Loading...
HomeMy WebLinkAboutAgenda CC 11.24.2020 WorkshopN otice of M eeting of the Governing B ody of the C ity of Georgetown, Texas N ovember 24 , 20 20 The Georgetown City Council will meet on November 24, 2020 at 3:00 P M at Teleconference The City of Georgetown is committed to compliance with the Americans with Disabilities Act (AD A). If you require assistance in participating at a public meeting due to a disability, as defined under the AD A, reasonable assistance, adaptations, or accommodations will be provided upon request. P lease contact the City Secretary's Office, at least three (3) days prior to the scheduled meeting date, at (512) 930-3652 or City Hall at 808 Martin Luther King J r. Street, Georgetown, TX 78626 for additional information; TTY users route through Relay Texas at 711. J oin fr om a P C, M ac , i P ad, i P hone or A ndroid devic e ple ase clic k this U R L : https://ge orge towntx.zoom.us/j/98984149740? pwd=M 3 R ZS E 5 Y V3 UwO U d3 M 3pvN D N0 O F d0 Q T09 Webinar I D: 989 8414 9740 P assc ode : 915990 De sc ription: Re gularly S cheduled Wor kshop and R egular M ee ting of the Geor getown City C ouncil - Novembe r 24, 2020 Workshop starts at 3:00 p.m. but attende es can join the we binar star ting at 2:30 p.m. O r to join by phone dial: (346)248-7799 O R (253)215-8782 O R (669)900-6833 O R (301)715-8592 O R (312)626-6799 O R (929)205-6099 TO L L F R E E (833)548-0276 O R (833)548-0282 O R (877)853-5257 O R (888)475-4499 Webinar I D: 989 8414 9740 P assc ode : 915990 Citizen comme nts are acc epted in thr ee differ ent for mats: Submit the following form by 12:00 p.m. on the date of the mee ting and the City S ec re tary will r ead your comme nts into the re cor ding dur ing the ite m that is be ing disc usse d – Page 1 of 173 https://re cor ds.geor getown.or g/F or ms/Addr essCounc il You may log onto the me eting, at the link above , and “raise your hand” dur ing the ite m. If you ar e unsur e if your devic e has a mic rophone ple ase use your home or mobile phone to dial the toll fr ee number. To J oin a Zoom M ee ting, clic k on the link and join as an attende e. You will be asked to e nte r your name and email addre ss – this is so we can identify you whe n you are calle d upon. At the bottom of the we bpage of the Zoom M e eting, ther e is an option to Raise your H and. To speak on an ite m, simply clic k on that R aise Your H and option onc e the item you wish to spe ak on has opened. Whe n you are calle d upon by the M ayor, your de vice will be r emotely un-muted by the A dministrator and you may speak for thr ee minute s. P lease state your name clear ly upon be ing allowe d to spe ak. When your time is over, your de vice will be muted again. As another option, we ar e opening a city confe re nc e r oom to allow public to “watch” the virtual mee ting on a bigge r scr ee n, and to “r aise your hand” to speak fr om that public de vice . This Vie wing Room is loc ated at City H all, 808 M artin L uther K ing J r. S tre et, Community R oom. Soc ial Distancing will be strictly enfor ce d. F ac e masks ar e r equire d and will be provided onsite . U se of profanity, thre atening language , slander ous r emarks or thr eats of harm are not allowed and will re sult in you be ing immediate ly r emove d from the me eting. If you have questions or ne ed assistanc e, ple ase contact the City Se cr etar y’s offic e at c s@ge orge town.org or at 512-930-3651. Policy De ve lopme nt/Re vie w Workshop - A P resentation and update regarding mitigation efforts related to the 2018 Risk Assessment -- Mayra Cantu, Management Analyst B Overview and discussion regarding the purpose of P ublic Improvement Districts (P ID) and the City’s P ID P olicy -- Wayne Reed, Assistant City Manager C P resentation and discussion regarding the creation of a P ublic Improvement District (P ID) called P arks at Westhaven -- Wayne Reed, Assistant City Manager D Review and discussion regarding 2021 boards and commission appointments -- Robyn Densmore, City Secretary; and David Morgan, City Manager Exe cutive Se ssion In compliance with the Open Meetings Act, Chapter 551, Government Code, Vernon's Texas Codes, Annotated, the items listed below will be discussed in closed session and are subject to action in the regular session. E Sec. 551.071: Consul tati on w i th Attorney Page 2 of 173 Advice from attorney about pending or contemplated litigation and other matters on which the attorney has a duty to advise the City Council, including agenda items - Litigation Update Sec. 551.072: Del i berati ons about Real P roperty - S H-29 Right of Way, Hillwood -- Travis Baird, Real Estate Services Manager Sec. 551.086: Certai n P ubl i c P ow er Uti l i ti es: Competi ti ve M atters - Competitive Matters -- Daniel Bethapudi, General Manager of the Electric Utility Sec. 551.074: P ersonnel Matters -City Attorney Check-in Adjournme nt Ce rtificate of Posting I, R obyn Densmore, C ity S ecretary for the C ity of G eorgetown, Texas, do hereby c ertify that this Notice of Meeting was pos ted at C ity Hall, 808 Martin Luther King Jr. S treet, G eorgetown, T X 78626, a plac e readily ac cessible to the general public as required by law, on the _____ day of _________________, 2020, at __________, and remained so pos ted for at leas t 72 c ontinuous hours prec eding the s cheduled time of said meeting. __________________________________ R obyn Dens more, C ity S ec retary Page 3 of 173 City of Georgetown, Texas City Council Workshop N ovember 24, 2020 S UBJEC T: P resentation and update regarding mitigation efforts related to the 2018 Risk Assessment -- Mayra Cantu, Management Analyst I T EM S UMMARY: In 2018 the City had a citywide risk assessment c onducte d by P lante Moran. The study identified risks across the City and made recommendations to help address and mitigate tho se risks. This update details the mitigation efforts that have been made and the current state of those risks. The Risk M itigation Repo rt provides a detailed update to the 2 01 8 risk assessment. A full review of each risk can be found in the appendix where the risk register outlines the completed actions and current mitigation status. F I NANC I AL I MPAC T: N A S UBMI T T ED BY: Mayra Cantu, Management Analyst AT TAC HMENT S : Description R isk Mitigation R eport R isk Mitigation P resentation Weaver Assessment 2018 R is k Assessment Page 4 of 173 Risk Mitigation Report UPDATE TO 2018 CITYWIDE RISK ASSESSMENT CITY OF GEORGETOWN 2020 Page 5 of 173 RISK MITIGATION REPORT 1 | Page CITY OF GEORGETOWN Table of Contents Purpose and Introduction ........................................................................................................................ 2 Risk Assessment and Mitigation Cycle .................................................................................................... 2 Risk Management Methods ................................................................................................................. 3 Notable Changes ...................................................................................................................................... 4 Departments ............................................................................................................................................. 4 2018 Citywide Risk Assessment ............................................................................................................... 5 Mitigation and Next Steps ....................................................................................................................... 8 City Manager’s Office ................................................................................................................................ 8 Facilities .................................................................................................................................................... 8 Emergency Management .......................................................................................................................... 9 Public Safety .............................................................................................................................................. 9 Finance and Human Resources ............................................................................................................... 11 City Secretary .......................................................................................................................................... 13 Information Technology .......................................................................................................................... 13 Overall Utility System .............................................................................................................................. 14 Electric ..................................................................................................................................................... 15 Water and Wastewater System .............................................................................................................. 17 Public Works ........................................................................................................................................... 19 Near Term Action ....................................................................................................................................... 20 APPENDIX .................................................................................................................................................... 21 Risk Mitigation Register .......................................................................................................................... 21 Page 6 of 173 RISK MITIGATION REPORT 2 | Page CITY OF GEORGETOWN Purpose and Introduction In 2018 a citywide risk assessment was conducted by Plante Moran, which outlined several risks across departments. Plante Moran also included risk treatment action plans for the risks they identified with recommendations on ways to mitigate in the future to reduce the risk likelihood or impact. This report outlines the mitigation and risk treatment statuses of the identified risks from 2018. Risk Assessment and Mitigation Cycle Steps 1-3 of the risk cycle were completed at different stages since 2018. After the risk assessment was conducted, the City has been in the 3rd part of the cycle with risk owners treating their risk with varying degrees of mitigation. The City now concurrently enters the last step of the cycle, step 4, as each risk is reviewed, and mitigation efforts are tracked to reassess whether the risk score has decreased. After this is completed the City will need to have another citywide ERP risk assessment conducted by 2023 to successfully identify new risks across the city from an enterprise and operational standpoint. Overall, most risks identified in 2018 have been mitigated or the risk has been accepted and steps are being taken to fully mitigate in the future as detailed later in this report. 