6.5. ERMUSR 06-12-2007Elk River
Municipal Utilities
13069 Orono Parkway
Elk River, MN 55330
June 1, 2007
To: Elk River Municipal Utilities commission
Jerry Takle
Jim Tralle
Jerry Gumphrey
From: Theresa Slominski
Subject: Personal and/or Credit Use & Security Policy
phone: 763.441.2020
Fax: 763.441.8099
At the last commission meeting, I updated the Commission on a product called Online
Utility Exchange (OUE), which allows us to verify social security numbers for potential
fraud and credit problems. After our attorneys reviewed the agreement from OUE, it was
recommended that we create and adopt policies to recognize our fiduciary responsibility
to be in compliance with the Fair Credit Reporting Act, and establish repercussions for its
misuse. The attached Policy is the result of that request. It has been reviewed by our
attorneys and by OUE. Staff recommends its adoption.
Ells River GPfiunEcipal 1JUHUes
Personal and/air Qred5Use & Security Policy
Elk River Municipal Utilities (ERMU) collects social security numbers and has access to
credit information in order to better position the organization to be able to collect unpaid debts.
ERMU will request and use personal and/or credit information solely in connection with
credit transactions involving the consumer as to whom such information is sought, or for
other "permissible purposes" as defined by the Fair Credit Reporting Act, 15 U.S. C.
Section 1681 et seq. ("FCRA") and to effect the collection of unpaid debts.
1. Effective Date
The Plan's Credit Use Policy is effective XXX xx, xxxx. The Policy will remain in force until
changed or rescinded by Management or Board Action.
2. Security Management Process
Risk Analysis and Risk Management.
Appropriate security measures are implemented to protect the confidentiality and integrity of
this information described in this policy. Measures in place consist of limited dedicated user
access to personal and/or credit information, employee signature acknowledging
responsibility, computer passwords, locked cabinets, and locked facilities with limited access
Employee Sanctions
ERMU will apply appropriate employee sanctions to any employee ERMU who violates the
Personal and/or Credit Use and Security Policy. Sanctions can include termination of
employment when appropriate.
3. Security Official
The Plan(s) will officially designate a Security Official and maintain written record of the
designation. The current Security Official designation is the Finance Director.
Responsibilities of The Plan(s) Security Official include:
a. Periodically evaluate this policy and the procedures implemented to protect
personal and/or credit information. The Security Official will maintain reasonable
and appropriate policies and procedures to comply with the FCRA Standards and
make appropriate changes when necessary.
b. Regularly review the activity of any information systems involved in the
maintenance or transmission of personal and/or credit information to determine if
information has been used or disclosed in an inappropriate manner.
4. Workforce Security
Employee authorization to access systems that obtains or transmits personal and/or credit
information, including determination of appropriate employee clearance level, person
authentication, and effective and timely termination of system access for employees who no
Commission adopted
longer qualify for system access will be the responsibility of the Security Official. The
Security Official may delegate these duties to appropriate parties.
S. Security Awareness and Training
The Policy will require any employee of ERMi J who is involved in the administration or
management of personal and/or credit information to certify in writing that they have received
training and have read and understood The Personal and/or Credit Use & Security Policy.
Employees will also be provided additional security training when available and appropriate.
This training may include (but not be limited to) security reminders, protection from malicious
software.
At least once per year, the Security Officer will review the Personal and/or Credit Use &
Security Policy with individuals involved in the administration and management of the
information.
6. Workstation Use and Security Access and Audit Controls
The Policy implements the following procedures to control access to personal and/or credit
information and manage access to workstations that can be used to access personal and/or
credit information.
Employees will be assigned unique user names and passwords for systems used to access
personal and/or credit information.
The following workstation procedures will be implemented to minimize the potential risk of
inappropriate use of personal and/or credit information to the extent possible and reasonable.
a. When accessing personal and/or credit information on a workstation, employees will reduce
visible windows or close programs whenever they are not physically present at the
workstation or when individuals not authorized to access the personal and/or credit
information can view the workstation.
b. Workstation screensavers will be set to engage at a reasonably short timeframe.
c. Workstations will be located in areas where viewing of personal and/or credit information
by unauthorized individuals is unlikely.
d. Users with portable workstations such as laptops or PDAs are not allowed to store personal
and/or credit information on workstation drives. All personal and/or credit information
should be stored on company servers subject to security procedures described in this policy
unless the Security Officer determines it is necessary for plan administration purposes to
store personal and/or credit information on portable workstations.
Employees who have been granted access to personal and/or credit information according to the
policies and procedures will be subject to the sanction policy if they allow unauthorized access to
personal and/or credit information by circumventing access control (e.g. sharing their unique
login I.D. and password).
7. Device and Media Controls and Integrity of Data, Destruction of Data
Any personal and/or credit information stored by the company in electronic storage media will
be subject to the following procedures to ensure that the personal and/or credit information is
not inappropriately used.
• All hardware, storage devices, and electronic media which contains or contained credit and/or
personal information will be erased, re -formatted or rendered unusable in a technically sufficient
manner prior to disposal, or re -use for other purposes, to assure no unauthorized access to credit
and/or personal information is possible in the future. Additionally, all papers containing
Commission adopted
personal and/or credit information will be destroyed by burning, pulverizing, or shredding so
that the information cannot practicably be read or reconstructed.
• The Plan's Security Official will be responsible to ensure that electronic media is controlled in
accordance with this policy and maintain any reasonable documentation necessary.
Commission adopted
Fair Credit Reporting Act
Personal and/or Credit Use & Security
Employee Responsibility Form
I, , have read and understand Elk River Municipal
(Employee Name)
Utilities policies regarding the request and use of credit information received, as
mandated by the Fair Credit Reporting Act, 15 U.S.C. Section 1681 et seq. ("FCRA").
In addition, I acknowledge that I have received training in Elk River Municipal Utilities
policies concerning credit information use, disclosure, storage and destruction.
In consideration of my employment or compensation from Elk River Municipal
Utilities, I hereby agree that I will not at any time — either during my employment or
association with Elk River Municipal Utilities or after my employment or association
ends — use, access or disclose personal and/or credit information to any person or entity,
internally or externally, except as is required and permitted in the course of my duties
and responsibilities with Elk River Municipal Utilities, as set forth in Elk River
Municipal Utilities privacy policy and procedures or as permitted under FCRA. I
understand that this obligation extends to any personal and/or credit information that I
may acquire during the course of my employment or association with Elk River
Municipal Utilities, whether in oral, written or electronic form and regardless of the
manner in which access was obtained.
I understand and acknowledge my responsibility to apply Elk River Municipal Utilities
policies and procedures during the course of my employment or association. I also
understand that unauthorized use or disclosure of credit information will result in
disciplinary action, up to and including termination of employment or association with
Elk River Municipal Utilities and the imposition of civil penalties and criminal penalties
under applicable federal and state law, as well as professional disciplinary action as
appropriate.
I understand that this obligation will survive the termination of my employment or end
of my association with Elk River Municipal Utilities, regardless of the reason for such
termination.
Signature
Name
Date
Fair Credit Reporting Act
Personal and/or Credit Information Use & Security
Designation of Security Official
Elk River Municipal Utilities, hereby designates the Finance Director as Security
Official for the Credit Use and Security Policy.
This designation shall remain in force until changed in writing by Management or the
Board of Directors.
Signed
Title
Date