Loading...
HomeMy WebLinkAboutAgenda_GGAF_10.28.2020Notice of Meeting for the General Gov ernment and F inance Adv isory B oard of the City of Georgetown October 28, 2020 at 4:30 P M at Georgetown P ublic L ibrary, 402 W 8th Street Georgetown, T X 78626 T he C ity of G eorgetown is committed to compliance with the Americans with Disabilities Act (ADA). If you require as s is tance in partic ipating at a public meeting due to a disability, as defined under the ADA, reas onable as s is tance, adaptations , or ac commodations will be provided upon request. P leas e c ontact the C ity S ec retary's O ffic e, at leas t three (3) days prior to the sc heduled meeting date, at (512) 930-3652 or C ity Hall at 808 Martin Luther King Jr. S treet, G eorgetown, T X 78626 for additional information; T T Y users route through R elay Texas at 711. Consiste nt with Gover nor Gr eg A bbott’s suspension of var ious provisions of the O pen M ee tings A ct, e ffec tive A ugust 1, 2020 and until fur the r notic e, to r educ e the c hance of C O V I D-19 tr ansmission, all C ity of Ge orge town Advisor y B oar d mee tings will be held vir tually. P ublic c omment will be allowed via telec onfer ence ; no one will be allowed to appear in pe rson. To participate , please c opy and paste the following we blink into your browse r: Weblink: J oin Zoom M e eting https://geor getowntx.zoom.us/j/96359697305? pwd=a3h H d2hhTWwva WswS mdp T V J D ZE x0 Zz09 M e eting I D: 963 5969 7305 P assc ode : 086481 Dial by your loc ation 888 475 4499 U S Toll-fre e 833 548 0276 U S Toll-fre e 833 548 0282 U S Toll-fre e 877 853 5257 U S Toll-fre e M e eting I D: 963 5969 7305 P assc ode : 086481 F ind your loc al numbe r: https://geor getowntx.zoom.us/u/amW F kY w G S Citizen comme nts are acc epted in thr ee differ ent for mats: 1. Submit written comme nts to danella.e lliott@ge orge town.org by noon on the date of the mee ting and the R ec ording S ec re tary will r ead your c omments into the r ec ording during the item that is being Page 1 of 167 discussed. 2. L og onto the mee ting at the link above and “r aise your hand” during the item. 3. Use your home /mobile phone to call the toll-fre e numbe r To join a Zoom me eting, c lick on the link provided and join as an attende e. You will be aske d to e nte r your name and email addre ss (this is so we can ide ntify you when you ar e c alled upon). To spe ak on an item, clic k on the “Raise your H and” option at the bottom of the Zoom mee ting we bpage once that ite m has opened. Whe n you are calle d upon by the Re cor ding Se cr etar y, your devic e will be r emotely un-muted by the A dministrator and you may spe ak for thre e minute s. P lease state your name clear ly, and when your time is over, your de vice will be muted again. Use of pr ofanity, thr eate ning language, slande rous r emarks or thr eats of harm are not allowed and will re sult in you be ing imme diately re moved fr om the mee ting. Regular Session (T his R egular S es s ion may, at any time, be rec es s ed to c onvene an Exec utive S es s ion for any purpose authorized by the O pen Meetings Act, Texas G overnment C ode 551.) A Disc ussion on how this virtual c onference will be c onducted, to inc lude options for public c omments and how the public may addres s the C ommis s ion –Tommy G onzalez, G G AF C hair B R eview minutes from the August 26, 2020 G eneral G o vernment and F inance Ad visory Board Meeting - Danella Elliott, Board Liaison C P resentation, disc ussion and update on mitigation since the 2018 ris k as s es s ment. – Mayra C antu, Management Analys t D C ons ideration and possible action to recommend a res olution formally adopting the C ity’s Investment P olic ies for F is cal Year 2021 – Leigh Wallace, F inanc e Direc tor E C ons ideration and possible recommendation to C ounc il of a c ontract with S uddenlink to provide dedic ated Internet s ervic e for a total of $136,620 over three years . - James Davis, I T Manager - O perations F C ons ideration and possible action to recommend to C ounc il the purc hase of vehic les and equipment in the amount of $2,317,620 - S tan Hohman, F leet S ervic es Manager Adjournment Ce rtificate of Posting I, R obyn Densmore, C ity S ecretary for the C ity of G eorgetown, Texas, do hereby c ertify that this Notic e of Meeting was posted at C ity Hall, 808 Martin Luther King Jr. S treet, G eorgetown, T X 78626, a plac e readily acc es s ible to the general public as required by law, on the _____ day of _________________, 2020, at Page 2 of 167 __________, and remained s o posted for at leas t 72 c ontinuous hours prec eding the s cheduled time of said meeting. __________________________________ R obyn Dens more, C ity S ec retary Page 3 of 167 City of Georgetown, Texas Government and Finance Advisory Board October 28, 2020 S UB J E C T: R eview minutes from the Augus t 26, 2020 G eneral G overnment and F inance Ad visory Bo ard Meeting - Danella Elliott, Board Liais on IT E M S UMMARY: F IN AN C IAL IMPAC T: . S UB MIT T E D B Y: Danella Elliott AT TAC H ME N T S: Description Type 08.26.2020 Draft Minutes Backup Material Page 4 of 167 Minutes of Meeting of the GENERAL GOVERNMENT AND FINANCE ADVISORY BOARD (GGAF) City of Georgetown, Texas August 26, 2020 The General Government and Finance Advisory Board met on Wednesday, August 26, 2020 at 4:30 PM via Zoom virtual meeting. The City of Georgetown is committed to compliance with the Americans with Disabilities Act (ADA). If you require assistance in participating at a public meeting due to a disability, as defined under the ADA, reasonable assistance, adaptations, or accommodations will be provided upon request. Please contact the City Secretary’s Office, at least three (3) days prior to the scheduled meeting date, at (512) 930-3652 or City Hall at 808 Martin Luther King Jr Street for additional information; TTY users route through Relay Texas at 711. The meeting was held with the Governor’s Order, all City Buildings are following these procedures: • Masks are recommended • Physical distancing; 6 feet between you and anyone not in your household • Practice good hygiene and wash your hands Board Members Present: City Staff Present: Tommy Gonzalez, Chair Kevin Pitts, Vice-Chair Stu McLennan, Secretary Robert Witt David Morgan, City Manager Laurie Brewer, Assistant City Manager Leigh Wallace, Finance Director Tadd Phillips, HR Director Laura Maloy, Assistant HR Director Holly Moyer, Benefits Consultant Greg Berglund, Assistant IT Director Eric Johnson, Facilities Director Trish Long, Facilities Superintendent Mayra Cantu, Management Analyst Danella Elliott, Board Liaison Board Members Absent: Eric Corp Others present: Rebecca Hawes, Gallagher Consultant Legislative Regular Agenda Tommy Gonzalez called the meeting to order at 4:41 p.m. A. Discussion on how this virtual conference will be conducted to include options for public comments and how the public may address the Commission – Tommy Gonzalez, GGAF Chair Tommy and Danella explained how the virtual conference would be conducted, including options for public comment. B. Review minutes from the June 24, 2020 General Government and Finance Advisory Board Meeting -Danella Elliott, Board Liaison Motion to approve the minutes by Stu McLennan; second by Kevin Pitts. Approved 4-0. Eric Corp absent. C. Consideration and possible action to award contracts for self-funded dental; program administration services, employee voluntary short-term and long-term disability insurance, employee supplemental insurance, an employee benefits concierge services authorizing the City Page 5 of 167 Manager to enter into such contracts on behalf of the City – Tadd Phillips, Human Resources and Organizational Development Director Tadd gave an overview presentation and noted that in response to the City’s competitively advertised RFP, a total of 21 proposals for one or more coverages were received Employee Health Benefit (including dental, voluntary short-term disability, long-term disability, supplemental insurance and benefits concierge services) for the upcoming 2021 calendar coverage year. He went over the process and timeline, as well as the scoring criteria. Proposals were evaluated extensively by Human Resources, Gallagher and Co. (the City’s benefits consultant), and the Employee Benefits Committee, focusing on coverage offered as well as the financial impact. Finalists for major coverages were invited to make a presentation, and the City entered negotiations with the final candidates. Where possible, coverages were bundled during negotiations to achieve the best value for the City. RFP recommendations are for a proposed new vendor for dental and supplemental insurance, and maintaining the current vendor for disability and concierge services. Based on the overall offering, financial impact on the City and the impact on em ployees, staff recommends GGAF approval to forward the following recommendations to Council: Program Current Partner Recommended Partner Self-Funded Dental Administration Ameritas Guardian Life Employee Supplemental Insurance Aflac Blue Cross Blue Shield TX Employee voluntary short-term & long-term disability Blue Cross Blue Shield TX Blue Cross Blue Shield TX Benefits Concierge Services Alight (Compass) Alight (Compass) The City anticipates offering competitive benefits to employees while minimalizing the financial impact to both employees and the City. Contract and rate guarantee terms vary between one and year years, depending on program. Coverages will be reviewed during the year to evaluate performance, and the City has the option to renew for an additional year, saving the cost of processing an RFP, providing continuity in care to employees and allowing the City to establish an ongoing relationship with the provider. The RFP included a mix of benefits paid by the employee, employer, and a combination of both. The four programs current annual cost to the City is $168,076. The selected bids will result in an increase of $1,596 or less than 1% increase. This is all within self-insurance fund budget. Motion to approve Item C by Kevin Pitts; second by Stu McLennan. Approved 4-0. Eric Corp absent. D. Consideration and possible recommendation to approve a contract amendment and extension with Microsoft to provide Microsoft-branded software, and services to the City of Georgetown for a total of $1,129,246.73 over 38 months. -- Greg Berglund, Assistant Director, Information Technology Greg Berglund, Assistant IT Director, explained that the City entered a three-year Enterprise Agreement with Microsoft in 2017. This agreement provides the City with licensing rights to install Microsoft products on City computer equipment, enables the IT Department to plan for enterprise upgrades to Microsoft software, utilizes Microsoft cloud services and provides software assurance which includes 24 x 7 technical support, access to the most current version of all applications, planning services, and technical training. Microsoft operating systems and software power every desktop, laptop and server on our computer networks. These tools enhance communication and collaboration and scale seamlessly with Page 6 of 167 growth while providing the top enterprise grade collaboration tools. These services have a financially backed 99.9% uptime service level and allow staff access to the tools across any internet connection. The City of Georgetown benefits heavily from having an Enterprise Agreement with Microsoft, and is a very cost-effective way to purchase these products. The differences are: in 2017, we had 550 users, and in 2020 we are up to 900 users. We renegotiated the number of users and get more out of the licenses as well. Also included is enhanced security, included enabling two-factor authentication. The contract is more, but the actual per user license has decreased. The cost in 2017 was $467 per user/per year, and the new contract is lower at $396 per user/per year. Staff recommends that the City approve a contract amendment and extension (for additional 38 months) of the City’s Microsoft Enterprise Agreement. Motion to approve Item D by Stu McLennan; second by Kevin Pitts. Approved 4-0. Eric Corp absent. E. Consideration and possible recommendation of approval to purchase laptops, desktops, and docking stations from Dell Inc. for an amount not to exceed $199,971.08 -- Greg Berglund, Assistant Director, Information Technology Dell Inc. has been the City’s vendor for desktop computers for approximately 10 years. In the first and second quarter of Fiscal Year 2020, the IT Department evaluated three vendors (Dell, HP, Lenovo) and determined Dell products to be the best value. Implementation of these strategies over the next five years will prepare the City need to efficiently manage a hybrid environment that includes physical desktops and Cloud based virtual desktops. Vendors were evaluated on: 1. Cost 2. Local economic impact of company 3. Responsiveness 4. Professional services 5. Product support offerings (City staff knowledge of the products (product options and fit with the City’s internal support model) In 2019, after conducting the study and a laptop computer pilot program, the City implemented a new strategy for the provision of desktop computers to employees to meet modern business needs and address technology changes. A five-year, three-pronged strategy was proposed to address these issues. On March 24th, due to COVID-19, an item went straight to Council for approval to purchase 163 laptops and accessories for $233,000. Employees needed to be able to have the equipment/technology quickly to be able to work remotely. This emergency purchase was approved, and that portion of the computer replacement project is completed. This has been reevaluated, and we would like to purchase the remaining equipment that was initially proposed in the 2020 budget as part of the City’s desktop computer strategy implementation. Half of the planned purchase order was expedited in response to COVID-19 (mentioned above) and this request is to complete the original planned purchase. Notes from Stu McLennan: • Cost is $199,971.08. Leverage DIR-TSO-3763 contract. • OptiPlex 5070 desktops (x18) • Laptops (x135); Dell Latitude 5420 (x20), Dell Latitude 5410 (x95), Mobile Precision 3551 (x20). • Q1: Item Summary says laptops (x153). Typo? o A1. Yes. Page 7 of 167 • Confirm “and accessories”. Docking stations (x135); Dell Dock WD19 (x115) and Dell Thunderbolt (20) • Planned for 2020. Expedited purchase of 50% due to COVID-19. This completes the buy. • Q2: Did Council approve $233,447 purchase @ meeting on March 24th? o A2. Yes. • In 2019, CoG changed from its virtual desktop strategy. VDI underperformed and was labor intensive. • CoG strategy now to purchase desktops (FY 20-22) and plan for cloud-based VDI (FY 22-24). • GGAF discussed VMWare and cloud on May 29, 2019. Purchased 7x servers and VMWare software for primary datacenter. Dell agreed to buy replaced Cisco servers. Chris can see CoG moving to a cloud based capability in 5-years. Staff recommends the purchase of 135 laptops, 18 desktops, and accessories. Motion to approve Item E by Stu McLennan; second by Kevin Pitts. Approved 4-0. Eric Corp absent. F. Consideration and possible action to approve a Construction Contract with Brandt Companies, LLC, of Carrollton, Texas for the Construction of the Natatorium Pool HVAC Unit Replacement, at the Georgetown Recreation Center in the amount of $607,077. – Eric Johnson, Facilities Director Eric went over the timeline for discussions on this topic, and explained that the original HVAC unit in the pool area of the Georgetown Recreation Center was in need of extensive repairs. The boiler is not in operation (it has no heat), one of the two circuits is down, the copper inside of the unit has extensive corrosion and is beginning to leak, and we performed repairs in 2019 totaling $68K. The City contracted with Jose I. Guerra, Inc. (JIG) in 2019 to design a replacement unit for the pool area. They provided Construction Specifications and Construction Documents in June of 2020. Trish Long provided the HVAC equipment inventory and noted that we have 449 pieces of equipment, and of that total, 49 contain R22. She explained that we will continue to budget replacement funds until R22 phase-out is complete. Approximately $400K is budgeted in FY21. On July 20, 2020, the City of Georgetown issued an Invitation to Bid for the Rec Center Natatorium Pool Unit replacement. On August 14, 2020 we received three (3) competitive bids. The low qualified bidder for the project was Brandt Companies, LLC with a total bid of $607,077. Jose I. Guerra, Inc (J IG) has reviewed the submitted bid by the Brandt Companies. As a result of the findings JIG recommend the contract be awarded to Brandt Companies, LLC. Notes from Stu McLennan: • GGAF discussed on Feb 26, 2020. Estimated cost was $700-$800,000. o CoG budgeted $800,000 in FY2020. o Funded by COOs in spring 2021. • Action item submitted to Council on March 24th, June 9th, and June 23rd. o Council approved reimbursement resolution on June 23rd. • $68,000 in repairs in 2019. • CoG issued RFP on July 20th. Received three proposals on August 14th. • Q1: Why was DKC proposal $910,000? • A1: DKC is a GC. Markup is for overhead and profit. Other two are HVHC contractors. • Trish Long, Facilities Superintendent. o CoG has 449x pieces of HVAC equipment. o 22x still have R-22. Page 8 of 167 Tommy reminded Eric that we needed to give the public as much notice as possible when the pool will be closing, and the expected duration of the closure. Motion to approve Item F by Kevin Pitts, second by Stu McLennan. Approved 4-0. Eric Corp absent. G. Discussion and possible action to recommend Council adopt changes to the Fiscal and Budgetary Policy during the annual budget adoption process for Fiscal Year 2021 – Leigh Wallace, Finance Director Leigh presented the proposed changes to the Fiscal and Budgetary Policy for the upcoming budget. The purpose of the Fiscal and Budgetary Policy is to provide the framework for financial operations of the City and to ensure prudent stewardship, financial planning and accountability. The bond rating agencies and external auditors are the primary external parties that review the policies and compliance. Leigh said that the goals was to find a balance between flexible enough to allow for situations that you may not can foresee until they happen, but also firm enough that they are guiding the organization in the right direction. Each year the Policy is administratively amended to recognize date and amount changes within the text; and to address any new financial or regulatory requirement that may need to be added. Other amendments may be recommended to clarify wording or to further define a particular policy area. Leigh gave some examples of past updates and explained the different types of changes usually included in the policy: Potential administrative changes for consideration and discussion include: • Clarify existing wording and formatting • Remove old language that no longer applies • Update compliance for coming fiscal year Potential substantive changes for consideration and discussion include: • Changing the meaning of the policy – Calculation change – Definition change – Change in decision maker • Adding new policies Leigh said that the COVID-19 pandemic was an opportunity to look at the policies in a new light, under circumstances that were emergency in nature and unusual compared to what they have typically been used for in the past. She is recommending broadening the wording in the within the budget contingency plan section to accommodate a wider variety of circumstances in which the plan may need to be used but still leaving in tact the actions that are authorized for the City Manager and City Council to take. Other recommended changes are an update to the compliance within our own Capital Maintenance and Replacement and a change to our Debt Management Policy and Procedure, slightly broadening the wording of the method of sale. Below is a recap of the recommended changes. There will be a Workshop with Council on September 8th and adoption of the policies will be an item on the September 22, 2020 Council meeting. Page 9 of 167 Leigh will also add a reference to the Social Service Funding Policy when this presentation goes to Council. Leigh explained that we do have 75 days of operating expenses (Citywide) and we do meet that reserve requirement. She feels confident/comfortable that we are using reserves in an appropriate way with language on how the reserves should be restored in the future and she feels very comfortable with that. She also mentioned that we have been recognized in the past by our credit rating agencies for our strong fiscal policies that recognize our flexible liquidity. Discussion on some wording changes between Leigh and members, and she will make sure they are included in the correct locations throughout the policies. Tommy suggested that Leigh send to all board members a listing of all reserves and what those dollar amounts are for each. Leigh said that it was in the budget document under the All Funds schedule, and totals about $78M in all reserves for all 40ish funds across the city. Notes from Stu McLennan: • Proposed changes for 2021. • Normally to GGAF and then Council in June-July. COVID-19 has affected that timeline. • Section IX; Budget Contingency Plan. o Impact of pandemic. • Split GUS Board. o Electric Utility - Electric. o Water Utility - Water and Wastewater. • Section XV; Financial Conditions and Reserves. o Add GTEC and GEDCO reserves. o Remove Downtown TIRZ debt service reserve. No longer needed. o Add Cemetery reserve. • Leigh explained IT recovery rates vis-à-vis the purchase of fiber assets from the Electric Utility Fund. Section XI(C)(2). Annually in 2021 to 2023, CoG will save 20% over IT’s 90-day Capital Reserve Fund Balance to facilitate this purchase. • CoG currently has $78 million in 90-day reserves for 40 funds. • Since 2012, the CoG has used $5 per capita based on 71,000 residents. Currently overfunded since CoG is ~60,000 residents. US Census reflects 79,000. Motion to approve Item G (with the recommended changes) by Kevin Pitts, second by Stu McLennan. Approved 4-0. Eric Corp absent. Page 10 of 167 Motion to adjourn meeting by Stu McLennan, second by Kevin Pitts, approved 4-0. Meeting adjourned at 5:55 pm. __________________________________ ____________ Tommy Gonzalez Date Board Chair ___ _______________________________ ____________ Stu McLennan Date Board Secretary __________________________________ ____________ Danella Elliott Date Board Liaison Page 11 of 167 City of Georgetown, Texas Government and Finance Advisory Board October 28, 2020 S UB J E C T: P res entation, dis cus s ion and update on mitigation s inc e the 2018 risk assessment. – Mayra C antu, Management Analyst IT E M S UMMARY: In 2018 the c ity had an enterprise ris k as s es s ment c onducted by P lante Moran. T he risk assessment detailed s everal ris ks across the various departments and highlighted mitigation we were doing at the time, recommendations on how to addres s some ris ing risks , and s taff ’s respons e to the recommendations . S inc e then several mitigation efforts have oc curred in respons e to the ris k as s es s ment. T his presentation provides an update and overview of the mitigation efforts that are ongoing, c ompleted, and some near-term actions s taff will complete to further mitigate risk ac ros s the C ity. F IN AN C IAL IMPAC T: . S UB MIT T E D B Y: S haron A P arker AT TAC H ME N T S: Description Type RMR Pres entation Ris k Mitigation Report Backup Material Georgetown Ris k As s es s ment Backup Material Page 12 of 167 Risk Mitigation Report Page 13 of 167 OVERVIEW •Introduction •2018 Risk Assessment •Mitigation Completed •Recommendations Page 14 of 167 RISK CYCLE 1. Risk Identification 2. Risk Assessment 3. Risk Mitigation, Planning, and Implementation 4. Risk and Mitigation Tracking Page 15 of 167 DEPARTMENTS/DIVISIONS •City Secretary •City Manager’s Office •Controller •Emergency Management •Facilities •Finance •Fire •Human Resources •Information Technology •Parks •Police •Purchasing •Records •Utility (Customer Care, Water and Electric) Page 16 of 167 RISK UNIVERSE City of Georgetown Risk Universe Access to Talent IT Security Awareness, Training, and Education Billing for Citizen Services IT Third Party Roles and Responsibilities Budget and Planning Leadership Composition of Tax Base Legislation Disaster Recovery/Business Continuity Physical Security Emergency Notification System Failure Police failure Fire Department Failure Records Management Freedom of Information Act (FOIA)Regulatory Filings Fraud Segregation of Duties Grant Obligations State-Fed Regulations Health & Safety Succession Planning IT Access Management Talent Management IT Asset Management: Data Classification Tax IT contingency Plan Utility market IT Critical Security Event Identification Utility Outage IT Cybersecurity Governance Model Vendor Reliance IT Incident Response Management Page 17 of 167 11 14 14 15 12 14 12 14 14 14 15 19 14 13 14 14 9 14 13 12 12 14 14 12 14 4 4 1 2 3 2 2 3 1 2 4 3 1 1 6 4 4 2 3 1 1 2 2 3 3 3 1 4 3 1 1 1 1 4 3 3 3 0 5 10 15 20 25 30 AIR ASV ATT COD COM CRT CUS CVB ECO ENG FIN GFD GPD GUS PLH HUR BINS ITS LIB MGR PRK SEC SWR TSP WSV 2018 Residual Risks by KBD Low 1-8 Med 9-16 High 17> Page 18 of 167 MITIGATION SUMMARY IMPACT / OCCURRENCE LIKELIHOOD LEVEL 2018 Risks Fully Mitigated Partially Mitigated Not Mitigated HIGH 5 2 3 0 MEDIUM 17 5 12 0 LOW 11 6 4 1 Total 33 39%58%3% Page 19 of 167 SIGNIFICANT CHANGES SINCE 2018 •Electric Utility-Energy Portfolio Management •Reorganization of City •Workday ERP •COVID-19 •Impact On FY2020 Budget And Beyond •Lost EMS iPad •Possible HIPAA Breach •Senate Bill 2 (revenue caps) •Shot Clock Legislation •Back-Up Data Center Page 20 of 167 MITIGATION-INFORMATION TECHNOLOGY Cybersecurity Policy •Completed a primary draft of a comprehensive Cybersecurity Policy, currently under review by the legal department. System and Network Contingency Plan •Incident Response Plan in development. This plan is scheduled for completion in December of 2020. Security Information and Event Management System •Multiple Security Information and Event Management Systems (SIEMs) are under review by the IT Department. •IT Department is evaluating the possibility of managed service contracts through the Texas Department of Information Resources to help fulfill this need. Page 21 of 167 MITIGATION-INFORMATION TECHNOLOGY Staff IT Security and Awareness Training •Successfully implemented a Security and Awareness Training initiative in FY 2020. •In June of 2020, the City Security Awareness Training program was certified by the State of Texas as complete for the current calendar year. Secondary Back-Up Data Center •A back-up data center was successfully brought online in the Winter of FY 2020. The purpose of this data center is to act as a failover in the case of a failure at the City’s primary data center. Homeland Security Audit Page 22 of 167 MITIGATION-PUBLIC SAFETY HIPAA Audit •The audit identified measures that need to be taken to maximize the protection of private health information and has informed a work plan for staff to reduce the risk of a breach occurring. Guardian Tracking –Police Performance Management Software •The software is used to formally capture praise, counseling, goal setting, and discipline. •The software also serves as an early warning system for repeated substandard performance. CommUNITY Advisory Task Force •Established in July of 2020 comprised of 20+ diverse community leaders. The task force will be working with the Chief to provide input regarding the state of policing in Georgetown as well as providing input as to the direction of the CommUNITY Initiative. •The police department plans to conduct six Listen and Learn Summits across six different stakeholder groups in FY2021. Page 23 of 167 MITIGATION-PUBLIC SAFETY Police Training –Arbinger Institute •The police department is in the process of having their officers complete training created by the Arbinger Institute. This training focuses on transitioning a self-focused inward mindset to an impact- focused outward mindset •Focuses on situational awareness and officer safety, trust and collaboration, and leadership. Replacement of Police Body Cameras •All cameras and the digital data derived are on one unified management software system. •The current technology is far superior to the old allowing for real time viewing, wider angles, seamless integration between car and body cameras, and automatic synchronization of all incident cameras on playback. Fire Station 6 and 7 •Fire Station 6 is open and 7 is set to open soon, adding additional resources to key areas within the City for a more efficient response. Fire station 7 will also add an engine and ambulance to our EMS system. Page 24 of 167 MITIGATION –EMERGENCY MANAGEMENT COVID-19 Response •The City is working closely with Williamson County, the Williamson County and Cities Health District, and State partners to coordinate our response to the pandemic. •The City has created an inventory of personal protective equipment to ensure adequate supplies both for first responders and general employees to be appropriately protected. •The City has amended internal personnel policies to ensure appropriate social distancing at work, allowing employees to telework when appropriate, and appropriate measures are taken when employees test positive for COVID -19 Hazard Mitigation Action Plan •The plan helps the City appropriately assess, prioritize, prepare for, and mitigate natural or human -caused hazards. This plan will allow the City to maintain eligibility for future federal mitigation grant funding and help identify mitigation act ions that will make the local community more disaster resistant Planning •Select staff recently completed a tabletop exercise on a cybersecurity event. In tabletop exercises key personnel who have emergency management roles and responsibilities gather to discuss various simulated emergency situations. This allows the City to think more proactively and align possible response efforts to events that could happen. Page 25 of 167 MITIGATION –CITY SECRETARY’S OFFICE Freedom of Information Act •The Open Records Coordinator will continue to provide annual trainings to staff related to best practices for responding to FOIA requests and do routine reviews of the Open Records Request policies and procedures. Records Management •The Records Management Team does a routine review of the Records Management policies and procedures to ensure that best practices are always being implemented. •Provide annual training to all employees Page 26 of 167 MITIGATION –FACILITIES Facility Access Policy •City Facilities are migrating to a public lobby and secure back of house model, •This policy will help establish necessary employee access to non-public areas within City Facilities. Georgetown Municipal Complex(GMC) Remodel •Secure separation of public and employee space requires building modifications, including access control doors and publicly accessible meeting space to keep employees from bringing public into the secure space. HLWW Remodel •Building currently requires entry from an alley and there is no separation from the public space and employee areas. •Remodel moves the front Planning entry to Martin Luther King Jr. St. •Will allow the use of a public lobby with a secure door to the employee area. Page 27 of 167 MITIGATION –CITY MANAGER’S OFFICE Organizational Performance Management •The City Manager’s Office routinely reviews departments performance metrics. On a biannual basis the metrics are reviewed and analyzed for performance. •Allows CMO to address area of concerns •Further supports budget requests given data Business Plans •The City had all departments and service areas create and complete business plans that help strategically align the departments missions and goals to objectives that will be completed over the next few years. •Reviewed regularly by management to ensure action plans are being completed. Legislative Advocacy •The Legislative Task Force is a special ad hoc group comprised of active leaders in the community -the leadership of City Boards and Commissions. •The Legislative Program will provide input to City Council on the issues relevant to the State Legislative Agenda in preparation for the Texas State Legislative Sessions. •Communicate to create stronger public engagement and advocacy with the legislature Page 28 of 167 MITIGATION -FINANCE Financial and HR Management/Workday •This new system has aligned financials and human resources to one system streamlining purchasing, travel, hiring, accounting, and budget to name a few high- level processes •Conducted detailed process reviews to implement best practices •Enhanced user and access controls •Created process controls such as budget checks on purchases and created a system of multi-level of approvals for purchases •Created better reporting •Implementing a budget module and project module to streamline and integrate workflows within the Workday system Page 29 of 167 MITIGATION -FINANCE Internal Audit Plan •Staff is creating a multi-year internal audit to apply a disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. •Some of the audits staff are including in the audit plan are: •Fee Collection Review •Hotel/Motel Audit •Franchise Fees •Airport Revenue Page 30 of 167 MITIGATION -FINANCE Sales Tax Audit of City Enterprise Revenue •The State is currently conducting a sales tax audit of revenue from city services that began in June 2020. •The audit helps determine whether taxes have been properly collected from city services, reported, and paid to the state. (Electric, Garbage, Airport) Page 31 of 167 MITIGATION –HUMAN RESOURCES Business Plans •The City had all departments and service areas create and complete business plans that help strategically align the departments missions and goals to objectives that will be completed over the next few years. •Reviewed regularly by management to ensure action plans are being completed. Organizational Development •The City hired its first learning and development coordinator in 2020. The coordinator has built a learning and development strategic plan that will be deployed over the next two years. •Plan includes multiyear approach to talent management and making use of Workday talent capabilities •In 2019 the City created the organizational & operational excellence office •The office has since rolled out annual business plans for all departments, lean trainings, and currently support over 60 lean process improvement projects.Page 32 of 167 MITIGATION –HUMAN RESOURCES Policy Updates •Six personnel policies were updated in alignment with Workday implementation in 2019 including introductory period, vacations, sick leave, hours of work, compensatory time, and holiday. •Multiple temporary policies have been issued during the COVID-19 Pandemic including telework and flex time. Safety & Risk Management Team •The City’s safety and risk management programs were combined, centralized, and staffed by three full- time employees focused on the development and evaluation of occupational safety and risk management programs in 2019. •Improved handling of citizen claims, accuracy in covered city property, management of our third-party risk pool administrators, and given greater support to our employees who experience work-related injuries •Building data sets to better understand worker injury and accident trends and working with stakeholders on appropriate mitigating actions Page 33 of 167 MITIGATION -UTILITIES OVERALL Weaver Assessment –Cash Receipt Review •Assisted in the review and identification of all cash receipts currently received the by City’s Utility Billing Office •Provided risk-control matrices and process mapping for areas in the City’s Utility and Accounting Offices where internal risks could occur. Weaver Assessment –UMAX Business Process Mapping •Provided a review of the City’s Utility Office internal controls, transactional processing efficiencies and review of audit trails and automated workflows integrated in the City’s new UMAX/CIS. •Documented workflows that are used when reviewing business processes. •The high-risk areas have been mitigated and many of the moderate risks have been addressed. Page 34 of 167 MITIGATION -UTILITIES OVERALL Gartner Assessment –AMI/CIS and MDM Systems •Conduct an assessment an analysis of the City’s Customer Information System (CIS), Advanced Metering Infrastructure (AMI) and Meter Data Management (MDM) systems. •Evaluated the City’s CIS business processes against the current CIS system, identify gaps or areas for opportunities, and explore alternative options to improve the City’s CIS operations and supporting technologies Page 35 of 167 MITIGATION -ELECTRIC Adoption of comprehensive Energy Risk Management Program •Implemented an Energy Risk Management Policy which governs all purchase power and related activities that may impact the Energy Risk profile of Georgetown Electric Utility. •Overall policy oversight is provided by City Council and the Georgetown Electric Board (GTEB). Independent 3rd Party provides Risk Management Compliance reporting to GTEB and City Council. Risk Oversight Committee •The Risk Oversight Committee (ROC) is an internal committee that oversees approval and compliance of transactions and risk limits. •The committee is comprised of the City’s executive team (City Manager and Assistant City Managers), the Electric General Manager and staff, and the Finance Director. Risk Management Committee •The Risk management Committee (RMC) is comprised of Shell, the Electric General Manager and staff, as well as independent consultants. •The RMC implement the risk management strategy approved by the ROC. The RMC reviews existing and potential transactions, monitor proximity to limits, and helps support the responsibilities of the ROC. Page 36 of 167 MITIGATION -ELECTRIC 3rd Party Electric Portfolio Management •Shell will be developing and making recommendations regarding how Georgetown’s energy is traded in the Texas energy market. •Shell will also assist in forecasting energy needs, energy costs, and addressing challenges related to transmitting energy around the state, all of which affect the city’s costs associated with purchasing power. •In addition to Shell North America, Crescent Power and ACES Power Marketing aid the staff in managing the overall energy portfolio risk and risk management policy compliance. Electric Board •Starting June 2020, a new electric oversight board was set up. Aid the City Council in providing the overall Policy Oversight. Page 37 of 167 MITIGATION -ELECTRIC Line Extension and Meter Connect Revenue Risk Mitigation •Review of the revenue generating activities related to electric infrastructure additions and service provisioning identified revenue loss and revenue leakage •Mitigation activities: •Business re-organization led to the electric engineering and project management function under the electric cost center. This identified the revenue losses and the redesigned processes led to better control and management of the electric infrastructure additions with appropriate cost recovery. •New Electric line extension policy implemented in early part of FY 2020, clearly identifies the infrastructure addition costs and the requirement of pre-payment of the invoices mitigated the risks posed by unpaid/overdue invoices. •Short term mitigation strategies were identified which address the meter connect revenue loss. The long-term mitigation strategy of a comprehensive business process redesign of the utility service connection is in progress. The new process will be in place starting January 1st, 2021. Page 38 of 167 MITIGATION -WATER Risk Assessment •The water utility had a risk and resilience assessment conducted by CDM Smith to comply with a new mandate set by the American Water Infrastructure Act. The assessment outlined several recommendations to help mitigate risks and improve system resiliency against the highest risk threats identified. Succession Planning •The Water Utilities Director is set to retire by the end of the year. •The City has started a plan to begin a national search for the next water utility director. In the meantime the Director has informally begun to prepare his direct reports to be able to assume more responsibility and is training them on any knowledge gaps he foresees. Water Rate Study •The city continues to maintain utility fiscal health by performing rate study and impact fee studies every three years. Previous rate studies were conducted on a revenue sufficiency principal. The rate study currently is a cost - of-service rate study. •The water rates and tiers were evaluated primarily for residential customers and will be in effect 2021. Page 39 of 167 MITIGATION -WATER Long Term Water Planning •The BRA and the City of Georgetown are jointly funding and participating in an Aquifer Storage and Recovery (ASR) Study. •The BRA, City of Round Rock and Georgetown are jointly participating in a collaborative study to identify regional and long-term water solutions for Williamson County. •Working to include additional groundwater resources from counties to the east as a long-term water resource within the Region G Plan. Capital Improvement Projects •Increasing treated water capacity •Maintaining infrastructure at the rate of the City’s growth Page 40 of 167 MITIGATION -WATER System Interconnects •The City is further diversifying its water resources and increasing system resilience through interconnects with neighboring systems. •The City currently has two interconnects with Round Rock and a third under design to utilize Round Rock’s excess treatment capacity. •An additional short-term interconnect is also constructed between the City and Leander’s system. Water Leak Detection •Starting in Fiscal year 2021, the city will be improving leak detection by using satellite detection. The City’s vast service area makes this method of detection and subsequent repair more efficient. Page 41 of 167 NEAR TERM ACTIONS ▪Conduct a citywide operational and enterprise risk assessment every 5 years- with the next study slated for FY23 ▪Complete Hazard Mitigation Plan ▪Implement consultants’recommendations as a result of the following studies: o Gartner Assessment of CIS/AMI/MDM systems o HIPAA Audit by SHI ▪Conduct an audit of the electric risk management practices Page 42 of 167 NEAR TERM ACTIONS (Cont.) ▪Finalize and initiate internal/external audit work plan ▪Process improvement: o Streamline purchasing process and create training for power users to ensure compliance with procurement laws o Integrated Council agenda process across the City Manager’s Office,City Secretary’s Office,City Attorney’s Office and Purchasing department as well as creating and implementing training for power users on the agenda process ▪Overall biannual review and update of citywide and departmental policies and procedures ▪Providing public dashboards of departmental performance management metrics Page 43 of 167 QUESTIONS? Page 44 of 167 Risk Mitigation Report UPDATE TO 2018 CITYWIDE RISK ASSESSMENT CITY OF GEORGETOWN 2020 Page 45 of 167 RISK MITIGATION REPORT 1 | Page CITY OF GEORGETOWN Table of Contents Purpose and Introduction ........................................................................................................................ 