1. Risk Identification 2. RIsk Assessment 3. Risk Mitigation, Planning, and Implementation 4. Risk and Mitigation Tracking Page 7 of 173 RISK MITIGATION REPORT 3 | Page CITY OF GEORGETOWN Risk Management Methods Risk does not always have to be mitigated. Several risk management methods exist that can be used instead to either eliminate a risk with risk avoidance, transferred to a third party with risk transfer, or even accepted because the risk is negligible that it would cost more to manage it then what it could possibly impact. Risk Mitigation Risk mitigation is a risk management technique by which an organization introduces specific measures to minimize or eliminate unacceptable risks associated with its operations. Risk mitigation measures can be directed towards reducing the severity of risk consequences, reducing the probability of the risk materializing, or reducing the organizations exposure to the risk. Risk Avoidance Risk avoidance is a technique of risk management where the goal is to eliminate a risk and not just reduce it. Rather than mitigating existing risk, it aims to eliminate the source of the risk altogether, sometimes replacing it with a smaller, more easily manageable risk. Risk Transfer Risk transfer is a risk management technique in which risk is transferred to a third party. In other words, risk transfer involves a party assuming the liabilities of another party. Purchasing insurance is a common example of transferring risk from an individual or entity to an insurance company. Risk Acceptance Risk acceptance is the assumption of a risk, typically because its risk-reward profile is attractive and within your risk tolerance. In general, it is impossible to make gains in business or life without taking risks. As such, risk acceptance is a common risk treatment. Mitigation Avoidance Transfer Acceptance Page 8 of 173 RISK MITIGATION REPORT 4 | Page CITY OF GEORGETOWN Notable Changes Significant events and operational changes since the 2018 citywide risk assessment update–include the following: • 3rd party electric energy portfolio manager • City department reorganization • Workday ERP • COVID-19; impact on FY2020 budget and beyond • Police and Fire agree and confer • Finance bond rating • In the spring of 2019, the Fire Department filed a “breach notification” report regarding an unencrypted EMS tablet that went missing from one of the ambulances. This breach had the potential to impact up to 719 patients. The 2018 Risk Assessment identified the most prevalent risks lived within the following departments. Departments • City Secretary’s Office • City Manager’s Office • Controller • Emergency Management • Finance • Fire • Human Resources • Information Technology • Facilities • Police • Purchasing • Records • Utility Page 9 of 173 RISK MITIGATION REPORT 5 | Page CITY OF GEORGETOWN 2018 Citywide Risk Assessment The risk assessment conducted in 2018 established the following risk universe for the City of Georgetown. City of Georgetown Risk Universe 1. Access to Talent 18. IT Security Awareness, Training, and Education 2. Billing for Citizen Services 19. IT Third Party Roles and Responsibilities 3. Budget and Planning 20. Leadership 4. Composition of Tax Base 21. Legislation 5. Disaster Recovery/Business Continuity 22. Physical Security 6. Emergency Notification System Failure 23. Police failure 7. Fire Department Failure 24. Records Management 8. Freedom of Information Act (FOIA) 25. Regulatory Filings 9. Fraud 26. Segregation of Duties 10. Grant Obligations 27. State-Fed Regulations 11. Health & Safety 28. Succession Planning 12. IT Access Management 29. Talent Management 13. IT Asset Management: Data Classification 30. Tax 14. IT contingency Plan 31. Utility market 15. IT Critical Security Event Identification 32. Utility Outage 16. IT Cybersecurity Governance Model 33. Vendor Reliance 17. IT Incident Response Management Each department has at least one of the above risks identified. Plante Moran worked with the departments to identify management responses to mitigate those risks at the time and outlined next steps to further mitigate the risks. The risks were given a risk impact score which was calculated utilizing ranked criteria: impact (financial, strategic, operational or compliance) and likelihood (probability or event occurrence) as noted below. Impact Criteria Ranking 5 (high) 4 3 2 1 (low) Financial Impact: Expense or Lost Revenue >$150K $100K-150K $50K-$100K $25K-$50K <$25K or Strategic Impact: Strategy/Mission/Legislature Failure to meet key strategic objective Major impact on strategic objective Moderate impact on strategy Minor impact on strategy No impact on strategy or Operational Impact: Reputation Extreme Severe Moderate Low None Process/System Shutdown >7 days 5-7 days 3-5 days 1-3 days <1 day Compliance Impact: Regulatory- State/Local/HIPAA/Debt Covenants Large-scale material Material breach but Material breach which can Minimal breach which Minimal breach which can Page 10 of 173 RISK MITIGATION REPORT 6 | Page CITY OF GEORGETOWN breach of regulation cannot be rectified be readily rectified cannot be rectified be readily rectified Likelihood Criteria Ranking 5 (high) 4 3 2 1 (low) Probability of an event occurring in a given year: >20% 15-20% 10-15% 5-10% <5% or Event Occurrence (on average): Once a year or more 1 in 3 years 1 in 5 years 1 in 7 years 1 in 10 years 2018 Residual Risks by KBD: Weighted Risks by Key Business Departments: the total number of risks weighted by rankings using the following weighting formula: Red 17 or > (3 points), Yellow 8-16 (2 points), and Green <8 to 5 (1 point), <4 (0 points). Therefore, the higher risk rankings carry a higher weighted risk. Since then these risks have been primarily mitigated, and a detail can be found in the appendix. Page 11 of 173 RISK MITIGATION REPORT 7 | Page CITY OF GEORGETOWN The 2018 risk assessment highlighted several high-level themes, particularly focused in Information Technology, Georgetown Utility Services, legislation, and policies and procedures. Since 2018, several strides have been made in each of these high-level themes. High-Level Themed Risks Risk Treatment Responses and Mitigation • The City is exposed to four high Information Technology (IT) residual risks. We recognize the City is currently in process of an ERP system upgrade and the status of these conditions will change in the near future: IT Cybersecurity, IT Asset Management: Data Classification, IT Access Management, and IT Contingency Plan. See Appendix B for IT Risk Report. •IT is working on a comprehensive policy covering IT Cybersecurity, IT Asset Management: Data Classification, IT Access Management, and IT Contingency Plan. • The City lacks a clear process for the assignment and review of user access roles and responsibilities to achieve segregation of duties in three key business departments. We noted during discussions with Finance, Customer Care and Parks and Recreation one person can control more than two phases of a transaction exposing the City to unauthorized transactions and fraud risk. • Workday has mitigated this risk, with various level of approvals needed for transactions. The requisitioner must have each requisition reviewed and approved by at least two people, with one being the manager. The risk of fraud has been mitigated significantly, if not almost entirely with the new ERP system and its integrated steps for accountability. • Management indicated several potential costly Texas legislative acts are due for review at future legislative sessions. • Staff has created an Intergovernmental Affairs Program which will prioritize the City’s legislative agenda considering public input; a committee is being created to enact this program. Focused Advocacy has also been hired as a consultant to aid in representing the City in legislative session. The City of Georgetown is also a participating TML city, allowing TML to provide guidance, direction, and advocacy on behalf of City’s best interests. • The City is challenged with documentation of operating policies and procedures. Currently, 15 out of 25 (60%) departments we interviewed have a lack of clearly written policies and procedures available to all employees • Since 2018 many of the lacking policies have now been written, with even more reviewed. Staff has identified a need to centralize a location for its policies and create a process or committee to review policies regularly to ensure they are up to date and follow legal mandates. Page 12 of 173 RISK MITIGATION REPORT 8 | Page CITY OF GEORGETOWN Mitigation and Next Steps The departments identified in the 2018 risk assessment have taken several mitigating steps which are fully detailed in the risk register found in the appendix. The section below provides a deeper dive into the more significant risks and the corresponding mitigation actions that have been completed or ongoing. City Manager’s Office Performance Management Review The City Manager’s Office routinely reviews departments performance metrics. On a biannual basis the metrics are reviewed and analyzed for performance and to assess whether the metrics are measuring what needs to be measured. These metrics are utilized in a variety of ways by departments and city management such as providing data to substantiate budget requests or to identify how well things are going in each area or to identify areas of concern that are not performing as well. Business Plans The City had all departments and service areas create and complete business plans. These business plans help strategically align the departments missions and goals to objectives that will be completed over the next few years. The business plans had the departments identify their key performance indicators that tie their strategic goals with City Council Goals. Council goals were also used to tie in and from an action plan created to enhance the department’s ability to meet organizational, customer, and workforce requirements. The business plans are utilized by staff as they move forward in completing their action plan. Legislative Task Force The Legislative Task Force is a special ad hoc group comprised of active leaders in the community - the leadership of City Boards and Commissions. With the membership comprised of the Boards and Commissions leadership, the Legislative Task Force are knowledgeable members of the community, educated on City priorities, and representing a wide range of City interests. The Legislative Task Force will provide input to City Council on the issues relevant to the State Legislative Agenda in preparation for the Texas State Legislative Sessions. Facilities Facility Access Policy As City Facilities move to a public lobby and secure back of house model, access control becomes more important. This policy will help establish necessary employee access to non-public areas within City Facilities. Georgetown Municipal Complex Remodel Secure separation of public and employee space requires building modifications, including access control doors and publicly accessible meeting space to keep employees from bringing public into the secure space. The GMC remodel creates that separation and adds meeting space in the public area. Light and Waterworks Remodel Page 13 of 173 RISK MITIGATION REPORT 9 | Page CITY OF GEORGETOWN Light and Waterworks building currently requires entry from an alley and there is no separation from the public space and employee areas. The LWW Remodel moves the front Planning entry to Martin Luther King Jr. St. This entry fits better within the City Center and allows the use of a public lobby with a secure door to the employee area. Emergency Management COVID-19 Response The City declared a local disaster and activated a virtual emergency operation center in response to COVID-19. In addition, the City is working closely with Williamson County, the Williamson County and Cities Health District, and State partners to coordinate our response to the pandemic. In July, the Mayor issued an order