the ERMU leadership team identified information security as a priority. Information
security was established as a strategic initiative and went through the 2017 budgeting process
where an allocation of resources was approved by the Commission.
The initiative had sufficient overlap with the City of Elk River that it was beneficial to both
parties to establish a collaborative effort. ERMU and City staff worked jointly to develop a scope
of work,reviewed quotes, and selected a consultant to perform a joint information security
assessment.
DISCUSSION:
One of the early recommendations from the consultant was to develop an information security
committee which would assist with the development of policy language, perform and report on
risk assessment, develop data needed for the budgeting process, and assist with staff education
and awareness.
There are benefits to creating a joint ERMU and City Information Security Committee which
include sharing of information and costs. The City Administrator has agreed to create the joint
committee and to serve in an advisory role to ERMU and City management. The committee
charter is attached for reference.
Even though the committee has been created as a management advisory committee, it had been
determined that representation from the governing bodies on this committee would be beneficial.
Any work product from this committee resulting in an initiative requiring capital expenditure
would be subject to any governance spending authority policy and/or approval budget procedure.
And as a result, it would be beneficial to have Commission and Council representative on the
committee who would have working knowledge of committee initiatives which may require
approval through the budget process.
ATTACHMENTS:
• ERMU Management Policy - A.24a Information Security Committee Charter
Page 1of1
42
Elk River
Municipal Utilities MANAGEMENT POLICY
Section: Category:
Management Administration Policies
Policy Reference: Policy Title:
A.24a Information Security Committee Charter
PURPOSE:
Information security is managing risks to the confidentiality, integrity, and availability of
information using administrative,physical, and technical controls.
The Information Security Committee exists to help develop and maintain industry appropriate
information security policies and oversight. Because of shared hardware and resources, there
exists an overlap and shared risk for ERMU and the City of Elk River operations. So although
governed autonomously, this shall be an advisory Committee to both the ERMU's and the City
of Elk River's management/leadership teams.
MEMBERSHIP:
This Committee shall be comprised of equal representation from ERMU and the City. From
ERMU this committee shall include: a Commissioner, the General Manager, the field manager,
an administrative manager, and an information technology employee. From the City this
committee shall include: a Councilmember, the City Administrator, a field manager, an
administrative manager, and an information technology employee. At no time shall there be a
quorum of the Commission or the Council on the Committee.
The Commission shall appoint ERMU's Committee member representatives annually following
the Commission election of officers during the March Regular Commission meeting. The
Council shall appoint the City's representatives annually in March. The Committee shall elect a
chair annually. The General Manager and the City Administrator shall serve as the authorized
reporting representatives for their respective governing bodies.
ROLE OF THE COMMITTEE CHAIR:
The primary role of the Committee Chair is to run the Committee meetings and act as committee
secretary. The Committee will adhere to the Current edition of Robert's Rules of Order Newly
Revised for all situations to which they are applicable and are not inconsistent with ERMU's
bylaws,policies, and any special rules of order that the Commission may adopt; and similarly,
Page 1 of 3
43
ERMU Management Policy—A.24a Information Security Committee Charter
the Committee action shall not be inconsistent with applicable laws and policies which regulate
the City of Elk River. The Committee meetings may be open or closed to employees at the
discretion of the Committee Chair.
AUTHORITY:
Except as established in this Committee Charter, the authority of the Committee is limited to the
purpose of research and recommendation to ERMU and City leadership teams.
SPECIFIC DUTIES:
1. Policies and Procedures: Assist ERMU and City leadership in the development of
information security related policies. Review effectiveness of information security policy
implementations. Identify and recommend how to handle non-compliance. Assist with the
development of information security related procedures, standards, guidelines, and baselines
to the ERMU and City leadership teams. At least annually, provide timely reports including
recommendations regarding effectiveness of polices and procedures to ERMU and City
leadership teams.
2. Risk Assessment: Review industry appropriate information security trends to maintain an up-
to-date perspective on related risks and industry's best practice risk mitigation methods.
Identify significant threats and vulnerabilities. Assess the adequacy and coordination of the
implementation of information security controls. Recommend methodologies and processes
for information security. Evaluate ongoing related legal and regulatory compliance changes.
Review incident information and recommend follow-up actions. At least annually,provide
timely reports including recommendation regarding risks assessment to ERMU and City
leadership teams.
3. Budget Development: Develop data needed for thorough evaluation of proposed information
security initiatives for budget preparation and consideration. Information shall include
options, risk evaluation, resource requirements, implementation timelines, and costs. At least
annually and coordinating with their respective budgeting process schedules, provide timely
reports regarding information security initiatives proposed for consideration to ERMU and
City leadership teams.
4. Education and Awareness: Function as an information security program champion providing
clear direction and unity in ERMU and City leadership teams' support for approved security
initiatives and policies. Develop and implement plans and programs to maintain information
security awareness. Promote information security education, training, and awareness
throughout ERMU and the City.
SCHEDULE:
At a minimum, the Committee shall meet on an annual basis.
Page 2 of 3
44
ERMU Management Policy—A.24a Information Security Committee Charter
TERMINATION:
The Committee shall exist as a joint effort between ERMU and the City until at such time either
the General Manager or the City Administrator dissolve the joint nature of the Committee.
POLICY HISTORY:
Established August 8, 2017
Page 3 of 3
45