2 Risk Assessment and Mitigation Cycle .................................................................................................... 2 Risk Management Methods ................................................................................................................. 3 Notable Changes ...................................................................................................................................... 4 Departments ............................................................................................................................................. 4 2018 Citywide Risk Assessment ............................................................................................................... 5 Mitigation and Next Steps ....................................................................................................................... 8 City Manager’s Office ................................................................................................................................ 8 Facilities .................................................................................................................................................... 8 Emergency Management .......................................................................................................................... 9 Public Safety .............................................................................................................................................. 9 Finance and Human Resources ............................................................................................................... 11 City Secretary .......................................................................................................................................... 13 Information Technology .......................................................................................................................... 13 Overall Utility System .............................................................................................................................. 14 Electric ..................................................................................................................................................... 15 Water and Wastewater System .............................................................................................................. 17 Public Works ........................................................................................................................................... 19 Near Term Action ....................................................................................................................................... 20 APPENDIX .................................................................................................................................................... 21 Risk Mitigation Register .......................................................................................................................... 21 Page 46 of 167 RISK MITIGATION REPORT 2 | Page CITY OF GEORGETOWN Purpose and Introduction In 2018 a citywide risk assessment was conducted by Plante Moran, which outlined several risks across departments. Plante Moran also included risk treatment action plans for the risks they identified with recommendations on ways to mitigate in the future to reduce the risk likelihood or impact. This report outlines the mitigation and risk treatment statuses of the identified risks from 2018. Risk Assessment and Mitigation Cycle Steps 1-3 of the risk cycle were completed at different stages since 2018. After the risk assessment was conducted, the City has been in the 3rd part of the cycle with risk owners treating their risk with varying degrees of mitigation. The City now concurrently enters the last step of the cycle, step 4, as each risk is reviewed, and mitigation efforts are tracked to reassess whether the risk score has decreased. After this is completed the City will need to have another citywide ERP risk assessment conducted by 2023 to successfully identify new risks across the city from an enterprise and operational standpoint. Overall, most risks identified in 2018 have been mitigated or the risk has been accepted and steps are being taken to fully mitigate in the future as detailed later in this report. 1. Risk Identification 2. RIsk Assessment 3. Risk Mitigation, Planning, and Implementation 4. Risk and Mitigation Tracking Page 47 of 167 RISK MITIGATION REPORT 3 | Page CITY OF GEORGETOWN Risk Management Methods Risk does not always have to be mitigated. Several risk management methods exist that can be used instead to either eliminate a risk with risk avoidance, transferred to a third party with risk transfer, or even accepted because the risk is negligible that it would cost more to manage it then what it could possibly impact. Risk Mitigation Risk mitigation is a risk management technique by which an organization introduces specific measures to minimize or eliminate unacceptable risks associated with its operations. Risk mitigation measures can be directed towards reducing the severity of risk consequences, reducing the probability of the risk materializing, or reducing the organizations exposure to the risk. Risk Avoidance Risk avoidance is a technique of risk management where the goal is to eliminate a risk and not just reduce it. Rather than mitigating existing risk, it aims to eliminate the source of the risk altogether, sometimes replacing it with a smaller, more easily manageable risk. Risk Transfer Risk transfer is a risk management technique in which risk is transferred to a third party. In other words, risk transfer involves a party assuming the liabilities of another party. Purchasing insurance is a common example of transferring risk from an individual or entity to an insurance company. Risk Acceptance Risk acceptance is the assumption of a risk, typically because its risk-reward profile is attractive and within your risk tolerance. In general, it is impossible to make gains in business or life without taking risks. As such, risk acceptance is a common risk treatment. Mitigation Avoidance Transfer Acceptance Page 48 of 167 RISK MITIGATION REPORT 4 | Page CITY OF GEORGETOWN Notable Changes Significant events and operational changes since the 2018 citywide risk assessment update–include the following: • 3rd party electric energy portfolio manager • City department reorganization • Workday ERP • COVID-19; impact on FY2020 budget and beyond • Police and Fire agree and confer • Finance bond rating • In the spring of 2019, the Fire Department filed a “breach notification” report regarding an unencrypted EMS tablet that went missing from one of the ambulances. This breach had the potential to impact up to 719 patients. The 2018 Risk Assessment identified the most prevalent risks lived within the following departments. Departments • City Secretary’s Office • City Manager’s Office • Controller • Emergency Management • Finance • Fire • Human Resources • Information Technology • Facilities • Police • Purchasing • Records • Utility Page 49 of 167 RISK MITIGATION REPORT 5 | Page CITY OF GEORGETOWN 2018 Citywide Risk Assessment The risk assessment conducted in 2018 established the following risk universe for the City of Georgetown. City of Georgetown Risk Universe 1. Access to Talent 18. IT Security Awareness, Training, and Education 2. Billing for Citizen Services 19. IT Third Party Roles and Responsibilities 3. Budget and Planning 20. Leadership 4. Composition of Tax Base 21. Legislation 5. Disaster Recovery/Business Continuity 22. Physical Security 6. Emergency Notification System Failure 23. Police failure 7. Fire Department Failure 24. Records Management 8. Freedom of Information Act (FOIA) 25. Regulatory Filings 9. Fraud 26. Segregation of Duties 10. Grant Obligations 27. State-Fed Regulations 11. Health & Safety 28. Succession Planning 12. IT Access Management 29. Talent Management 13. IT Asset Management: Data Classification 30. Tax 14. IT contingency Plan 31. Utility market 15. IT Critical Security Event Identification 32. Utility Outage 16. IT Cybersecurity Governance Model 33. Vendor Reliance 17. IT Incident Response Management Each department has at least one of the above risks identified. Plante Moran worked with the departments to identify management responses to mitigate those risks at the time and outlined next steps to further mitigate the risks. The risks were given a risk impact score which was calculated utilizing ranked criteria: impact (financial, strategic, operational or compliance) and likelihood (probability or event occurrence) as noted below. Impact Criteria Ranking 5 (high) 4 3 2 1 (low) Financial Impact: Expense or Lost Revenue >$150K $100K-150K $50K-$100K $25K-$50K <$25K or Strategic Impact: Strategy/Mission/Legislature Failure to meet key strategic objective Major impact on strategic objective Moderate impact on strategy Minor impact on strategy No impact on strategy or Operational Impact: Reputation Extreme Severe Moderate Low None Process/System Shutdown >7 days 5-7 days 3-5 days 1-3 days <1 day Compliance Impact: Regulatory- State/Local/HIPAA/Debt Covenants Large-scale material Material breach but Material breach which can Minimal breach which Minimal breach which can Page 50 of 167 RISK MITIGATION REPORT 6 | Page CITY OF GEORGETOWN breach of regulation cannot be rectified be readily rectified cannot be rectified be readily rectified Likelihood Criteria Ranking 5 (high) 4 3 2 1 (low) Probability of an event occurring in a given year: >20% 15-20% 10-15% 5-10% <5% or Event Occurrence (on average): Once a year or more 1 in 3 years 1 in 5 years 1 in 7 years 1 in 10 years 2018 Residual Risks by KBD: Weighted Risks by Key Business Departments: the total number of risks weighted by rankings using the following weighting formula: Red 17 or > (3 points), Yellow 8-16 (2 points), and Green <8 to 5 (1 point), <4 (0 points). Therefore, the higher risk rankings carry a higher weighted risk. Since then these risks have been primarily mitigated, and a detail can be found in the appendix. Page 51 of 167 RISK MITIGATION REPORT 7 | Page CITY OF GEORGETOWN The 2018 risk assessment highlighted several high-level themes, particularly focused in Information Technology, Georgetown Utility Services, legislation, and policies and procedures. Since 2018, several strides have been made in each of these high-level themes. High-Level Themed Risks Risk Treatment Responses and Mitigation • The City is exposed to four high Information Technology (IT) residual risks. We recognize the City is currently in process of an ERP system upgrade and the status of these conditions will change in the near future: IT Cybersecurity, IT Asset Management: Data Classification, IT Access Management, and IT Contingency Plan. See Appendix B for IT Risk Report. •IT is working on a comprehensive policy covering IT Cybersecurity, IT Asset Management: Data Classification, IT Access Management, and IT Contingency Plan. • The City lacks a clear process for the assignment and review of user access roles and responsibilities to achieve segregation of duties in three key business departments. We noted during discussions with Finance, Customer Care and Parks and Recreation one person can control more than two phases of a transaction exposing the City to unauthorized transactions and fraud risk. • Workday has mitigated this risk, with various level of approvals needed for transactions. The requisitioner must have each requisition reviewed and approved by at least two people, with one being the manager. The risk of fraud has been mitigated significantly, if not almost entirely with the new ERP system and its integrated steps for accountability. • Management indicated several potential costly Texas legislative acts are due for review at future legislative sessions. • Staff has created an Intergovernmental Affairs Program which will prioritize the City’s legislative agenda considering public input; a committee is being created to enact this program. Focused Advocacy has also been hired as a consultant to aid in representing the City in legislative session. The City of Georgetown is also a participating TML city, allowing TML to provide guidance, direction, and advocacy on behalf of City’s best interests. • The City is challenged with documentation of operating policies and procedures. Currently, 15 out of 25 (60%) departments we interviewed have a lack of clearly written policies and procedures available to all employees • Since 2018 many of the lacking policies have now been written, with even more reviewed. Staff has identified a need to centralize a location for its policies and create a process or committee to review policies regularly to ensure they are up to date and follow legal mandates. Page 52 of 167 RISK MITIGATION REPORT 8 | Page CITY OF GEORGETOWN Mitigation and Next Steps The departments identified in the 2018 risk assessment have taken several mitigating steps which are fully detailed in the risk register found in the appendix. The section below provides a deeper dive into the more significant risks and the corresponding mitigation actions that have been completed or ongoing. City Manager’s Office Performance Management Review The City Manager’s Office routinely reviews departments performance metrics. On a biannual basis the metrics are reviewed and analyzed for performance and to assess whether the metrics are measuring what needs to be measured. These metrics are utilized in a variety of ways by departments and city management such as providing data to substantiate budget requests or to identify how well things are going in each area or to identify areas of concern that are not performing as well. Business Plans The City had all departments and service areas create and complete business plans. These business plans help strategically align the departments missions and goals to objectives that will be completed over the next few years. The business plans had the departments identify their key performance indicators that tie their strategic goals with City Council Goals. Council goals were also used to tie in and from an action plan created to enhance the department’s ability to meet organizational, customer, and workforce requirements. The business plans are utilized by staff as they move forward in completing their action plan. Legislative Task Force The Legislative Task Force is a special ad hoc group comprised of active leaders in the community - the leadership of City Boards and Commissions. With the membership comprised of the Boards and Commissions leadership, the Legislative Task Force are knowledgeable members of the community, educated on City priorities, and representing a wide range of City interests. The Legislative Task Force will provide input to City Council on the issues relevant to the State Legislative Agenda in preparation for the Texas State Legislative Sessions. Facilities Facility Access Policy As City Facilities move to a public lobby and secure back of house model, access control becomes more important. This policy will help establish necessary employee access to non-public areas within City Facilities. Georgetown Municipal Complex Remodel Secure separation of public and employee space requires building modifications, including access control doors and publicly accessible meeting space to keep employees from bringing public into the secure space. The GMC remodel creates that separation and adds meeting space in the public area. Light and Waterworks Remodel Page 53 of 167 RISK MITIGATION REPORT 9 | Page CITY OF GEORGETOWN Light and Waterworks building currently requires entry from an alley and there is no separation from the public space and employee areas. The LWW Remodel moves the front Planning entry to Martin Luther King Jr. St. This entry fits better within the City Center and allows the use of a public lobby with a secure door to the employee area. Emergency Management COVID-19 Response The City declared a local disaster and activated a virtual emergency operation center in response to COVID-19. In addition, the City is working closely with Williamson County, the Williamson County and Cities Health District, and State partners to coordinate our response to the pandemic. In July, the Mayor issued an order requiring the wearing of face coverings while in businesses with some exceptions. These orders were later amended to reflect statewide mask order issued by the Governor. The Governor’s orders also prohibit outdoor gatherings of more than 10 people at a time, without mayoral approval. Additionally, the City is seeking reimbursement through Williamson County for COVID-19 related expense that are eligible to be covered by the CARES act. These funds are being dispersed in three tranches to cover expenses through calendar year 2020. The City has also created an inventory of personal protective equipment to ensure adequate supplies both for first responders and general employees to be appropriately protected. Finally, the City has amended internal personnel policies to ensure appropriate social distancing at work, allowing employees to telework when appropriate, and appropriate measures are taken when employees test positive for COVID-19, including administering federal ESICK and EFMLA programs. Hazard Mitigation Action Plan The City is in the process of updating its Hazard Mitigation Action Plan. The plan helps the City appropriately assess, prioritize, prepare for, and mitigate natural or human-caused hazards. This plan will allow the City to maintain eligibility for future federal mitigation grant funding and help identify mitigation actions that will make the local community more disaster resistant. The planning efforts are expected to begin in October and be completed in the first quarter of 2021. The plan will require state and federal review prior to City Council adoption. Public Safety HIPAA Audit In the spring of 2019, the Fire Department filed a “breach notification” report regarding an unencrypted EMS tablet that went missing from one of the ambulances. This breach had the potential to impact up to 719 individuals and the City began a review of procedures and practices. This review has been expanded to include a HIPAA audit in September 2020 to adequately address any gaps in procedures and policy. The audit will identify measures that need to be taken to maximize the protection of private health information as defined within the Health and Human Services’ Security Rule 45 CFR Part 160 and Subparts A and C of Part 164. The HIPAA Security Rule establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information. This audit will help Page 54 of 167 RISK MITIGATION REPORT 10 | Page CITY OF GEORGETOWN inform changes that need to be made to reduce the risk of a breach occurring again and is expected to be completed by December 2020. Also, to further reduce risk, the City is in the process of creating a HIPAA hybrid entity which would create a healthcare component and discern what areas would be subject to HIPAA privacy regulations. This would ensure that only the designated areas that need to comply with HIPAA privacy rules would do so, instead of the entire organization. Only these newly identified areas would have the right to use, maintain, access and/or transmit personal history information. This process will create clear boundaries to further protect sensitive information and create internal controls to limit access. Guardian Tracking: Performance Management Software Since 2012, the police department has been utilizing Guardian Tracking, a performance management software platform. The software is used to formally capture praise, counseling, goal setting, and discipline. The software also serves as an early warning system for repeated substandard performance. Replacement of Police Body Cameras In 2019, due to reliability issues with the previous vendor, non-compatibility between car and body cameras, and the inability to keep existing equipment serviceable we replaced all car cameras, body cameras, and facility interview cameras. We transitioned to WatchGuard, a Texas based company and industry leader with regards to police vehicle cameras, body cameras, and digital evidence management software. Now all cameras and the digital data derived are on one unified management software system. The current technology is far superior to the old allowing for real time viewing, wider angles, seamless integration between car and body cameras, and automatic synchronization of all incident cameras on playback. CommUNITY Advisory Task Force The police department established a Chief’s CommUNITY Advisory Task Force in July of 2020 comprised of 20+ diverse community leaders. The task force will be working with the Chief to provide input regarding the state of policing in Georgetown as well as providing input as to the direction of the CommUNITY Initiative. The police department plans to conduct six Listen and Learn Summits across six different stakeholder groups in FY2021. Police Training - Arbinger institute The police department is in the process of having their officers complete training created by the Arbinger Institute. This training focuses on transitioning a self-focused inward mindset to an impact-focused outward mindset. Arbinger’s Policing with an Outward Mindset™ program addresses three key challenges in law enforcement today:  Situational Awareness and Officer Safety o Officers must increasingly operate in ways that are both smart and safe. This requires the self-awareness and motivation to be the most trained, skilled, and conditioned version of themselves possible. In addition, officers must be aware of contextual behavioral anomalies indicative of dangerous or criminal behavior without being distracted by factors such as race, gender, age, sexual orientation, etc.  Trust and Collaboration Page 55 of 167 RISK MITIGATION REPORT 11 | Page CITY OF GEORGETOWN o With so many factors influencing incident narratives and investigations, trust, and collaboration within agencies and with the communities they serve has become critical— but also quite difficult.  Leadership o Law enforcement leaders today must carry a deep sense of personal responsibility to develop competency in each of their roles and to understand the impact they have on others while carrying out their duties. Such a leader inspires and systematically develops similar personal responsibility from others. Arbinger enables organizations and their people to turn outward through a three-step process: mindset change, leader development, and systems improvement. Fire station 6 and 7 Fire Station 6 is open and 7 is set to open soon, adding additional resources to key areas within the City for a more efficient response. In having these stations come online the Fire department will also have more staff to reduce the number of overtime hours. Finance and Human Resources Workday The City has converted to a new ERP system, Workday. This new system has aligned financials and human resources to one system streamlining purchasing, travel, recruiting, on-boarding, performance, benefits, payroll, accounting, and budget to name a few high-level processes. This conversion has fully mitigated many threats outlined in the 2018 assessment with more restricted security roles limiting access to sensitive information. The system also requires 2-factor authentication furthering our security of the system. Workday is cloud based, allowing for business continuity in the case of a disaster impacting our critical network and infrastructure. Overall, conversion to Workday has allowed for more efficient processes and reporting options for staff. The workday implementation has addressed the following: Page 56 of 167 RISK MITIGATION REPORT 12 | Page CITY OF GEORGETOWN • Conducted detailed process reviews to implement best practices • Enhanced user and access controls • Requires 2 Factor Authorization to access • Created process controls such as budget checks on purchases and created a system of multi- level of approvals for purchases • Implementing the budget module Adaptive to streamline and integrate workflows within the Workday system Internal Audit Plan Staff is creating a multi-year internal audit to apply a disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. The internal audit plan reinforces the City’s commitment to accountability and integrity while having an objective party look for ways to improve operations. Some of the audits staff are including in the audit plan are: • Fee Collection Review • Hotel/Motel Audit • Franchise Fees • Airport Revenue Sales Tax Audit The State is currently conducting a sales tax audit that began in June 2020. The audit is done to ensure that Texas tax laws are applied uniformly and to promote compliance. The audit helps determine whether taxes have been properly collected, reported, and paid to the state. Policy Updates Six personnel policies were updated in alignment with Workday implementation in 2019 including introductory period, vacations, sick leave, hours of work, compensatory time, and holiday. Multiple temporary policies have been issued during the COVID-19 Pandemic including telework and flex time. Safety & Risk Management Team The City’s safety and risk management programs were combined, centralized, and staffed by three full- time employees focused on the development and evaluation of occupational safety and risk management programs in 2019. Since that time, the team has improved handling of citizen claims, improved accuracy in covered city property, improved management of our third-party risk pool administrators, and given greater support to our employees who experience work-related injuries. The team has deployed the first phase of active shooter and building evacuation training, with more to come. They are also building data sets to better understand worker injury and accident trends and working with stakeholders on appropriate mitigating actions. Organizational Development Page 57 of 167 RISK MITIGATION REPORT 13 | Page CITY OF GEORGETOWN The City hired its first learning and development coordinator in 2020. The coordinator has built a learning and development strategic plan that will be deployed over the next two years. Included in that plan is our multiyear approach to talent management and making use of Workday talent capabilities. In 2019 the City created the organizational & operational excellence office, focused on helping staff ‘eat elephants…one bite at a time.’ The office works to empower staff at all levels through our organizational performance management (see City Manager section) and process improvement programs. The office has since rolled out annual business plans for all departments, lean trainings to over 1,000 participants, and currently support over 60 lean process improvement projects. City Secretary Freedom of Information Act – Compliance with Open Records The Open Records Coordinator will continue to provide annual trainings to staff related to best practices for responding to FOIA requests and do routine reviews of the Open Records Request policies and procedures. The City Secretary’s Office will continue to work towards adding another Open Records Coordinator to mitigate the large workload that the growing number of open records requests provide. Records Management – Current Practice The Records Management team does routine departmental check-ins and works to organize projects that make departments more efficient and less reliant on paper. The Records Management Team does a routine review of the Records Management policies and procedures to ensure that best practices are always being implemented. They also provide annual training to all employees. Agenda Process Staff members from City Secretary’s Office, City Attorney’s Office, City Manager’s Office, and Purchasing are working together to improve the agenda process that is currently not as efficient as it could be. City Secretary Office is also looking into the possibility of switching agenda software. Information Technology Cybersecurity Policy The IT Department has completed a primary draft of a comprehensive Cybersecurity Policy. The draft has been reviewed by first line technical staff and is being prepared for final round of review by the Human Resources, City Secretary, and Legal Departments. Staff participated in a cybersecurity tabletop exercise in October 2020 conducted by the Texas Department of Information Resources. The tabletop discussion covered the potential impacts of a computer security incident impacting a local community. This training furthered staff’s education on responding to a cybersecurity incident and its potential impacts. System and Network Contingency Plan The IT Department currently has an Incident Response Plan in development through the Human Resources Departments Lean Process Development methodology. This plan is scheduled for completion in December of 2020. Security Information and Event Management System Page 58 of 167 RISK MITIGATION REPORT 14 | Page CITY OF GEORGETOWN Multiple Security Information and Event Management Systems (SIEMs) are under review by the IT Department. Also, the IT Department is evaluating the possibility of managed service contracts through the Texas Department of Information Resources to help fulfill this need. Due to budgetary constraints presented by COVID-19, a purchase was not proposed for FY 2021. Pending budget availability for FY 2022, IT will work toward the purchase and implementation of a SIEM system. Staff IT Security and Awareness Training The City of Georgetown successfully implemented a Security and Awareness Training initiative in FY 2020. This included training and testing for all City IT users through the City’s Learning Management System. In June of 2020, the City Security Awareness Training program was certified by the State of Texas as complete for the current calendar year. Back-Up Data Center A back-up data center was successfully brought online in the Winter of FY 2020. The purpose of this data center is to act as a failover in the case of a failure at the City’s primary data center. Failures could include physical destruction or damage to the primary datacenter by a man-made or natural disaster. Failures may also include some types of cyberattacks. In such a case, the back-up data center could be brought online and subsequently run 90 percent of the City’s technology systems within a matter of hours. This includes all the City’s mission critical data systems. Overall Utility System Weaver Assessment – Cash Receipt Review The City of Georgetown engaged with Weaver and Tidwell, LLP to provide assist in the review and identification of all cash receipts currently received the by City’s Utility Billing Office and identify alternative locations and processes for non-utility payments. Weaver and Tidwell also provided risk- control matrices and process mapping for areas in the City’s Utility and Accounting Offices where internal risks could occur. Weaver Assessment – UMAX Business Process Mapping The Weaver and Tidwell, LLP engagement also provided a review of the City’s Utility Office internal controls, transactional processing efficiencies and review of audit trails and automated workflows integrated in the City’s new UMAX/CIS. Four (4) high-risk, fifteen (15) moderate risk, and four (4) low- risk processes were identified. These ranking provided guidance to the City with regards to prioritizing effort and resources. It also documented workflows that are used when reviewing business processes. The high-risk areas have been mitigated and many of the moderate risks have been addressed. Gartner Assessment – AMI/CIS and MDM Systems The City of Georgetown engaged with Gartner Consulting to conduct an assessment an analysis of the City’s Customer Information System (CIS), Advanced Metering Infrastructure (AMI) and Meter Data Management (MDM) systems. The objective is to evaluate the City’s CIS business processes against the current CIS system, identify gaps or areas for opportunities, and explore alternative options to improve the City’s CIS operations and supporting technologies. As well as to evaluate the business value provided by the AMI and MDM systems to enable the City to meet its smart meter information needs. Page 59 of 167 RISK MITIGATION REPORT 15 | Page CITY OF GEORGETOWN Electric The electric utility went through a management assessment conducted by Schneider Engineering., The following were the recommendations from the management assessment: 1. Develop and implement comprehensive risk management policy. a. Leverage internal and external resources to increase oversight and accountability for decision making regarding contracts management. b. Procure third party energy management services. 2. Study the installation of separate governance structure for Georgetown Utility Systems. Based on the recommendations, the following action were taken to better manage the risks. Adoption of comprehensive Energy Risk Management Program: The new Energy Risk Management Policy governs all purchase power and related activities that may impact the Energy Risk profile of Georgetown Electric Utility. Activities that fall within the scope of this Policy include, but are not limited to, the following: • Wholesale Transactions (PPA, Bilateral Trades) • Independent System Operator (ISO)/ERCOT Market Transactions (DAM/RTM/AS) • Energy hedging activities involving physical and financial energy products • Basis hedging activities involving energy products • All energy commodity trading • Counterparty contracting and credit management Under the new Energy Risk Management Policy there are multiple levels of oversight provided to the electric fund. Overall policy oversight is provided by City Council and the Georgetown Electric Board (GTEB). Independent 3rd Party provides Risk Management Compliance reporting to GTEB and City Council. Page 60 of 167 RISK MITIGATION REPORT 16 | Page CITY OF GEORGETOWN Risk Oversight Committee The Risk Oversight Committee (ROC) is an internal committee that oversees approval and compliance of transactions and risk limits. The committee is comprised of the City’s executive team (City Manager and Assistant City Managers), the Electric General Manager and staff, and the Finance Director. ROC provides inputs to the risk management strategy and receives weekly/monthly risk management updates from the Risk Management Committee. Risk Management Committee The Risk management Committee (RMC) is comprised of Shell, the Electric General Manager, and staff, as well as independent consultants. The RMC implement the risk management strategy approved by the ROC. The RMC reviews existing and potential transactions, monitor proximity to limits, and helps support the responsibilities of the ROC. Ultimately the RMC, is responsible for the day-to-day execution and management of transactions. Page 61 of 167 RISK MITIGATION REPORT 17 | Page CITY OF GEORGETOWN Procurement of 3rd Party Electric Energy Portfolio Management Services: In December of 2019 Council approved an agreement with Shell Energy North America to provide energy management services. Shell will be developing and making recommendations regarding how Georgetown’s energy is traded in the Texas energy market. Shell will also assist in forecasting energy needs, energy costs, and addressing challenges related to transmitting energy around the state, all of which affect the city’s costs associated with purchasing power. In addition to Shell North America, Crescent Power and ACES Power Marketing aid the staff in managing the overall energy portfolio risk and risk management policy compliance. Creation of new Electric Board to provide better risk and financial oversight: Starting June 2020, a new electric oversight board was set up. The electric board’s proposed role in risk management is as follows: • Aid the City Council in providing the overall Policy Oversight. • An independent third party appointed by the Georgetown Electric Board will provide periodic Risk Management Policy Compliance reports to the GTEB and City Council. • Receives Monthly Risk Management Policy updates from Risk Oversight Committee (ROC) and Risk Management Committee (RMC) Line Extension and Meter Connect Revenue Risk Mitigation To ensure all revenue is properly collected, review of the revenue generating activities related to electric infrastructure additions and service provisioning identified revenue loss and revenue leakage. The causes for lost revenue and revenue leakage were: 1. Unsent/unpaid/overdue invoices for electric infrastructure additions. 2. Sub-optimal business processes and significant short comings of the software systems led to significant under-collection of electric meter connect fees. Mitigation activities: 1. Business re-organization led to the electric engineering and project management function under the electric cost center. This identified the revenue losses and the redesigned processes led to better control and management of the electric infrastructure additions with appropriate cost recovery. 2. New Electric line extension policy implemented in early part of FY 2020, clearly identifies the infrastructure addition costs and the requirement of pre-payment of the invoices mitigated the risks posed by unpaid/overdue invoices. 3. Short term mitigation strategies were identified which address the meter connect revenue loss. The long-term mitigation strategy of a comprehensive business process redesign of the utility service connection is in progress. The new process will be in place starting January 1st, 2021. Water and Wastewater System Risk Assessment of Water Utility Page 62 of 167 RISK MITIGATION REPORT 18 | Page CITY OF GEORGETOWN The water utility had a risk and resilience assessment conducted by CDM Smith to comply with a new mandate set by the American Water Infrastructure Act. The assessment outlined several recommendations to help mitigate risks and improve system resiliency against the highest risk threats identified. The recommendations for the water utility system are:  Plan for use of portable power supply generators during an emergency to supply temporary power to critical system components that do not currently have back-up generators or hook-ups.  Expand Lake water treatment plant and build a new water treatment plant south of the lake to improve system redundancy during an emergency (this is in the planning process with expansions and new treatment plant construction tentatively scheduled within the next five to seven years).  Implement floodproofing techniques at the Park water treatment plant to protect critical system components from damages during flood or dam failure.  Develop a source water protection plan for Lake Georgetown and Lake Stillhouse Hollow in coordination with the Brazos River Authority, United States Army Corps of Engineers, and other stakeholders.  