requiring the wearing of face coverings while in businesses with some exceptions. These orders were later amended to reflect statewide mask order issued by the Governor. The Governor’s orders also prohibit outdoor gatherings of more than 10 people at a time, without mayoral approval. Additionally, the City is seeking reimbursement through Williamson County for COVID-19 related expense that are eligible to be covered by the CARES act. These funds are being dispersed in three tranches to cover expenses through calendar year 2020. The City has also created an inventory of personal protective equipment to ensure adequate supplies both for first responders and general employees to be appropriately protected. Finally, the City has amended internal personnel policies to ensure appropriate social distancing at work, allowing employees to telework when appropriate, and appropriate measures are taken when employees test positive for COVID-19, including administering federal ESICK and EFMLA programs. Hazard Mitigation Action Plan The City is in the process of updating its Hazard Mitigation Action Plan. The plan helps the City appropriately assess, prioritize, prepare for, and mitigate natural or human-caused hazards. This plan will allow the City to maintain eligibility for future federal mitigation grant funding and help identify mitigation actions that will make the local community more disaster resistant. The planning efforts are expected to begin in October and be completed in the first quarter of 2021. The plan will require state and federal review prior to City Council adoption. Public Safety HIPAA Audit In the spring of 2019, the Fire Department filed a “breach notification” report regarding an unencrypted EMS tablet that went missing from one of the ambulances. This breach had the potential to impact up to 719 individuals and the City began a review of procedures and practices. This review has been expanded to include a HIPAA audit in September 2020 to adequately address any gaps in procedures and policy. The audit will identify measures that need to be taken to maximize the protection of private health information as defined within the Health and Human Services’ Security Rule 45 CFR Part 160 and Subparts A and C of Part 164. The HIPAA Security Rule establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information. This audit will help Page 14 of 173 RISK MITIGATION REPORT 10 | Page CITY OF GEORGETOWN inform changes that need to be made to reduce the risk of a breach occurring again and is expected to be completed by December 2020. Also, to further reduce risk, the City is in the process of creating a HIPAA hybrid entity which would create a healthcare component and discern what areas would be subject to HIPAA privacy regulations. This would ensure that only the designated areas that need to comply with HIPAA privacy rules would do so, instead of the entire organization. Only these newly identified areas would have the right to use, maintain, access and/or transmit personal history information. This process will create clear boundaries to further protect sensitive information and create internal controls to limit access. Guardian Tracking: Performance Management Software Since 2012, the police department has been utilizing Guardian Tracking, a performance management software platform. The software is used to formally capture praise, counseling, goal setting, and discipline. The software also serves as an early warning system for repeated substandard performance. Replacement of Police Body Cameras In 2019, due to reliability issues with the previous vendor, non-compatibility between car and body cameras, and the inability to keep existing equipment serviceable we replaced all car cameras, body cameras, and facility interview cameras. We transitioned to WatchGuard, a Texas based company and industry leader with regards to police vehicle cameras, body cameras, and digital evidence management software. Now all cameras and the digital data derived are on one unified management software system. The current technology is far superior to the old allowing for real time viewing, wider angles, seamless integration between car and body cameras, and automatic synchronization of all incident cameras on playback. CommUNITY Advisory Task Force The police department established a Chief’s CommUNITY Advisory Task Force in July of 2020 comprised of 20+ diverse community leaders. The task force will be working with the Chief to provide input regarding the state of policing in Georgetown as well as providing input as to the direction of the CommUNITY Initiative. The police department plans to conduct six Listen and Learn Summits across six different stakeholder groups in FY2021. Police Training - Arbinger institute The police department is in the process of having their officers complete training created by the Arbinger Institute. This training focuses on transitioning a self-focused inward mindset to an impact-focused outward mindset. Arbinger’s Policing with an Outward Mindset™ program addresses three key challenges in law enforcement today:  Situational Awareness and Officer Safety o Officers must increasingly operate in ways that are both smart and safe. This requires the self-awareness and motivation to be the most trained, skilled, and conditioned version of themselves possible. In addition, officers must be aware of contextual behavioral anomalies indicative of dangerous or criminal behavior without being distracted by factors such as race, gender, age, sexual orientation, etc.  Trust and Collaboration Page 15 of 173 RISK MITIGATION REPORT 11 | Page CITY OF GEORGETOWN o With so many factors influencing incident narratives and investigations, trust, and collaboration within agencies and with the communities they serve has become critical— but also quite difficult.  Leadership o Law enforcement leaders today must carry a deep sense of personal responsibility to develop competency in each of their roles and to understand the impact they have on others while carrying out their duties. Such a leader inspires and systematically develops similar personal responsibility from others. Arbinger enables organizations and their people to turn outward through a three-step process: mindset change, leader development, and systems improvement. Fire station 6 and 7 Fire Station 6 is open and 7 is set to open soon, adding additional resources to key areas within the City for a more efficient response. In having these stations come online the Fire department will also have more staff to reduce the number of overtime hours. Finance and Human Resources Workday The City has converted to a new ERP system, Workday. This new system has aligned financials and human resources to one system streamlining purchasing, travel, recruiting, on-boarding, performance, benefits, payroll, accounting, and budget to name a few high-level processes. This conversion has fully mitigated many threats outlined in the 2018 assessment with more restricted security roles limiting access to sensitive information. The system also requires 2-factor authentication furthering our security of the system. Workday is cloud based, allowing for business continuity in the case of a disaster impacting our critical network and infrastructure. Overall, conversion to Workday has allowed for more efficient processes and reporting options for staff. The workday implementation has addressed the following: Page 16 of 173 RISK MITIGATION REPORT 12 | Page CITY OF GEORGETOWN • Conducted detailed process reviews to implement best practices • Enhanced user and access controls • Requires 2 Factor Authorization to access • Created process controls such as budget checks on purchases and created a system of multi- level of approvals for purchases • Implementing the budget module Adaptive to streamline and integrate workflows within the Workday system Internal Audit Plan Staff is creating a multi-year internal audit to apply a disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. The internal audit plan reinforces the City’s commitment to accountability and integrity while having an objective party look for ways to improve operations. Some of the audits staff are including in the audit plan are: • Fee Collection Review • Hotel/Motel Audit • Franchise Fees • Airport Revenue Sales Tax Audit The State is currently conducting a sales tax audit that began in June 2020. The audit is done to ensure that Texas tax laws are applied uniformly and to promote compliance. The audit helps determine whether taxes have been properly collected, reported, and paid to the state. Policy Updates Six personnel policies were updated in alignment with Workday implementation in 2019 including introductory period, vacations, sick leave, hours of work, compensatory time, and holiday. Multiple temporary policies have been issued during the COVID-19 Pandemic including telework and flex time. Safety & Risk Management Team The City’s safety and risk management programs were combined, centralized, and staffed by three full- time employees focused on the development and evaluation of occupational safety and risk management programs in 2019. Since that time, the team has improved handling of citizen claims, improved accuracy in covered city property, improved management of our third-party risk pool administrators, and given greater support to our employees who experience work-related injuries. The team has deployed the first phase of active shooter and building evacuation training, with more to come. They are also building data sets to better understand worker injury and accident trends and working with stakeholders on appropriate mitigating actions. Organizational Development Page 17 of 173 RISK MITIGATION REPORT 13 | Page CITY OF GEORGETOWN The City hired its first learning and development coordinator in 2020. The coordinator has built a learning and development strategic plan that will be deployed over the next two years. Included in that plan is our multiyear approach to talent management and making use of Workday talent capabilities. In 2019 the City created the organizational & operational excellence office, focused on helping staff ‘eat elephants…one bite at a time.’ The office works to empower staff at all levels through our organizational performance management (see City Manager section) and process improvement programs. The office has since rolled out annual business plans for all departments, lean trainings to over 1,000 participants, and currently support over 60 lean process improvement projects. City Secretary Freedom of Information Act – Compliance with Open Records The Open Records Coordinator will continue to provide annual trainings to staff related to best practices for responding to FOIA requests and do routine reviews of the Open Records Request policies and procedures. The City Secretary’s Office will continue to work towards adding another Open Records Coordinator to mitigate the large workload that the growing number of open records requests provide. Records Management – Current Practice The Records Management team does routine departmental check-ins and works to organize projects that make departments more efficient and less reliant on paper. The Records Management Team does a routine review of the Records Management policies and procedures to ensure that best practices are always being implemented. They also provide annual training to all employees. Agenda Process Staff members from City Secretary’s Office, City Attorney’s Office, City Manager’s Office, and Purchasing are working together to improve the agenda process that is currently not as efficient as it could be. City Secretary Office is also looking into the possibility of switching agenda software. Information Technology Cybersecurity Policy The IT Department has completed a primary draft of a comprehensive Cybersecurity Policy. The draft has been reviewed by first line technical staff and is being prepared for final round of review by the Human Resources, City Secretary, and Legal Departments. Staff participated in a cybersecurity tabletop exercise in October 2020 conducted by the Texas Department of Information Resources. The tabletop discussion covered the potential impacts of a computer security incident impacting a local community. This training furthered staff’s education on responding to a cybersecurity incident and its potential impacts. System and Network Contingency Plan The IT Department currently has an Incident Response Plan in development through the Human Resources Departments Lean Process Development methodology. This plan is scheduled for completion in December of 2020. Security Information and Event Management System Page 18 of 173 RISK MITIGATION REPORT 14 | Page CITY OF GEORGETOWN Multiple Security Information and Event Management Systems (SIEMs) are under review by the IT Department. Also, the IT Department is evaluating the possibility of managed service contracts through the Texas Department of Information Resources to help fulfill this need. Due to budgetary constraints presented by COVID-19, a purchase was not proposed for FY 2021. Pending budget availability for FY 2022, IT will work toward the purchase and implementation of a SIEM system. Staff IT Security and Awareness Training The City of Georgetown successfully implemented a Security and Awareness Training initiative in FY 2020. This included training and testing for all City IT users through the City’s Learning Management System. In June of 2020, the City Security Awareness Training program was certified by the State of Texas as complete for the current calendar year. Back-Up Data Center A back-up data center was successfully brought online in the Winter of FY 2020. The purpose of this data center is to act as a failover in the case of a failure at the City’s primary data center. Failures could include physical destruction or damage to the primary datacenter by a man-made or natural disaster. Failures may also include some types of cyberattacks. In such a case, the back-up data center could be brought online and subsequently run 90 percent of the City’s technology systems within a matter of hours. This includes all the City’s mission critical data systems. Overall Utility System Weaver Assessment – Cash Receipt Review The City of Georgetown engaged with Weaver and Tidwell, LLP to provide assist in the review and identification of all cash receipts currently received the by City’s Utility Billing Office and identify alternative locations and processes for non-utility payments. Weaver and Tidwell also provided risk- control matrices and process mapping for areas in the City’s Utility and Accounting Offices where internal risks could occur. Weaver Assessment – UMAX Business Process Mapping The Weaver and Tidwell, LLP engagement also provided a review of the City’s Utility Office internal controls, transactional processing efficiencies and review of audit trails and automated workflows integrated in the City’s new UMAX/CIS. Four (4) high-risk, fifteen (15) moderate risk, and four (4) low- risk processes were identified. These ranking provided guidance to the City with regards to prioritizing effort and resources. It also documented workflows that are used when reviewing business processes. The high-risk areas have been mitigated and many of the moderate risks have been addressed. Gartner Assessment – AMI/CIS and MDM Systems The City of Georgetown engaged with Gartner Consulting to conduct an assessment an analysis of the City’s Customer Information System (CIS), Advanced Metering Infrastructure (AMI) and Meter Data Management (MDM) systems. The objective is to evaluate the City’s CIS business processes against the current CIS system, identify gaps or areas for opportunities, and explore alternative options to improve the City’s CIS operations and supporting technologies. As well as to evaluate the business value provided by the AMI and MDM systems to enable the City to meet its smart meter information needs. Page 19 of 173 RISK MITIGATION REPORT 15 | Page CITY OF GEORGETOWN Electric The electric utility went through a management assessment conducted by Schneider Engineering., The following were the recommendations from the management assessment: 1. Develop and implement comprehensive risk management policy. a. Leverage internal and external resources to increase oversight and accountability for decision making regarding contracts management. b. Procure third party energy management services. 2. Study the installation of separate governance structure for Georgetown Utility Systems. Based on the recommendations, the following action were taken to better manage the risks. Adoption of comprehensive Energy Risk Management Program: The new Energy Risk Management Policy governs all purchase power and related activities that may impact the Energy Risk profile of Georgetown Electric Utility. Activities that fall within the scope of this Policy include, but are not limited to, the following: • Wholesale Transactions (PPA, Bilateral Trades) • Independent System Operator (ISO)/ERCOT Market Transactions (DAM/RTM/AS) • Energy hedging activities involving physical and financial energy products • Basis hedging activities involving energy products • All energy commodity trading • Counterparty contracting and credit management Under the new Energy Risk Management Policy there are multiple levels of oversight provided to the electric fund. Overall policy oversight is provided by City Council and the Georgetown Electric Board (GTEB). Independent 3rd Party provides Risk Management Compliance reporting to GTEB and City Council. Page 20 of 173 RISK MITIGATION REPORT 16 | Page CITY OF GEORGETOWN Risk Oversight Committee The Risk Oversight Committee (ROC) is an internal committee that oversees approval and compliance of transactions and risk limits. The committee is comprised of the City’s executive team (City Manager and Assistant City Managers), the Electric General Manager and staff, and the Finance Director. ROC provides inputs to the risk management strategy and receives weekly/monthly risk management updates from the Risk Management Committee. Risk Management Committee The Risk management Committee (RMC) is comprised of Shell, the Electric General Manager, and staff, as well as independent consultants. The RMC implement the risk management strategy approved by the ROC. The RMC reviews existing and potential transactions, monitor proximity to limits, and helps support the responsibilities of the ROC. Ultimately the RMC, is responsible for the day-to-day execution and management of transactions. Page 21 of 173 RISK MITIGATION REPORT 17 | Page CITY OF GEORGETOWN Procurement of 3rd Party Electric Energy Portfolio Management Services: In December of 2019 Council approved an agreement with Shell Energy North America to provide energy management services. Shell will be developing and making recommendations regarding how Georgetown’s energy is traded in the Texas energy market. Shell will also assist in forecasting energy needs, energy costs, and addressing challenges related to transmitting energy around the state, all of which affect the city’s costs associated with purchasing power. In addition to Shell North America, Crescent Power and ACES Power Marketing aid the staff in managing the overall energy portfolio risk and risk management policy compliance. Creation of new Electric Board to provide better risk and financial oversight: Starting June 2020, a new electric oversight board was set up. The electric board’s proposed role in risk management is as follows: • Aid the City Council in providing the overall Policy Oversight. • An independent third party appointed by the Georgetown Electric Board will provide periodic Risk Management Policy Compliance reports to the GTEB and City Council. • Receives Monthly Risk Management Policy updates from Risk Oversight Committee (ROC) and Risk Management Committee (RMC) Line Extension and Meter Connect Revenue Risk Mitigation To ensure all revenue is properly collected, review of the revenue generating activities related to electric infrastructure additions and service provisioning identified revenue loss and revenue leakage. The causes for lost revenue and revenue leakage were: 1. Unsent/unpaid/overdue invoices for electric infrastructure additions. 2. Sub-optimal business processes and significant short comings of the software systems led to significant under-collection of electric meter connect fees. Mitigation activities: 1. Business re-organization led to the electric engineering and project management function under the electric cost center. This identified the revenue losses and the redesigned processes led to better control and management of the electric infrastructure additions with appropriate cost recovery. 2. New Electric line extension policy implemented in early part of FY 2020, clearly identifies the infrastructure addition costs and the requirement of pre-payment of the invoices mitigated the risks posed by unpaid/overdue invoices. 3. Short term mitigation strategies were identified which address the meter connect revenue loss. The long-term mitigation strategy of a comprehensive business process redesign of the utility service connection is in progress. The new process will be in place starting January 1st, 2021. Water and Wastewater System Risk Assessment of Water Utility Page 22 of 173 RISK MITIGATION REPORT 18 | Page CITY OF GEORGETOWN The water utility had a risk and resilience assessment conducted by CDM Smith to comply with a new mandate set by the American Water Infrastructure Act. The assessment outlined several recommendations to help mitigate risks and improve system resiliency against the highest risk threats identified. The recommendations for the water utility system are:  Plan for use of portable power supply generators during an emergency to supply temporary power to critical system components that do not currently have back-up generators or hook-ups.  Expand Lake water treatment plant and build a new water treatment plant south of the lake to improve system redundancy during an emergency (this is in the planning process with expansions and new treatment plant construction tentatively scheduled within the next five to seven years).  Implement floodproofing techniques at the Park water treatment plant to protect critical system components from damages during flood or dam failure.  Develop a source water protection plan for Lake Georgetown and Lake Stillhouse Hollow in coordination with the Brazos River Authority, United States Army Corps of Engineers, and other stakeholders.  