§ 74-93. Personal security procedures.

The water, sewer and garbage utilities adopt the following security procedures:

(1)

Paper documents, files, and electronic media containing secure information will be stored in a locked file cabinet.

(2)

Only specially identified employees with a legitimate need will have keys to the file cabinet.

(3)

Files containing personally identifiable information are kept in a locked file cabinet except when an employee is working on the file.

(4)

Employees will not leave sensitive papers out on their desks when they are away from their workstations.

(5)

Employees log off their computers when leaving their work areas.

(6)

Employees lock file cabinets when leaving their work areas.

(7)

Access to off-site storage facilities is limited to employees with a legitimate business need.

(8)

Any sensitive information shipped will be shipped using a shipping service that allows tracking of the delivery of this information.

(9)

Visitors who must enter areas where sensitive files are kept must be escorted by an employee of the utility.

(10)

Access to sensitive information will be password protected and passwords will not be shared or posted near workstations.

(11)

Anti-virus and anti-spyware programs will be run on individual computers and on servers daily.

(12)

When installing new software, vendor-supplied default passwords are changed.

(13)

Laptop users will not store sensitive information on their laptops.

(14)

The computer network will have a firewall where your network connects to the Internet.

(15)

References or background checks will be performed before hiring employees who will have access to sensitive data.

(16)

New employees who will have access to sensitive data will be trained to follow the town's confidentiality and security standards.

(17)

Employees will be alert to attempts at phone phishing.

(18)

Employees are required to notify the town clerk immediately if there is a potential security breach.

(19)

Employees who violate security policy are subject to discipline, up to, and including, dismissal.

(20)

Paper records will be shredded before being placed into the trash.

(Ord. No. 03-09, § 1-7, 4-13-2009)