Improve physical security measures at critical facilities to reduce the risk of an outsider threat accessing critical assets. Examples may include automatic lock doors at water treatment plants, or motion sensors that trigger security camera alerts outside of regular business hours when personnel are not physically on-site. Many of these recommendations are being addressed in the years to come with the City’s capital improvement plan to expand water treatment capability as well as an initiative with the Brazos River Authority (BRA) to secure additional water resources for the future. Succession Planning The Water Utilities Director is set to retire by the end of the year. Upon their departure the water department will lose a vast amount of historical knowledge of the utility and expertise in the field. The City has started a plan to begin a national search for the next water utility director. In the meantime, the director has informally begun to prepare his direct reports to be able to assume more responsibility and is training them on any knowledge gaps he foresees. Long Term Water Planning The city is pursuing several resources when it comes to Long term water planning. Planning is conducted on a State, Regional and local level. The City works closely with neighboring cities, the Brazos River Authority (BRA) and Region G to analyze and develop additional water resources available to meet the City’s long-term needs. The BRA and the City of Georgetown are jointly funding and participating in an Aquifer Storage and Recovery (ASR) Study. This study will look at seasonal recharge of surplus reservoir water from Lake Georgetown, treating this water during times when there is spare water treatment capacity and then conveying this water to a suitable location within aquifer(s) that can be used to store the water. During periods of high-water demand or extended drought, the stored water may then be recovered to meet water resource needs. This storage and utilization method may also be used to store additional groundwater resources. The BRA, City of Round Rock and Georgetown are jointly participating in a collaborative study to identify regional and long-term water solutions for Williamson county, the evaluation will include groundwater and conjunctive water development opportunities that have been presented by different marketing groups, water sharing and scenarios for potential redistribution of water Page 63 of 167 RISK MITIGATION REPORT 19 | Page CITY OF GEORGETOWN supplies for regional and long-term sustainability of water supplies in Williamson county. James (Jim) Briggs, former Utility General Manager, has worked to include additional groundwater resources from counties to the east as a long-term water resource within the Region G Plan. By having groundwater listed as a long-term solution on the Region G plan, related projects will be eligible for state funding participation. System Interconnects The City is further diversifying its water resources and increasing system resilience through interconnects with neighboring systems. The City currently has two interconnects with Round Rock and a third under design to utilize Round Rock’s excess treatment capacity. An additional short-term interconnect is also constructed between the City and Leander’s system. This interconnect will be used during periods of high demand. The use excess treatment capacity of others assists the city in being fiscally responsible in the ability to defer capital construction when possible. Water Leak Detection In an effort to more responsibly utilize current water resources the City continues to track and trend Water Loss as a key operating metric. Starting in Fiscal year 2021, the city will be improving leak detection by using satellite detection. The City’s vast service area makes this method of detection and subsequent repair more efficient. Water Rates The city continues to maintain utility fiscal health by performing rate study and impact fee studies every three years. Previous rate studies were conducted on a revenue sufficiency principal. The rate study currently is a cost-of-service rate study. The water rates and tiers were evaluated primarily for residential customers and will be in effect 2021. Commercial tiers, and reclaimed use is to be analyzed in 2021. Implementation of the new water rates and narrowed tiers will assist the utility in maintaining financial integrity and make significant effort to improve resource use efficiency. Public Works Capital Improvement Project Coordination Committee The lack of regularly scheduled CIP Coordination meetings outside of the annual budget process has led to disjointed communication with the CMO on capital improvements projects and, at times, has limited the ability of the organization to consider the full range of options as obstacles, challenges, and opportunities have arisen. All of which is why a new internal committee is being created to enhance CIP coordination across the City. Enhanced CIP coordination will save time, increase accountability, reduce errors, improve timely project close-out, improve debt tracking and issuance, minimize miscommunication, improve intergovernmental coordination, increase accuracy of billing to correct cost centers, and increase opportunity to proactively respond to challenges, obstacles, and opportunities. Contract Coordinator The City of Georgetown hired a contract administrator in March of 2020. This role is responsible for enhancing contract management for various types of agreements, by working with City staff to raise additional awareness for upcoming obligations. Since being hired on the contract administrator has assisted in modifying the internal cover sheet process for two major developments, this improvement led Page 64 of 167 RISK MITIGATION REPORT 20 | Page CITY OF GEORGETOWN to identifying over a million dollars in funds owed to the City for public infrastructure. This continuous process and review by the contract administrator will allow for more detailed oversight in the growing number of contracts as the City expands. The contract administrator created a tracking process to monitor the monetary obligations owed to the City or what the city owes given contract specifications. Also, a Contract Coordination Committee has been formed with its initial meeting scheduled for October 2020. This will further assist the City in working together to track obligations that need to be met. The position will also be the liaison for the City regarding new MUDs and PIDs wishing to be created within City limits and ETJ. Near Term Action  Complete Hazard Mitigation Plan  Conduct a citywide operational and enterprise risk assessment every 5 years-with the next study slated for FY23  Implement consultants’ recommendations as a result of the following studies: o Gartner Assessment of CIS/AMI/MDM systems o HIPAA Audit by SHI  Conduct an audit of the electric risk management practices  Finalize and initiate internal audit work plan  Process improvement o Streamline purchasing process and create training for power users to ensure compliance with procurement laws o Integrated Council agenda process across the City Manager’s Office, City Secretary’s Office, City Attorney’s Office and Purchasing department as well as creating and implementing training for power users on the agenda process  Overall biannual review and update of citywide and departmental policies and procedures  Providing public dashboards of departmental performance management metrics Page 65 of 167 RISK MITIGATION REPORT 21 | Page CITY OF GEORGETOWN APPENDIX Risk Mitigation Register Page 66 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS R01 IT Cybersecurity Governance Model A comprehensive Information Technology (IT) cybersecurity policy and procedures document has not been approved by management and communicated to all employees and relevant external parties, outlining responsibility and oversight for Information Security (IS) and policy administration. IT Director Chris Bryce 21 1) We recommend the City implement a governance framework that allows for the proper management of a successful ISP. An effective ISP involves participation from senior management to set the direction for proper information security practices, adequate staffing and compliance with policies 2) Further, we recommend the City adopt a practice of performing a Cybersecurity risk assessment periodically. The periodic approach may take either of the following approaches: (A) performing a full assessment every other year due to intensive resources required to facilitate such an exercise or, (B) a targeted approach done annually including: • revisiting this report findings and updating controls where appropriate, • re-assessing the City’s mitigation plan to update progress and note any further concerns, and/or, • selecting a few high-priority control areas (e.g. vendor management, or any business objective/goal identified by executive management) and re-assessing associated threats related to those areas 1) Implementing IT Catalyst Plan – 5 year Strategic Plan 2) Developing documented policies to address various IT areas 3) Developing Cybersecurity Training 4) Conducted 2 security audits 5) Budgeting Lead System Security Analyst in FY19 6) Conducting PCI (Payment Card Industry) study (scheduled) 7) Implementing two factor authentication 8) IT Cybersecurity Risk Assessment by the US Department of Homeland Security 9) Determine best practices, implement security policies, and identify staffing/challenges to implement ISP 10) Identify staffing needs to appropriately manage IT security challenges and ISP 11) Continue Cybersecurity scanning on a yearly basis. 12) Implement ISP 13) Assigned security roles to existing staff and hired any security staff needed to manage an Information Security Program FULLY MITIGATED 1) The City has completed a draft Cybersecurity policy that is under review by multiple departments. It is a comprehensive policy that establishes basic security guidelines for all aspects of IT services, infrastructure and staff. The policy includes the designation of Cybersecurity officer in IT to lead implementations. Upon acceptance of the policy, multiple PMP measures will be instituted to measure compliance with policy. 2) The City is currently working with a consultant to perform a study of HIPAA related data security. 3) The City has conducted and passed multiple security assessments including those conducted by U.S. Department of Homeland Security. R02 Utility Market Exposure to fluctuations in the market price of utilities General Manager of Electric Utilities Daniel Bethapudi 18.75 1) Continue to enhance the City’s forecasting tools and techniques to increase granularity and improve accuracy. 2) Continue development of a strategy to meet future peak demand growth with distributed generation and storage rather than remote central generation to mitigate exposure to transmission congestion. 1) Shell was hired to forecast and manage purchasing power. Line extension policies and a rate study by NewGen has been conducted to ensure th electric utility is more resilient to a fluctuation in market price. 2) Daniel Bethapudi was hired to oversee the electric utility. 3) Risk Oversight Committee was created and regular reporting to Council PARTIALLY MITIGATED RESPONSE RISK LOG RISK RISK REGISTER ASSESSMENT Page 67 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R03 IT Asset Management: Data Classification The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to business objectives and the organization’s risk strategy. IT Director Chris Bryce 17 1) The City should consider classifying data within the system based on its criticality and / or sensitivity (NIST SP 800-53 Rev. 4 RA- 2). Classification of data will also help drive the above- mentioned information flow enforcement and help define the City’s security architecture 2) We recommend the classification of City data to define an appropriate set of protection levels and communication required for special handling Classifications and associated protective controls (including encryption for data at rest and data leak prevention tools) should take into account department needs for sharing or restricting information and the associated business impacts if such data were compromised. Successful data classification in an organization requires a thorough understanding of where the organization’s data assets reside and on what applications/devices they are stored. Handling procedures should include details regarding the secure processing, storage, transmission, declassification, and destruction of data. 1) Implementing IT Catalyst Plan – 5 year Strategic Plan 2) Implementing 2 factor authentication with Workday 3) Implementing consistent role based access to CIS and ERP system functions through Workday PARTIALLY MITIGATED 1) As part of the Cybersecurity Policy under review, a Data Management policy has been created that lays out a multi- department guidelines to classify and manage sensitive data. R04 IT Access Management Access to assets and associated facilities is limited to authorized users, processes, or devices, and to authorized activities and transactions. IT Director Chris Bryce 17 1) A role-based access scheme should be established to ensure consistent application of user access rights within the system. Users should be assigned their base set of access authorizations based on the concept of “Least Privilege Necessary” to perform their role or job function (as defined within their formal job description). Additional access beyond the previously established role-based access scheme should be formally requested, reviewed for conflicts and approved (NIST SP 800-53 Rev. 4 AC-2). Moreover, Management should consider integrating access rights with data classification efforts identified in Appendix B of this report 2) Ensure a process is in place to approve special access requests and timely de-provision access upon notification from HR 1) Roles and access defined in policy and set in Workday. SCADA is being audited by Homeland Security and will see recommendations to mitigate potential risks. FULLY MITIGATED 1) As a first step in meeting these requirements, the City has established a Cyber Security policy. As sub policy, that policy includes guidelines on access management. Upon acceptance of the policy, IT will begin implementing aspects of the policy pertaining to IT. 2) IT has implemented an approval process in its ticketing systems for both access requests and change control on major systems. R05 IT Contingency Plan Loss or inability to continue business due to natural disaster, system capacity or performance issues, interruption in communication, loss or corruption of data, or loss of critical vendors or staff members. IT Director Chris Bryce 17 Plante Moran recommends the City conduct and formalize: (1) A Business Impact Analysis (BIA) which identifies and analyzes mission-critical business functions, and then quantifies the impact a loss of those functions would have on the City, and (2) An information system contingency plan to mitigate the risk of critical system and service unavailability. The contingency planning process should occur after a formal Business Impact Analysis (BIA) is conducted, in order to correlate the system with the critical processes and services provided, and based on that information, characterize the consequences of a disruption. Three steps are typically involved in accomplishing the BIA: • Determine mission/business processes and recovery criticality • Identify resource requirements • Identify recovery priorities for system resources Preparedness committee in partnership with IT PARTIALLY MITIGATED The City will conduct this as part of a Business Continuity Plan Page 68 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R06 Segregation of Duties The Organization fails to adequately segregate roles and tasks between team members Finance Director Leigh Wallace 16.43 1) An annual review of user access for all staff members within the City across all programs managed by IT should be performed 2) Departments that have not had an internal control review within the past five years should evaluate the design and effectiveness of their internal controls Workday ERP system requires role-based security assignments. The Workday ERP system requires 2-factor authentication to access the system. FULLY MITIGATED R07 Legislation Governmental laws change that impact the organization by financial, operating, strategic or compliance issues. CMO David, Laurie, and Wayne 16.36 1) Council and Management should review and closely monitor the status of annexation plans for the City. After the 2020 census, the City will be limited in its ability to perform annexations due to Williamson County’s population surpassing 500,000 citizens 2) The City should work with legislators to clarify the impact of harmful legislation including revenue caps and limits on debt financing for infrastructure during the City’s period of high growth and should stress the removal of local control restrictions that impact citizens ability to impart changes in their local community 1) Staff reviews annexations and carefully plans in DPRC 2) Focused Advocacy was contracted as a lobbyist for the City to inform the City of developing and implemented legislation and its affects; as well as lobbies in the City's best interest PARTIALLY MITIGATED City is creating a Legislative Task Force with representation from the community to inform the City's legislative agenda. R08 Emergency Notification System Failure (ENSF) The City's Emergency Notification System fails to alert citizens in the event of an emergency. Emergency Management Coordinator Raymond Mejia 13.81 1) The City should communicate Incident Action Plans for large scale events to all parties involved with the event, including the Convention and Visitors Bureau (CVB) 2) Management should inform all departments of the operating procedures related to the ENSF 3) The EMC should develop basic and advanced emergency management training for key stakeholders in the City (Division Managers) and conduct table top and/or practical training exercises that replicate local level emergencies 1) Incident Action Plans are created and shared with needed stakeholders. With COVID- 19 Situational Reports and IAP's were created after EOC meetings and shared with stakeholders. 2) 3) Creation of Preparedness Committee which is working on several emergency management deliverables to better prepare the organization as a whole. 1) Work with utilities to map a process flow to send out alerts (e.g. boil water notices) PARTIALLY MITIGATED 1) Creation of Continuity of Operations Plan 2) Tabletop exercises completed quarterly throughout the year with Directors 3) Create EOC training and emergency management training for staff on the LMS Page 69 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R09 Fraud Customer, third party, or internal fraud occurs resulting in a significant misappropriation of assets and/ or incorrect financial reporting, or corruption/ kickback schemes. Controller Elaine Wilson 13.75 1) The Finance Department should perform more robust reviews of P-Card purchases and consider utilizing software to perform regular audits of P-Cards 2) The Finance Department should perform annual reviews of P- Card users to evaluate whether the all users actually need P- Cards 3) The City should implement a more extensive asset tracking program, utilizing fixed asset tags on assets valued over $1,000 with consideration of periodic asset audits 4) Vendor Ship-To addresses should be limited to a “drop down” list consisting only of City facilities 5) The City should consider developing a fraud awareness and prevention training program with active participants across all City departments 6) All changes to IT databases deemed to be material should be tracked on an Audit File Log and reviewed by someone without access to the databases 1) A review of all P-card users was performed during the Workday ERP conversion. Cards were added and reduced as necessary across departments. Several departments turned in individual cards used infrequently, and switched to shared cards monitored by a card liaison. The total number of cards remained the same across the City. Travel requests are now audited before the event occurs, in addition to after the event occurs. This has improved accuracy of travel expenses 2) P and T Card review was done this year with the issuance of new cards 3) Some departments are beginning asset management programs 4) Workday limits ship to address options 5) Cash handling training is required for those handling cash 6) Several levels of reviews for changes to IT database and regularly audited and checked for weaknesses by Department of Homeland Security PARTIALLY MITIGATED Have regular audits conducted of processes prone or vulnerable to fraud R10 Health & Safety Exposure to potentially significant workers' compensation liabilities due to the inability to maintain compliance with applicable health and safety laws and regulations. HR Director Tadd Phillips 13.04 Overall, the City has robust health and safety procedures and should consider adding the following: 1) The Library should develop clear policies and procedures on a course of action when a customer, employee, or volunteer is injured at the facility. 2) The City should review the lifeguard policy for pool facility rentals. The City currently does not provide a lifeguard for pool rentals by the Georgetown Independent School District and does not require GISD to provide their own lifeguard. 3) Consider adding an Active Shooter response plan 1) Centralized safety and risk management team as of Oct. 1, 2019 2) GISD and the City are working on an interlocal agreement that will mitigate the safety risks. 3)November and December active shooter and fire safety training at several City facilitates FULLY MITIGATED Page 70 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R11 IT Incident Response Management Response processes and procedures are executed and maintained, to ensure timely response to detected cybersecurity events IT Director Chris Bryce 12 We recommend the City implement a formal incident response plan including: 1) Provide a roadmap for implementing its incident response capability; 2) Describes the structure and organization of City of Georgetown’s incident response capability; 3) Provides a high-level approach for how the incident response capability fits into City of Georgetown as a whole and the overall Family of Companies; 4) Meets the unique requirements of City of Georgetown’s mission, size, structure, and functions; 5) Defines reportable incidents as well as requirements and guidelines for external communications and information sharing (e.g., what can be shared with whom, when, and over what channel); 6) Provides metrics for measuring the incident response capability within the organization; 7) Defines the resources and management support needed to effectively maintain and mature an incident response capability; and 8) Is reviewed and approved by senior management Preparedness committee is devloping a hazard mitigation plan that will address these across departments including IT PARTIALLY MITIGATED Preparedness committee is devloping a hazard mitigation plan that will address these across departments including IT R12 Utility Outage The City is unable to respond to mass failures of electrical, water, or sewage outages in a timely manner. Utility Director Glenn Dishong 11.89 1) Maintain equipment useful lives schedule and proactively monitor components which have reached their useful lives 2) Perform a vulnerability assessment to judge your preparedness for handling the increased likelihood for power outages 1) Assets are being monitored as well as their useful lives. 2) Risk and vulnerability assessment was conducted. PARTIALLY MITIGATED Continuity of operation plan and playbook for utility outage. R13 Access to Talent Organization lacks sufficient staffing levels to carry out its routine operations. HR Director Tadd Phillips 11.75 1) The City should evaluate positions with required specialized certifications and determine whether entry level staff members can obtain certifications after hire 2) For specialized positions, including, but not limited to, building inspectors, paving foremen, and traffic engineers, the City should conduct an assessment of staffing levels with a 3-year outlook 3) The Fire Department should develop a plan to acquire the necessary EMS personnel talent 1) Several key departments are initializing step programs to promote staff retention and development for more specialized roles. 2) Many departments utilize metrics to gauge staffing needs with an outlook of a few years. 3) Fire continues to study the needed personnel and requests staff in the budget process. FS 6 and 7 will have the adequate staff to operate. FULLY MITIGATED Establish a process to identify staffing level needs with a 3-5 year outlook. R14 Disaster Recovery / Business Continuity Planning Inability of the organization to continue key business processes during a potential disaster due to lack of sufficient disaster recovery planning and/or execution. CMO David, Laurie, and Wayne 11.6 1) The City has inconsistent DR/BCP across the organization. Some departments have a robust plan and others have none. A DR/BCP should be developed for every City department. Each of these department-level plans should then be integrated into a city-wide plan 2) Tabletop disaster recovery simulations should be performed with all City Departments 1) Business plans have been completed by all departments with their budgets for 2021. 2) Emergency management coordinator is developing policies and procedures as well as tabletop exercises; 2) Disaster Preparedness Committee has been created PARTIALLY MITIGATED 1) Policies and procedures developed, adopted, and training given to all employees. 2) Tabletop exercises completed quarterly throughout the year with Directors 3+L11) Workday is a cloud system, meaning it is accessible anywhere with an internet connection, including mobile devices. Page 71 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R15 Billing for Citizen Services Citizens are billed incorrect amounts or not billed at all for citizen services Customer Care Director Leticia Zavala 11.37 a. The fine schedule for the Municipal Court citations should be restricted to specific users b. All invoices should be created in a single system across the City and remit-to addresses should be limited by a “drop-down” function consisting of only addresses the City accepts payments c. Management should consider a third party revenue recognition study to validate all sources of revenue are complete and accurate across the City operations d. An outside party, Emergicon, reviews billing for EMS incidents as there are various rates depending on citizen’s ability to pay. Emergicon also collects funds and this helps reduce the occurrence of billing errors and improves collections. However, Emergicon also writes off funds and there is no reconciliation of EMS revenue to billings. We recommend the City enhance reconciliation controls around billing procedures and perform internal audits of quality control and verification of vendor compliance. 1) AMI/MDM and CIS systems are currently being reviewed by a third party to identify efficiencies and recommend processes to reduce billing inaccuracies as well as other issues with the systems PARTIALLY MITIGATED 1) Implement changes recommended by Garner's study of the AMI.MDM and CIS system R16 Composition of Tax Base Changes in the balance of commercial and residential tax base result in losses of revenue from taxes. CMO David, Laurie, and Wayne 10.63 1) The City should communicate potential new commercial and residential development to directly impacted City departments and evaluate how new development would affect each directly impacted department 2) Management should utilize a concentration strategy that is flexible and supported by realistic expectations 1) City can use the Fiscal Impact Model to estimate the cost to serve and its impact on city services with new developments; DPRC also serves as a vehicle to consider new developments and its impact FULLY MITIGATED R17 Grant Obligations Organization fails to meet grant covenant requirements. Controller Elaine Wilson 10.55 1) The City should designate a staff member as a Grant Administrator. This staff member should be responsible for maintaining a repository of all grants being applied for, awarded, contact person, and any required filings associated with each grant. City should require that all Grants be managed through the new Grant Administrator 2) A Grant Status Report should be provided on a periodic basis to the City Manager’s office for potential budget considerations 1) Elaine Wilson is the grant administrator and staff does the reporting for grants. Policy created and training is done with departments with active grants. 2) Quarterly Financial Report includes grant report which is validated by Controller. FULLY MITIGATED R18 IT Third Party Roles & Responsibilities Security roles and responsibilities are not established for all third-party service providers and lack clear contractual obligations for service level agreements and KPI’s. IT Director Chris Bryce 10 We recommend management take the following actions: 1) Clearly identify the cybersecurity responsibilities to be outlined in the contract with the service provider including roles for identification, response, and recovery procedures 2) Establish Key performance indicators for third-party responsibilities including number of events, data breaches, number of notifications 3) Continuously monitor contract SLA’s and established key performance indicators PARTIALLY MITIGATED This is a low priority risk as IT infrastructure is managed in- house. As part of the new Cybersecurity Policy under review, a Vendor Access policy will cover basic guidelines for vendors. Page 72 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R19 Vendor Reliance Any termination of, or adverse change in, the Organization's relationships with its key suppliers, or loss of the supplies in support of one of the organization’s key services Purchasing Manager Leah Neal 9.81 1) Assign one person the responsibility of monitoring all key vendors to the City 2) Create a subsidiary listing of all key vendors with contract details, SLA’s and performance metrics 3) Report back to City Manager when it is determined a vendor may become insolvent or is not meeting SLA’s 4) Prior to contract renewal, negotiate with all key vendors to capture volume discounts and preferred pricing 5) Management indicated Garland Power & Light currently reconciles their meter data to the scheduling data and the transaction settlement engine. This could be done in house but would require additional headcount as the process runs 24/7. Management should consider a cost/ benefit study to do this in- house 1) Not realistic, but procurement could have oversight with contract monitors in each department 2) Existing contracts do not have performance measures built-in. Contracts need more specificity to identify indicators of performance. Contract specialist could help in this area to create a standard for contracts moving forward. Performance of contracts should be done more so on the power user level, but processes should be put in place. 5) Gartner study is identifying best practices and gaps with current MDM/CIS system. There is also a multi-department initiative beginning soon that aims to find efficiencies and streamline the meter-to-cash processes PARTIALLY MITIGATED 1) Create a sole source policy; vendors should not be the ones to verify that they are sole source and a approval process for sole source needs to be created. 2) Create a better process of procurement; often contracts and purchases on the Council agenda have never been reviewed by the purchasing team. Training recommended for staff on procurement process. 3) Contract Review Committee with members from key stakeholders involved (e.g. Purchasing, Legal, CMO, etc.) to follow best practice and keep all parties apprised of contracts within the City R20 Physical Security Facilities are not appropriately secured from unauthorized access. Facilities Eric Johnson 9 1) Consider taking inventory of all key cards to validate none have been stolen or lost 2) Consider development of physical security training for all personnel regarding safeguarding of assets, restrictive access to high risk areas, etc. The City must support integrity of physical security through the organization with the assistance of the City’s Risk Manager 3) Standardize a consistent security plan across all locations appropriate for each facility 4) The City currently monitors physical access to the facility where IT resides to detect and respond to physical security incidents. However, CoG does not review physical access logs periodically 1) Staff is working on this with the police department, and access is monitored for irregularities. 2) New city buildings were built with security in mind, older buildings are being renovated with employee safety as a priority. 3) The safety team in HR & OD is working on creating a safety plan across all facilities; Emergency Response Plan is also available and being updated. 4) The City monitors when an incident occurs or access usage is used out of the normal operating times or pattern usually seen from whomever is accessing the building. PARTIALLY MITIGATED 1) Create a formal security access policy 2) Conduct safety training or create training in the LMS for threats such as active shooter and natural disaster like a tornado in the area 3) Remodel GMC to have better safety and controlled access for employees Page 73 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R21 IT Critical Security Event Identification A formal risk event identification process is not in place to identify, classify and resolve security events IT Director Chris Bryce 9 1) Identify high risk events that can be alerted from current logging capabilities (NIST SP 80053 Rev. 4 AU-6). Potential high risk events can be discerned through the risk assessment process (NIST SP 800-53 Rev. 4 RA-3), penetration testing, and best practice documentation. Some common threat events include: • Multiple failed login attempts • Elevations in access privileges • Changes to application code • Changes to security settings • Process specific actions 2) Consider alert generation techniques for risky events such as devices that connect to the network without authorization 3) Identified events should be responded to in accordance with the organization’s Incident Response Plan The City's current Cybersecurity Officer and Operations Staff monitor cybersecurity events. PARTIALLY MITIGATED When economic conditions allow, IT intends to implement a Security Information and Event Management (SIEM) system for improved monitoring of security events. R22 IT Security Awareness, Training and Education Personnel are not informed of potential IT threats to the organization and are unable to respond effectively IT Director Chris Bryce 9 1) Rely on end users as the first line of defense to limit exposure to social engineering frauds and threats 2) Consider increasing complexity of password requirements 3) Create a formal IT Awareness training and provide to all employees on a periodic basis 4) Require employees to formally acknowledge in writing that they have read and understand the security awareness training, and that they recognize the ramifications of non- compliance In FY 20, the City implemented a Security Awareness policy that includes a requirement that all employees conduct Cybersecurity Awareness training. PARTIALLY MITIGATED All employees completed this training and will do so annually. The new policy, currently under review, will also require additional training for employees who handle sensitive data. R23 Fire Department Failure The Fire Department is not adequately equipped to handle responses to emergencies in the City. Fire Chief John Sullivan 8 1) Consider an independent third party evaluation study of the GFD capabilities, response metrics and resource allocations to evaluate if there needs to be changes to the current resource allocation model 2) Consider cooperative agreements with ESD8 and/or contiguous municipalities to elevate synergistic programs (co- located/co-operated) fire stations and boundary drops (enhanced auto-aid). 3) Consider making licensed buildings be required to be inspected annually. Also, consider a self inspection program for low risk properties and/or an inspection matrix as follows: • Low Risk – every 3 years • Medium Risk – every 2 years • High Risk – annually 4) Management should consider the implications for property owners and businesses when the Public Protection Classification (PPC) issued by the Insurance Services Organization (ISO) is not performed, as there may be a negative impact if not inspected annually. 1) Hired technical advisory; Community risk assessment and strategic plan for accreditation Spring 2021. 2) Finalized a 10 year contract; ESD 3& 5 auto- aid with Williamson, Travis, and Round Rock. Fire station 6 is now open in ESD8. 3) Not needed at this time. 1) Fire Marshall 2) Fire Protection Engineer PARTIALLY MITIGATED R24 Freedom of Information Act (FOIA)Non-compliance with FOIA requests City Secretary Robyn Densmore 6.22 1) When the transfer of FOIA request process is complete, consider documenting the process with written policies and procedures FOIA policy and procedure created and presented to Directors. City has a full time open records specialist. Additional open records specialist due to the continued increase in volume of open records requests. FULLY MITIGATED Continue annual staff trainings on open records requests Page 74 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R25 Police Failure The Police Department is inadequately equipped to respond to emergencies or responds in an unauthorized manner. Police Chief Wayne Nero 6 1) Develop the following Key Risk Indicators (KRI’s) and monitoring controls which may indicate a risk event is about to occur a. Increase in City crime rates b. Increase in police misconduct/brutality incident claims c. Increase in squad car accidents d. Excessive overtime e. Unexpected cost overruns/continuous unfavorable budget variances f. Increase in dismissed cases due to insufficient evidence, improper procedures or failure to follow legal standards for police 1) Metrics for monitoring are closely monitored for trends and shared with CMO and Council. These metrics guide decisions made by the Police chief. B.) Every incident is reviewed/investigated, monthly management report reviewed, and guardian tracking has an early warning system for personnel exhibiting certain performance indicators that triggers higher level review of officer C.) Reviewed and investigated and included in monthly mismanagement report and added to officers file for tracking of patterns. D.) OT monitored every pay period with various measures and historical reviewed E. Costs tracked internally and in workday FULLY MITIGATED R26 Talent Management Organization lacks a clear assessment and evaluation process to align qualified employees with specific business requirements and needs. HR Director Tadd Phillips 5.42 1) Have HR department work collaboratively with business lines to gain in depth knowledge of resource needs and constraints 2) Consider using an outside party for diversity in pre-hire assessments 1. Directors oversee their departments and align those best qualified to fill gaps in their organization through promotion or lateral shifts. FULLY MITIGATED Learning and development survey was conducted , city staff were asked to identify their needs for professional development. R27 Records Management No records management policy is in place, adhered to, or is inadequately designed. Records Program Manager Cynthia Conomos 5.27 1) Formalize Records Management policy regarding digital records and communicate to all departments 2) Consider additional training on electronic records management 3) Consider digitizing Parks & Recreation forms 1) Records management program has an existing policy from 2015, revised in 2019. Team is currently in the process of their records management survey. 2) Began a finance electronic record cleanup to help clear records that met retention and organize files for Finance. 3) Digitizing forms in progress Records specialist to maintain with the rate of new requests FULLY MITIGATED Records team is working with all departments on their records retention program and conducting training. Page 75 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R28 Regulatory Filings Failure to comply with regulatory filings such as GASB, EPA, etc. Controller Elaine Wilson 5.2 1) Agency (EPA) and Texas Commission on Environmental Quality (TCEQ) permit reports every 3-5 years 2) Finance prepares annual CAFR and SEFA which is submitted to the clearinghouse 3) Customer Care prepares annual filings on storm water use survey breaking out how much water was taken in to the system. 4) City of Georgetown has an exemption from complying and filing necessary reports mandated by Senate Bill 898 (reducing energy consumption in City owned facilities) & administered via the State Energy Conservation Offices (SECO) because of the 100% renewable designation. 5) Customer Care is required by TCEQ to report water quality testing results to customers on an annual basis. Deadline for customer communications is 7/1. GUS must certify with TCEQ by 5/1 that we provided water quality testing results to water purveyors that obtain wholesale water from GUS. 6) Energy Services relies on outsource provider Snyder Engineering for all regulatory findings 7) Utility services is subject to an annual requirement with the ERCOT to validate that a risk management plan is in place 8) Airport has a significant amount of regulatory filings ranging from EPA, TCEQ, Stormwater, Airplane inventory, and Property Taxes through MCAT. Use Microsoft Outlook as reminders 9) Fire Dept. has numerous state health services filings regarding training, certifications, incidents, fatalities, etc. 1) Each department is responsible for compliance at the state and federal level and they do so regulalry to comply with deadlines. FULLY MITIGATED R29 Succession Planning Leadership talent within the organization is insufficiently developed to provide for orderly succession in the future. HR Director Tadd Phillips 4.39 1) The City should consider an outside party to implement a formal Succession Plan 2) Consider a mentor shadowing program to protect the City against unplanned terminations or leaves of absences 1) Engaged leaders program allows for leadership development. Directors informally plan succession by training assistant directors or identifying d individuals they believe might be right for the job. National searches are done externally to also fill roles with the best candidate. 2) City is establish its organizational development department within HR which will facilitate the creation of programs that will bolster professional development and any other needs of staff identified in the City-wide needs assessment. PARTIALLY MITIGATED Learning and development survey was conducted , city staff were asked to identify their needs for professional development. Several departments have incorporated cross-training and succession planning into their operations. Page 76 of 167 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R30 Budget and Planning Budgets and business plans are not realistic, based on appropriate assumptions, based on cost drivers and performance measures, accepted by key managers, or useful or used as a monitoring tool. Finance Director Leigh Wallace 3.24 1) Certain departments such as utilities, water, electric, etc. count on supplemental data to prepare their budget (see Data Governance risk #27). We recommend management validate and document the completeness and accuracy of assumptions for all budget line items 2) Management should set a clearly defined threshold for all material variances to be explained (e.g. +/-XX% and $YY,YYY) 1. New business plans were developed tying KPI's with the goals of that department and the mission. 