Improve physical security measures at critical facilities to reduce the risk of an outsider threat accessing critical assets. Examples may include automatic lock doors at water treatment plants, or motion sensors that trigger security camera alerts outside of regular business hours when personnel are not physically on-site. Many of these recommendations are being addressed in the years to come with the City’s capital improvement plan to expand water treatment capability as well as an initiative with the Brazos River Authority (BRA) to secure additional water resources for the future. Succession Planning The Water Utilities Director is set to retire by the end of the year. Upon their departure the water department will lose a vast amount of historical knowledge of the utility and expertise in the field. The City has started a plan to begin a national search for the next water utility director. In the meantime, the director has informally begun to prepare his direct reports to be able to assume more responsibility and is training them on any knowledge gaps he foresees. Long Term Water Planning The city is pursuing several resources when it comes to Long term water planning. Planning is conducted on a State, Regional and local level. The City works closely with neighboring cities, the Brazos River Authority (BRA) and Region G to analyze and develop additional water resources available to meet the City’s long-term needs. The BRA and the City of Georgetown are jointly funding and participating in an Aquifer Storage and Recovery (ASR) Study. This study will look at seasonal recharge of surplus reservoir water from Lake Georgetown, treating this water during times when there is spare water treatment capacity and then conveying this water to a suitable location within aquifer(s) that can be used to store the water. During periods of high-water demand or extended drought, the stored water may then be recovered to meet water resource needs. This storage and utilization method may also be used to store additional groundwater resources. The BRA, City of Round Rock and Georgetown are jointly participating in a collaborative study to identify regional and long-term water solutions for Williamson county, the evaluation will include groundwater and conjunctive water development opportunities that have been presented by different marketing groups, water sharing and scenarios for potential redistribution of water Page 23 of 173 RISK MITIGATION REPORT 19 | Page CITY OF GEORGETOWN supplies for regional and long-term sustainability of water supplies in Williamson county. James (Jim) Briggs, former Utility General Manager, has worked to include additional groundwater resources from counties to the east as a long-term water resource within the Region G Plan. By having groundwater listed as a long-term solution on the Region G plan, related projects will be eligible for state funding participation. System Interconnects The City is further diversifying its water resources and increasing system resilience through interconnects with neighboring systems. The City currently has two interconnects with Round Rock and a third under design to utilize Round Rock’s excess treatment capacity. An additional short-term interconnect is also constructed between the City and Leander’s system. This interconnect will be used during periods of high demand. The use excess treatment capacity of others assists the city in being fiscally responsible in the ability to defer capital construction when possible. Water Leak Detection In an effort to more responsibly utilize current water resources the City continues to track and trend Water Loss as a key operating metric. Starting in Fiscal year 2021, the city will be improving leak detection by using satellite detection. The City’s vast service area makes this method of detection and subsequent repair more efficient. Water Rates The city continues to maintain utility fiscal health by performing rate study and impact fee studies every three years. Previous rate studies were conducted on a revenue sufficiency principal. The rate study currently is a cost-of-service rate study. The water rates and tiers were evaluated primarily for residential customers and will be in effect 2021. Commercial tiers, and reclaimed use is to be analyzed in 2021. Implementation of the new water rates and narrowed tiers will assist the utility in maintaining financial integrity and make significant effort to improve resource use efficiency. Public Works Capital Improvement Project Coordination Committee The lack of regularly scheduled CIP Coordination meetings outside of the annual budget process has led to disjointed communication with the CMO on capital improvements projects and, at times, has limited the ability of the organization to consider the full range of options as obstacles, challenges, and opportunities have arisen. All of which is why a new internal committee is being created to enhance CIP coordination across the City. Enhanced CIP coordination will save time, increase accountability, reduce errors, improve timely project close-out, improve debt tracking and issuance, minimize miscommunication, improve intergovernmental coordination, increase accuracy of billing to correct cost centers, and increase opportunity to proactively respond to challenges, obstacles, and opportunities. Contract Coordinator The City of Georgetown hired a contract administrator in March of 2020. This role is responsible for enhancing contract management for various types of agreements, by working with City staff to raise additional awareness for upcoming obligations. Since being hired on the contract administrator has assisted in modifying the internal cover sheet process for two major developments, this improvement led Page 24 of 173 RISK MITIGATION REPORT 20 | Page CITY OF GEORGETOWN to identifying over a million dollars in funds owed to the City for public infrastructure. This continuous process and review by the contract administrator will allow for more detailed oversight in the growing number of contracts as the City expands. The contract administrator created a tracking process to monitor the monetary obligations owed to the City or what the city owes given contract specifications. Also, a Contract Coordination Committee has been formed with its initial meeting scheduled for October 2020. This will further assist the City in working together to track obligations that need to be met. The position will also be the liaison for the City regarding new MUDs and PIDs wishing to be created within City limits and ETJ. Near Term Action  Complete Hazard Mitigation Plan  Conduct a citywide operational and enterprise risk assessment every 5 years-with the next study slated for FY23  Implement consultants’ recommendations as a result of the following studies: o Gartner Assessment of CIS/AMI/MDM systems o HIPAA Audit by SHI  Conduct an audit of the electric risk management practices  Finalize and initiate internal audit work plan  Process improvement o Streamline purchasing process and create training for power users to ensure compliance with procurement laws o Integrated Council agenda process across the City Manager’s Office, City Secretary’s Office, City Attorney’s Office and Purchasing department as well as creating and implementing training for power users on the agenda process  Overall biannual review and update of citywide and departmental policies and procedures  Providing public dashboards of departmental performance management metrics Page 25 of 173 RISK MITIGATION REPORT 21 | Page CITY OF GEORGETOWN APPENDIX Risk Mitigation Register Page 26 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS R01 IT Cybersecurity Governance Model A comprehensive Information Technology (IT) cybersecurity policy and procedures document has not been approved by management and communicated to all employees and relevant external parties, outlining responsibility and oversight for Information Security (IS) and policy administration. IT Director Chris Bryce 21 1) We recommend the City implement a governance framework that allows for the proper management of a successful ISP. An effective ISP involves participation from senior management to set the direction for proper information security practices, adequate staffing and compliance with policies 2) Further, we recommend the City adopt a practice of performing a Cybersecurity risk assessment periodically. The periodic approach may take either of the following approaches: (A) performing a full assessment every other year due to intensive resources required to facilitate such an exercise or, (B) a targeted approach done annually including: • revisiting this report findings and updating controls where appropriate, • re-assessing the City’s mitigation plan to update progress and note any further concerns, and/or, • selecting a few high-priority control areas (e.g. vendor management, or any business objective/goal identified by executive management) and re-assessing associated threats related to those areas 1) Implementing IT Catalyst Plan – 5 year Strategic Plan 2) Developing documented policies to address various IT areas 3) Developing Cybersecurity Training 4) Conducted 2 security audits 5) Budgeting Lead System Security Analyst in FY19 6) Conducting PCI (Payment Card Industry) study (scheduled) 7) Implementing two factor authentication 8) IT Cybersecurity Risk Assessment by the US Department of Homeland Security 9) Determine best practices, implement security policies, and identify staffing/challenges to implement ISP 10) Identify staffing needs to appropriately manage IT security challenges and ISP 11) Continue Cybersecurity scanning on a yearly basis. 12) Implement ISP 13) Assigned security roles to existing staff and hired any security staff needed to manage an Information Security Program FULLY MITIGATED 1) The City has completed a draft Cybersecurity policy that is under review by multiple departments. It is a comprehensive policy that establishes basic security guidelines for all aspects of IT services, infrastructure and staff. The policy includes the designation of Cybersecurity officer in IT to lead implementations. Upon acceptance of the policy, multiple PMP measures will be instituted to measure compliance with policy. 2) The City is currently working with a consultant to perform a study of HIPAA related data security. 3) The City has conducted and passed multiple security assessments including those conducted by U.S. Department of Homeland Security. R02 Utility Market Exposure to fluctuations in the market price of utilities General Manager of Electric Utilities Daniel Bethapudi 18.75 1) Continue to enhance the City’s forecasting tools and techniques to increase granularity and improve accuracy. 2) Continue development of a strategy to meet future peak demand growth with distributed generation and storage rather than remote central generation to mitigate exposure to transmission congestion. 1) Shell was hired to forecast and manage purchasing power. Line extension policies and a rate study by NewGen has been conducted to ensure th electric utility is more resilient to a fluctuation in market price. 2) Daniel Bethapudi was hired to oversee the electric utility. 