4.1d ERMUSR 01-11-2022COMMISSIONPOLICY
Section:Category:
GovernanceGovernancePolicies
Policy Reference:Policy Title:
G.2g3Information SecurityCommitteeCharter
PURPOSE:
Information security is managing risks to the confidentiality, integrity, and availability of
information using administrative, physical, and technical controls.
The Information Security Committee exists to help develop and maintain industry appropriate
information security policiesand oversight. Because of shared hardware and resources,there
exists an overlap and shared risk for ERMU and the City of Elk River (City) operations.
Although governed autonomously, this shall be an advisory Committee to both the ERMUand
theCity.
MEMBERSHIP:
ThisCommittee shall be comprised of equal representation from ERMU and the City. From
ERMU this committee shall include: a Commissioner, the General Manager, afield manager,an
administrative manager, and aninformation technology employee. From the City this committee
shall include: a Councilmember, the City Administrator, a field manager, an administrative
manager, and an information technology employee.At no time shall there be a quorum of the
Commission or the Council on the Committee.
The Commission shall appoint Committee member representatives annually following
the Commission election of officers during the March Regular Commission meeting. The
The Committee shall elect a
chair annually. The General Manager and the CityAdministrator shall serve as the authorized
reporting representatives for their respective governing bodies.
ROLE OF THE COMMITTEE CHAIR:
The primary role of the Committee Chair is to run the Committee meetingsand act as committee
secretary.The Committee will adhere to the Current edition of
Revised
bylaws, policies, and any special rules of orderthat the Commission may adopt; and similarly,
______________________________________________________________________________
Page 1of3
53
ERMUCommissionPolicyG.2g3Information Security CommitteeCharter
______________________________________________________________________________
the Committee action shall not be inconsistent with applicable laws and policies which regulate
the City of Elk River. The Committee meetings may be open or closed to employees at the
discretion of the Committee Chair.
AUTHORITY:
Except as established in this Committee Charter, the authority of the Committee is limited tothe
purpose of research and recommendation to ERMU and the City.
SPECIFIC DUTIES:
1.Policies and Procedures:Assist ERMU andtheCityin the development of information
security related policies.Review effectiveness of information security policy
implementations.Identify and recommend how to handle non-compliance. Assist with the
development of information security related procedures, standards, guidelines, and baselines
to the ERMU and theCity.At least annually, provide timely reportsincluding
recommendations regarding effectiveness of polices and procedures to ERMU and City
leadership teams.
2.Risk Assessment:Review industry appropriate information security trendsto maintain an up-
to-
Identify significant threats and vulnerabilities. Assess the adequacy and coordination of the
implementation of information security controls. Recommend methodologies and processes
for information security. Evaluate ongoing related legal and regulatory compliance changes.
Review incident information and recommend follow-up actions. At least annually, provide
timelyreportsincluding recommendationregarding risksassessment to ERMU and City
leadership teams.
3.Budget Development:Develop dataneeded for thorough evaluation of proposed information
security initiativesfor budget preparation and consideration. Information shall include
options, risk evaluation, resource requirements, implementation timelines, and costs. At least
annually and coordinating with their respective budgeting process schedules, provide timely
reports regarding information security initiatives proposed for consideration to ERMU and
City leadership teams.
4.Education and Awareness:Function as an information security program champion providing
roved security
initiatives and policies.Develop and implement plans and programs to maintain information
security awareness. Promote information security education, training, and awareness
throughout ERMU and the City.
SCHEDULE:
At a minimum, the Committee shall meet on an annualbasis.
______________________________________________________________________________
Page 2of3
54
ERMUCommissionPolicyG.2g3Information Security CommitteeCharter
______________________________________________________________________________
TERMINATION:
The Committee shall exist as a joint effort between ERMUand the City until at such time either
theCommission or Council dissolve the joint nature of the Committee.
POLICY HISTORY:
EstablishedAugust 8, 2017
RevisedNovember12, 2019
______________________________________________________________________________
Page 3of3
55