2. Budget process requires several reviews and checks by analysts and executives to ensure budget lines are appropriate. The budget development module of the Workday ERP system is currently being implemented. Finance participates in the rate studies and supplemental consultant financial models for the utilities. PARTIALLY MITIGATED 1) Create a budget with a more detailed 5 year outlook R31 Tax Non-compliance with state or federal tax law. Controller Elaine Wilson 3 1) Consider the creation of a master tax filing schedule and reporting to City Manager N/A NOT MITIGATED 1) Create master tax filing schedule after Workday implementation R32 State/Federal Regulations Failure to comply with new or existing federal or state regulations. Controller Elaine Wilson 2.44 1) Develop a Citywide license and CPE tracking system 2) Develop a process to ensure all City playgrounds comply with ASTM F1487-07. The code does not require a formal inspections process, just that the City complies with the ASTM F1487-07 standard 1) Workday has capability to track development and performance, but is not being used as the city develops it learning and development program 2) City utilizes third party's to design and construct playgrounds who are aware of state and federal regulations PARTIALLY MITIGATED 1) Consider tracking CPE's through Workday R33 Leadership The people responsible for the important City processes do not or cannot provide the leadership, vision, and support necessary to help employees be effective and successful in their jobs. CMO David, Laurie, and Wayne 2.42 1) The City should consider an upward feedback program to validate lower levels of employees are satisfied with management’s performance 1) Currently focused feedbacks are in place which are a two-way feedback of the employee and supervisor; Supervisors are evaluated in 360 evaluations by peers; employee engagement surveys are done bi- annually and provide a feedback mechanism as well anonymously 2) More regular feedback is encouraged with the use of the Diamond Drop program FULLY MITIGATED IMPACT / OCCURRENCE LIKELIHOOD LEVEL 2018 Risks Fully Mitigated Partially Mitigated Not Mitigated HIGH MEDIUM LOW HIGH 5 2 3 0 5 17 11 MEDIUM 17 5 12 0 LOW 11 6 4 1 Fully Mitigated Partially Mitigated Not Mitigated Total 33 39%58%3% 13 19 1 2018 Risks TOTAL REGISTER DROPDOWN KEYS IMPACT / OCCURRENCE LIKELIHOOD LEVEL MITIGATION STATUS Page 77 of 167 Make the mark. CITY OF GEORGETOWN, TEXAS SEPTEMBER 25, 2018 Citywide Risk Assessment Results & Next Steps Page 78 of 167 September 25, 2018 Mr. David Morgan, City Manager City of Georgetown 113 E. 8th Street Georgetown, Texas 78627 Dear David, We have performed the procedures as agreed upon in our consultation agreement dated November 7, 2017. Those procedures were applied solely to provide consulting services to assist City of Georgetown, Texas (“City”) in developing a Citywide Risk Assessment (CRA) to understand the risk environment and internal control structure of your functional areas and processes to identify key risks and the internal controls over those risks. The results of this report contain our assessment of the key risks to your organization, rankings of current mitigation strategies, treatment plans to assist in the management of key risks, and emerging best practices in government industry control environments. We were not engaged to, and did not perform an examination, the objective of which would be the expression of an opinion of City of Georgetown, Texas’s internal control environment. Accordingly, we do not express such an opinion. We were not engaged to perform any specific internal control testing procedures beyond inquiry of management and, therefore, we have not done so. Had we performed additional procedures, other matters might have come to our attention that would have been reported to you. This report is solely for the information and use of the management of City of Georgetown, Texas and is not intended to be, and should not be, used by anyone other than the specified party. We would like to recognize and thank the staff of City of Georgetown, Texas for the cooperation and courtesy extended to us throughout this process. Sincerely, Doug Farmer, CICA Partner – Risk & Accounting Advisory Services Plante Moran, PLLC Page 79 of 167 TOC | Page Table of Contents Executive Summary 1 Project Scope and Approach 3 Risk Universe 4 Impact and Likelihood Criteria 5 Risk Assessment Results and Next Steps 7 Appendix A: Risk Treatment Action Plans 11 Appendix B: Information Technology Detail 40 Page 80 of 167 1 | Page Executive Summary Purpose and Introduction In 2017, staff updated the City’s Fiscal and Budgetary Policies to enhance the existing internal audit and risk program. The General Government and Finance Advisory Board and the Council added ongoing funding to the Finance Administration budget to support this change. As a first step in the program, the City procured a firm to perform a comprehensive risk assessment. The outcome of the assessment will be used to prioritize the steps to continue enhancing the audit program and mitigating risk. Plante Moran performed a Citywide Risk Assessment (CRA) of the City of Georgetown, Texas (“Georgetown”, “COG” or “City”) with the objective of helping the City achieve its strategic priorities and advance management’s process to identify, classify and mitigate risks to the organization. Our CRA services consisted of the following: 1. Interview key stakeholders to understand Georgetown’s viewpoint on risk management 2. Conduct interviews with key City Departments to assess inherent and residual risks of the risk universe 3. Assess the strength of Georgetown’s mitigating activities and risk treatment factors 4. Assignment of risk owners and actions steps for remediation plans, if necessary 5. Preparation of reports to management and Council detailing the results of our work and recommendations to manage risk and strengthen the control environment High Level Themes Noted: • The City is exposed to four high Information Technology (IT) residual risks. We recognize the City is currently in process of an ERP system upgrade and the status of these conditions will change in the near future: IT Cybersecurity, IT Asset Management: Data Classification, IT Access Management and IT Contingency Plan. See Appendix B for IT Risk Report. • The City lacks a clear process for the assignment and review of user access roles and responsibilities to achieve segregation of duties in three key business departments. We noted during discussions with Finance, Customer Care and Parks and Recreation one person can control more than two phases of a transaction exposing the City to unauthorized transactions and fraud risk. • The Georgetown Utility Service (GUS) electricity is a vertically integrated monopoly which is allowed in the State of Texas. The Texas Legislature granted an exception called OPT OUT of bundled services and this gets reviewed at each legislative session every two years. If this OPT OUT provision is rescinded, the City would still have the wires/ transmission equipment and would be the whole seller to the power companies but there would be significant effort and expense to the City to be OPT IN ready if the legislature changes position and the resulting transition would take about 2 years. • Management indicated several potential costly Texas legislative acts are due for review at future legislative sessions. • The City is challenged with documentation of operating policies and procedures. Currently, 15 out of 25 (60%) departments we interviewed have a lack of clearly written policies and procedures available to all employees. Page 81 of 167 2 | Page Project Approach and Scope Approach We met with management to develop the following: • Planning Meeting – This segment was dedicated to understanding the risks to key individuals in the organization. We worked with management to outline the risks impacting the City. • Ranking Criteria – Based on our conversations with key individuals, we created impact and likelihood criteria for grading / assessment of the risks. • Risk Assessment Interviews - We held risk assessment interviews with key individuals from key departments across the City to capture management’s view of inherent risks and mitigating activities. • Control Gaps & Observations – Using the information gained in the items above, we noted observations, identified the top residual risks to the organization, and offered recommendations for control and process improvements. Scope In context of this risk assessment, a “Key Business Department (KBD)” is defined as a vital business process, function or activity on which the organization spends a significant amount of financial or personnel resources to perform, or an activity over which they have primary responsibility within the City. The following 25 departments are considered KPD’s and in scope for this engagement: Key Business Departments (KBD) Listing 1. (AIR) Airport 14. (GUS) Georgetown Electric / (NRG) Energy Services 2. (ASV) Animal Services 15. (PLH) Planning/Housing 3. (ATT) City Attorney 16. (HUR) Human Resources 4. (COD) Code Enforcement 17. (BINS) Building Inspection Services 5. (COM) Communications 18. (ITS) Information Technology Services 6. (CRT) Municipal Court 19. (LIB) Library 7. (CUS) Customer Care / Conservation 20. (MGR) City Manager’s Office 8. (CVB) Convention & Visitor's Bureau 21. (PKR) Park & Rec 9. (ECO) Economic Development / Main Street 22. (SEC) Secretary / Records 10. (ENG) GUS Systems Engineering / GIS 23. (SWR) Solid Waste & Recycling 11. (FIN) Finance, Purchasing & Payroll 24. (TSP) Transportation 12. (GFD) Georgetown Fire Department 25. (WSV) Water Services 13. (GPD) Georgetown Police Department Plante Moran met with the department heads and key managers to discuss the risk universe, assess the inherent risks and document the key internal controls and mitigation strategies for each risk in the risk universe applicable to each department. Residual risk scores are calculated based on inherent risk minus strength of mitigation activities. Page 82 of 167 3 | Page Risk Universe A planning meeting was held with the City Manager and Assistant City Managers to co-develop a risk universe using a standard governmental entity risk profile customized to the Georgetown specifics for population, demographics, services offered, operations and complexity. The initial universe started with approximately 90 risks and the list was distilled down to the top 33 risks applicable to the City of Georgetown. We then met with each department individually to discuss the impact and likelihood to their department. It is important to note that not all 33 risks are applicable to every department. Only 14 out of 33 risks were determined to be citywide impacting all departments. The illustration below is the risk universe utilized for this assessment: City of Georgetown Risk Universe 1. Access to Talent 18. IT Security Awareness, Training and Education 2. Billing for Citizen Services 19. IT Third Party Roles & Responsibilities 3. Budget and Planning 20. Leadership 4. Composition of Tax Base 21. Legislation 5. Disaster Recovery / Business Continuity 22. Physical Security 6. Emergency Notification System Failure 23. Police Failure 7. Fire Department Failure 24. Records Management 8. Freedom of Information Act (FOIA) 25. Regulatory Filings 9. Fraud 26. Segregation of Duties 10. Grant Obligations 27. State-Fed Regulations 11. Health & Safety 28. Succession Planning 12. IT Access Management 29. Talent Management 13. IT Asset Management: Data Classification 30. Tax 14. IT Contingency Plan 31. Utility Market 15. IT Critical Security Event Identification 32. Utility Outage 16. IT Cybersecurity Governance Model 33. Vendor Reliance 17. IT Incident Response Management Note: the 14 bold risks were common citywide across all departments. The remaining risks were assessed on a case-by-case scenario by department. Information Technology risks were evaluated in three categories: 1) Centrally Managed, 2) Vendor Managed, and 3) Department Managed. Impact and Likelihood Criteria Key department personnel participated in the risk interviews to rank the risks to the organization using an impact and likelihood criteria developed with senior management. The impact and likelihood criteria table below is applied to each risk to assign the inherent risk. The inherent risk rankings are then used as the starting point to calculate residual risks. Impact Criteria Ranking 5 (high) 4 3 2 1 (low) Financial Impact: Expense or Lost Revenue >$150K $100K - 150K $50K - $100K $25K - $50K <$25K or Strategic Impact: Page 83 of 167 4 | Page Strategy/ Mission/ Legislature Failure to meet key strategic objective Major impact on strategic objective Moderate impact on strategy Minor impact on strategy No impact on strategy or Operational Impact: Reputation Extreme Severe Moderate Low None Process / System Shutdown > 7 Days 5 - 7 days 3 - 5 days 1 - 3 days < 1 day Compliance Impact: Regulatory - State/ Local/ HIPAA/ Debt Covenants Large-scale material breach of regulation Material breach but cannot be rectified Material breach which can be readily rectified Minimal breach which cannot be rectified Minimal breach which can be readily rectified Likelihood Criteria Ranking 5 (high) 4 3 2 1 (low) Probability of an event occurring in a given year: >20% 15 - 20% 10 - 15% 5 - 10% <5% or Event Occurrence (on average): Once a year or more 1 in 3 years 1 in 5 years 1 in 7 years 1 in 10 years Page 84 of 167 5 | Page Risk Identification and Ratings It is important to clarify the factors in determining the levels of risk as presented in the following departmental risk assessment graphs. For comparability purposes, risk is evaluated by distinguishing between types of risk and the following definitions are provided: INHERENT RISK – the perceived impact and likelihood associated with a process or activity that exists simply from the perspective of its current environment BEFORE consideration of mitigating activities such as insurance, internal controls or other risk treatment strategies. This assumes no significant actions taken by management to mitigate (address) those risks. For example, the City has inherent risks associated with its citizen demographics, funding sources, population, economic slowdown, structure of federal and state government, etc. This can then begin to be refined to the departments within the City government. RESIDUAL RISK – the level of impact and likelihood of an adverse event occurring to impede the City, Department, and/or Processes from achieving success AFTER identifying and testing of management’s mitigating activities and internal control structure. The citywide risk assessment considered primarily inherent risks, with limited identification of control risk as self-reported by management. We did not substantively test specific management controls in detail and therefore, do not render an opinion on the effectiveness of design nor the efficiency in implementation or existence. The ratings do not imply a judgment on how management is addressing risk and thus is not a specific assessment of management performance nor concludes on ‘Residual Risk’. Management will need to perform detail testing to determine: (1) if mitigation activities reported by management are actually in place, and (2) if the mitigation activities are designed and operating effectively. VELOCITY – the speed assessment of how quickly a risk will impact the organization: • Fast: These risks are becoming more relevant to Georgetown’s operations and can quickly impact the organization. Risks with a moderate to high residual risk ranking and fast velocity should be closely monitored as a risk event could occur quickly and without warning. • Moderate: No known or pending events suggest either an increase or decrease in the composite risk weighting. These risks will impact the organization at neither a fast nor a slow pace. • Slow: These risks will impact the organization over time and might require a playbook that extends over a longer period of time. Risk Assessment Results and Next Steps The following pages summarize the Risk Assessment Results from 3 different perspectives: Page 85 of 167 6 | Page Graph 1 - Net Risks by KBD 1: (1) Net Risks by Key Business Departments: the total number of risks from the Risk Universe that apply to each department. As noted earlier, 14 of the 33 risks have been identified as pervasive across all departments and the others are assessed on a case-by-case scenario. The net risk assessment by KBD revealed that Georgetown Fire Department, Information Technology Service2, Finance, Georgetown Police Department and Parks & Recreation fall within the high risk category based on Net Risks by Department. 1 Each department was assessed for the 33 risks outlined in the Risk Universe on p. 3. There are 14 risks that are pervasive across the City and the remaining risks were assessed on a case-by-case scenario. 2 For the purposes of risk ranking, certain Information Technology risks with similar mitigation activities and control objectives were combined for reporting purposes. The Risk Universe shows 8 IT risks and the detail IT Risk Assessment report is included in Appendix B has 11 risks. Page 86 of 167 7 | Page Graph 2 – Weighted Residual Risks by KBD: (2) Weighted Risks by Key Business Departments: the total number of risks weighted by rankings using the following weighting formula: Red 17 or > (3 points), Yellow 8-16 (2 points), and Green <8 to 5 (1 point), <4 (0 points). Therefore, the higher risk rankings carry a higher weighted risk. The Weighted Residual Risk by KBD reveals there are two (2) additional departments needing consideration as the ratio of high risks to total brings the residual risk to a high for Customer Service and Building Inspection Services, in addition to the KBD’s noted in Graph 1. Evaluation of these various factors provides indicators on prioritizing the potential Future State Risk Mitigation Activity recommendations outlined in Appendix A. Page 87 of 167 8 | Page Graph 3 – Citywide Composite Residual Risk Rankings X = Fast Velocity | = Moderate Velocity (3) City-wide Composite Residual Risk Rankings: the profile of consolidated highest ranking risks to the City regardless of KBD. As noted earlier, certain risks may only apply to a limited number of KBD and may be insignificant on a City-wide basis. Page 88 of 167 9 | Page Composite scores represent a cross-section view of risk without regard to KBD. The composite scores above are an average of the risk rankings for only the departments where the risks are applicable. For example, Billing for Citizen Services is a risk to the City but only applies to 13 out of 25 KBD’s. The scores above are an average of those applicable departments excluding the departments that do not do billing. Results from this graph illustrate the severity of risk regardless of the department which they fall under. Residual Risk Dispersion The following graph depicts the dispersion of the risk events between high, medium, and low residual risk (including the consideration of existing control or mitigation activities) categories. High indicates that the residual risk score fell beyond Georgetown’s risk tolerance. These risks require the most attention and strongest mitigation strategies. Medium indicates that the residual risk was within tolerance. Low indicates that the risk fell well below Georgetown’s tolerance. It may be possible that some of these risks are being over mitigated. Next Steps 1. Strengthen and implement mitigating activities for each risk to bring the residual risk down into tolerance (see Risk Treatment Action Plans in Appendix A). 2. Assign risk owners and control owners and determine what information needs to be reported back to the City Manager on a periodic basis (i.e., quarterly). 3. Identify a risk management resource to manage the risk owners and communicate all necessary information from the risk owners to the City Manager and City Council. 4. Risk Owners identify key risk indicators (KRI’s) for each risk. 5. Build execution playbooks for each risk treatment. RANK RESIDUAL RISK COUNT High > 16 7 Medium 8 – 16 14 Low < 8 12 Total 0 – 25 33 Page 89 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 10 | Page Recommended Risk Treatment Action Plans Page 90 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 11 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 1 IT Cybersecurity Governance Model A comprehensive Information Technology (IT) cybersecurity policy and procedures document has not been approved by management and communicated to all employees and relevant external parties, outlining responsibility and oversight for Information Security (IS) and policy administration. 21.00 IT Director 1) The City has a documented IT Acceptable Use Policy in place but it does not encompass an overall Information Security Program (ISP) containing the following elements: Purpose/Scope, Roles and responsibilities (including those related to regulatory requirements), Enforcement, Information Sharing, Data Classification, Information Risk Management (IRM), Data Backup and Retention, Data Destruction/ Retention Policy 2) Members of the IT department perform several duties beyond their originally assigned tasks and roles and responsibilities related to key initiatives such as Risk & Incident Management, Disaster Recovery & Business Continuity are not clearly defined 3) The IT department has taken measures in implementing security practices throughout the IS environment; however organizational cybersecurity risk management practices are not formalized, and risk is managed in an ad hoc/reactive manner; a citywide approach to managing cybersecurity risk has not been established 1) We recommend the City implement a governance framework that allows for the proper management of a successful ISP. An effective ISP involves participation from senior management to set the direction for proper information security practices, adequate staffing and compliance with policies 2) Further, we recommend the City adopt a practice of performing a Cybersecurity risk assessment periodically. The periodic approach may take either of the following approaches: (A) performing a full assessment every other year due to intensive resources required to facilitate such an exercise or, (B) a targeted approach done annually including: • revisiting this report findings and updating controls where appropriate, • re-assessing the City’s mitigation plan to update progress and note any further concerns, and/or, • selecting a few high-priority control areas (e.g. vendor management, or any business objective/goal identified by executive management) and re-assessing associated threats related to those areas The City is already taking several steps to comprehensively manage and enhance security: 1) Implementing IT Catalyst Plan – 5 year Strategic Plan 2) Developing documented policies to address various IT areas 3) Developing Cybersecurity Training 4) Conducted 2 security audits 5) Budgeting Lead System Security Analyst in FY19 6) Conducting PCI (Payment Card Industry) study 7) Implementing two factor authentication IT agrees that an Information Security Program (ISP) needs to be created. IT Immediate actions (next 12 months) 1. IT Cybersecurity Risk Assessment by the US Department of Homeland Security. 2. Determine best practices, implement security policies, and identify staffing/challenges to implement ISP. 3. Identify staffing needs to appropriately manage IT security challenges and ISP. IT future planned actions (12 - 36 months) 1. Continue Cybersecurity scanning on a yearly basis. 2. Implement ISP. 3. Assign security roles to existing staff and hire any security staff needed to manage an Information Security Program Page 91 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 12 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 2 Utility Market Exposure to fluctuations in the market price of utilities. 18.75 Deputy General Manager – Georgetown Utilities 1) The City has no physical risk and low financial risk from the power supply market. 2) ERCOT, the state run system operator, manages and controls the physical matching of supply to demand statewide, thus eliminating the City’s exposure to physical supply risk. 3) As a Utility within ERCOT, the City takes delivery of all power from ERCOT at the market rate, thus exposing inherent financial risk. 4) The City mitigates the inherent financial risk through hedging demand with offsetting, fixed-price power purchase agreements (PPA’s) and hedging transmission congestion charges through congestion revenue rights (CRR’s) which are forward contracts on congestion. Additional residual financial risk is further mitigated through the industry standard utility practice of passing the variance though to customers as a power cost adjustment factor (PCA). The City does currently use a form of the PCA pass- through, however it is not the current practice to adjust this on a monthly basis. 5) The City has a diversified portfolio of PCA’s with both short and long terms. The two principle agreements are a 20 year wind and a 25 year solar contract. Together, these two contracts exceed the City’s current needs and will accommodate growth. 6) The long duration power agreements at fixed price provide long term rate stability through a long term hedge. 7) A utility rate study is in progress, to update the most recent study from 2012 8) Quarterly financial updates are presented to the GUS Board and the City Council. 1) Continue to enhance the City’s forecasting tools and techniques to increase granularity and improve accuracy. 2) Continue development of a strategy to meet future peak demand growth with distributed generation and storage rather than remote central generation to mitigate exposure to transmission congestion. The City will continue its efforts to mitigate exposure to the utility market: 1) Implementing rate study recommendations 2) Will grow reserves for contingency and market fluctuations to comply with Fiscal & Budgetary Policy 3) Will perform rate study every 3 years 4) Providing quarterly reports to GUS board 5) and City Council. Page 92 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 13 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 3 IT Asset Management: Data Classification The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to business objectives and the organization’s risk strategy. 17.00 IT Director 1) The City has identified and catalogued its hardware and software via a tool called Lansweeper. This approach ties into an overall information flow enforcement (NIST SP 800-53 Rev. 4 AC-4) which ensures the confidentiality, integrity, and availability of critical data when defined and enforced 2) In addition, the City also maintains a manual list of all inventoried applications/ software 3) An information classification policy does not currently exist 1) The City should consider classifying data within the system based on its criticality and / or sensitivity (NIST SP 800-53 Rev. 4 RA-2). Classification of data will also help drive the above-mentioned information flow enforcement and help define the City’s security architecture 2) We recommend the classification of City data to define an appropriate set of protection levels and communication required for special handling Classifications and associated protective controls (including encryption for data at rest and data leak prevention tools) should take into account department needs for sharing or restricting information and the associated business impacts if such data were compromised. Successful data classification in an organization requires a thorough understanding of where the organization’s data assets reside and on what applications/devices they are stored. Handling procedures should include details regarding the secure processing, storage, transmission, declassification, and destruction of data. The City is currently taking several steps to classify and protect data: 1) Implementing IT Catalyst Plan – 5 year Strategic Plan 2) Developing documented policies to address various IT areas 3) Classification of HR and Finance data during Enterprise Resource Planning project 4) Payment Card Industry compliance audit IT sees value in creating a data classification policy that outlines how the city classifies data for each system. IT Immediate actions (next 12 months) *Work with new ERP vendor to develop classification framework for financial, asset and employee information. Create a Data Classification policy. IT future planned actions (12 - 36 months) Classify data in all systems city wide that IT is responsible for administering. Page 93 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 14 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 4 IT Access Management Access to assets and associated facilities is limited to authorized users, processes, or devices, and to authorized activities and transactions. 17.00 IT Director 1) New employees and vendors are required to sign off on the Acceptable Use policy 2) For financial system, Application Administrator is assigned responsibility of setting permissions for add/removal of users after approval from system owners 3) Security administration duties are assigned to various applications whereby all analysts have a designated system/application they are assigned to. Department directors are considered system owners; the IT department facilitates requests/approval of application owner for security access. All IT employees are CJIS certified 4) Application vendors must be CJIS certified and CJIS certification is also required in vendor agreements. It was noted that not all applications have a formal process of provisioning and de-provisioning 5) Every building is on its own VLAN and segregated, DMZs also exist which is separated by firewalls (in and out). SCADA systems are also air gapped and do not interact with other parts of the network 1) A role-based access scheme should be established to ensure consistent application of user access rights within the system. Users should be assigned their base set of access authorizations based on the concept of “Least Privilege Necessary” to perform their role or job function (as defined within their formal job description). Additional access beyond the previously established role-based access scheme should be formally requested, reviewed for conflicts and approved (NIST SP 800-53 Rev. 4 AC-2). Moreover, Management should consider integrating access rights with data classification efforts identified in Appendix B of this report 2) Ensure a process is in place to approve special access requests and timely de-provision access upon notification from HR The City agrees with these recommendations and is taking the following steps: 1) Implementing IT Catalyst Plan – 5 year Strategic Plan 2) Implementing 2 factor authentication 3) Implementing consistent role based access to CIS and ERP system functions through ERP conversion project IT agrees that additional process and policy is needed to enhance IT access control. IT feels ownership of physical security audits need to be conducted by the department(s) that maintain keys to buildings or the system controlling automated keycard access. IT Immediate actions (next 12 months) Implementation of Enterprise Application Access Control policy. Leverage new Systems Admin Lead to identify additional costs and resources to implement auditing of these changes in the future. IT future planned actions (12 - 36 months) Identify a way to audit Application Access on a yearly bases. Implement yearly audits for Application Access. Page 94 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 15 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 5 IT Contingency Plan Loss or inability to continue business due to natural disaster, system capacity or performance issues, interruption in communication, loss or corruption of data, or loss of critical vendors or staff members. 17.00 IT Director 1) The City has an extensive data backup strategy is in place in order to ensure that critical data for operations are available in the event of an interruption or incident 2) The current data backup plan has redundancy built into the datacenter environmental controls 3) Recovery processes are in place to restore systems/assets affected by cybersecurity events. However, CoG is yet to formalize a BCP/DRP 4) The City has prepared a five year IT Strategic Plan which includes a plan for implementing business continuity practices over the next 2-3 years Plante Moran recommends the City conduct and formalize: (1) A Business Impact Analysis (BIA) which identifies and analyzes mission-critical business functions, and then quantifies the impact a loss of those functions would have on the City, and (2) An information system contingency plan to mitigate the risk of critical system and service unavailability. The contingency planning process should occur after a formal Business Impact Analysis (BIA) is conducted, in order to correlate the system with the critical processes and services provided, and based on that information, characterize the consequences of a disruption. Three steps are typically involved in accomplishing the BIA: • Determine mission/business processes and recovery criticality • Identify resource requirements • Identify recovery priorities for system resources The City will continue with the efforts already planned to mitigate this risk: 1) Planning and funding fail-over data center 2) Developing and testing protocol to fail-over data center IT feels this risk is related to the lack of a City Wide Business Continuity plan. IT fully takes responsibility for Disaster Recovery of IT systems, a city wide BCP is needed to identify the Business Impact Analysis and criticality of City wide services to assist with proper implementation of Disaster Recovery activities IT Immediate actions (next 12 months) Identify how the city wants to address business continuity city wide. Work with Emergency Management to look for third party support to develop a BCP. Leverage new Lead System Admin to start planning and identified resources needed to create a DR plan. IT future planned actions (12 - 36 months) Develop consistent DR plan that can co-exist with city BCP. Page 95 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 16 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 6 Legislation Governmental laws change that impact the organization by financial, operating, strategic or compliance issues. 16.36 City Manager’s Office 1) The City Attorney’s office monitors legislative sessions for the City as a whole, and communicates the effects of legislation to appropriate departments 2) The Electric Department utilizes a third party engineering firm to monitor potential legislation that could impact the Department 3) The City has an agreement with an outside government affairs and advisory firm which specializes in advising and assisting municipalities in legislative activities 4) The Transportation Department has developed a detail plan of response to the effects of the City passing the 50,000 population threshold, specifically related to the traffic signal operation. After the 2020 census, the City will be responsible for operating all traffic signals in the City, which is double the number the City currently operates. A large financial commitment will be required to operate and maintain all traffic signals in the City 1) Council and Management should review and closely monitor the status of annexation plans for the City. After the 2020 census, the City will be limited in its ability to perform annexations due to Williamson County’s population surpassing 500,000 citizens 2) The City should work with legislators to clarify the impact of harmful legislation including revenue caps and limits on debt financing for infrastructure during the City’s period of high growth and should stress the removal of local control restrictions that impact citizens ability to impart changes in their local community The City will continue its efforts to monitor state actions and advocate for what is best for the organization and community: 1) Implement Council strategies and tactics related to influence with State government 2) Continue supporting TML efforts 3) Continue working with government affairs and advisory firm 4) Continue to build relationships with other governmental agencies Page 96 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 17 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 7 Segregation of Duties The Organization fails to adequately segregate roles and tasks between team members. 16.43 Finance Director 1) Each department communicates a personnel change to HR and IT to add/remove/change a staff member’s access 2) HR and payroll have segregated rolls for processing employee payroll and benefit information. Only Finance has access to process changes within the payroll module 3) Segregation within the finance department is maintained by separate individuals processing payroll and accounts payable 4) Utilities customer cash receipts are handled through Customer Care front facing staff. Cash drawers are reconciled and closed on a daily basis. Bank deposits are prepared by Customer Care back office operations daily and are couriered to the bank by Police Officers. Revenue financial reporting is done by Finance 5) A police officer travels to the cash locations to provide secure courier service on all bank deposits 1) An annual review of user access for all staff members within the City across all programs managed by IT should be performed 2) Departments that have not had an internal control review within the past five years should evaluate the design and effectiveness of their internal controls 1) Implementing new CIS and ERP systems which requires thorough review of system segregation controls. 2) Cameras being evaluated for various cash areas 3) Emphasize and explain segregation of duties attributes during training for new or revised financial policies and procedures. 4) Parks & Recreation has segregated deposit duties separate from cashiers. 5) Finance is reviewing the segregation of the vendor database duties for the new ERP system. IT feels this risk requires joint ownership with other departments. IT already has controls in place for user access to computer resources and access to applications. IT Immediate actions (next 12 months) Implementation of Enterprise Application Access Control policy. Train IT employees on the new policy. Enforce the new policy on new Enterprise systems as they roll out. Leverage new Lead Admin to identify resources, and costs associated with reviewing user access for all city computer resources and applications. IT future planned actions (12 - 36 months) Implement annual reviews/audits of user accounts with access to computers and enterprise applications. 8 Access to Talent Organization lacks sufficient staffing levels to carry out its routine operations. 11.75 HR Director 1) The growth of the City has resulted in a large talent pool for many positions within the City, with some job openings attracting over 300 applicants. Overall, the City gets sufficient applicants for general open positions 2) The City is in the process of performing an assessment of retirement eligibility for key personnel 3) Departments within the City utilize third party contractors to fill non-key positions on a temporary basis 1) The City should evaluate positions with required specialized certifications and determine whether entry level staff members can obtain certifications after hire 2) For specialized positions, including, but not limited to, building inspectors, paving foremen, and traffic engineers, the City should conduct an assessment of staffing levels with a 3-year outlook 3) The Fire Department should develop a plan to acquire the necessary EMS personnel talent 1) HR and Fire are continuously developing a recruitment strategy for future station staffing 2) The City currently recruits many positions such as 911 dispatcher and Electric Linemen Apprentices in the manner described in mitigating recommendation #1 and continues to review options as new vacancies arise. 3) The City works continuously to keep pay and benefits market competitive and HR staff is currently working on enhanced recruitment branding techniques to continue to bring in excellent talent. Page 97 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 18 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 9 Emergency Notification System Failure (ENSF) The City's Emergency Notification System fails to alert citizens in the event of an emergency. 13.81 Emergency Management Coordinator 1) There is a city-wide emergency notification system consisting of tornado sirens and reverse 911 (Code Red) which are tested on a regular basis. The outdoor warning system is place to notify citizens to take shelter and is not intended to be heard in doors 2) The City recently added a position dedicated to Emergency Planning 3) Incident Action Plans are developed for large scale community events, such as the Red Poppy Festival 1) The City should communicate Incident Action Plans for large scale events to all parties involved with the event, including the Convention and Visitors Bureau (CVB) 2) Management should inform all departments of the operating procedures related to the ENSF 3) The EMC should develop basic and advanced emergency management training for key stakeholders in the City (Division Managers) and conduct table top and/or practical training exercises that replicate local level emergencies The City agrees with these mitigating activities and will prioritize them in the EMC’s work plan Page 98 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 19 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 10 Fraud Customer, third party, or internal fraud occurs resulting in a significant misappropriation of assets and/ or incorrect financial reporting, or corruption/ kickback schemes. 13.75 Controller 1) The Finance Department performs a review of a small number of P-Cards to verify the legitimacy of the purchases 2) Fixed assets over $5,000 in value are tracked in the ERP fixed asset module 3) Currently no fraud prevention program is communicated to all employees with training to identify and prevent fraud. 