3) Risk Oversight Committee was created and regular reporting to Council PARTIALLY MITIGATED RESPONSE RISK LOG RISK RISK REGISTER ASSESSMENT Page 27 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R03 IT Asset Management: Data Classification The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to business objectives and the organization’s risk strategy. IT Director Chris Bryce 17 1) The City should consider classifying data within the system based on its criticality and / or sensitivity (NIST SP 800-53 Rev. 4 RA- 2). Classification of data will also help drive the above- mentioned information flow enforcement and help define the City’s security architecture 2) We recommend the classification of City data to define an appropriate set of protection levels and communication required for special handling Classifications and associated protective controls (including encryption for data at rest and data leak prevention tools) should take into account department needs for sharing or restricting information and the associated business impacts if such data were compromised. Successful data classification in an organization requires a thorough understanding of where the organization’s data assets reside and on what applications/devices they are stored. Handling procedures should include details regarding the secure processing, storage, transmission, declassification, and destruction of data. 1) Implementing IT Catalyst Plan – 5 year Strategic Plan 2) Implementing 2 factor authentication with Workday 3) Implementing consistent role based access to CIS and ERP system functions through Workday PARTIALLY MITIGATED 1) As part of the Cybersecurity Policy under review, a Data Management policy has been created that lays out a multi- department guidelines to classify and manage sensitive data. R04 IT Access Management Access to assets and associated facilities is limited to authorized users, processes, or devices, and to authorized activities and transactions. IT Director Chris Bryce 17 1) A role-based access scheme should be established to ensure consistent application of user access rights within the system. Users should be assigned their base set of access authorizations based on the concept of “Least Privilege Necessary” to perform their role or job function (as defined within their formal job description). Additional access beyond the previously established role-based access scheme should be formally requested, reviewed for conflicts and approved (NIST SP 800-53 Rev. 4 AC-2). Moreover, Management should consider integrating access rights with data classification efforts identified in Appendix B of this report 2) Ensure a process is in place to approve special access requests and timely de-provision access upon notification from HR 1) Roles and access defined in policy and set in Workday. SCADA is being audited by Homeland Security and will see recommendations to mitigate potential risks. FULLY MITIGATED 1) As a first step in meeting these requirements, the City has established a Cyber Security policy. As sub policy, that policy includes guidelines on access management. Upon acceptance of the policy, IT will begin implementing aspects of the policy pertaining to IT. 2) IT has implemented an approval process in its ticketing systems for both access requests and change control on major systems. R05 IT Contingency Plan Loss or inability to continue business due to natural disaster, system capacity or performance issues, interruption in communication, loss or corruption of data, or loss of critical vendors or staff members. IT Director Chris Bryce 17 Plante Moran recommends the City conduct and formalize: (1) A Business Impact Analysis (BIA) which identifies and analyzes mission-critical business functions, and then quantifies the impact a loss of those functions would have on the City, and (2) An information system contingency plan to mitigate the risk of critical system and service unavailability. The contingency planning process should occur after a formal Business Impact Analysis (BIA) is conducted, in order to correlate the system with the critical processes and services provided, and based on that information, characterize the consequences of a disruption. Three steps are typically involved in accomplishing the BIA: • Determine mission/business processes and recovery criticality • Identify resource requirements • Identify recovery priorities for system resources Preparedness committee in partnership with IT PARTIALLY MITIGATED The City will conduct this as part of a Business Continuity Plan Page 28 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R06 Segregation of Duties The Organization fails to adequately segregate roles and tasks between team members Finance Director Leigh Wallace 16.43 1) An annual review of user access for all staff members within the City across all programs managed by IT should be performed 2) Departments that have not had an internal control review within the past five years should evaluate the design and effectiveness of their internal controls Workday ERP system requires role-based security assignments. The Workday ERP system requires 2-factor authentication to access the system. FULLY MITIGATED R07 Legislation Governmental laws change that impact the organization by financial, operating, strategic or compliance issues. CMO David, Laurie, and Wayne 16.36 1) Council and Management should review and closely monitor the status of annexation plans for the City. After the 2020 census, the City will be limited in its ability to perform annexations due to Williamson County’s population surpassing 500,000 citizens 2) The City should work with legislators to clarify the impact of harmful legislation including revenue caps and limits on debt financing for infrastructure during the City’s period of high growth and should stress the removal of local control restrictions that impact citizens ability to impart changes in their local community 1) Staff reviews annexations and carefully plans in DPRC 2) Focused Advocacy was contracted as a lobbyist for the City to inform the City of developing and implemented legislation and its affects; as well as lobbies in the City's best interest PARTIALLY MITIGATED City is creating a Legislative Task Force with representation from the community to inform the City's legislative agenda. R08 Emergency Notification System Failure (ENSF) The City's Emergency Notification System fails to alert citizens in the event of an emergency. Emergency Management Coordinator Raymond Mejia 13.81 1) The City should communicate Incident Action Plans for large scale events to all parties involved with the event, including the Convention and Visitors Bureau (CVB) 2) Management should inform all departments of the operating procedures related to the ENSF 3) The EMC should develop basic and advanced emergency management training for key stakeholders in the City (Division Managers) and conduct table top and/or practical training exercises that replicate local level emergencies 1) Incident Action Plans are created and shared with needed stakeholders. With COVID- 19 Situational Reports and IAP's were created after EOC meetings and shared with stakeholders. 2) 3) Creation of Preparedness Committee which is working on several emergency management deliverables to better prepare the organization as a whole. 1) Work with utilities to map a process flow to send out alerts (e.g. boil water notices) PARTIALLY MITIGATED 1) Creation of Continuity of Operations Plan 2) Tabletop exercises completed quarterly throughout the year with Directors 3) Create EOC training and emergency management training for staff on the LMS Page 29 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R09 Fraud Customer, third party, or internal fraud occurs resulting in a significant misappropriation of assets and/ or incorrect financial reporting, or corruption/ kickback schemes. Controller Elaine Wilson 13.75 1) The Finance Department should perform more robust reviews of P-Card purchases and consider utilizing software to perform regular audits of P-Cards 2) The Finance Department should perform annual reviews of P- Card users to evaluate whether the all users actually need P- Cards 3) The City should implement a more extensive asset tracking program, utilizing fixed asset tags on assets valued over $1,000 with consideration of periodic asset audits 4) Vendor Ship-To addresses should be limited to a “drop down” list consisting only of City facilities 5) The City should consider developing a fraud awareness and prevention training program with active participants across all City departments 6) All changes to IT databases deemed to be material should be tracked on an Audit File Log and reviewed by someone without access to the databases 1) A review of all P-card users was performed during the Workday ERP conversion. Cards were added and reduced as necessary across departments. Several departments turned in individual cards used infrequently, and switched to shared cards monitored by a card liaison. The total number of cards remained the same across the City. Travel requests are now audited before the event occurs, in addition to after the event occurs. This has improved accuracy of travel expenses 2) P and T Card review was done this year with the issuance of new cards 3) Some departments are beginning asset management programs 4) Workday limits ship to address options 5) Cash handling training is required for those handling cash 6) Several levels of reviews for changes to IT database and regularly audited and checked for weaknesses by Department of Homeland Security PARTIALLY MITIGATED Have regular audits conducted of processes prone or vulnerable to fraud R10 Health & Safety Exposure to potentially significant workers' compensation liabilities due to the inability to maintain compliance with applicable health and safety laws and regulations. HR Director Tadd Phillips 13.04 Overall, the City has robust health and safety procedures and should consider adding the following: 1) The Library should develop clear policies and procedures on a course of action when a customer, employee, or volunteer is injured at the facility. 2) The City should review the lifeguard policy for pool facility rentals. The City currently does not provide a lifeguard for pool rentals by the Georgetown Independent School District and does not require GISD to provide their own lifeguard. 3) Consider adding an Active Shooter response plan 1) Centralized safety and risk management team as of Oct. 1, 2019 2) GISD and the City are working on an interlocal agreement that will mitigate the safety risks. 3)November and December active shooter and fire safety training at several City facilitates FULLY MITIGATED Page 30 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R11 IT Incident Response Management Response processes and procedures are executed and maintained, to ensure timely response to detected cybersecurity events IT Director Chris Bryce 12 We recommend the City implement a formal incident response plan including: 1) Provide a roadmap for implementing its incident response capability; 2) Describes the structure and organization of City of Georgetown’s incident response capability; 3) Provides a high-level approach for how the incident response capability fits into City of Georgetown as a whole and the overall Family of Companies; 4) Meets the unique requirements of City of Georgetown’s mission, size, structure, and functions; 5) Defines reportable incidents as well as requirements and guidelines for external communications and information sharing (e.g., what can be shared with whom, when, and over what channel); 6) Provides metrics for measuring the incident response capability within the organization; 7) Defines the resources and management support needed to effectively maintain and mature an incident response capability; and 8) Is reviewed and approved by senior management Preparedness committee is devloping a hazard mitigation plan that will address these across departments including IT PARTIALLY MITIGATED Preparedness committee is devloping a hazard mitigation plan that will address these across departments including IT R12 Utility Outage The City is unable to respond to mass failures of electrical, water, or sewage outages in a timely manner. Utility Director Glenn Dishong 11.89 1) Maintain equipment useful lives schedule and proactively monitor components which have reached their useful lives 2) Perform a vulnerability assessment to judge your preparedness for handling the increased likelihood for power outages 1) Assets are being monitored as well as their useful lives. 