4) The Finance team indicated internal controls can be strengthened around: • Communication, billing and collection from - Planning and Housing and GUS Engineering on construction/ development contracts with developers and as they have limited visibility on project status, progress, completion and timelines of payment due dates. Cannot get My Permit Now to reconcile to Accounting • Processing and internal controls around Grant Administration regarding collections and subsequent compliance reporting • Credit Card (P-Cards) payment procedures are inconsistently applied across City operations 5) The City lacks internal monitoring controls and audit logs around Master File Maintenance on IT databases (employee, customer, vendor, etc.) 6) Segregation of duties reduces the chance of fraud 7) The City has a personnel policy related to fraud 8) A fraud hotline is advertised to the City staff, so that staff can report fraud anonymously. The reports are collected by an outside firm, who sends information to representatives in Human Resources, Finance, and the CMO for investigation. The CMO follows up on any investigations 9) Purchasing cards have strict limits to ensure the risk of misuse by a single employee is limited to an average of $1,000. 1) The Finance Department should perform more robust reviews of P-Card purchases and consider utilizing software to perform regular audits of P-Cards 2) The Finance Department should perform annual reviews of P-Card users to evaluate whether the all users actually need P-Cards 3) The City should implement a more extensive asset tracking program, utilizing fixed asset tags on assets valued over $1,000 with consideration of periodic asset audits 4) Vendor Ship-To addresses should be limited to a “drop down” list consisting only of City facilities 5) The City should consider developing a fraud awareness and prevention training program with active participants across all City departments 6) All changes to IT databases deemed to be material should be tracked on an Audit File Log and reviewed by someone without access to the databases 1) Asset tracking and vendor shipping will improve as part of the ERP project. 2) The City has already implemented and conducted training on grant tracking and reporting. 3) Staff are currently developing a citywide fraud awareness and reporting training. Page 99 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 20 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 11 Health & Safety Exposure to potentially significant workers' compensation liabilities due to the inability to maintain compliance with applicable health and safety laws and regulations. 13.04 HR Director 1) All Public Works and Utility departments have a robust safety program consisting of monthly safety training, daily safety summaries, semi- monthly safety meetings, and detailed safety policies. Public Works departments also provide sufficient safety equipment to all relevant staff members 2) The Fire and Police Departments have a robust line of safety gear, training, fitness assessments, inspections, and safety policies 3) All safety incidents are communicated to Human Resources for review and to work as a liaison between the department and the employee 4) The Airport requires all non-airport employees to be escorted by a staff member with knowledge of Air Traffic Control communication 5) Parks and Recreation requires safety maintenance with swimming pools to ensure chemicals are in balance Overall, the City has robust health and safety procedures and should consider adding the following: 1) The Library should develop clear policies and procedures on a course of action when a customer, employee, or volunteer is injured at the facility. 2) The City should review the lifeguard policy for pool facility rentals. The City currently does not provide a lifeguard for pool rentals by the Georgetown Independent School District and does not require GISD to provide their own lifeguard. 3) Consider adding an Active Shooter response plan 1)HR and Library will work together to develop consistent injury procedure 2) The City has met with GISD swim coaches to brainstorm ways to mitigate lifeguard risk and is drafting a facility use agreement that outlines the lifeguard requirements of the City and GISD 3) HR and Police are developing Active Shooter training for departments Page 100 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 21 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 12 IT Incident Response Management Response processes and procedures are executed and maintained, to ensure timely response to detected cybersecurity events. 12.00 IT Director 1) The City has no formalized or documented information security incident response procedure 2) CoG's IT department has an informal (undocumented/ad-hoc) resolution process to ensure appropriate steps are taken to respond to incidents. The process is triggered in the event of a report/discovery of compromise, loss, or theft of system data We recommend the City implement a formal incident response plan including: 1) Provide a roadmap for implementing its incident response capability; 2) Describes the structure and organization of City of Georgetown’s incident response capability; 3) Provides a high-level approach for how the incident response capability fits into City of Georgetown as a whole and the overall Family of Companies; 4) Meets the unique requirements of City of Georgetown’s mission, size, structure, and functions; 5) Defines reportable incidents as well as requirements and guidelines for external communications and information sharing (e.g., what can be shared with whom, when, and over what channel); 6) Provides metrics for measuring the incident response capability within the organization; 7) Defines the resources and management support needed to effectively maintain and mature an incident response capability; and 8) Is reviewed and approved by senior management IT agrees a formal process and procedures need to exist to manage cybersecurity incidents appropriately. IT Immediate actions (next 12 months) Implement Incident response policy. Train IT staff on procedures to ensure policy is being met. IT future planned actions (12 - 36 months) Document formal incident response plan including all recommendations by Plante. 13 Utility Outage The City is unable to respond to mass failures of electrical, water, or sewage outages in a timely manner. 11.89 Utility Director 1) Control Center has monitoring alarms in the event of outages 2) Control Center has an outage management system to diagnose location of fault and provide area of impact and customer count 3) Response plan is in place for water, wastewater, and electric system failures. 4) Regular maintenance tracking of all critical equipment; replacement is made when showing signs of degrading through testing 1) Maintain equipment useful lives schedule and proactively monitor components which have reached their useful lives 2) Perform a vulnerability assessment to judge your preparedness for handling the increased likelihood for power outages Emergency Response Procedures have been expanded to include establishment of an Operations Command Center procedure for emergency response for large scale utility outages that do not rise to the level of EOC activation. Page 101 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 22 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 14 Disaster Recovery / Business Continuity Planning Inability of the organization to continue key business processes during a potential disaster due to lack of sufficient disaster recovery planning and/or execution. 11.60 City Manager’s Office 1) Most city staff members are able to work remotely via Virtual Desktop Infrastructure (VDI) 2) The Public Works Departments conduct assessments of potentially hazardous situations (ex: tree trimming to prevent outages during windstorms) 3) The Fire and Police Departments can immediately route 911 calls to the Williamson County 911 center 4) Tabletop disaster recovery simulations are performed on an annual basis by the Emergency Management Coordinator in conjunction with the Fire Department 5) No backup plan in place at Airport if fueling system or lighting vault fails. This has been identified as a weakness and accounted for in the Airport Master Plan to remediate over the next 5 years. 6) No DR/BCP plan at the Library, Communications, Convention & Visitor’s Bureau, Customer Care and Inspection Services 7) Back in 2005, the Municipal Court had a system crash and were unable to recover records. They had to recreate 2.5 months of records and it took about 6 months. The issue has not been resolved 1) The City has inconsistent DR/BCP across the organization. Some departments have a robust plan and others have none. A DR/BCP should be developed for every City department. Each of these department-level plans should then be integrated into a city-wide plan 2) Tabletop disaster recovery simulations should be performed with all City Departments 1) As the City buys new or upgrades existing software, we are prioritizing cloud options that improve security and access Page 102 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 23 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 15 Billing for Citizen Services Citizens are billed incorrect amounts or not billed at all for citizen services. 11.37 Customer Care Director 1) Rates and/or fees for Utility Services, Building Inspection Services, Animal Services, Permits, Fire, Police and Airport are approved by Council 2) Parks and Recreation rates are set and approved by the Parks and Recreation Director and submitted to the Council annually 3) Customer Care utilizes systems built into the meter data management (MDM) and customer information systems (CIS) that apply validation methodology to detect abnormal consumption or amount billed. These “exceptions” are identified in the systems for staff to review and validate manually (referred to as “Edit Process”) 4) Billing for EMS services is performed by a 3rd party service and any hardship write downs require the Fire Chief’s approval 5) Departments handling cash perform daily cash reconciliations 6) The Municipal Court clerks review all tickets/citations before being sent to the recipient 7) The Code Enforcement Department maintains evidence of violations to be billed, and the Energy Services Department maintains the police report as evidence for billing for damages 8) Airport uses a third party appraisal for lease amounts along with fuel prices set by City Council a. The fine schedule for the Municipal Court citations should be restricted to specific users b. All invoices should be created in a single system across the City and remit-to addresses should be limited by a “drop-down” function consisting of only addresses the City accepts payments c. Management should consider a third party revenue recognition study to validate all sources of revenue are complete and accurate across the City operations d. An outside party, Emergicon, reviews billing for EMS incidents as there are various rates depending on citizen’s ability to pay. Emergicon also collects funds and this helps reduce the occurrence of billing errors and improves collections. However, Emergicon also writes off funds and there is no reconciliation of EMS revenue to billings. We recommend the City enhance reconciliation controls around billing procedures and perform internal audits of quality control and verification of vendor compliance. 1) Implementing a new ERP system will include a thorough review of the Accounts Receivable/Billing module. 2) Once Emergicon has completed a full fiscal year of billings and collections, the City can audit and evaluate the performance and compliance of Emergicon’s processes and procedures. Page 103 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 24 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 16 Composition of Tax Base Changes in the balance of commercial and residential tax base result in losses of revenue from taxes. 10.63 City Manager’s Office 1) The City has performed a detailed mapping of how each square mile of the city will be used in the future 2) The City Manager’s Office completes regular fiscal impact models to determine the effects of commercial vs. residential development 3) The Economic Development Department has established a comprehensive strategic plan 4) Economic Development relies on demographic research for talking to prospects regarding future development. Works closely with the Planning Department 5) The Fire Department should be involved in all communications regarding commercial development in order to ensure the Department is able to acquire the necessary equipment to manage emergencies at large scale commercial properties 6) The Fire Department has increased its staff to respond to an increase in calls for service. The rate of EMS calls for service is growing at double the rate of population 7) The City is updating its Comprehensive Plan which will include an update to the future land use plan 8) Planning Dept. promotes and encourages a varied level of housing products and commercial tax base per the Comprehensive Plan. 1) The City should communicate potential new commercial and residential development to directly impacted City departments and evaluate how new development would affect each directly impacted department 2) Management should utilize a concentration strategy that is flexible and supported by realistic expectations The City is updating its Comprehensive Plan through a robust citizen engagement process during 2018/19. This plan will identify community standards and goals for growth. City staff from various departments impacted by development meet with the City Manager’s Office on a bi-weekly basis to discuss major development applications as well as to collaborate and problem solve on various issues. 17 Grant Obligations Organization fails to meet grant covenant requirements. 10.55 Controller 1) Grants filings across the City are monitored by various personnel within the Finance Department 2) Grant applications require City Council approval per the City’s Fiscal and Budgetary Policy 3) Federal and State grants require compliance filings and, if omitted, could impact future grant funding, as well as result in audit findings 1) The City should designate a staff member as a Grant Administrator. This staff member should be responsible for maintaining a repository of all grants being applied for, awarded, contact person, and any required filings associated with each grant. City should require that all Grants be managed through the new Grant Administrator 2) A Grant Status Report should be provided on a periodic basis to the City Manager’s office for potential budget considerations The City has completed these recommendations. The Controller is the Grant Administrator. A new policy was implemented in the spring and the status report is presented to Council in the quarterly financial report. Page 104 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 25 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 18 IT Third Party Roles & Responsibilities Security roles and responsibilities are not established for all third-party service providers and lack clear contractual obligations for service level agreements and KPI’s. 10.00 IT Director 1) The City has identified trusted partners with respect to hardware and hosted applications 2) Roles and responsibilities have been established but are not formally documented. Within the workforce, absence of a formal documentation poses a risk for segregation of duties and with third parties, accountability may be lacking 3) The contract between City of Georgetown and the service provider does not specifically outline the roles and responsibilities related to Cybersecurity controls handled by each organization 4) There is no monitoring of external party use of the system for potential Cybersecurity events We recommend management take the following actions: 1) Clearly identify the cybersecurity responsibilities to be outlined in the contract with the service provider including roles for identification, response, and recovery procedures 2) Establish Key performance indicators for third- party responsibilities including number of events, data breaches, number of notifications 3) Continuously monitor contract SLA’s and established key performance indicators IT has been working to ensure new contracts meet a higher level of security requirements. For example the Office 365 contract with Microsoft has advanced alerting for things like elevation in access privileges and enhanced reporting to view our security posture at any time. IT manages KPI’s for 3rd party contracts through simple notification of security events that can follow the city’s Information Security Response plan should provide adequate documentation for security events. Incident response risks are being addressed under Risk # 3 on this document. IT Immediate actions (next 12 months) Continue to monitor all new contracts to ensure proper cybersecurity language exists. Require all vendors to use multi factor authentication to access city resources. IT future planned actions (12 - 36 months) Review older contracts and make notes of where changes are needed during contract renewals. Page 105 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 26 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 19 Vendor Reliance Any termination of, or adverse change in, the Organization's relationships with its key suppliers, or loss of the supplies in support of one of the organization’s key services. 9.81 Purchasing Manager 1) The majority of City Departments have multiple vendors available to supply goods & services and would not face disruption if they had to switch vendors 2) We noted 3 departments that have a reliance on key vendors and they are closely monitoring this process: Transportation (asphalt and concrete), Fire Department (specialty vehicle repair) and Animal Services (specialty veterinarian drugs and feed) 1) Assign one person the responsibility of monitoring all key vendors to the City 2) Create a subsidiary listing of all key vendors with contract details, SLA’s and performance metrics 3) Report back to City Manager when it is determined a vendor may become insolvent or is not meeting SLA’s 4) Prior to contract renewal, negotiate with all key vendors to capture volume discounts and preferred pricing 5) Management indicated Garland Power & Light currently reconciles their meter data to the scheduling data and the transaction settlement engine. This could be done in house but would require additional headcount as the process runs 24/7. Management should consider a cost/ benefit study to do this in-house The new ERP will enhance the ability to analyze vendor and contract details. The City’s purchasing policy receives quotes and/or formal bids for purchased over $3,000. Purchases over $50,000 are approved by Council so more review is given to these large expenditures. The management acknowledges that certain items noted are “sole source” which provides a reliance on key vendors in limited situations/purchases. Page 106 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 27 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 20 IT Critical Security Event Identification A formal risk event identification process is not in place to identify, classify and resolve security events 9.00 IT Director 1) Currently there are a variety of log generation methods in place for the system, however there is no catalog of security event types being identified and reviewed within the logs by security professionals 2) As noted in the Segregation of Duties risk, there are no documented audit log reviews of changes made to critical City databases 1) Identify high risk events that can be alerted from current logging capabilities (NIST SP 800- 53 Rev. 4 AU-6). Potential high risk events can be discerned through the risk assessment process (NIST SP 800-53 Rev. 4 RA-3), penetration testing, and best practice documentation. Some common threat events include: • Multiple failed login attempts • Elevations in access privileges • Changes to application code • Changes to security settings • Process specific actions 2) Consider alert generation techniques for risky events such as devices that connect to the network without authorization 3) Identified events should be responded to in accordance with the organization’s Incident Response Plan IT does not currently have designated security staff. This makes it challenging to implement controls at this level because of the time and knowledge necessary to keep a proactive approach maintained. IT agrees we should have an advanced alerting process on high risk events however continuing to maintain these types of processes can be staff intensive. IT Immediate actions (next 12 months) Hire a Lead System Administrator (approved for FY19) to assist with security activities. Identify high risk events that occur in current logging tools. Research methods for alerting based on events. Research staff time needed to implement and maintain an alerting process that always follows best practices. Research managed security services and costs. Discuss options with City Manager’s Office for implementation. IT future planned actions (12 - 36 months) Create an alerting strategy/process that alerts staff when appropriate. Implement alerting for high risk events. Implement managed security services if feasible. Page 107 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 28 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 21 IT Security Awareness, Training and Education Personnel are not informed of potential IT threats to the organization and are unable to respond effectively. 9.00 IT Director 1) The City has implemented an Acceptable Use Policy amongst other policies around proper use of computers and accessing digital information. However, to ensure compliance, there is a need to assess employee’s understanding of policies and response to cybersecurity threats via periodic awareness and training 2) IT staff monitors and reports email scams to all employees in an effort to increase awareness 1) Rely on end users as the first line of defense to limit exposure to social engineering frauds and threats 2) Consider increasing complexity of password requirements 3) Create a formal IT Awareness training and provide to all employees on a periodic basis 4) Require employees to formally acknowledge in writing that they have read and understand the security awareness training, and that they recognize the ramifications of non-compliance IT Immediate actions (next 12 months) Implement city wide security awareness program and training. Partner with HR to leverage use of LMS for security training. IT future planned actions (12 - 36 months) Continue to provide security awareness training and review annually for new material and best practices. 22 Fire Department Failure The Fire Department is not adequately equipped to handle responses to emergencies in the City. 8.00 Fire Chief 1) The GFD studies data points to best position their resources in order to minimize response times. In instances when there are no resources available, GFD has agreements with third party ambulance providers who are obligated to provide the same response time as the GFD 2) Also, the GFD have mutual aid agreements with neighboring communities to assist in calls when the City is not available 3) The GFD indicated they perform fire inspections of public buildings (schools, hospitals, government buildings, etc.) but there are not enough resources to do fire inspections/ capacity evaluations on all businesses in the City 4) The City is currently building two stations to ensure adequate response to the growing population 1) Consider an independent third party evaluation study of the GFD capabilities, response metrics and resource allocations to evaluate if there needs to be changes to the current resource allocation model 2) Consider cooperative agreements with ESD8 and/or contiguous municipalities to elevate synergistic programs (co-located/co-operated) fire stations and boundary drops (enhanced auto-aid). 3) Consider making licensed buildings be required to be inspected annually. Also, consider a self- inspection program for low risk properties and/or an inspection matrix as follows: • Low Risk – every 3 years • Medium Risk – every 2 years • High Risk – annually 4) Management should consider the implications for property owners and businesses when the Public Protection Classification (PPC) issued by the Insurance Services Organization (ISO) is not performed, as there may be a negative impact if not inspected annually. GFD regularly reviews KPIs and communicates with city management on service delivery standards. Mutual aid agreements are in place for assistance when additional resources are needed. Additionally, GFD is exploring partnership opportunities on a long-term future station with Round Rock. A Fire inspector has been added to the staff for FY19 to help address the backlog of inspections and keep up with the growing number of business inspections. Page 108 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 29 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 23 Physical Security Facilities are not appropriately secured from unauthorized access. 9.00 Asst. Parks & Recreation Director Overall the City has robust physical securities controls in Place: 1) Customer Care and Municipal Courts have robust physical security programs in place. Safes are utilized for cash and cameras cover registers and safes. Dual access controls with keys and codes are used at cash access points 2) Most City buildings require access badge/ fob to enter restricted (non-public) areas. 3) Police, Fire and Energy Services departments have restricted access areas 4) However, we noted several areas with limited physical security controls: • Animal Services – lack of physical security is a major issue as animals have been stolen. Cash is not well controlled and cameras are not in place on critical areas. The safe is not adequately secured. • Building Inspection Services, Public Works, GIS, Systems Engineering and the Georgetown Municipal Complex have poor physical security 1) Consider taking inventory of all key cards to validate none have been stolen or lost 2) Consider development of physical security training for all personnel regarding safeguarding of assets, restrictive access to high risk areas, etc. The City must support integrity of physical security through the organization with the assistance of the City’s Risk Manager 3) Standardize a consistent security plan across all locations appropriate for each facility 4) The City currently monitors physical access to the facility where IT resides to detect and respond to physical security incidents. However, CoG does not review physical access logs periodically 1) Cameras are being evaluated for various cash areas 2) Security access will be part of the current facilities study 3) Security access will be evaluated with the opening of each new or renovated facility. 24 Freedom of Information Act (FOIA) Non-compliance with FOIA requests 6.22 City Secretary 1) The procedure is for all FOIA requests to enter through Legal. They will decipher the request and handoff to the City Secretary office to obtain information. 2) FOIA request process is currently being transferred from Legal to City Secretary and is approximately 90% complete 3) GovQA is an electronic system used to maintain and track FOIA requests. 1) When the transfer of FOIA request process is complete, consider documenting the process with written policies and procedures 2) 1) The City has completed the transfer of FOIA request process to the Open Records Coordinator in the City Secretary’s office. 2) Citywide training has been completed by the Open Records Coordinator to provide guidelines and consistency to the process. 3) The City Secretary Department is in the process of completing Policies and Procedures for FOIA and should have completed within the next month. Page 109 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 30 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 25 Police Failure The Police Department is inadequately equipped to respond to emergencies or responds in an unauthorized manner. 6.00 Police Chief 1) Police department is aware of people, process, technology and regulatory requirements 2) Robust controls are in place to monitor progress and key performance indicators 3) A culture of clearly communicating expectations, behaviors, and training is in place so officers are held accountable for their actions 3) Guardian Tracking is a day-to-day tracking of personnel performance entry recordkeeping. Police management reviews and a conversation with the employees occurs when they handle situations incorrectly 4) Training includes the following: • Handling of persons with mental illness • Defusing techniques to encourage peaceful tactics • Non-lethal methods of restraint 5) Internal affairs division investigates all complaints against officers 1) Develop the following Key Risk Indicators (KRI’s) and monitoring controls which may indicate a risk event is about to occur a. Increase in City crime rates b. Increase in police misconduct/brutality incident claims c. Increase in squad car accidents d. Excessive overtime e. Unexpected cost overruns/continuous unfavorable budget variances f. Increase in dismissed cases due to insufficient evidence, improper procedures or failure to follow legal standards for police 1) The City will monitor quality of life crimes within the city and identify strategies for reduction where feasible. 2) The City will monitor and investigate all complaints, including use of force and pursuits and will identify strategies for reduction where feasible. 3) The City will monitor police overtime and identify strategies for reduction where feasible. 4) An annual report of crime statistics is presented publically to the City Council. 26 Talent Management Organization lacks a clear assessment and evaluation process to align qualified employees with specific business requirements and needs. 5.42 HR Director 1) The City personnel policy requires bi-monthly performance discussions with all employees 2) Formal annual and mid-year performance evaluations, including employee development and training plans, are performed on all employees 3) Energy Department has a robust training curriculum with a 4-year apprentice program 4) Police department uses Guardian Tracking to evaluate officer performance daily 1) Have HR department work collaboratively with business lines to gain in depth knowledge of resource needs and constraints 2) Consider using an outside party for diversity in pre-hire assessments 1) HR staff is developing a supervisor survey to identify employee development for current and future roles 2) HR staff trained all supervisors in 2017 on proper hiring techniques including ways to overcome various forms of hiring bias 3) The city conducted an employee survey in 2016 and again in 2018. 79% of employees believe their job makes good use of their skills and abilities. 84% believe their job provides opportunities to do challenging and interesting work. 27 Records Management No records management policy is in place, adhered to, or is inadequately designed. 5.27 Records Program Manager 1) The City’s records retention policy is in line with the Texas State Library records retention policy. The department receives alerts from the state library of any changes to policy 2) Finance indicated they are unclear on how electronic records storage should be handled 3) Parks and Recreation has a large quantity of waivers and registration hard copy forms 4) Animal Services has a lack of electronic records and believes there is a risk of information loss 1) Formalize Records Management policy regarding digital records and communicate to all departments 2) Consider additional training on electronic records management 3) Consider digitizing Parks & Recreation forms 1) The Records Team is training various departments on retention, destruction of records and digitalization of records. 2) Policies and Procedures have been completed and implemented. 3) The following information has been made available to employees via the internal GO site: a. Records Management Policy & Procedures b. Retention Schedules c. Off-site storage information d. Destruction authorization forms Page 110 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 31 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 28 Regulatory Filings Failure to comply with regulatory filings such as GASB, EPA, etc. 5.20 Controller 1) Water Services completes Environmental Protection Agency (EPA) and Texas Commission on Environmental Quality (TCEQ) permit reports every 3-5 years 2) Finance prepares annual CAFR and SEFA which is submitted to the clearinghouse 3) Customer Care prepares annual filings on storm water use survey breaking out how much water was taken in to the system. 4) City of Georgetown has an exemption from complying and filing necessary reports mandated by Senate Bill 898 (reducing energy consumption in City owned facilities) & administered via the State Energy Conservation Offices (SECO) because of the 100% renewable designation. 5) Customer Care is required by TCEQ to report water quality testing results to customers on an annual basis. Deadline for customer communications is 7/1. GUS must certify with TCEQ by 5/1 that we provided water quality testing results to water purveyors that obtain wholesale water from GUS. 6) Energy Services relies on outsource provider Snyder Engineering for all regulatory findings 7) Utility services is subject to an annual requirement with the ERCOT to validate that a risk management plan is in place 8) Airport has a significant amount of regulatory filings ranging from EPA, TCEQ, Stormwater, Airplane inventory, and Property Taxes through MCAT. Use Microsoft Outlook as reminders 9) Fire Dept. has numerous state health services filings regarding training, certifications, incidents, fatalities, etc. 1) There is a significant amount of regulatory filings across the City. Management should consider a consolidated Regulatory Compliance Landscape (RCL) ledger be compiled to have one list of all requirements outlining the filing dates. Further, Management should store this on a shared drive and assign all filings to an owner who is required to indicate when the filing is complete. Someone should be responsible for checking for missed filings Management is evaluating a contracts management system to track and comply with contractual and regulatory requirements. This may be part of the ERP implementation or a stand-alone system. Page 111 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 32 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 29 Succession Planning Leadership talent within the organization is insufficiently developed to provide for orderly succession in the future. 4.39 HR Director 1) No formal succession planning in place. Per Human Resources, they emphasize internal cross training to grow future leaders from inside the City organization 2) The City is in the process of performing an assessment of retirement eligibility for key personnel 1) The City should consider an outside party to implement a formal Succession Plan 2) Consider a mentor shadowing program to protect the City against unplanned terminations or leaves of absences 1) City initiated first Emerging Leader training program in 2018 with 20 graduates. Anticipate annual opportunity to grow employees at various levels each year 2) Supervisory Series initiated in 2017 and successfully completed by 168 supervisors. Additional curriculum to be added this year aimed at growing managerial skillset of all city supervisors 3) The city conducted an employee survey in 2016 and again in 2018. 76% of employees plan to continue working for Georgetown for 5+ years, which is significantly higher than most employers. 30 Budget and Planning Budgets and business plans are not realistic, based on appropriate assumptions, based on cost drivers and performance measures, accepted by key managers, or useful or used as a monitoring tool. 3.24 Finance Director 1) The City uses a robust budget and planning tool across the organization using historical data supplemented with forward looking analytics. Each Department head formalizes their budget and forward to Finance for consolidation 2) Finance utilizes Excel to manually consolidate the budgets and upload into the ERP system 3) Final budgets are presented to City Council for review and approval 4) Quarterly budget to actual reports are presented to City Council 1) Certain departments such as utilities, water, electric, etc. count on supplemental data to prepare their budget (see Data Governance risk #27). We recommend management validate and document the completeness and accuracy of assumptions for all budget line items 2) Management should set a clearly defined threshold for all material variances to be explained (e.g. +/-XX% and $YY,YYY) 1) The new ERP system will facilitate a central location of budget development information and reporting 2) Finance Administration’s performance measures include budget to actual variance targets 31 Tax Non-compliance with state or federal tax law. 3.00 Controller 1) Finance maintains schedule of tax payments and receipts to/ from County, State and Federal authorities 1) Consider the creation of a master tax filing schedule and reporting to City Manager The City agrees with this recommendation. 32 State / Federal Regulations Failure to comply with new or existing federal or state regulations. 2.44 Controller 1) Building Inspection Services provided that maintaining state licenses and Continuing Professional Education (CPE) is a challenge 2) State regulations require the Police Department to report all racial profiling and crime data 3) Parks and Recreation indicated that there is a State Health and Safety Code that requires public play equipment comply with the American Society for Testing Materials (ASTM) F1487-07 which provides performance standards for public playgrounds and this is NOT being done on a routine basis 1) Develop a Citywide license and CPE tracking system 2) Develop a process to ensure all City playgrounds comply with ASTM F1487-07. The code does not require a formal inspections process, just that the City complies with the ASTM F1487-07 standard The City will review a tracking system in context of all other technology needs. Employees and supervisors will continue to be responsible for tracking individual and departmental CPE and licensing. Parks Department is working on a schedule to evaluate older parks to replace equipment as needed. Newer parks and equipment is compliant. Page 112 of 167 APPENDIX A – RISK TREATMENT ACTION PLANS 33 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 33 Leadership The people responsible for the important City processes do not or cannot provide the leadership, vision, and support necessary to help employees be effective and successful in their jobs. 2.42 City Manager 1) All departments we interviewed provided the same issue on leadership – there is a strong management base that sets realistic strategic objectives and has an open communication line with each department head 2) Leadership has frequent meetings with department heads to check on status of operations and those concepts are clearly communicated throughout the organization 3) Detail performance evaluations are done at all levels of the City government and each employee is evaluated for job performance 1) The City should consider an upward feedback program to validate lower levels of employees are satisfied with management’s performance 1) A 360 evaluation process was implemented last year for Directors and will be rolled out to mid-level management in the upcoming year. 2) The city has implemented a bi-monthly check- in program where employees have the capability to provide upward feedback to their supervisor. 3) The city conducted an employee survey in 2016 and again in 2018. Employee response rates were 85% and 82% respectively and the city has involved employees in tactical action planning to further improvement engagement and enablement. Page 113 of 167 APPENDIX B Information Technology Executive Summary Appendix B Page 114 of 167 APPENDIX B CYBERSECURITY RISK ASSESSMENT EXECUTIVE SUMMARY Inherent Risk: Risk management is the ongoing process of identifying, assessing, and responding to risk. To manage risk, organizations should understand the probability that a threat event will occur and the resulting impact. The probability and impact analysis leads to identification of inherent risk (i.e., risk without consideration of controls) to the IT environment. With this information, organizations can determine the acceptable level of risk for delivery of services and can express this as their risk tolerance. Factors considered when performing the risk assessment are: • Probability: What is the likelihood that a threat will occur? • Impacts: What are the immediate damages if the threat is realized (e.g., disclosure of information, modification of data, disruption of key systems/processes, containment, and resolution costs)? • Identify Information Assets: What should be protected in relation to electronic data, IT applications and IT infrastructure? Our methodology takes into consideration any third parties or vendors that transmit, host, or process your organization’s data or IT systems. • Criticality Analysis: How critical are your information assets? Each technology layer (i.e., data, applications, and infrastructure) has its own unique criticality analysis. • Threats: Identify the natural to man-made threats that impact the confidentiality, availability, and integrity of your data and information systems. • Consequences: What are the long-term effects of the threat being realized (e.g., damage to reputation of your organization, loss of business or revenue, damage to your brand)? • Controls: What effective security measures (security services and mechanisms) are needed to protect the assets? In understanding the high risk areas for the IT applications and systems, several key questions came to mind when addressing the Cybersecurity considerations: • What security controls are needed to satisfy the security requirements and to adequately mitigate risk incurred by using information and information systems in the execution of organizational missions and business functions? • Have the security controls been implemented, or is there an implementation plan in place? • What is the desired or required level of assurance that the selected security controls, as implemented, are effective in their application? The answers to these questions are not uniquely answered in isolation but rather in the context of an overall effective risk management process suggested by the NIST Cybersecurity Framework. Through the control evaluation process, we isolated areas that City of Georgetown can continue to identify, mitigate, and monitor risks associated with cyber threats identified through the threat assessment. Logically, areas of high risk would require more extensive controls than low risk areas and in most cases, inherent risks can be controlled by the implementation of adequate countermeasures. Page 115 of 167 APPENDIX B NIST Cybersecurity Framework Maturity Summary The chart below indicates City of Georgetown’s overall picture of the current state versus it’s desired/target state in accordance with the Cybersecurity framework. Page 116 of 167 APPENDIX B Mitigation Plan Page 117 of 167 APPENDIX B 3.1 FINDINGS AND RECOMMENDATIONS 3.1.1 Cybersecurity Governance Model Assigned to: City of Georgetown Priority High Recommendations Currently, the City’s Information Technology department has no succession plan for key roles occupied by experienced staff. In addition, most members of the IT department perform several duties beyond their originally assigned tasks and roles and responsibilities related to key initiatives such as Risk & Incident Management, Disaster Recovery & Business Continuity are not clearly defined. According to Inform ation Security Governance Guidance for Boards of Directors and Executive Management, 2nd edition, the five basic outcomes of information security governance include: 1. Strategic alignment of information security with business strategy to support organizational objectives 2. Risk management by executing appropriate measures to manage and mitigate risks and reduce potential impacts on information resources to an acceptable level 3. Resource management by utilizing information security knowledge and infrastructure efficiently and effectively 4. Performance measurement by measuring, monitoring and reporting information security governance metrics to ensure that organizational objectives are achieved 5. Value delivery by optimizing information security investments in support of organizational objectives At a minimum, we recommend the City implement a governance framework that allows for the proper management of a successful Information Security program (ISP). An effective ISP involves participation from senior management to set the direction for proper information security practices, adequate staffing (with assigned roles and responsibilities) and compliance with policies. Furthermore, a commitment from management helps to ensure support and funding from for security activities requiring financial resources; and that organization-wide risk management programs are developed and implemented effectively. Source: http://www.isaca.org/Knowledge- Center/Research/ResearchDeliverables/Pages/Information-Security-Governance-Guidance- for-Boards-of-Directors-and-Executive-Management-2nd-Edition.aspx Page 118 of 167 APPENDIX B 3.1.2 Risk Management Assigned to: City of Georgetown Priority High Recommendations At the City of Georgetown, it is evident that the IT department has taken measures in implementing security practices throughout the IS environment; however organizational cybersecurity risk management practices are not formalized, and risk is managed in an ad hoc/reactive manner; an organization-wide approach to managing cybersecurity risk has not been established. As a result, security activities or business strategies may not be directly aligned with organizational risk objectives or the current threat landscape. The City has undertaken an effort through this assessment to evaluate the security controls needed to combat cybersecurity risks, but there is a need for an overall information security risk assessment to identify risks to the organization and threat mitigation strategies. To this effect, we recommend that management adopt a practice of performing a risk assessment periodically. The periodic approach may take either of the following approaches: (A) performing a full assessment every other year due to intensive resources required to facilitate such an exercise or, (B) a targeted approach done annually. The targeted approach may include: (1) revisiting Plante Moran’s deliverables and updating controls where appropriate, (2) re-assessing the City’s mitigation plan to update progress and note any further concerns, and/or (3) Selecting a few high-priority control areas (e.g. vendor management, or any business objective/goal identified by executive management) and re-assessing associated threats related to those areas. Irrespective of the approach selected, the process for performing a risk assessment typically includes: • Identification of information assets (data, applications, infrastructure, and vendors) • Assigning value to identified assets based on criticality (or dollar value in some cases) • Evaluation of vulnerabilities and threats In addition to the above, we also suggest that the City assess the penalties and impact of security breaches. From a regulatory perspective, such liabilities should be considered to ensure that risks to sensitive data is properly assessed and accounted for. Moreover assessing information security risks throughout the organization provides keen insight into management’s risk tolerance for implementing security layers within the organization. The IT risk assessment should be in-line with the City's risk management strategies for identifying risks, evaluating existing controls and mitigating controls, understanding residual risk and establishing a risk mitigation plan. Page 119 of 167 APPENDIX B 3.1.3 Policies and Procedures Assigned to: City of Georgetown Priority High Recommendations Security policies and procedures are key components of an Information Security Program. They reflect the organization's business processes and strategy, thereby enabling management to define the scope of security, what is expected from employees, dictate what must be protected and to what extent, and what the consequences of noncompliance will be. To this effect, in addition to the already existing Acceptable Use policy in place, we recommend management consider an organization-wide Information Security Policy, to include key sections such as the ones listed below: • Purpose/Scope • Roles and responsibilities (including those related to regulatory requirements) • Management commitment and business owner requirements • Enforcement • Information Sharing: Define and set requirements for relationships with or connections to information systems of other agencies. Additional policies that the City should consider adding include: • Data Classification • Information Risk Management (IRM) • User Access Provisioning and Review • Data Backup and Retention • Data Destruction/Retention Policy • Media Handling/Disposal Policy (this can be combined with the existing Computer Disposal Policy) • Data Protection and Encryption • Secure Configuration/Hardening • Physical Security Policy • Contingency Plan • Vulnerability Assessment and Remediation • Incident Response Policy (for breaches, events and other critical incidents) The ISP should be reviewed periodically (e.g. annually) by senior management and enforced through annual end-user acknowledgement signoffs. Page 120 of 167 APPENDIX B 3.1.4 Asset Management: Data Classification Assigned to: City of Georgetown Priority High Recommendations The City has identified and catalogued its hardware and software via a tool called Lansweeper. This approach ties into an overall information flow enforcement (NIST SP 800-53 Rev. 4 AC-4) which ensures the confidentiality, integrity, and availability of critical data when defined and enforced. The next step is to classify data within the system based on its criticality and / or sensitivity (NIST SP 800-53 Rev. 4 RA-2). Classification of data will also help drive the above- mentioned information flow enforcement and help define the City’s security architecture. Most organizations conduct the security categorization process as an organization-wide activity with the involvement of chief information officers, senior information security officers, information system owners, mission/business owners, and information owners/stewards. Plante Moran recommends the classification of City data to define an appropriate set of protection levels and communication required for special handling. Classifications and associated protective controls (including encryption for data at rest and data leak prevention tools) should take into account department needs for sharing or restricting information and the associated business impacts if such data were compromised. Successful data classification in an organization requires a thorough understanding of where the organization’s data assets reside and on what applications/devices they are stored. Handling procedures should include details regarding the secure processing, storage, transmission, declassification, and destruction of data. Page 121 of 167 APPENDIX B 3.1.5 Access Management Assigned to: City of Georgetown Priority High Recommendations Logical Access: Access provisioning to the system is completed on the practice of mirroring, that is, 'set up as another user within the system’. This practice can potentially lead to excessive access rights being provided to users. On the other hand, for existing users, additional access is provisioned without a formal review for SoD (Segregation of Duties) conflict. When users are terminated, access removal from all necessary applications may not be performed in a timely manner due to delayed notification from HR to the IT department. Furthermore, in all aforementioned scenarios (access provisioning, modification and termination), it was noted that not all applications have a formal process of provisioning and de-provisioning. A role-based access scheme should be established to ensure consistent application of user access rights within the system. Users should be assigned their base set of access authorizations based on the concept of “Least Privilege Necessary” to perform their role or job function (as defined within their formal job description). Additional access beyond the previously established role-based access scheme should be formally requested, reviewed for conflicts and approved (NIST SP 800-53 Rev. 4 AC-2). Moreover, Management should consider integrating access rights with data classification efforts identified in the findings within this report (See 3.1.4 above, for more details). Physical Security: The City currently monitors physical access to the facility where information system resides to detect and respond to physical security incidents. However, CoG does not review physical access logs periodically (e.g. quarterly/annually). We recommend management take the following actions: 1. Establish a role based access scheme that takes into account the job responsibilities associated with each role for City of Georgetown. 2. Establish a process to periodically review user access (including physical access) to ensure accuracy and adherence to existing/changed business processes. 3. Ensure a process is in place to approve additional or special access requests and timely de-provision access upon notification from HR. 4. Implement and enforce procedures to identify and document appropriate access requirements for removing, adding or modifying City personnel’s access to electronic PHI. The need for and extent of access should be based on an assessment of risk, cost, benefit and feasibility as well as business need, and permission to view, alter, retrieve and store ePHI. 5. Perform a periodic review of user access to PHI and ePHI (including access to the data center) to verify the list is accurate and to ensure access is still commensurate with job responsibilities. Page 122 of 167 APPENDIX B 3.1.6 Contingency Plan Assigned to: City of Georgetown Priority High Recommendations In order to ensure that critical operations are available in the event of an interruption or incident, redundancy is built into the datacenter environmental controls at the City and an extensive data backup strategy is in place. However, a formal contingency plan is not in place and related resources/systems are not catalogued and prioritized. Plante Moran recommends the City conduct and formalize: (1) a Business Impact Analysis (BIA) which identifies and analyzes mission-critical business functions, and then quantifies the impact a loss of those functions would have on the City, and (2) An information system contingency plan to mitigate the risk of critical system and service unavailability. The contingency planning process should occur after a formal Business Impact Analysis (BIA) is conducted, in order to correlate the system with the critical processes and services provided, and based on that information, characterize the consequences of a disruption. Three steps are typically involved in accomplishing the BIA: • Determine mission/business processes and recovery criticality • Identify resource requirements • Identify recovery priorities for system resources The information system contingency plan should consider three phases: (1) Activation and Notification Phase which outlines activation criteria and notification procedures, (2) Recovery Phase which outlines recovery activities, escalation, and notification, and (3) Reconstitution Phase which allows validating successful recovery and deactivation of the plan through activities such as validation testing, notifications, and event documentation. The contingency planning process should also include the following elements: • Roles and responsibilities • Scope as applies to common platform types and organization functions (i.e., telecommunications, legal, media relations) • Resource requirements • Training requirements • Exercise and testing schedules • Plan maintenance schedule, and • Minimum frequency of backups and storage of backup media Further, an effective contingency plan should tie into the City’s Incident Response Plan and should consider City’s personnel as information system contingency plans are not executed on their own and an incident will often impact individuals that are crucial to tasks related to information system operations. Personnel safety and evacuation, personnel health, personnel welfare, relationships with response organizations, and communication planning should be considered when developing the contingency plan. Finally, the agreed upon plan should be compatible with the enterprise-wide Business Continuity Plan. Sources: http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata- Nov11-2010.pdf Page 123 of 167 APPENDIX B 3.1.7 Incident Response Management Assigned to: City of Georgetown Priority High Recommendations Based on inquiry, it was noted that the City of Georgetown does not have a formal Incident Response Plan. Incident management includes a proactive and reactive phase. While reactive measures help to ensure that incidents are properly handled, proactive measures allow incidents to be detected in a timely and controllable manner (See finding 3.1.9). An improved approach will be to implement an Incident Management Program, which is initiated by an Incident Response Policy and include the following key elements: • Provide a roadmap for implementing its incident response capability; • Describes the structure and organization of City of Georgetown’s incident response capability; • Provides a high-level approach for how the incident response capability fits into City of Georgetown as a whole and the overall Family of Companies; • Meets the unique requirements of City of Georgetown’s mission, size, structure, and functions; • Defines reportable incidents as well as ; • Requirements and guidelines for external communications and information sharing (e.g., what can be shared with whom, when, and over what channel) • Provides metrics for measuring the incident response capability within the organization; • Defines the resources and management support needed to effectively maintain and mature an incident response capability; and • Is reviewed and approved by senior management We recommend management take the following actions: 1. Develop a more comprehensive plan incorporating the above elements. 2. Integrate City of Georgetown’s Incident Response Plan testing activities with relevant third parties. Page 124 of 167 APPENDIX B 3.1.8 Third Party Cybersecurity Roles & Responsibilities Assigned to: City of Georgetown Priority High Recommendations While the City has identified trusted partners with respect to hardware and hosted applications. We noted the following deficiencies related to third party roles and responsibilities: • The contract between City of Georgetown and the service provider does not specifically outline the roles and responsibilities related to Cybersecurity controls handled by each organization. • There is no monitoring of external party use of the system for potential Cybersecurity events. Security roles and responsibilities should be established for all third-party service providers (NIST SP 800-53 Rev. 4 PS-7). Responsibilities are key to ensure that the City of Georgetown and its service providers understand exactly who is responsible for which Cybersecurity controls; this is especially important in a business continuity situation. These roles and responsibilities should be formally documented in a contractual agreement. Service level agreements should be established based on Key Performance Indicators (KPI) where City of Georgetown’s expectations are set for each outsourced responsibility to its third-party service providers. Once established, KPIs should be monitored to ensure third- party service providers adhere to contractual obligations (NIST SP 800-53 Rev. 4 CA-7). Furthermore, adherence to Key Performance Indicators should be used to identify potential issues with vendor service that can be addressed through negotiations or seeking a new vendor. We recommend management take the following actions: 1. Clearly identify the cybersecurity responsibilities to be outlined in the contract with the service provider including roles for identification, response, and recovery procedures. 2. Establish Key performance indicators for third-party responsibilities including number of events, data breaches, number of notifications. 3. Continuously monitor established key performance indicators. Page 125 of 167 APPENDIX B 3.1.9 Critical Security Event Identification Assigned to: City of Georgetown Priority Medium Recommendations We noted a variety of log generation methods are in place for the system. These logs can be used to identify everything from system health to potential security violations. Presently, there is not a comprehensive catalog of security related event types being identified and reviewed within the logs by security professionals. To establish an effective event logging and monitoring program, City of Georgetown will need to first identify high risk events that can be alerted from current logging capabilities (NIST SP 800-53 Rev. 4 AU-6). Potential high risk events can be discerned through the risk assessment process (NIST SP 800-53 Rev. 4 RA-3), penetration testing, and best practice documentation. Some common threat events include: • Multiple failed login attempts • Elevations in access privileges • Changes to application code • Changes to security settings • Process specific actions For more risky events, such as devices that connect to the network without authorization, the organization may consider alert generation techniques while for less risky events they may simple review on a periodic basis. Identified events should be responded to in accordance with the organization’s Incident Response Plan (NIST SP 800-53 Rev. 4 IR-4, IR-5). Once event detection processes are implemented a process to test said processes should be established. Security assessments by internal or external independent parties can be an effective way to ensure logging and monitoring processes are effective (NIST SP 800-53 Rev. 4 CA-2). Management should seek continuous improvement opportunities for the event logging and monitoring program based on the results of security assessments. We recommend management take the following actions: 1. Identify the system events that may indicate a potential security event. 2. Define monitoring techniques commensurate with associated risk. 3. Establish formal policies and procedures related to defined monitoring activities. 4. Periodically test the effectiveness of event logging and monitoring processes. Page 126 of 167 APPENDIX B 3.1.10 Security Awareness, Training and Education Assigned to: City of Georgetown Priority Medium Recommendations The City has implemented an acceptable use policy amongst other policies around proper use of computers and accessing digital information. However, to ensure compliance, there is a need to assess employee’s understanding of policies and response to cybersecurity threats via periodic awareness and training. End users are the first line of defense against a variety of social engineering threats and must be relied upon to appropriately select strong passwords, perform secure day-to-day operations, and appropriately use equipment. By not providing formal training to all employees, the risk is increased that employees may not follow appropriate security procedures. We recommend a formal IT security awareness training be provided to all employees on a periodic basis. Employees should be educated on the organization’s information security policies upon hire, periodically (at least annually), and as major changes occur. In addition, employees should be required to formally acknowledge that they have read and understand the security topics discussed, and that they understand the ramifications of noncompliance. Management should consider allocating resources for security awareness activities (including other items, e.g. banners and posters), and enforce employee participation/attendance within the organization. Page 127 of 167 APPENDIX B 3.1.11 Unauthorized Mobile Code Detection Assigned to: City of Georgetown Priority Low Recommendations Mobile code is defined as any program, application, or content that is capable of being embedded and transferred (via email, document, website, etc.). Examples of mobile code include: JavaScript, Active X, PDF, VBscripts, etc. Avenues There are currently multiple avenues for mobile code to be introduced into the information systems supporting the system. Mobile code may be introduced from USB (current USB restriction only prevent data being copied to a USB), through email, and through downloads from websites. The City should identify the types of mobile code that are approved for use within the information system and educate users on the proper use of related technologies. Likewise, organizations should define which types of mobile code are not approved for use within the information system. Processes should be defined to identify unauthorized mobile code deployed within the environment. These processes could include configuration management controls, vulnerability scanning, etc. (NIST SP 800-53 Rev. 4 SC-18). City of Georgetown does have controls in place to mitigate the risk of malicious mobile code: antivirus controls, and limiting user access to administrator functions based on the concept of least privilege. We recommend management take the following actions: 1. Define acceptable and unacceptable mobile code and mobile code technologies. 2. Deploy a process to monitor for the presence of mobile code 3. Integrate mobile code detection processes into the Incident Response Plan Page 128 of 167 APPENDIX B Page 129 of 167 City of Georgetown, Texas Government and Finance Advisory Board October 28, 2020 S UB J E C T: C onsideration and pos s ible ac tion to rec ommend a resolution formally adopting the C ity’s Inves tment P olicies for F isc al Year 2021 – Leigh Wallac e, F inance Director IT E M S UMMARY: T his item is to recommend the Investment P olic y to C ity C ounc il. T he purpos e of the Inves tment P olicy is to provide the framework for managing the C ity’s inves tments in a way that mitigates ris k while optimizing returns. T he polic y is modeled after P ublic F unds Investment Act (P F I A) rec ommendations. Acc ording to the Act, the C ounc il mus t approve the polic ies annually. T he C ity’s Investment Advisors, Valley View C onsulting, and C ity s taff worked together on the updates. T here are no major updates for F Y2021. F IN AN C IAL IMPAC T: . S UB MIT T E D B Y: S haron A P arker AT TAC H ME N T S: Description Type Investment Policy Presentation Pres entation Investment Policy FY2020-2021 Recommended Backup Material Investment Policy Res olution Resolution Letter Page 130 of 167 Investment Policy Review and Portfolio Summary City of Georgetown Page 131 of 167 PFIA Requirements Public Funds Investment Act, Texas Government Code Chapter 2256 Requires written investment policy that meets requirements Investment policy Must be approved by Council Must be reviewed annually by Council Investment strategies & objectives must be outlined Investment officers must be designated Mandates training for investment officers Page 132 of 167 PFIA Requirements Specifies the type of securities allowed No derivatives City policy can be and is more restrictive Safekeeping and Custody Authorized brokers/dealers Competitive bid process Collateral minimum 102% Regular reporting of investments Minimum information items required Compliance audit as part of annual financial audit Focus on management controls and adherence to approved investment policy Quarterly investment report reviewed Page 133 of 167 Investment Policy Objectives In priority order Safety-Preservation and safety of principal Liquidity-Sufficient cash to pay obligations when due Public Trust-No investments that may be questionable by public Yield-Maximize earnings within policy Page 134 of 167 City’s Authorized Investments Financial Institution Deposits US Treasuries and Agencies Investment Pools AAA Rated & Mark to Market daily Money Market Mutual Funds Repurchase Agreements Texas Municipal Issuers Rated “A” or better Page 135 of 167 Investment Policy Compliance Certified by the Government Treasurers Organization of Texas (GTOT) Best practices -model policy guidelines Part of Independent Auditor’s work Review for compliance with all legal requirements Opinion Letter in Comprehensive Annual Financial Report (CAFR) Page 136 of 167 Review Proposed Changes Add Investment Officer –Assistant Finance DirectorAdd Minor editing changes •Broker/Dealer ListEdit Staff will continue to monitor for policy issues and federal & state law changesMonitor Page 137 of 167 Year in Review –2020 City of Georgetown Interest earnings declined drastically in 2020. Due to COVID-19 and market changes, the Fed Rate decreased significantly in 2020 to 0-.25%. Example: In August 2019, we accepted a rate of 2.25%, but in September 2020, our highest rate was .30% for 9 months. Continued laddered purchases throughout the year. Renewed Depository Banking Contract through Spring 2022. Page 138 of 167 City Portfolio-Type By Quarter City of Georgetown Page 139 of 167 Investment Strategy City of Georgetown REVIEW CASH FLOW NEEDS MAINTAIN PROJECT SCHEDULE FOR BOND PROCEEDS INVEST ON A LADDERED APPROACH Page 140 of 167 Market Update Susan Anderson Valley View Consulting, L.L.C. City’s Investment Advisor Page 141 of 167 Rates Dropped Significantly in 2020 12 0.00 0.50 1.00 1.50 2.00 2.50 3.00 3.50 US Treasury Historical Yields -Since Nov 2015 Six Month T-Bill Two Year T-Note Ten Year T-Note Page 142 of 167 •1. Policy as presented along with any GGAF changes will be on the December 8, 2020 Council agenda. •2. Ongoing quarterly reports to Council. Next Steps: Page 143 of 167 Investment Policy Review Questions/Comments Page 144 of 167 City of Georgetown Investment Policy Page 1 CITY OF GEORGETOWN, TEXAS INVESTMENT POLICY As amended December 8, 2020 SECTION 1: SCOPE & OBJECTIVES 1.1 SCOPE This Investment Policy applies to all financial assets of the City of Georgetown, Texas, which includes the City of Georgetown Economic Development Corporation and the Georgetown Transportation Enhancement Corporation, held in all funds. 1.2 STATEMENT OF CASH MANAGEMENT PHILOSOPHY The City will maintain a comprehensive cash management program to include the effective collection of all accounts receivable, the prompt deposit of receipts to the City's bank accounts, the payment of obligations to comply with State law and in accord with vendor invoices, and the prudent investment of idle funds in accord with this Policy. 1.3 OBJECTIVES The City's investment program will be conducted to comply with Texas Government Code Chapter 2256 (the Public Funds Investment Act) and accomplish the following objectives, listed in priority order: 1. Safety. The City will give priority to the preservation and safety of the principal invested. Investments will be made in a manner that will mitigate credit risk and interest rate risk. 2. Liquidity. The City will maintain the availability of sufficient cash to pay obligations of the City when they are due. 3. Public Trust. Investment Officers shall seek to act responsibly as custodians of the public trust. Investment Officers shall avoid transactions that might impair public confidence in the City’s ability to govern effectively. 4. Yield. The City will invest idle cash in a manner that will maximize earnings to the greatest extent possible, consistent with State and local laws and the objectives of safety and liquidity listed above. It is also the objective of the City to diversify its investments to eliminate the risk of loss resulting from over concentration of assets in a specific maturity, a specific issuer or a specific class of investments, when appropriate. It is the intent of the City to hold investments to maturity. SECTION 2: STANDARD OF CARE 2.1 PRUDENCE Investments will be made with judgment and care, under prevailing circumstances, that a person of prudence, discretion, and intelligence would exercise in the management of the person’s own affairs, not for speculation, but for investment, considering the probable safety of capital and the probable income to be derived. The City Council recognizes that in maintaining a diversified portfolio, occasional measured losses due to market volatility are inevitable and must be Page 145 of 167 City of Georgetown Investment Policy Page 2 considered within the context of the overall portfolio's investment return, provided that adequate diversification has been implemented. In determining whether an Investment Officer has exercised prudence with respect to an investment decision, the determination shall be made taking into consideration: A. The investment of all funds, or funds under the City’s control, over which the Officer had responsibility rather than a consideration as to the prudence of a single investment. B. Whether the investment decision was consistent with the written Investment Policy of the City. The Investment Officers, acting in accordance with written procedures and exercising due diligence, shall not be held personally responsible for a specific investment's adverse credit risk or market price changes, provided that these deviations are reported immediately to the City Manager and/or the City Council and that appropriate action is taken to control adverse developments. 2.2 ETHICS & CONFLICT OF INTEREST Investment Officers and employees involved in the investment process will refrain from personal business activity that could conflict with the proper execution of the investment program, or which could impair their ability to make impartial investment decisions. Investment Officers and employees will comply with all disclosure and reporting requirements of Section 2256.005 (i) of the Texas Government Code. 2.3 DELEGATION OF AUTHORITY The Finance Director, both Assistant Finance Directors, and the Treasurer are the City's Investment Officers. The Finance Director is responsible for overall management of the City's investment program and may direct the other Investment Officers in his/her duties. Accordingly, the Investment Officers are responsible for day-to-day administration of the investment program and for the duties listed below: 1. Maintain current information as to available cash balances in City accounts, and as to the amount of idle cash available for investment; 2. Make investments and maintain written procedures for the operation and internal control of the investment program consistent with this Policy; 3. Ensure that all investments are adequately secured; and 4. Attend training relating to investment responsibilities under this Policy as required by Section 2256.008 of the Texas Government Code. Ten (10) hours of investment training must be completed within twelve (12) months of attaining the position of Investment Officer, and thereafter, eight (8) hours of training must be completed within a two-year period that begins on the first day of the City’s fiscal year and consists of the two consecutive fiscal years after that date. To ensure quality and capability of investment management, all Investment Officers shall receive training from an independent source that addresses investment controls, security risks, strategy risks, market risks, diversification of investment portfolios, and compliance with the Public Funds Investment Act. The Training sponsored by any of the following organizations is approved: Texas Municipal League Page 146 of 167 City of Georgetown Investment Policy Page 3 Government Finance Officers Association of Texas (GFOAT) Government Finance Officers Association of the United States and Canada Government Treasurers’ Organization of Texas (GTOT) University of North Texas Texas Tech University Center for Professional Development Unless authorized by law, no person may deposit, withdraw, transfer or manage in any other manner the funds of the City. SECTION 3: INVESTMENT STRATEGIES 3.1 OPERATING FUNDS Operating Funds are defined as cash and investments used for day-to-day operations that do not fall into one of the other categories. Operating Funds will be invested in a manner suitable to provide adequate liquidity for the anticipated operating needs of the City. Investments of Operating Funds shall be limited to a weighted average maturity no greater than one year and any one investment may not exceed 36 months without authorization by the City Manager. All investment instruments must meet credit and safety criteria as required by the Public Funds Investment Act and this Policy. All investments shall be of high quality with no perceived default risk. Operating Funds will remain sufficiently liquid to enable the City to meet operating requirements that may be reasonably anticipated. If utilized, securities with active and efficient secondary markets are necessary in the event of unanticipated cash requirements. Operating Funds’ maturities will be staggered based on the City’s anticipated operating needs, and the investments may include financial institution deposits, U.S. treasuries and agencies, state and municipal debt instruments, investment pools, and money market mutual funds. Investment of Operating Funds will be structured to attain the optimal yield given the liquidity and safety requirements. 3.2 CONTINGENCY RESERVES (or operating reserves) Contingency Reserves are the minimum fund balance/working capital requirements as defined by City Council in the Annual Operating Plan. Contingency Reserves’ balances may be used to cover any cash operating shortfalls due to the timing of bond issues, revenue receipts, etc. The funds will be invested in a manner suitable to cover operating shortfalls that may be reasonably anticipated. All investment instruments must meet credit and safety criteria as required by the Public Funds Investment Act and this Policy. All investments shall be of high quality with no perceived default risk. Investments of these funds may exceed 24 months with prior approval of the City Manager if short term cash flow needs are not evident. Any one investment may not exceed 36 months in maturity length. The weighted average maturity for these funds may not exceed 24 months. Contingency Reserves investments will remain sufficiently liquid to meet City needs in the event of an operating shortfall, and if utilized, securities with active and efficient secondary markets will provide marketability necessary should the need arise to liquidate the investment prior to maturity. Contingency Reserves’ maturities will be diverse to cover possible operating shortfalls, and the investments may include financial institution deposits, U.S. treasuries and agencies, state and municipal debt instruments, investment pools, and money market mutual funds. Investment of Contingency Reserves will be structured to attain the optimal yield given the liquidity and safety requirements. 3.3 DEBT 3.3.1 Reserves. Debt Reserves are defined as bond reserve funds required to be set aside in accordance with bond covenants. The City’s bond covenants do not require the City to maintain any reserve funds. Therefore, the City’s investments are not adversely affected by any reserve requirement conditions. Page 147 of 167 City of Georgetown Investment Policy Page 4 3.3.2 Interest & Sinking (or debt service funds). Interest and Sinking funds are defined as those funds accumulated to meet periodic payments required by bond and note maturity schedules. The investment maturities are limited by pertinent debt service requirements and tax laws limiting accumulation and earnings for such funds, and investments should be made in a manner suitable to comply with applicable requirements and payment schedules. The investments must meet credit and safety criteria as required by the Public Funds Investment Act and this Policy. All investments shall be of high quality with no perceived default risk. The funds shall be invested to ensure adequate funding for each consecutive debt service payment but shall not exceed the debt service schedule. Involuntary liquidation of investments is highly unlikely due to the nature of these funds. Interest and Sinking fund maturities will be diversified by matching them to the debt service payments of the City, and the investments may include financial institution deposits, U.S. treasuries and agencies, state and municipal debt instruments, investment pools, and money market mutual funds. Investment of Interest and Sinking funds will be structured to attain the optimal yield given the liquidity and safety requirements. 3.4 BOND PROCEEDS (capital improvement funds) Bond proceed funds are defined as those funds received from the sales of City bonds or notes and not otherwise set aside for debt service or reserve purposes. These funds typically include money to fund infrastructure, construction, or other large projects. The investment maturities are limited by pertinent project draw requirements, applicable bond covenants, and tax laws governing earnings for such funds, but may not have a single security greater than 36 months, unless a flexible repurchase agreement is used in accordance with Section 4.1.5 of this Policy. Investments must meet credit and safety criteria as required by the Public Funds Investment Act and this Policy and should be made in a manner suitable to meet project requirements. All investments shall be of high quality with no perceived default risk. The funds shall be invested to match projected cash flow requirements with sufficient liquidity to meet unanticipated project outlays, and maturities shall not exceed the expected project completion dates. Bond proceed maturities will be diverse to provide necessary liquidity based on project needs, and investments may include financial institution deposits, flexible repurchase agreements, U.S. treasuries and agencies, state and municipal debt instruments, investment pools, and money market mutual funds. Investment of Bond Proceeds will be structured to attain the optimal yield given the liquidity and safety requirements. SECTION 4: AUTHORIZED INVESTMENTS 4.1 AUTHORIZED INVESTMENTS City funds may be invested in the following authorized investments: 4.1.1 Financial Institution Deposits. Certificates of Deposit and other evidences of deposit at a financial institution that, a) has its main office or a branch office in Texas and is guaranteed or insured by the Federal Deposit Insurance Corporation or its successor, b) is secured by obligations or in any other manner and amount provided by law for deposits of the City, or c) is executed through a depository institution or approved broker that has its main office or a branch office in Texas that meets the requirements of the Public Funds Investment Act. All financial institution deposits in excess of the FDIC insured amount must be collateralized as described by Section 5.5 COLLATERALIZATION. 4.1.2 U.S. Treasuries and Agencies. Obligations of the United States of America, its agencies and instrumentalities, including other obligations, the principal and interest of which are unconditionally guaranteed or insured by, or backed by the full faith and credit of the United States or its agencies and instrumentalities, including obligations that are fully guaranteed or insured by the Federal Deposit Insurance Corporation or by the explicit Page 148 of 167 City of Georgetown Investment Policy Page 5 full faith and credit of the United States. Such obligations include letters of credit of the United States or its agencies and instrumentalities, including the Federal Home Loan Banks. 4.1.3 Investment Pools. Investment pools that meet all requirements of the Public Funds Investment Act, including the following criteria: a. An investment pool must provide an offering circular or other similar disclosure instruments and provide monthly and transaction reporting as required by Section 2256.016 of the Texas Government Code. b. Investment in a new pool will require the approval of the City Council. c. A public funds investment pool created to function as a money market mutual fund must (1) mark its portfolio to market daily, (2) include in its investment objectives the maintenance of a stable net asset value of $1.00 for each share and (3) be continuously rated no lower than AAAm or at an equivalent rating by at least one nationally recognized rating service. 