2) Risk and vulnerability assessment was conducted. PARTIALLY MITIGATED Continuity of operation plan and playbook for utility outage. R13 Access to Talent Organization lacks sufficient staffing levels to carry out its routine operations. HR Director Tadd Phillips 11.75 1) The City should evaluate positions with required specialized certifications and determine whether entry level staff members can obtain certifications after hire 2) For specialized positions, including, but not limited to, building inspectors, paving foremen, and traffic engineers, the City should conduct an assessment of staffing levels with a 3-year outlook 3) The Fire Department should develop a plan to acquire the necessary EMS personnel talent 1) Several key departments are initializing step programs to promote staff retention and development for more specialized roles. 2) Many departments utilize metrics to gauge staffing needs with an outlook of a few years. 3) Fire continues to study the needed personnel and requests staff in the budget process. FS 6 and 7 will have the adequate staff to operate. FULLY MITIGATED Establish a process to identify staffing level needs with a 3-5 year outlook. R14 Disaster Recovery / Business Continuity Planning Inability of the organization to continue key business processes during a potential disaster due to lack of sufficient disaster recovery planning and/or execution. CMO David, Laurie, and Wayne 11.6 1) The City has inconsistent DR/BCP across the organization. Some departments have a robust plan and others have none. A DR/BCP should be developed for every City department. Each of these department-level plans should then be integrated into a city-wide plan 2) Tabletop disaster recovery simulations should be performed with all City Departments 1) Business plans have been completed by all departments with their budgets for 2021. 2) Emergency management coordinator is developing policies and procedures as well as tabletop exercises; 2) Disaster Preparedness Committee has been created PARTIALLY MITIGATED 1) Policies and procedures developed, adopted, and training given to all employees. 2) Tabletop exercises completed quarterly throughout the year with Directors 3+L11) Workday is a cloud system, meaning it is accessible anywhere with an internet connection, including mobile devices. Page 31 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R15 Billing for Citizen Services Citizens are billed incorrect amounts or not billed at all for citizen services Customer Care Director Leticia Zavala 11.37 a. The fine schedule for the Municipal Court citations should be restricted to specific users b. All invoices should be created in a single system across the City and remit-to addresses should be limited by a “drop-down” function consisting of only addresses the City accepts payments c. Management should consider a third party revenue recognition study to validate all sources of revenue are complete and accurate across the City operations d. An outside party, Emergicon, reviews billing for EMS incidents as there are various rates depending on citizen’s ability to pay. Emergicon also collects funds and this helps reduce the occurrence of billing errors and improves collections. However, Emergicon also writes off funds and there is no reconciliation of EMS revenue to billings. We recommend the City enhance reconciliation controls around billing procedures and perform internal audits of quality control and verification of vendor compliance. 1) AMI/MDM and CIS systems are currently being reviewed by a third party to identify efficiencies and recommend processes to reduce billing inaccuracies as well as other issues with the systems PARTIALLY MITIGATED 1) Implement changes recommended by Garner's study of the AMI.MDM and CIS system R16 Composition of Tax Base Changes in the balance of commercial and residential tax base result in losses of revenue from taxes. CMO David, Laurie, and Wayne 10.63 1) The City should communicate potential new commercial and residential development to directly impacted City departments and evaluate how new development would affect each directly impacted department 2) Management should utilize a concentration strategy that is flexible and supported by realistic expectations 1) City can use the Fiscal Impact Model to estimate the cost to serve and its impact on city services with new developments; DPRC also serves as a vehicle to consider new developments and its impact FULLY MITIGATED R17 Grant Obligations Organization fails to meet grant covenant requirements. Controller Elaine Wilson 10.55 1) The City should designate a staff member as a Grant Administrator. This staff member should be responsible for maintaining a repository of all grants being applied for, awarded, contact person, and any required filings associated with each grant. City should require that all Grants be managed through the new Grant Administrator 2) A Grant Status Report should be provided on a periodic basis to the City Manager’s office for potential budget considerations 1) Elaine Wilson is the grant administrator and staff does the reporting for grants. Policy created and training is done with departments with active grants. 2) Quarterly Financial Report includes grant report which is validated by Controller. FULLY MITIGATED R18 IT Third Party Roles & Responsibilities Security roles and responsibilities are not established for all third-party service providers and lack clear contractual obligations for service level agreements and KPI’s. IT Director Chris Bryce 10 We recommend management take the following actions: 1) Clearly identify the cybersecurity responsibilities to be outlined in the contract with the service provider including roles for identification, response, and recovery procedures 2) Establish Key performance indicators for third-party responsibilities including number of events, data breaches, number of notifications 3) Continuously monitor contract SLA’s and established key performance indicators PARTIALLY MITIGATED This is a low priority risk as IT infrastructure is managed in- house. As part of the new Cybersecurity Policy under review, a Vendor Access policy will cover basic guidelines for vendors. Page 32 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R19 Vendor Reliance Any termination of, or adverse change in, the Organization's relationships with its key suppliers, or loss of the supplies in support of one of the organization’s key services Purchasing Manager Leah Neal 9.81 1) Assign one person the responsibility of monitoring all key vendors to the City 2) Create a subsidiary listing of all key vendors with contract details, SLA’s and performance metrics 3) Report back to City Manager when it is determined a vendor may become insolvent or is not meeting SLA’s 4) Prior to contract renewal, negotiate with all key vendors to capture volume discounts and preferred pricing 5) Management indicated Garland Power & Light currently reconciles their meter data to the scheduling data and the transaction settlement engine. This could be done in house but would require additional headcount as the process runs 24/7. Management should consider a cost/ benefit study to do this in- house 1) Not realistic, but procurement could have oversight with contract monitors in each department 2) Existing contracts do not have performance measures built-in. Contracts need more specificity to identify indicators of performance. Contract specialist could help in this area to create a standard for contracts moving forward. Performance of contracts should be done more so on the power user level, but processes should be put in place. 5) Gartner study is identifying best practices and gaps with current MDM/CIS system. There is also a multi-department initiative beginning soon that aims to find efficiencies and streamline the meter-to-cash processes PARTIALLY MITIGATED 1) Create a sole source policy; vendors should not be the ones to verify that they are sole source and a approval process for sole source needs to be created. 2) Create a better process of procurement; often contracts and purchases on the Council agenda have never been reviewed by the purchasing team. Training recommended for staff on procurement process. 3) Contract Review Committee with members from key stakeholders involved (e.g. Purchasing, Legal, CMO, etc.) to follow best practice and keep all parties apprised of contracts within the City R20 Physical Security Facilities are not appropriately secured from unauthorized access. Facilities Eric Johnson 9 1) Consider taking inventory of all key cards to validate none have been stolen or lost 2) Consider development of physical security training for all personnel regarding safeguarding of assets, restrictive access to high risk areas, etc. The City must support integrity of physical security through the organization with the assistance of the City’s Risk Manager 3) Standardize a consistent security plan across all locations appropriate for each facility 4) The City currently monitors physical access to the facility where IT resides to detect and respond to physical security incidents. However, CoG does not review physical access logs periodically 1) Staff is working on this with the police department, and access is monitored for irregularities. 2) New city buildings were built with security in mind, older buildings are being renovated with employee safety as a priority. 3) The safety team in HR & OD is working on creating a safety plan across all facilities; Emergency Response Plan is also available and being updated. 4) The City monitors when an incident occurs or access usage is used out of the normal operating times or pattern usually seen from whomever is accessing the building. PARTIALLY MITIGATED 1) Create a formal security access policy 2) Conduct safety training or create training in the LMS for threats such as active shooter and natural disaster like a tornado in the area 3) Remodel GMC to have better safety and controlled access for employees Page 33 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R21 IT Critical Security Event Identification A formal risk event identification process is not in place to identify, classify and resolve security events IT Director Chris Bryce 9 1) Identify high risk events that can be alerted from current logging capabilities (NIST SP 80053 Rev. 4 AU-6). Potential high risk events can be discerned through the risk assessment process (NIST SP 800-53 Rev. 4 RA-3), penetration testing, and best practice documentation. Some common threat events include: • Multiple failed login attempts • Elevations in access privileges • Changes to application code • Changes to security settings • Process specific actions 2) Consider alert generation techniques for risky events such as devices that connect to the network without authorization 3) Identified events should be responded to in accordance with the organization’s Incident Response Plan The City's current Cybersecurity Officer and Operations Staff monitor cybersecurity events. PARTIALLY MITIGATED When economic conditions allow, IT intends to implement a Security Information and Event Management (SIEM) system for improved monitoring of security events. R22 IT Security Awareness, Training and Education Personnel are not informed of potential IT threats to the organization and are unable to respond effectively IT Director Chris Bryce 9 1) Rely on end users as the first line of defense to limit exposure to social engineering frauds and threats 2) Consider increasing complexity of password requirements 3) Create a formal IT Awareness training and provide to all employees on a periodic basis 4) Require employees to formally acknowledge in writing that they have read and understand the security awareness training, and that they recognize the ramifications of non- compliance In FY 20, the City implemented a Security Awareness policy that includes a requirement that all employees conduct Cybersecurity Awareness training. PARTIALLY MITIGATED All employees completed this training and will do so annually. The new policy, currently under review, will also require additional training for employees who handle sensitive data. R23 Fire Department Failure The Fire Department is not adequately equipped to handle responses to emergencies in the City. Fire Chief John Sullivan 8 1) Consider an independent third party evaluation study of the GFD capabilities, response metrics and resource allocations to evaluate if there needs to be changes to the current resource allocation model 2) Consider cooperative agreements with ESD8 and/or contiguous municipalities to elevate synergistic programs (co- located/co-operated) fire stations and boundary drops (enhanced auto-aid). 