4.1.4. Money Market Mutual Funds. No-load government money market mutual funds if the fund: a. Is compliant with the Public Funds Investment Act; b. Is regulated by the Securities and Exchange Commission; c. Marks its portfolio to market daily; d. Includes in its investment objectives the maintenance of a stable net asset value of $1.0000 for each share; d. Is continuously rated no lower than AAA or at an equivalent rating by at least one nationally recognized rating service. 4.1.5. Repurchase Agreements. Fully collateralized repurchase agreements that: a. Have a defined termination date; b. Are secured by cash or obligations as allowed by the Public Funds Investment Act and this Policy; c. Require independent third-party safekeeping of all securities prior to the release of any funds; d. Are placed through a primary dealer or financial institution doing business in Texas; and e. Do not create a reverse repurchase agreement by the City. Construction, capital improvement and bond proceed funds may utilize a flexible repurchase agreement, or similar agreement, that allows expenditure-related withdrawal of funds, without penalty, with an average life and termination date limitation based on the anticipated draw schedule. Any repurchase agreement shall require the execution of a mutually acceptable Repurchase Agreement. 4.1.6. Municipal Issuers. Obligations of: a. The State of Texas or its agencies and instrumentalities; and b. Counties, cities, and other political subdivisions of the State of Texas rated as to investment quality by a nationally recognized investment rating firm not less than A or its equivalent. Investments purchased prior to this Policy’s revision, that do not meet the revised requirements of this Policy, are not required to be liquidated. The City shall monitor each investment’s status to determine whether it is in the best interest of the City to hold or liquidate the investment. Page 149 of 167 City of Georgetown Investment Policy Page 6 4.2 CREDIT RATING REVIEW AND EFFECT OF LOSS OF REQUIRED RATING Not less than quarterly, the Investment Officers will obtain from a reliable source the current credit rating for each held investment that has a Public Funds Investment Act-required minimum rating. Any Authorized Investment that requires a minimum rating and does not qualify at any time during the period, is considered to not have the minimum rating. The City shall take all prudent measures that are consistent with this Policy to liquidate an investment that does not have the minimum rating. 4.3 COMPLIANCE WITH STATE LAW All authorized investments outlined above must meet the requirements of the Public Funds Investment Act. No investment may be made in any instrument except as provided above. 4.4 CASH ON HAND Cash resources required for the immediate needs of the City, and not otherwise available for longer term investment, will be placed in account(s) at the City's Depository/Depositories, in local government investment pools and/or money market mutual funds. Such account(s) will earn interest at the highest rate(s) provided in the respective depository contract(s). SECTION 5: SAFEKEEPING AND CUSTODY 5.1 AUTHORIZED BROKER/DEALERS and INVESTMENT POLICY CERTIFICATION Authorized investment securities may be purchased only through brokers/dealers who are licensed and in good standing with the Texas State Securities Board, the Securities Exchange Commission, the Financial Industry Regulatory Authority, or other applicable self-regulatory organization. The City Council will, at least annually, review, revise, and adopt a list of broker/dealers who are authorized to engage in investment transactions with the City. The list is approved and included in Attachment “A” of this Policy. Before engaging in investment transactions with an Investment Pool or discretionary investment management firm, the Investment Officers will have received from said pool/firm a signed Certification Form. This form will attest that the individual responsible for the City’s account with that pool/firm has received and reviewed the City’s Investment Policy and that the pool/firm has implemented reasonable procedures and controls to preclude transactions conducted between the City and the pool/firm that are not authorized by the City’s Investment Policy, except to the extent that this authorization is dependent on an analysis of the makeup of the City’s entire portfolio, requires an interpretation of subjective investment standards, or relates to investment transactions of the City that are not made through accounts or other contractual arrangements over which the pool/firm has accepted discretionary investment authority. The letter must be signed by a Qualified Representative as defined by the Public Funds Investment Act. “Qualified Representative” means a person who holds a position with a business organization who is authorized to act on behalf of the business organization and who is one of the following: (1) for an investment pool, the person authorized by the elected official or board with authority to administer the activities of the investment pool to sign the written instrument on behalf of the investment pool, or Page 150 of 167 City of Georgetown Investment Policy Page 7 (2) for a discretionary investment management firm registered under the Investment Advisers Act of 1940 or, if not subject of registration under the Act, registered with the State Securities Board, a person who is an officer or principal of the investment management firm. 5.2 AUTHORIZED FINANCIAL INSTITUTIONS Financial institution deposits and other evidences of deposit may be purchased at qualified City Depositories and other financial institutions. Qualifications will be determined by the Investment Officers. The City must have a written agreement with the Depository and other financial institutions, and that depository and other financial institutions must meet all State Laws for deposit of public funds. The City's main operating Depository/Depositories will be selected as provided by law and the City’s purchasing procedure. 5.3 INTERNAL CONTROLS The Finance Director will establish and maintain procedures for the execution of the investment program and these procedures will address internal controls to mitigate risks of intentional or inadvertent mismanagement or misappropriation of funds. All investment transactions will be documented by the Investment Officers. The Investment Officers, or through the City’s Investment Advisor, may make investments orally, but will follow promptly with a written confirmation to the financial institution or broker/ dealer, with a copy of such confirmation retained in the City's files. All trades, purchases, and sales, excluding cash equivalent transactions, will be completed through a competitive process. Where appropriate, at least three (3) quotations will be solicited for each such investment made. Market value of the portfolio and each investment will be monitored at least quarterly through industry standard publications/sources for market data such as, but not limited to, The Wall Street Journal or Bloomberg. 5.4 SAFEKEEPING All securities purchased by the City under this Policy must be designated as assets of the City, must be settled on a delivery-versus-payment (DVP) basis, and must be protected through the use of a third-party custody/safekeeping agent. The City will enter into a formal agreement with an institution of such size and expertise as is necessary to provide the services needed to protect and secure the investment assets of the City. 5.5 COLLATERALIZATION To the extent not insured by federal agencies that secure deposits, City funds (including financial institution deposits and CDs) must be collateralized in compliance with the Texas Public Funds Collateral Act and pertinent federal banking regulations. With the exception of deposits secured with irrevocable letters of credit at 100% of deposit plus accrued interest, the aggregate market value of pledged securities shall be equal to at least one hundred two percent (102%) of the deposit plus accrued interest less an amount insured by the Federal Deposit Insurance Corporation. Should the depository fail to adequately maintain the required collateral level, the City may increase the minimum to 110%. The City reserves the right, in its sole discretion, to accept or reject any form of insurance or collateral pledged towards its deposits. Institutions serving as a depository will be required to sign a Depository/Collateral Agreement with the City. The collateralized deposit portion of the Agreement shall define the City’s rights to the collateral in case of default, bankruptcy, or closing and shall establish a perfected security interest in compliance with Federal and State regulations, including: Page 151 of 167 City of Georgetown Investment Policy Page 8 • The agreement must be in writing; • The agreement must be executed by the Depository and the City contemporaneously with the acquisition of the asset; • The agreement must be approved by the Board of Directors or designated committee of the Depository and a copy of the meeting minutes must be delivered to the City; and • The agreement must be part of the Depository’s “official record” continuously since its execution. Securities pledged as collateral must be retained by an independent, third party custodian and marked as pledged to the City. The City will be provided the original safekeeping receipt from the custodian on each pledged security. With the exception of the Federal Reserve Bank, the City, financial institution, and the custodian will operate in accordance with an acceptable custodial agreement. The City's Investment Officers must approve in writing the release of collateral prior to its removal from the safekeeping account in accordance with the terms of the depository and/or custodial agreement. The financial institution(s) with which the City invests and/or maintains deposits will require the custodian to provide monthly a listing of the collateral pledged to the City marked to current market prices. The listing will include total pledged securities itemized by name, CUSIP, type and description of the security; safekeeping receipt number; par value; current market value; maturity date; and Moody's or Standard & Poor's rating, if available. SECTION 6: REPORTING 6.1 QUARTERLY REPORTING The Investment Officers shall prepare, sign and submit to the City Council a quarterly report on investment transactions for all funds covered by this Policy. The report will be prepared in compliance with the Public Funds Investment Act. The report will cover the investment position of the City at the end of each fiscal quarter. The contents will include at a minimum: 1. Beginning and ending market value and accrued interest of the portfolio; 2. Beginning and ending market value and book value, maturity date, type of funds, interest coupon, and yield for each separate security; and 3. A statement as to the compliance with this Policy and State law. 6.2 ANNUAL REPORTING Within 90 days following the end of the fiscal year, the Investment Officers will present to the City Council or the General Government and Finance Advisory Board a comprehensive annual report on the investment program and investment activity. In addition to the information required for quarterly reporting, the annual report will include a review of the activities and return for the twelve months, suggest Policy revisions and improvements that might enhance the investment program, and include an investment plan for the ensuing fiscal year. The annual report may be a component of the quarterly report. 6.3 PERFORMANCE STANDARDS To evaluate portfolio performance of funds subject to this Policy, the City establishes “weighted average yield to maturity” as the standard portfolio performance measurement. The portfolio’s performance will be compared against appropriately competitive and reasonable benchmarks, including money market mutual funds or investment pools of similar make-up and maturities. 6.4 COMPLIANCE Page 152 of 167 City of Georgetown Investment Policy Page 9 The quarterly reports shall be formally reviewed and a compliance audit of management controls and adherence to this Policy as it relates to the City’s investments and investing activity will be performed on an annual basis in conjunction with the City’s annual financial audit. The results shall be reported to the City Council. SECTION 7: POLICY REVIEW AND AMENDMENTS This Investment Policy will be reviewed by the City Council on at least an annual basis as required by the Public Funds Investment Act. The City Council shall adopt a written instrument by rule, order, ordinance, or resolution stating that it has reviewed the investment policy and investment strategies and the written instrument so adopted shall record any changes made to either the investment policy or investment strategy. Page 153 of 167 City of Georgetown Investment Policy Page 10 CITY OF GEORGETOWN INVESTMENT POLICY Attachment “A” Approved Broker/Dealer List FHN Financial Duncan Williams Hilltop Securities Multi-Bank Securities SAMCO Capital Rice Financial Wells Fargo Securities These broker/dealers meet the City’s Investment Policy requirements. Page 154 of 167 Resolution Number: ___________________________ Page 1 of 1 Description: Investment Policy Date Approved: December 8, 2020 RESOLUTION NO. ____________ A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF GEORGETOWN, TEXAS, AMENDING THE EXISTING CITY OF GEORGETOWN INVESTMENT POLICY EFFECTIVE DECEMBER 8, 2020. WHEREAS, the goal of the City of Georgetown is to implement an investment policy that utilizes all current municipal investment practices, while ensuring the safety and availability of all funds entrusted to the City in compliance with federal, state and local laws; and WHEREAS, the City Council of the City of Georgetown has reviewed the investment policy; and WHEREAS, the City Council of the City of Georgetown wishes to amend its Investment Policy (as last amended December 10, 2019); and NOW, THEREFORE, BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF GEORGETOWN, TEXAS, THAT: SECTION 1. The facts and recitations contained in the preamble of this resolution are hereby found and declared to be true and correct, and are incorporated by reference herein and expressly made a part hereof, as if copied verbatim. The enactment of this resolution is not inconsistent or in conflict with any 2030 Plan Policies. SECTION 2. The Investment Policy attached as Exhibit “A” is hereby adopted by the City Council of the City of Georgetown, Texas. SECTION 3. This resolution shall be effective immediately upon adoption. RESOLVED this 8th day of December 2020. ATTEST: THE CITY OF GEORGETOWN: Robyn Densmore Dale Ross City Secretary Mayor APPROVED AS TO FORM: Skye Masson City Attorney Page 155 of 167 City of Georgetown, Texas Government and Finance Advisory Board October 28, 2020 S UB J E C T: C onsideration and pos s ible rec ommendation to C ouncil of a contrac t with S uddenlink to provide dedicated Internet service for a total of $136,620 over three years. - James Davis , I T Manager - O perations IT E M S UMMARY: T his item is to request approval of a new three-year contrac t with S uddenlink for a dedic ated internet circ uit for a total of $136,620 ($3,795 a month). S uddenlink provides the following services to the C ity of G eorgetown: 1. P rimary Internet services delivered over dedicated fiber optic c ables . 2. A dedicated fiber line to send the C ity’s C hannel 10 video feed to S uddenlink. 3. All public I P addres s es that connec t C ity of G eorgetown s ervers to the public Internet. No other vendor can reasonably provide this combination of s ervic es to C ity facilities . T his c ontract reduces the c os t of services by $360 per month while increasing the amount of bandwidth available to the C ity from 200 megabits /sec ond to 2 gigabytes /sec ond. T he cost was reduced by eliminating a redundant fiber path to the C ity’s datacenter. T his path was no longer needed as the C ity recently added a sec ond internet service provider that terminates at the new Dis as ter R ecovery datac enter. T he Legal Department has reviewed and approved the attached c ontract. F IN AN C IAL IMPAC T: All items were budgeted during the F Y 2021 budget proc es s . Expenses will be rec orded in C C 0652 (I T Management) in s pend category (S oftware Maintenanc e S ubs criptions and S upport S ervices). S UB MIT T E D B Y: S haron P arker AT TAC H ME N T S: Description Type Suddenlink CSA Rev Final Backup Material Page 156 of 167 City of Georgetown_ Suddenlink_CSA Rev 09.16.20_ggk Confidential & Proprietary Page 1 of 6 Page 157 of 167 City of Georgetown_ Suddenlink_CSA Rev 09.16.20_ggk Confidential & Proprietary Page 2 of 6 Commercial Service Agreement Customer (“You” or “Customer”) agrees to be bound by this Commercial Service Agreement (the “Agreement”) with respect to all services (“Service(s)”) provided by Suddenlink Communications and its affiliates and subsidiaries authorized to provide the services set forth herein (collectively, "Suddenlink"). The Agreement includes the general terms of service set forth below, as well as the additional commercial terms of service and terms of service applicable to the specific Services and features to which you subscribe or have access, including cable television service ("Video Service"), high speed da ta service ("High Speed Internet Service"), voice service ("Phone Service" or "Business Hosted Voice Service on FIBER"), support services and mobile apps, as are set forth below or at https://www.suddenlink.com/terms-and-policies and may be updated from time to time (collectively, the “Additional Terms of Service”), which a re incorporated in this Agreement by reference. You further understand and agree that the Suddenlink Communications Privacy Policy (“Privacy Policy”), which governs the collection, use and disclosure of Customer personal information, is likewise incorporat ed herein by reference. THIS AGREEMENT CONTAINS A BINDING ARBITRATION AGREEMENT THAT AFFECTS CUSTOMER’S RIGHTS, INCLUDING THE WAIVER OF CLASS ACTIONS AND JURY TRIALS. THE AGREEMENT ALSO CONTAINS PROVISIONS FOR OPTING OUT OF ARBITRATION. PLEASE REVIEW IT CAREFULLY. GENERAL TERMS OF SERVICE APPLICABLE TO SERVICE(S): 1. Services. Suddenlink shall use reasonable efforts to make the Services available by any requested service date. Suddenlink shall not be liable for any damages whatsoever resulting from delays in meeting any service dates due to delays resulting from construction or for reasons beyond its control. Suddenlink shall provide Customer with the Services and Equipment identified on the commercial service order presented to Customer' at time of installation (“Service Order”); provided, however, if Suddenlink determines that Customer's location is not serviceable under Suddenlink's normal installation guidelines, Suddenlink may terminate this Agreement. Suddenlink shall have no responsibility for the maintenance or repair of networks, facilities and equipment not furnished by Suddenlink. 2. Payment of Charges. The charges for one month of Services, including any deposits, activation, set-up, installation, construction and/or Equipment charges, are due upon installation of the Services or as otherwise set forth on the Service Order. Thereafter, Customer agrees to pay monthly recurring Service charges and Equipment charges (if an y) in advance, including all applicable fees (such as restoration or experience fees), taxes, regulatory fees, franchise fees, surcharges (including sports and broadcast tv surcharges), or other government assessments no later than the date indicated on Customer’s bill. Charges for non-recurring Services or Equipment charges will be reflected on Customer’s subsequent bill at the then current applicable rates. All rates for Services, Equipment charges and other fees and surcharges are subject to change in accordance with applicable law. If Customer elects to pay by automatic recurring credit card, debit card or automatic clearing house payments, Customer authorizes Suddenlink to charge such accounts. If Customer elects to send a check as payment, Customer authorizes Suddenlink either to use information from Customer’s check to make a one -time electronic funds transfer from Customer’s bank account or to process the payment as a check transaction. Failure to receive a bill does not release Customer from Customer's obligation to pay. Failure to pay the total balance when due (including checks returned for insufficient funds) shall constitute a breach of this Agreement and may be grounds for termination of Service, removal of Equipment from Customer's premises and/or imposition of a late fee (“Late Fee”) in accordance with applicable law. You can avoid incurring Late Fees by paying your monthly bill promptly. Any Late Fee imposed on Customer is intended to be a reasonable advance estimate of costs of managing past due accounts. The Late Fee is not interest, a credit service charge or a finance charge. If the Customer has more than one account (Business and/or Residential) served by Suddenlink, all Suddenlink-provided Services at all locations may be subject to discontinuance of Service in the event any one account remains unpaid. In the event collection activities are required, an additional collection charge may be imposed. 3. Additional Fees. In addition to Customer’s monthly recurring charges and any Late Fee, additional fees may be imposed, including fees for returned checks, Payment Assistance Fees for paying by phone, receiving a paper bill, charge card chargeback, early termination, reconnection and service calls. Additional charges may also be imposed if collection activities are required to recover past due balances, including attorney fees. A list of applicable fees “Schedule of Fees”) is available at www.suddenlink.com.pricing-packages. Suddenlink reserves the right to amend or change the Schedule of Fees from time to time. 4. Third Party Provider Charges. In connection with Customer’s use of the Services and Equipment, Customer may be able to access, subscribe to, use and/or purchase products, services, software or a pplications that are provided to Customer by third parties (“Third Party Providers”). Customer acknowledges that Customer may incur charges in connection with the subscription to, purchase or use of these Third-Party Provider products, services, software or applications. All such charges, including any additional fees and applicable taxes, shall be paid by Customer to the Third-Party Provider and are not the responsibility of Suddenlink. Credits or billing adjustments for products, services, software or applications billed by a Third-Party Provider shall be subject to the stated billing practices of that Third-Party Provider. Termination of a service or subscription offered for a separate charge billed directly by a Third-Party Provider shall be effected in accordance with the Terms of Service or similar agreement between the Customer and the Third-Party Provider. 5. Taxes. Customer agrees to pay any local, state or federal taxes imposed or levied on or with respect to the Services, the Equipment or installation or service charges incurred with respect to the same. 6. Term; Early Termination. Your Service Term subscription begins either on or the first day following your installation date and continues for the initial term set forth on your Service Order (“Initial T erm”). If a Service Order does not specify an Initial Term, You have an automatically renewing monthly Term subscription (“Monthly Subscription”). a. Monthly Term. If you have a Monthly Subscription, your subscription begins either on or the first day following your installation date and aut omatically renews thereafter on a monthly basis beginning on the first day of the next billing period assigned to you until cancelled by you. The monthly service charge(s) will be billed at the beginning of your assigned bi lling period and each month thereafter unless and until you cancel your Service(s). PAYMENTS ARE NONREFUNDABLE AND THERE ARE NO REFUNDS OR CREDITS FOR PARTIALLY USED SUBSCRIPTION PERIOD(S). You may cancel Service(s) for a period up to the last day of the b illing period prior to the service period that you wish to cancel, and the cancellation will be effective at the end of the then-current billing period. Any request for cancellation after the commencement of a service period will be effective at the end of the then-current service period. Access to the Services will, if possible, continue to be provided at the location ordered or, if you move, to your new location if in an Suddenlink-served area (subject to any installation charges). b. Initial Term Subscription. If You have an Initial Term, your subscription begins either on or the first day following your installation date and conti nues for the duration of the applicable Initial Term. Upon the expiration of the Initial Term, Your subscription automatically renews thereafter on a monthly basis (each, a “Renewal Month”) beginning on the first day of the next billing period assigned to you until cancelled by you. The monthly service charge(s) for each month during the Initial Term and any Renewal Months will be billed at the beginn ing of your assigned billing period and each month thereafter unless and until you cancel your Service(s). PAYMENTS ARE NONREFUNDABLE AND THERE ARE NO REFUNDS OR CREDITS FOR PARTIALLY USED SUBSCRIPTION PERIOD(S). i. Except as provided below. If Customer cancels, terminate or downgrade the Service(s) before the completion of the Initial Term"), you agree to pay Suddenlink early cancellation fees in an amount that includes: (i) all non-recurring charges reasonably expended by Suddenlink to establish service to Customer and not remunerated, (ii) any disconnection, early cancellation or termination charges reasonably incurred and paid by Suddenlink to third parties on behalf of Customer, and (iii) all monthly recurring charges for Services and Equipment for the remaining bala nce of the Initial Term.. Notwithstanding the foregoing, this Agreement is subject to the availability of funding. In the event that funds do not become available the Agreement may be terminated or the scope may be amended. A 30-day written notice will be provided to Suddenlink and there will be no penalty nor other charges incurred by the City. ii. Following the Initial Term, You may cancel Service(s) for a period up to the last day of the billing period prior to the serv ice period that you wish to cancel, and the cancellation will be effective at the end of the then-current billing period. Any request for cancellation after the commencement of a service period will be effective at the end of the then-current service period. Access to the Services will, if possible, continue to be provided at the location ordered or, if you move, to your new location if in a Suddenlink-served area (subject to any installation charges). 7. Right to Make Credit Inquiries. Customer acknowledges and agrees that Suddenlink may (a) verify Customer’s credit standing, make inquiries and receive information about your credit experiences, including your credit report, from credit reporting agencies; (b) enter this information in your file, and disclose this information concerning you to appropriate third parties for reasonable business purposes; and (c) furnish information about you, your account(s) and your payment history to those credit reporting agencies. 8. Security Deposit. Suddenlink may require a deposit or activation fee based on Customer’s credit standing or past payment history with Suddenlink. A deposit or activation fee does not relieve the Customer of the responsibility for the prompt payment of bills on presentation. Any security deposit given by Customer for the Equipment or Suddenlink's Service will be due and payable upon the first monthly billing. Such security deposits will be returned to Customer within sixty (60) days of termination of Suddenlink's Service so long as payment has be en made for all amounts due on Customer's account and Customer has returned the Suddenlink Equipment undamaged. Security deposits paid by Customer for Equipment or Services may be used, to the extent permitted by law, to offset any unpaid balance or charges after termination of Service. Customer shall remain liable for any outstanding balances after the security deposit has been applied. Further terms and conditions of the security d eposit may be contained in the deposit receipt given to Customer at the time the security deposit is collected. 9. Disputed Charges. Customer agrees to pay all undisputed monthly charges and all applicable fees and taxes as itemized on the Suddenlink monthly bill and notify Suddenlink in writing of disputed items or requests for credit within thirty (30) days of Customer’s receipt of the bill for which correction of an error or credit is sought, or longer as provided by applicable law. The date of the dispute shall be the date Suddenlink receives sufficient documentation to enable Suddenlink to investigate the dispute. The date of the resolution is the date Suddenlink completes its investigation and notifies the Customer of the disposition of the dispute. 10.Adjustments or Refunds. Any adjustment or refund, given in each case in Suddenlink’s sole discretion, will be accomplished by a credit on a subsequent bill for Service, unless otherwise required by applicable law. No credit allowance will be made for interruptions of Service that are: (a) due to the negligence of or noncompliance with the provisions of the Agreement by Customer or any person authorized by customer to use the Service; (b) due to the negligence of any person other than Suddenlink including, but not limited to, the other common carrie rs connected to the Suddenlink's facilities; (c) due to the failure or malfunction of Customer owned equipment or third party equipment; (d) during any period in which Suddenlink is not given full and free access to its facilities and Equipment for the purpose of investigating and correcting interruptions; (e) during a period in which Customer continues to use the Service on an impaired basis; (f) less than thirty (30) minutes’ duration; (g) during any period when the i nterruption is due to implementation of a Customer order for a change in Service arrangements; or (h) due to circumstances or causes beyond the control of Suddenlink. Unless otherwise provided by applicable law, in the event any amounts owed by Suddenlink to Customer are not claimed by Customer within one year of the date on which the amount became payable to Customer, Customer shall forfeit all rights to the refund and all such amounts shall become the property of Suddenlink. 11. Equipment and Software. "Distribution System" shall mean (1) all distribution plant, network facilities and associated electronics and all Equipment installed or provided by Suddenlink or its predecessors which is necessary to distribute Services throughout the premises, but specifically excluding Inside Wiring, and (2) all Equipment fur nished by Suddenlink at the premises. Ownership of the Distribution System shall at all times be and remain in Suddenlink and shall be used exclusively by and in connection with Suddenlink operations. Upon termination o f this Agreement and if Suddenlink is no longer providing Services to the premises, Suddenlink has the option to remove all or any portion of the Distribution System, provided that any damage to the premises caused by removal of the Distribution System will be repaired by Suddenlink to Customer’s reasonable satisfaction. “Equipment” means all equipment, including but not limited to, any cables, wires, amplifiers, cable boxes, access cards, remotes, cable cards, battery backup units, modems, routers, gateways, Altice One and Altice One Mini units distributed to and/or installed for use in the Customer’s service location but does not include Inside Wiring. “Inside Wiring” shall mean all wiring on the Customer’s side of the demarcation point at Customer’s service location, whether installed by Suddenlink or by Customer. The demarcation point shall mean a point at (or about) twelve (12) inches outside of where the cable wire enters the Customer’s service location. Inside Wiring shall be Customer property and not Suddenlink Equipment, and repair and maintenanc e for such Inside Wiring is the responsibility of Customer unless otherwise agreed by Customer and Suddenlink. None of the Equipment shall become a fixture nor shall distribution, installation, and/or use of Equ ipment, including but not limited to cable boxes and/or set top boxes be deemed a lease of such Equipment. Unless otherwise stated in the Service Order, Customer will acquire no ownership or other interest in the Distribution System, Equipment, network facilities, and software by virtue of payments made pursuant to this Agreement or by the attachment of any portion of the Distribution System, Equipment or network facilities to Customer's premises. Page 158 of 167 City of Georgetown_ Suddenlink_CSA Rev 09.16.20_ggk Confidential & Proprietary Page 3 of 6 a. Misuse of Equipment. Suddenlink Equipment is intended to service and reside at the specific service location and is not to be removed from the service location where it was installed or used off premises without Suddenlink authorization. Customer agrees that neither Customer nor any other person (except Suddenlink’s authorized personne l) will open, alter, misuse, tamper with, service, or make any alterations to any Equipment. Customer will not remove any markings or labels from the Equipment. Customer agrees to safeguard the Equipment from loss or damage of any kind, and (except for any self installation procedures approved by Suddenlink) will not permit anyone other than a Suddenlink authorized representative to perform any work on the Equipment. Any misuse, alteration, tampering, or removal, or the use of Equipment which permits the receipt of Services without authorization or the receipt of Services to an unauthorized number of outlets, or to unauthorized locations constitutes theft of service and is prohibited. b. Return of Equipment. If Customer's Service is terminated or cancelled (for whatever reason), unless Suddenlink expresses otherwise in writing, Cus tomer agrees that Customer no longer has the right to keep or use the Equipment and Customer must promptly return the Equipment. The Equipment must be returned to Suddenlink in the same condition as when received, ordinary wear and tear excepted. Absent other instructions, if Customer fails to return the Equipment, Customer will pay any expenses Suddenlink incurs in retrieving the Equipment. Failure of Suddenlink to remove the Equipment does not mean that Suddenlink has abandoned the Equipment. Suddenlink may impose a charge for unreturned Equipment to be determined in accordance with Suddenlink’s then current schedule of charges for non-returned Equipment and/or continue to charge Customer a monthly Service fee every month until any remaining Equipment is returned, collected by Suddenlink or fully paid for by Customer. Any charge for unreturned Equipment shall be due immediately. Suddenlink retains ownership of all Equipment. c. Damaged or Lost Equipment. If the Equipment is damaged by Customer, destroyed, lost or stolen while in Customer's possession, Customer is responsible for the cost of repair or replacement of the Equipment. d. Operation of Equipment. Customer agrees to operate any Equipment in accordance with instructions of Suddenlink or Suddenlink's agent. Failure to do s o will relieve the Suddenlink Parties of liability for interruption of Service and may make the Customer responsible for damage to Equipment. e. Tests and Inspections. Upon reasonable notification to the Customer, and at a reasonable time, Suddenlink may make s uch tests and inspections as may be necessary to determine that the Customer is complying with the requirements set forth herein. f. Software. Customer agrees to comply with the terms and conditions of any software license agreement applicable to the software provided or installed by Suddenlink (“Software”). The Software shall be used solely in connection with the Services and Customer will not modify, disassemble, translate or reverse engineer, the Software. All r ights title and interest to the Software, including associated intellectual property rights, are and will remain with Suddenlink and Suddenlink’s licensors. If Customer's Service is terminated, Customer will promptly r eturn or destroy all Software provided by Suddenlink and any related written materials. Suddenlink will have the right to upgrade, modify and enhance the Equipment and Software from time to time. Customer acknowle dges that the Software, and any related written materials, may be subject to applicable export control laws and regulations of the USA. Customer agrees not to export or re-export the Software, directly or indirectly, to any countries that are subject to USA export restrictions. g. Repair. Suddenlink will repair and/or replace defective Software or Equipment provided such damage was not caused by misuse, neglect or other fault of Customer. Suddenlink assumes no responsibility and shall have no responsibility for the operation, maintenance, condition or repair of any Customer-provided equipment and/or software, including, but not limited to, televisions, computer devices, remote controls or other consumer electronics, including any hardware or third party software, which may be connected to the Services ("Customer Equipment"), except that Suddenlink may automatically push required software or firmware updates directly to Customer Equipment when necessary for the provision of Suddenlink Service(s). Customer is responsible for the repair and maintenance of Customer Equipment. Suddenlink is not responsible or liable for any loss or impairment of Suddenlink’s Service due in whole or in part to a malfunction, defect or otherwise caused by Customer Equipment. Suddenlink makes no warranties, with respect to Equipment or Service provided by Suddenlink or with respect to the Equipment's compatibility with any Customer Equipment. 12. Prohibitions/Theft of Service. Customer shall not intercept, receive or assist in the interception or receipt of, resell, distribute or duplicate any Services. In no event shall Customer use the Services and/or Equipment to engage in any illegal or prohibited activity. 13. Customer Liability for Users. Customer is responsible for any access, use or misuse of the Services and/or Equipment that may result from access or use by any other person who has access to Customer's premises, equipment or account. Customer is responsible for ensuring that all persons who use Customer's subscribed to Services ("Users") understand and comply with all terms and conditions applicable to the Services. 14.Business Hosted Voice on Fiber: Customers purchasing Business Hosted Voice on Fiber are also bound by the Additional Terms for Business Hosted Voice Service on Fiber found at www.suddenlink.com/terms-and- policies ("Terms of Service") and additional T&C;s as applicable. a. SOFTPHONES, OFF-SITE PHONES & WIFI CONNECTIVITY: SUDDENLINK ALLOWS THE ABILITY TO ACCESS THE HOSTED VOICE SERVICE THROUGH SOFTPHONES, OFF-SITE PHONES AND WIFI CONNECTIVITY. IN NO EVENT SHALL SUDDENLINK BE RESPONSIBLE FOR, NOR DOES IT WARRANT THE PERFORMANCE OR INTEROPERABILITY OF THE SERVICE IN CONNECTION WITH ANY SOFTPHONES, OFF-SITE PHONES OR WIRELESS CONNECTIVITY. IT IS CUSTOMER’S SOLE RESPONSIBILITY TO SUPPORT AND TROUBLESHOOT ANY RELATED CONNECTIVITY ISSUES UNDER THIS SECTION. CUSTOMER ACKNOWLEDGES AND UNDERSTANDS THE HOSTED VOICE PRODUCT CHARACTERISTICS AS SET FORTH IN THE OFF-SITE REMOTE PHONE AND SOFTPHONE ACKNOWLEDGEMENT. PHONES NOT PROVIDED BY SUDDENLINK UNDER THIS AGREEMENT ARE NOT PERMITTED NOR SUPPORTED AND USE OF SUCH PHONES WILL RESULT IN TERMINATION OF THIS AGREEMENT. b. Emergency Calling Services (E911) for Hosted Voice Service: Customer is responsible for complying with all applicable emergency calling service laws. E911 procedures and restrictions are set forth in Emergency Calling Services Terms and Conditions as applicable. 15.SecureNet and SecureNet Services: Altice Business SecureNet Service / Altice Business SecureNet Plus Service: Altice Business SecureNet Service/AlticeBusiness SecureNet Plus Service purchased pursuant to this Agreement is a turnkey managed Service solution that bundles Altice Business Internet Service (over fiber), Managed DDoS Protection Service, Managed Security Gateway Service, and for Altice Business SecureNet Plus Service, also includes Managed Security Gateway Service with Unified Thread Management, and is subject to the terms and conditions of this Agreement, including those for Managed DDoS Protection Service and Managed Security Gateway Service as set forth below. 16.Managed DDoS Protection Service: Managed DDoS (Distributed Denial of Service) Protection Service purchased pursuant to this Agreement and offered in conjunction with Altice Business Internet Service (over fiber) only, will monitor, detect and mitigate Altice Business Internet Service inbound traffic against DDoS attacks and provide cleansing up to thirty (30) times the contracted bandwidth. Managed DDoS Protection Service is provisioned over Altice Business Internet Service/traffic only. 17.Service Level Agreement: The Service Level Agreement (“SLA”) attached hereto as Exhibit A sets forth Customer’s sole remedy for any claim relating to the Service including any failure to meet any guarantee as set forth in the SLA. 18.Access to Customer Premises. Customer grants Suddenlink and its employees, agents, contractors, and representatives all necessary rights of access to enter and within Customer's premises, including access to space for cables, conduits and equipment, the wiring within Customer's premises and Customer's computer(s) and other devices, to install, deliver, connect, inspect, maintain, repair, replace, disconnect, remove or alter any and all facilities, check for signal leakage or install or deliver Equipment and Software provided by Suddenlink. Customer shall cooperate in providing such access upon request of Suddenlink. If Customer is not the owner of the premises, Customer warrants that Customer has obtained the legal authority of the owner to authorize Suddenlink personnel and/or its agents to enter the premises for the purposes described herein. Suddenlink’s failure to remove its Equipment shall not be deemed an abandonment thereof. Customer shall provide a secured space with electrical power, climate control and protection against fire, vandalism, and other casualty for Suddenlink’s equipment. Customer is responsible for ensuring that Customer's equipment is compatible for the Services selected and with the Suddenlink network. 19. Violations of this Agreement. It shall be a violation of this Agreement for Customer or any User (1) to engage in any conduct prohibited by this Agreement (or by any terms and conditions incorporated herein by reference); or (2) not to engage in conduct required by this Agreement, each case determined in Suddenlink’s sole good faith discretion. In addition, whether or not the conduct set forth below is elsewhere prohibited by this Agreement, it shall be a violation of this Agreement if: (a) Customer or any User fails to abide by Suddenlink’s rule s and regulations or to pay the charges billed; (b) Customer or any User fails to provide and maintain accurate registration information or the information required in the registration process is or becomes incorrect, a bsent or incomplete; (c) Customer or any User engages in any illegal or prohibited activity in connection with their use of any Service; (d) Customer or any User harasses, threatens or otherwise abuses any Suddenlink emp loyee or agent; (e) Customer or any User refuses to provide Suddenlink with reasonable access to the service location or refuses to allow Suddenlink to diagnose and/or troubleshoot a service issue when such access or customer interaction is necessary in order to provide the appropriate customer support; or (f) The amount of customer and/or technical support required to be provided to Customer or any User is excessive in the sole good faith discretion of Suddenlink. 20.Termination. Suddenlink may terminate this Agreement, disconnect or suspend any or all Services, and remove Equipment at any time, without prior notice, for any reason whatsoever or for no reason, including but not limited to if Customer or any User fails to fully comply with the terms of this Agreement and/or any Suddenlink or authorized Third Party Provider terms of service, agreements or policies incorporated herein by reference. If Suddenlink terminates Service due to a violation of this Agreement or Suddenlink’s policies, Customer may be subject to additional fees and charges, includ ing disconnect and termination fees and Suddenlink may also exercise other rights and remedies available under law or in equity. The Agreement is subject to the availability of funding. In the event that funds do not become available the Agreement may be terminated or the scope may be amended. A 30-day written notice will be provided to Suddenlink and there will be no penalty nor other charges incurred by the City. 21.Effect of Termination by Suddenlink. Customer agrees that in the event of termination by Suddenlink: (i) Suddenlink and any Third Party Providers of co -branded services offered as part of or through the high speed internet service shall have no liability to Customer or any User; and (ii) unless expressly prohibited by law, Suddenlink, in its sole good faith discretion, may decline or reject a new application for service or block access to or use of any component of the Services by Customer or any former User. Customer further agrees that upon termination of any Service, Customer will immediately cease use of the Equipment and any Software, and; Customer will pay in full the charges for Customer's use of the Service and the Equipment through the later of: (i) Customer's applicable Service month, or (ii) if applicable, the expiration of any promotional term, or, if applicable, (iii) the date when the associated Equipment o r Software has been returned to Suddenlink. Failure of Suddenlink to remove Equipment shall not be deemed an abandonment ther eof. Customer shall pay reasonable collection and/or attorney's fees to Suddenlink in the event that Customer shall find it necessary to enforce collection or to preserve and protect its rights under this Agreement. 22.Content and Services. All content, program services, program packages, number of channels, channel allocations, broadcast channels, interactive services, email, data offerings and other services are subject to change in accordance with applicable law. 23.Disclaimer. Suddenlink assumes no liability for any program, services, content or information distributed on or through the Services, Equ ipment or the cable system, unless locally provided by Suddenlink, and Suddenlink expressly disclaims any responsibility or liability for your use thereof. Further, Suddenlink shall not be respons ible for any products, merchandise or prizes promoted or purchased through the use of the Services. Page 159 of 167 City of Georgetown_ Suddenlink_CSA Rev 09.16.20_ggk Confidential & Proprietary Page 4 of 6 24.Telephone Communications with You Regarding Your Account or Service. You agree that Suddenlink and its agents may call or text you at any phone number (landline or wireless) that you provide to us, using an automated dialing system and/or a prerecorded message, for non-promotional service and/or account-related purposes, such as appointment confirmations, service alerts, billing and collection issues or account recovery concerns. You agree to notify us: (1) if any such phone number changes; (2) is no l onger active; or (3) is ported from a landline to a wireless phone number. You can manage your contact preferences by logging into your account at http://www.suddenlink.com. 25.No Waiver. The failure of Suddenlink to enforce this Agreement and any of its components, for whatever reason, shall not constitute a waiver of any right of Suddenlink or the ability to assert or enforce such right at any time in the future. 26.No Assignment. This Agreement and the Services and/or Equipment supplied by Suddenlink are not assignable or otherwise transferable by Customer, without specific written authorization from Suddenlink. In Suddenlink's discretion, Suddenlink may assign, in whole or in part, this Agreement, and Service may be provided by one or more legally authorized Suddenlink affiliates. 27.No Warranty; Limitation of Liability. Customer expressly agrees that: (a) the Services provided are best efforts services and the Services, Software and Equipment are provided by Suddenlink on an “AS IS” and "AS AVAILABLE" basis without warranties of any kind, either express or implied; (b) Suddenlink, its officers, shareholders, directors, employees, affiliates, vendors, carrier partners, content providers and other persons or entities involved in providing the Services or Equipment (collectively, the “Suddenlink Parties”) are not responsible or liable for any loss or impairment of service due in whole o r in part to Customer owned- or provided- Equipment; and (c) all use of the Services, Software and Equipment, including that provided by Third Party Providers, as well as the purchase, download or use of any third party service, product, or application provided by or accessed through the Services or Equipment, are provided at Customer’s sole risk and Customer assumes total responsibility for Customer’s or any User’s use of the Services. Without limiting the generality of the foregoing, the Suddenlink Parties make no warranty: (i) that the Services will be uninterrupted or error free or that the Equ ipment will work as intended; (ii) as to transmission or upstream or downstream speeds of the network; (iii) that the Services, Equipment or Software are compatible with any Customer owned- or provided-Equipment; or (iv) as to the security of Customer’s communications via Suddenlink’s facilities or Services, or that third parties will not gain unauthorized access to or monitor Customer’s communications. Customer has the sole responsibility to secure Customer’s communications and the Suddenlink Parties will not be liable for any loss associated with such unauthorized access. In addition, neither the Suddenlink Parties nor any Third Party Provider of services or products makes any representations or warranties with respect to any product or services offered through the Services or Equipment, and Suddenlink shall not be party to nor responsible for monitoring any transaction between Customer and any Third Party Provider of products or services. Except for a refund or credit as expressly provided in this Agreement, in no event (including negligence) will the Suddenlink Parties be held responsible or liable for any loss, damage, cost or expense including direct, indirect, incidental, special, treble, punitive, exemplary or consequential losses or damages including, but not limited to, loss of profits, earnings, business opportunities, loss of data, personal injury (including death), property damage or legal fees and expenses, sought by Customer or anyone else using Customer’s Service account: (x) resulting directly or indirectly out of the use or inability to use the Services (including the inability to access emergency 911 or e911 services) and/or use of the Software, Equipment or provided third party services or otherwise arising in connection with the installation, maintenance, failure, removal or use of Services, Software and/or Equipment or Customer’s reliance on the Services, Software and/or Equipment, including without limi tation any mistakes, omissions, interruptions, failure or malfunction, deletion or corruption of files, work stoppage, errors, defects, delays in operation, delays in installation, failure to maintain proper standards or operation, failure to exercise reasonable supervision, delays in transmission, breach of warranty or failure of performance of the Services, Software and/or Equipment; or (y) resulting directly or indirectly out of, or otherwise arising in connection with, any allegation, claim, suit or other proceeding relating to Services, Software and/or Equipment, or the infringement of the copyright, patent, trademark, trade s ecret, confidentiality, privacy, or other intellectual property or contractual rights of any third party. Suddenlink’s Maximum Liability to Customer arising under this Agreement shall be the lesser of $5,000.00 or the amount actual ly paid by Customer for Services hereunder for the respective regular billing period. 28.Indemnification. To the extent permitted by law, Customer agrees to defend, indemnify, and hold harmless Suddenlink Parties from and against any and all claims and expenses, including reasonable attorneys’ fees, arising out of or related in any way to the use of the Service and Equipment by Customer or otherwise arising out of or related in any way t o the use of Customer’s account or any equipment or facilities in connection therewith, or the use of any other products or services provided by Suddenlink to Customer. Customer agrees to indemnify and hold harmless the Suddenlink Parties against claims, losses or suits for injury to or death of any person, or damage to any property which arises from the use, placement or presence or removal of Suddenlink's Equipment, facilities and associated wiring on Customer's premises and further, Customer indemnifies and holds harmless the Suddenlink Parties against claims for libel, slander, or the infringement of copyright arising directly or indirectly from the material transmitted over the facilities of Suddenlink or the use thereof by Customer; against claims for infringement of patents arising from combining with or using in connection with, facilities furnished by Suddenlink, and apparatus, Equipment, and systems provided by Customer; and against all other claims arising out of any act or omission of Customer in connection with the Services or facilities provided by Suddenlink. 29.Regulatory Authority. This Agreement and the obligations of the parties shall be subject to modification to comply with all applicable laws, regulations, court rulings, and administrative orders, as amended. 30.BINDING ARBITRATION. Please read this section carefully. It affects your rights. Any and all disputes arising between You and Suddenlink, including its respective parents, subsidiaries, affiliates, officers, directors, employees, agents, predecessors, and successors, shall be resolved by binding arbitration on an individual basis in accordanc e with this arbitration provision. This agreement to arbitrate is intended to be broadly interpreted. It includes, but is not limited to: claims arising out of or relating to any aspect of the relationship between us, whether based in contract, tort, statute, fraud, misrepresentation or any other legal theory; claims that arose before this or any prior Agreement, claims that may arise after the termination of this Agreement. Notwithstanding the foregoing, either You or Suddenlink may bring claims in small claims court in Your jurisdiction, if that court has jurisdiction over the parties and the action and the claim complies with the prohibitions on class, representative, and private attorney general proceedings and non-individualized relief discussed below. You may also bring issues to the attention of federal, state, and local executive or administrative agencies. Resolving Your dispute with Suddenlin k through arbitration means You will have a fair hearing before a neutral arbitrator instead of in a court before a judge or jury. YOU AGREE THAT BY ENTERING INTO THIS AGREEMENT, YOU AND SUDDENLINK EACH WAIVE THE RIGHT TO A TRIAL BY JURY AND THE RIGHT TO PARTICIPATE IN A CLASS, REPRESENTATIVE, OR PRIVATE ATTORNEY GENERAL ACTION. a.Opting Out of Arbitration. IF YOU HAVE BEEN AN EXISTING CUSTOMER FOR AT LEAST 30 DAYS BEFORE THE EFFECTIVE DATE OF THIS AGREEMENT AND HAVE PREVIOUSLY ENTERED INTO AN ARBITRATION AGREEMENT WITH SUDDENLINK OR A PREDECESSOR COMPANY, THIS OPT-OUT PROVISION DOES NOT APPLY TO YOU. IF YOU BECAME A CUSTOMER ON OR WITHIN 30 DAYS OF THE EFFECTIVE DATE OF THIS AGREEMENT, AND DO NOT WISH TO BE BOUND BY THIS ARBITRATION PROVISION, YOU MUST NOTIFY SUDDENLINK IN WRITING WITHIN 30 DAYS OF THE EFFECTIVE DATE OF THIS AGREEMENT BY EMAILING US AT NOARBITRATION@ALTICEUSA.COM OR BY MAIL TO ALTICE SHARED SERVICES, 200 JERICHO QUADRANGLE, JERICHO, NY 11753 ATTN. ARBITRATION. YOUR WRITTEN NOTIFICATION TO SUDDENLINK MUST INCLUDE YOUR NAME, ADDRESS, AND SUDDENLINK ACCOUNT NUMBER AS WELL AS A CLEAR STATEMENT THAT YOU DO NOT WISH TO RESOL VE DISPUTES WITH SUDDENLINK THROUGH ARBITRATION. YOUR DECISION TO OPT OUT OF THIS ARBITRATION PROVISION WILL HAVE NO ADVERSE EFFECT ON YOUR RELATIONSHIP WITH SUDDENLINK OR THE DELIVERY OF SUD DENLINK SERVICES TO YOU. OPTING OUT OF THIS ARBITRATION PROVISION HAS NO EFFECT ON ANY OTHER OR FUTURE ARBITRATION AGREEMENTS THAT YOU MAY HAVE WITH SUDDENLINK. b.Pre-Arbitration Process. (i) Notice Of Dispute. Before commencing an action in arbitration, You must first notify us of Your dispute and allow us an opportunity to resolve it without the need for arbitration. You must write us a letter briefly explaining the dispute and stating the relief that You demand. Provide as much information as possi ble, including where applicable dates and specific amounts of money. Also include the account holder's name, the account number, the service address, and a telephone number at which You may be reached during bus iness hours. For Your convenience, You may download a Notice of Dispute form from our website at https://www.suddenlink.com/sites/default/files/Notice-Of-Dispute.pdf. Once you have written the letter or filled out the Notice, send it to us by certified mail at Altice Shared Serv ices, 200 Jericho Quadrangle, Jericho, NY 11753, Attn: Customer Disputes. (ii) 30 Day Wait Period. If Suddenlink has not been able to resolve your dispute to your satisfaction within 30 days from when we received your Notice of Dispute, you may start arbitration proceedings. c.Commencing an Arbitration. To commence an arbitration, you must submit a written Demand for Arbitration to the American Arbitration Association (“AAA”), Case Filing Services, 1101 Laurel Oak Road, Suite 100, Voorhees, NJ 08043, with a copy to Suddenlink. A Demand for Arbitration form can be found on the AAA website at https ://www.adr.org/CommercialForms. d.Arbitration Process. The arbitration will be administered by the AAA under the AAA’s Commercial Arbitration Rules, as modified by this arbitrati on provision. You may obtain copies of those rules from the AAA at www.adr.org. If the AAA will not enforce this arbitration provision as written, it cannot serve as the arbitration organization to res olve Your dispute. If this situation arises, or if the AAA for any reason cannot serve as the arbitration organization, the parties shall agree on a substitute arbitration organization or ad hoc arbitration, which will enforce this arbitration provision as to the dispute. If the parties are unable to agree, the parties shall mutually petition a court of appropriate jurisdiction to appoint an arbitration organization or ad hoc arbitrator that will administer arbitration under this arbitration provision as written. If there is a conflict between this arbitration provision and the AAA rules, this arbitration provision shall govern. A sing le arbitrator will resolve the dispute between You and Suddenlink. Participation in arbitration may result in limited discovery. The arbitrator will honor claims of privilege recognized by law and will take reasonable steps to protect confidential or proprietary information, including customer personally identifiable information. All issues are for the arbitrator to decide, except that issues relating to arbitrability, the scope or enforcea bility of this arbitration provision, or the interpretation of its prohibitions of class, representative, and private attorney general proceedings and non-individualized relief shall be for a court of competent jurisdiction to decide. The Arbitrator is limited and bound by terms of this arbitration provision. Although the arbitrator shall be bound by rulings in prior arbitrations involving the same customer to the extent required by applicable law, the arbitrator shall not be bound by rulings in other arbitrations involving different customers. The arbitrator will make any award in writing but need not provide a statement of reasons unless requested by a party. An award rendered by the arbitrator may be entered in any court having jurisdiction over the parties for purposes of enforcement. Unless the parties agree otherwise, any arbitration hearing will take place in the county (or parish) of Your service address. If the amount in dispute is less than $50,000, Suddenlink agrees that You may choose whether the arbitration is conducted solely on the basis of documents submitted to the arbitrator, by a telephonic hearing, or by an in-person hearing as established by AAA rules. If the amount in dispute exceeds $75,000 or the claim seeks any form of injunctive relief, either party may appeal the award to a three-arbitrator panel administered by AAA by a written notice of appeal within thirty (30) days from the date of entry of the written arbitration award. An award of injunct ive relief shall be stayed during any such appeal. The members of the three-arbitrator panel will be selected according to AAA rules. The three-arbitrator panel will issue its decision within one hundred and twenty (120) days of the date of the appealing party's notice of appeal. The decision of the three-arbitrator panel shall be final and binding, subject to any right of judicial review that exists under the FAA. e.Arbitration Fees. Except as otherwise provided in this arbitration provision, Suddenlink will pay all arbitration filing, administrative, and arbitrator fees for any arbitration that Suddenlink commences or that You commence seeking damages of $10,000 or less. If You commence an arbitration seeking greater than $10,000 in damages, arbitrat ion filing, administrative, and arbitrator fees shall be allocated in accordance with the AAA rules. If You cannot pay Your share of these fees, You may request a fee waiver from the AAA. In addition, Suddenlink will consider reimbursing Your share of these fees if You indicate You cannot afford them and, if appropriate, will pay directly all such fees upon Your written request prior to the commencement of the arbitration. You are responsible for all additional costs and expenses that You incur in the Page 160 of 167 City of Georgetown_ Suddenlink_CSA Rev 09.16.20_ggk Confidential & Proprietary Page 5 of 6 arbitration, including, but not limited to, attorneys’ or expert witness fees and expenses, unless the arbitrator determines that applicable law requires Suddenlink to pay those costs and expenses. Notwithstanding the foregoing, if the arbitrator concludes that Your claim is frivolous or has been brought for an improper purpose (as measu red by the standards of Federal Rule of Civil Procedure 11(b)), then the AAA rules shall govern the allocation of arbitration fees, and You agree to reimburse Suddenlink for any amounts Suddenlink may have paid on Your behalf. f.Governing Law. Because the Service(s) provided to You involves interstate commerce, the Federal Arbitration Act (“FAA“), not state arbitration law, shall govern the arbitrability of all disputes under this arbitration provision. Any state statutes pertaining to arbitration shall not be applicable. g. Waiver of Class and Representative Actions. YOU AGREE TO ARBITRATE YOUR DISPUTE AND TO DO SO ON AN INDIVIDUAL BASIS; CLASS, REPRESENTATIVE, AND PRIVATE ATTORNEY GENERAL ARBITRATIONS AND ACTIONS ARE NOT PERMITTED. You and Suddenlink agree that each party may bring claims against the other only in Your or its individual capacity and may not participate as a class member or serve as a named plaintiff in any purported class, representative, or private attorney general proceeding. This arbitration provision does not permit and explicitly prohibits the arbitration of consolidated, class, or representative disputes of any form. In addition, although the arbitrator may award any relief that a court could award that is individualiz ed to the claimant and would not affect other Suddenlink account holders, neither You nor Suddenlink may seek, nor may the arbitrator award, non-individualized relief that would affect other account holders. Further, the arbitrator may not consolidate or join more than one person's claims unless all parties affirmatively agree in writing. If any of the prohibitions in the preceding paragraph is held to be unenforceable as to a particular claim, then that claim (and only that claim) must be severed from the arbitration and brought in court. In that instance, or any instance when a claim between You and Suddenlink proceeds to court rather than through arbitration, You and Suddenlink each waive the right to any trial by jury through this Agreement. h.Severability and Survival. If any other portion of this arbitration provision is determined to be unenforceable, then the remainder of this arbitration provision shall be given full for ce and effect. The terms of the arbitration provision shall survive termination, amendment or expiration of this Agreement. 31.Governing Law. Subject to Section 26.f above, this Agreement shall be governed by the laws of the state of TEXAS. 32.Severability. If any term or condition of this Agreement shall be adjudicated or determined as invalid or unenforceable by a court, tribunal or arbitrator with appropriate jurisdiction over the subject matter, the remainder of the Agreement with respect to such claim shall not be affected and shall remain valid and enforceable to the fullest extent permitted by law. 33.No Relationship. Nothing in this Agreement will create any joint venture, joint employer, franchisee-franchisor, employer-employee or principal-agent relationship between Suddenlink and any content, backbone, network, circuit and other technology or communications providers, software and other licensors, hardware and equipment suppliers or other third party providers of elements of the High Speed Internet Service, nor impose upon any such companies any obligations for any losses, debts or other obligations incurred by the other. 34.Survival. All representations, warranties, indemnifications, dispute resolution provisions and limitations of liability contained in this Agreement shall survive the termination of this Agreement, as well as any other obligations of the parties hereunder which, by their terms, would be expected to survive such termination or which relate to the period prior to termination (including legal conditions, payment, and Suddenlink rights and the rights of others). 35.Force Majeure. Suddenlink Parties shall not be liable for any delay or failure of performance or Equipment due to causes beyond its control, including but not limited to: acts of God, fire, flood, explosion or other catastrophes; any law, order, regulation, direction, action or request of the United States government or of any other government including state and local governments having or claiming jurisdiction over Suddenlink, or of any department, agency, commission, bureau, corporation or other instrumentality of any one or more of these federal, state, or local governments or of any military authority; preemption of existing service in compliance with national emergencies, acts of terrorism, insurrections, riots, wars, unavailability of rights-of-way, material shortages, strikes, lockouts, or work stoppages. 36.Entire Agreement. This Agreement, including the applicable Additional Terms of Service, Privacy Policy and Acceptable Use Policy (“AUP”), the Service Order and the Schedule of Fees constitute the entire agreement between Suddenlink and Customer with respect to the Services. No undertaking, representation or warranty made by an agent or representative of Suddenlink in connection with the sale, installation, maintenance or removal of Suddenlink's Services or Equipment shall be binding on Suddenlink except as expressly included herein. 37.Amendment; Notice. Suddenlink may, in its sole discretion, change, modify, add or remove portions of this Agreement at any time. Suddenlink may notify Customer of any such changes to this Agreement, or any other required or desired notice hereunder, by posting notice of such changes on Suddenlink’s website (www.suddenlink.com), or by sending notice via email or postal mail to Customer’s billing address, and/or by contacting the telephone number(s) on Customer's account (including mobile phones) by means such as but not limited to browser bulletins, walled garden (browser interruption), voice, SMS, MMS, and text messages, including by the use of by automatic telephone dialing systems. Customer agrees that any one of the foregoing will constitute sufficient notice. Because Suddenlink may from time to time notify Customer about important information regarding the Services, the Privacy Policy and this Agreement by such methods, Customer agrees to regularly check postal mail, e-mail and all postings on the Suddenlink web site (www.suddenlink.com) and Customer bears the risk of failing to do so. The Customer's continued use of the applicable Service(s) following notice of such change, modification or amendment shall be deemed to be the Customer's acceptance of any such revision. If Customer does not agree to any revision of this Agreement, Customer must immediately cease use of the all Service(s) and notify Suddenlink that Customer is cancelling this Agreement in accordance with the then-current policy. Customer shall not be responsible for any termination fees if the Agreement is cancelled due to Suddenlink’s modification of this Agreement or its Services Page 161 of 167 City of Georgetown_ Suddenlink_CSA Rev 09.16.20_ggk Confidential & Proprietary Page 6 of 6 Service Level Agreement - Fiber Services Only (non-coax) This Service Level Agreement (“SLA”) covers the local transport area to the Suddenlink demarcation point including Suddenlink equipment associated with the endpoints such as POE devices and routers. The provisions described below shall be Customer’s sole and exclusive remedy in the event of Interruption. MEAN TIME TO REPAIR Suddenlink’s objective is a four (4) hour mean-time-to-repair (“MTTR”) SERVICE LEVEL GUARANTEE Interruption/Outage (“Interruption”): Defined as a total loss of Service. Service Level Guarantee: If Customer detects an Interruption, Customer shall open a trouble ticket with Suddenlink Network Operation Center by calling 866-232-5455 (option 4) or via the customer portal at Suddenlink.com. An Interruption period begins when Customer reports a circuit/service failure, opens a valid trouble ticket and releases it for testing and repair. The controlling record for the purpose of deter mining the duration of the Interruption and calculating credits shall be the date/time stamp on the trouble reporting ticket as generated by Altice Business’s trouble reporting system. An Interruption period ends when the circuit/service is operative. a. If Customer reports a circuit/service to be inoperative but declines to release it for testing and repair, it is considered to be impaired, but not Interrupted. b. If an Altice Business technician is dispatched for a reported failure and it is determined that such failure is not within Altice Business’s control, Customer will be subject to a truck roll fee for any subsequent dispatch/truck roll(s) requested. c. Customer may request a credit, in writing, and reference the date of the ticket. Requests for credit must be submitted to customercare@suddenlink.com within thirty (30) calendar days of the Interruption. d. For calculating credit allowances, every month is considered to have thirty (30) days. e. A credit allowance is applied on a pro rata basis against the monthly recurring charge for the affected circuit/service and is dependent upon the length of the Interruption. Altice Business shall credit Customer’s monthly recurring charges for the circuit/service experiencing the Interruption as follows: Outage Duration Credit of Monthly Charges Less than 30 minutes none 30 minutes up to but not including 3 hrs 1/10 of a day 3 hrs up to but not including 6 hrs 1/5 of a day 6 hrs up to but not including 9 hrs 2/5 of a day 9 hrs up to but not including 12 hrs 3/5 of a day 12 hrs up to but not including 15 hrs 4/5 of a day 15 hrs up to and including 24 hrs 1 day Over 24 hours 2 days for each full 24-hour period Limitations: Total credits in a given month shall not exceed one hundred percent (100%) of the monthly recurring charge for the affected circuit/service in that month. Chronic Interruption: Defined as three (3) separate Interruptions of two (2) hours or more on the same facility, within a consecutive thirty (30) day period and/or an Interruption that lasts longer than forty-eight (48) hours. In the event Customer experiences Chronic Interruptions in Service, Altice Business will perform a detailed investigation, report the findings to Customer and, if necessary, institute a corr ective plan. If Customer experiences any additional Interruptions on the circuit and a plan for corrective action has been implemented for thirty (30) days, Customer may terminate the affected circuit/service without any further liability upon thirty (30) days prior written notice. No credit allowance will be made for: a. Interruptions caused by the negligence of Customer or third parties outside of Altice Business’s control. b. Interruptions due to the failure of power, equipment, systems or connections not provided by Altice Business under this Agreement. c. Interruptions during any period when Customer has released the circuit for maintenance or rearrangement purposes or for the implementation of a Customer order. d. Interruptions which continue because of Customer’s failure to authorize replacement of any element of the Service. e. Interruptions due to force majeure events. f. No trouble found or where the fault of the trouble is undetermined. Page 162 of 167 City of Georgetown, Texas Government and Finance Advisory Board October 28, 2020 S UB J E C T: C onsideration and pos s ible ac tion to rec ommend to C ouncil the purchas e of vehicles and equipment in the amount of $2,317,620 - S tan Hohman, F leet S ervic es Manager IT E M S UMMARY: T hes e vehic les will be purc hased through cooperative purc hasing agreements. T hey have been inc luded in the 2020/21 Annual Budget as being either replacement of exis ting vehicles within the F leet or as new additions . T here are two vehic les being replaced due to hail damage and one wrec ked vehicle that was not budgeted. T he vehicles and equipment to be purchas ed in this item inc lude: 3 S mall Hybrid S UV’s 1 S mall Hybrid S edan 2 S mall Mini-Vans 7 P ic kups 5 Utility Bed Trucks 3 Utility Mini-Van’s 1 F ifteen P as s enger Van 1 F latbed Utility Truc k 1 Dump Bed Utility Truc k 1 Dump Truc k 1 C hipper Bed Truc k 1 Electric Bucket Truc k 1 Unmarked P olic e P ic kup 2 Unmarked P olice Utility Vehic les 2 Unmarked P olice Utility Traffic Units 3 Marked P olice Utility Traffic Units 9 Marked P olice Utility Vehic les In the F leet Internal S ervic e F und, departments are charged annual fleet leas e fees that are figured by dividing the total purc hase cost of the unit by its estimated useful life. T hese fees are trans ferred into the fund to pay for replac ements . R eplacement criteria is bas ed on the unit reaching 100,000 miles or 10 years of service. C ons iderations given on replacements are the type of s ervic e of the unit, how many miles are driven annually, and the reliability of the unit since it has been in s ervic e. O ut of the 44 units reques ting purc hase approval, 36 of thes e are replacements and 8 are new additions approved by C ounc il in the adoption of the F Y2021 budget. F IN AN C IAL IMPAC T: T hes e vehic les were budgeted for in the 2020/21 F leet Budget. Two vehicles that were hail damaged and the wrecked vehic le that was not budgeted are being paid for with insuranc e proc eeds . F und Impacts : F leet R eplacement I S F $819,627.87 P ublic S afety $974,652.49 Electric $303,235.50 Ins urance/hail $127,002.01 S treets $93,102.00 S UB MIT T E D B Y: S haron A P arker AT TAC H ME N T S: Description Type Cover s heet for Vehicle Purchas e Cover Memo Vehicles and Equipment FY2021 Summary Backup Material Page 163 of 167 General Government & Finance Advisory Board (GGAF) Meeting Date: October 28, 2020 Item No. AGENDA ITEM COVER SHEET SUBJECT Consideration and possible action to recommend to Council the purchase of vehicles and equipment in the amount of $2,317,620. ITEM SUMMARY These vehicles will be purchased through cooperative purchasing agreements. They have been included in the 2020/21 Annual Budget as being either replacement of existing vehicles within the Fleet or as new additions. There are two vehicles being replaced due to hail damage and one wrecked vehicle that was not budgeted. The vehicles and equipment to be purchased in this item include: 3 Small Hybrid SUV’s 1 Small Hybrid Sedan 2 Small Mini-Vans 7 Pickups 5 Utility Bed Trucks 3 Utility Mini-Van’s 1 Fifteen Passenger Van 1 Flatbed Utility Truck 1 Dump Bed Utility Truck 1 Dump Truck 1 Chipper Bed Truck 1 Electric Bucket Truck 1 Unmarked Police Pickup 2 Unmarked Police Utility Vehicles 2 Unmarked Police Utility Traffic Units 3 Marked Police Utility Traffic Units 9 Marked Police Utility Vehicles In the Fleet Internal Service Fund, departments are charged annual fleet lease fees that are figured by dividing the total purchase cost of the unit by its estimated useful life. These fees are transferred into the fund to pay for replacements. Replacement criteria is based on the unit reaching 100,000 miles or 10 years of service. Considerations given on replacements are the type of service of the unit, how many miles are driven annually, and the reliability of the unit since it has been in service. Out of the 44 units requesting purchase approval, 36 of these are replacements and 8 are new additions approved by Council in the adoption of the FY2021 budget. FINANCIAL IMPACT These vehicles were budgeted for in the 2020/21 Fleet Budget. Two vehicles that were hail damaged and the wrecked vehicle that was not budgeted are being paid for with insurance proceeds. Fund Impacts: Fleet Replacement ISF $819,627.87 Public Safety $974,652.49 Electric $303,235.50 Insurance/hail $127,002.01 Streets $93,102.00 . Page 164 of 167 ATTACHMENTS Vehicles and Equipment FY2021 Summary Submitted By: Stan Hohman, Fleet Services Manager Page 165 of 167 10/21/2020 2021 Vehicle/Equipment Purchase Vendor Description Unit Replacing Department Purchasing Contract Budgeted Price Fund Disposition Silsbee Ford 204-02 Airport GoodBuy $35,000.00 $25,993.96 Fleet ISF Auction $1,500 Fee $300.00 Silsbee Ford 135-09 Engineering GoodBuy $33,500.00 $27,423.96 Fleet ISF Auction $1,500 Cowboy Dodge Additional Communications GoodBuy $33,500.00 $23,912.00 Fleet ISF Additional Fee $300.00 Cowboy Dodge 340-03 Planning GoodBuy $30,000.00 $23,912.00 Fleet ISF Pool Silsbee Ford 115-15 SCADA GoodBuy $30,000.00 $26,835.50 Electric Auction $2,000 Silsbee Ford 108-26 Water Plants GoodBuy $30,000.00 $26,835.50 Fleet ISF Auction $1,500 Silsbee Ford Additional Engneering GoodBuy $35,000.00 $29,330.50 Fleet ISF Additional Silsbee Ford 135-04 Engineering GoodBuy $35,000.00 $32,111.50 Fleet ISF Auction $2,000 Silsbee Ford Additional Stormwater GoodBuy $35,000.00 $32,111.50 Fleet ISF Additional Silsbee Ford 134-01 Streets GoodBuy $60,000.00 $49,408.80 Fleet ISF Auction $2,500 Silsbee Ford 266-03 Animal Control GoodBuy $35,000.00 $27,187.75 Fleet ISF Auction $2,000 Silsbee Ford 439-08 Fleet Services GoodBuy $35,000.00 $27,187.75 Fleet ISF Pool Silsbee Ford 435-04 Facilities GoodBuy $45,000.00 $40,807.60 Fleet ISF Auction $2,500 Silsbee Ford 115-18 Metering Services GoodBuy $30,000.00 $24,142.00 Electric Auction $2,500 Silsbee Ford 115-49 Metering Services GoodBuy $30,000.00 $24,142.00 Electric Auction $2,500 Silsbee Ford 115-50 Metering Services GoodBuy $30,000.00 $24,142.00 Electric Auction $1,500 Silsbee Ford Additional Fleet Services GoodBuy $38,000.00 $34,184.75 Fleet ISF Additional Silsbee Toyota 602-08 Mail Services GoodBuy $33,500.00 $28,451.00 Fleet ISF Auction/Pool Fee $300.00 Silsbee Ford 108-22 Water GoodBuy $65,000.00 $39,972.75 Fleet ISF Pool Silsbee Ford 108-34 Water GoodBuy $65,000.00 $65,325.15 Fleet ISF Auction $2,500 Silsbee Ford 108-35 Water GoodBuy $65,000.00 $65,325.15 Fleet ISF Auction $2,500 Silsbee Ford 110-33 Water GoodBuy $145,000.00 $111,126.25 Fleet ISF Auction $2,500 Freightliner of Austin 134-43 Streets TIPS $100,000.00 $93,102.00 Streets Auction $3,500 Altec 106-48 Electric Sourcewell $240,000.00 $203,974.00 Electric Totaled Freightliner of Austin 114-21 Stormwater TIPS $125,000.00 $108,120.00 Fleet ISF Auction $2,500 Half ton, extended cab, short bed pick up w/tool box Ford Escape Hybrid AWD Ford Escape Hybrid Dodge Grand Caravan Dodge Grand Caravan Half ton, extended cab, short bed pick up w/tool box Toyota RAV4 Hybrid Half ton, extended cab, 4WD, short bed pick up w/tool box Half ton, 4 door, short bed, 4WD Half ton, 4 door, short bed, 4WD One ton, diesel, 4 door, flatbed truck Three quarter ton, regular cab, long bed pickup Three quarter ton, regular cab, long bed pickup Three quarter ton, regular cab, utility truck with overhead rack Ford Transit Connect minivan Ford Transit Connect minivan Ford Transit Connect minivan Ford Transit 15 passeger van One ton, diesel, regular cab, truck w/dump bed One ton, 4WD, regular cab, utility bed with crane One ton, 4WD, regular cab, utility bed with crane Ford F-550, diesel, regular cab, utility truck body with 7500 lb. capacity Crane Freightliner M2-106 Single axle, 6 yard dump truck Electric Bucket Truck Altec AM-55E Freightliner M2-106 Single axle, with 16 foot chipper body Page 166 of 167 Vendor Description Unit Replacing Department Purchasing Contract Budgeted Price Fund Disposition Totaled Silsbee Ford One ton, ext. cab, electric utility bed 4WD 106-65 Electric GoodBuy $0.00 $56,682.60 Insurance Totaled Hail damaged Silsbee Toyota 925-07 IT GoodBuy $0.00 $28,073.00 Insurance Hail Damaged/Totaled Hail damaged Silsbee Ford 864-143 Police GoodBuy $0.00 $42,246.41 Insurance Hail Damaged/Totaled Silsbee Ford 864-125 Police GoodBuy $50,000.00 $42,246.41 Public Safety Auction/Pool Lake Country Chevrolet 864-130 Police GoodBuy $50,000.00 $39,320.48 Public Safety Auction/Pool Fee $300.00 Silsbee Ford 864-48 Police GoodBuy $70,000.00 $53,098.42 Public Safety Auction/Pool Silsbee Ford 864-87 Police GoodBuy $70,000.00 $55,636.88 Public Safety Auction/Pool Silsbee Ford 864-84 Police GoodBuy $70,000.00 $63,780.27 Public Safety Auction/Pool 864-85 $70,000.00 $63,780.27 Public Safety Auction/Pool 864-86 $70,000.00 $63,780.27 Public Safety Auction/Pool Silsbee Ford 864-12 Police GoodBuy $70,000.00 $65,856.61 Public Safety Auction/Pool 864-24 $70,000.00 $65,856.61 Public Safety Auction/Pool 864-32 $70,000.00 $65,856.61 Public Safety Auction/Pool 864-37 $70,000.00 $65,856.61 Public Safety Auction/Pool 864-43 $70,000.00 $65,856.61 Public Safety Auction/Pool 864-49 $70,000.00 $65,856.61 Public Safety Auction/Pool 864-64 $70,000.00 $65,856.61 Public Safety Auction/Pool Additional $70,000.00 $65,856.61 Public Safety Additional Additional $70,000.00 $65,856.61 Public Safety Additional Budgeted Cost Difference Fleet ISF $978,500.00 $819,627.87 $158,872.13 Public Safety $1,080,000.00 $974,652.49 $105,347.51 Electric $360,000.00 $303,235.50 $56,764.50 Insurance $0.00 $127,002.01 -$127,002.01 Streets $100,000.00 $93,102.00 $6,898.00 Totals $2,518,500.00 $2,317,619.87 $200,880.13 Police Interceptor utility undercover vehicles Toyota Camry Hybrid Police Interceptor utility undercover vehicles ON THIS SHEET Half ton, 4 door, short bed pickup Police Interceptor Utility undercover vehicle (Silver) Police Interceptor Utility Silver Traffic Special Unit Police Interceptor Utility Silver Traffic Units (3 Each) Police Interceptor Utility marked vehicles (9 Each) Page 167 of 167