3) Consider making licensed buildings be required to be inspected annually. Also, consider a self inspection program for low risk properties and/or an inspection matrix as follows: • Low Risk – every 3 years • Medium Risk – every 2 years • High Risk – annually 4) Management should consider the implications for property owners and businesses when the Public Protection Classification (PPC) issued by the Insurance Services Organization (ISO) is not performed, as there may be a negative impact if not inspected annually. 1) Hired technical advisory; Community risk assessment and strategic plan for accreditation Spring 2021. 2) Finalized a 10 year contract; ESD 3& 5 auto- aid with Williamson, Travis, and Round Rock. Fire station 6 is now open in ESD8. 3) Not needed at this time. 1) Fire Marshall 2) Fire Protection Engineer PARTIALLY MITIGATED R24 Freedom of Information Act (FOIA)Non-compliance with FOIA requests City Secretary Robyn Densmore 6.22 1) When the transfer of FOIA request process is complete, consider documenting the process with written policies and procedures FOIA policy and procedure created and presented to Directors. City has a full time open records specialist. Additional open records specialist due to the continued increase in volume of open records requests. FULLY MITIGATED Continue annual staff trainings on open records requests Page 34 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R25 Police Failure The Police Department is inadequately equipped to respond to emergencies or responds in an unauthorized manner. Police Chief Wayne Nero 6 1) Develop the following Key Risk Indicators (KRI’s) and monitoring controls which may indicate a risk event is about to occur a. Increase in City crime rates b. Increase in police misconduct/brutality incident claims c. Increase in squad car accidents d. Excessive overtime e. Unexpected cost overruns/continuous unfavorable budget variances f. Increase in dismissed cases due to insufficient evidence, improper procedures or failure to follow legal standards for police 1) Metrics for monitoring are closely monitored for trends and shared with CMO and Council. These metrics guide decisions made by the Police chief. B.) Every incident is reviewed/investigated, monthly management report reviewed, and guardian tracking has an early warning system for personnel exhibiting certain performance indicators that triggers higher level review of officer C.) Reviewed and investigated and included in monthly mismanagement report and added to officers file for tracking of patterns. D.) OT monitored every pay period with various measures and historical reviewed E. Costs tracked internally and in workday FULLY MITIGATED R26 Talent Management Organization lacks a clear assessment and evaluation process to align qualified employees with specific business requirements and needs. HR Director Tadd Phillips 5.42 1) Have HR department work collaboratively with business lines to gain in depth knowledge of resource needs and constraints 2) Consider using an outside party for diversity in pre-hire assessments 1. Directors oversee their departments and align those best qualified to fill gaps in their organization through promotion or lateral shifts. FULLY MITIGATED Learning and development survey was conducted , city staff were asked to identify their needs for professional development. R27 Records Management No records management policy is in place, adhered to, or is inadequately designed. Records Program Manager Cynthia Conomos 5.27 1) Formalize Records Management policy regarding digital records and communicate to all departments 2) Consider additional training on electronic records management 3) Consider digitizing Parks & Recreation forms 1) Records management program has an existing policy from 2015, revised in 2019. Team is currently in the process of their records management survey. 2) Began a finance electronic record cleanup to help clear records that met retention and organize files for Finance. 3) Digitizing forms in progress Records specialist to maintain with the rate of new requests FULLY MITIGATED Records team is working with all departments on their records retention program and conducting training. Page 35 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R28 Regulatory Filings Failure to comply with regulatory filings such as GASB, EPA, etc. Controller Elaine Wilson 5.2 1) Agency (EPA) and Texas Commission on Environmental Quality (TCEQ) permit reports every 3-5 years 2) Finance prepares annual CAFR and SEFA which is submitted to the clearinghouse 3) Customer Care prepares annual filings on storm water use survey breaking out how much water was taken in to the system. 4) City of Georgetown has an exemption from complying and filing necessary reports mandated by Senate Bill 898 (reducing energy consumption in City owned facilities) & administered via the State Energy Conservation Offices (SECO) because of the 100% renewable designation. 5) Customer Care is required by TCEQ to report water quality testing results to customers on an annual basis. Deadline for customer communications is 7/1. GUS must certify with TCEQ by 5/1 that we provided water quality testing results to water purveyors that obtain wholesale water from GUS. 6) Energy Services relies on outsource provider Snyder Engineering for all regulatory findings 7) Utility services is subject to an annual requirement with the ERCOT to validate that a risk management plan is in place 8) Airport has a significant amount of regulatory filings ranging from EPA, TCEQ, Stormwater, Airplane inventory, and Property Taxes through MCAT. Use Microsoft Outlook as reminders 9) Fire Dept. has numerous state health services filings regarding training, certifications, incidents, fatalities, etc. 1) Each department is responsible for compliance at the state and federal level and they do so regulalry to comply with deadlines. FULLY MITIGATED R29 Succession Planning Leadership talent within the organization is insufficiently developed to provide for orderly succession in the future. HR Director Tadd Phillips 4.39 1) The City should consider an outside party to implement a formal Succession Plan 2) Consider a mentor shadowing program to protect the City against unplanned terminations or leaves of absences 1) Engaged leaders program allows for leadership development. Directors informally plan succession by training assistant directors or identifying d individuals they believe might be right for the job. National searches are done externally to also fill roles with the best candidate. 2) City is establish its organizational development department within HR which will facilitate the creation of programs that will bolster professional development and any other needs of staff identified in the City-wide needs assessment. PARTIALLY MITIGATED Learning and development survey was conducted , city staff were asked to identify their needs for professional development. Several departments have incorporated cross-training and succession planning into their operations. Page 36 of 173 RISK ID Risk DESCRIPTION Risk Owner Contact Residual Risk MITIGATION STEPS IDENTIFIED COMPLETED ACTION NEEDS RESPONSE STATUS NEXT STEPS RESPONSE RISK LOG RISK ASSESSMENT R30 Budget and Planning Budgets and business plans are not realistic, based on appropriate assumptions, based on cost drivers and performance measures, accepted by key managers, or useful or used as a monitoring tool. Finance Director Leigh Wallace 3.24 1) Certain departments such as utilities, water, electric, etc. count on supplemental data to prepare their budget (see Data Governance risk #27). We recommend management validate and document the completeness and accuracy of assumptions for all budget line items 2) Management should set a clearly defined threshold for all material variances to be explained (e.g. +/-XX% and $YY,YYY) 1. New business plans were developed tying KPI's with the goals of that department and the mission. 2. Budget process requires several reviews and checks by analysts and executives to ensure budget lines are appropriate. The budget development module of the Workday ERP system is currently being implemented. Finance participates in the rate studies and supplemental consultant financial models for the utilities. PARTIALLY MITIGATED 1) Create a budget with a more detailed 5 year outlook R31 Tax Non-compliance with state or federal tax law. Controller Elaine Wilson 3 1) Consider the creation of a master tax filing schedule and reporting to City Manager N/A NOT MITIGATED 1) Create master tax filing schedule after Workday implementation R32 State/Federal Regulations Failure to comply with new or existing federal or state regulations. Controller Elaine Wilson 2.44 1) Develop a Citywide license and CPE tracking system 2) Develop a process to ensure all City playgrounds comply with ASTM F1487-07. The code does not require a formal inspections process, just that the City complies with the ASTM F1487-07 standard 1) Workday has capability to track development and performance, but is not being used as the city develops it learning and development program 2) City utilizes third party's to design and construct playgrounds who are aware of state and federal regulations PARTIALLY MITIGATED 1) Consider tracking CPE's through Workday R33 Leadership The people responsible for the important City processes do not or cannot provide the leadership, vision, and support necessary to help employees be effective and successful in their jobs. CMO David, Laurie, and Wayne 2.42 1) The City should consider an upward feedback program to validate lower levels of employees are satisfied with management’s performance 1) Currently focused feedbacks are in place which are a two-way feedback of the employee and supervisor; Supervisors are evaluated in 360 evaluations by peers; employee engagement surveys are done bi- annually and provide a feedback mechanism as well anonymously 2) More regular feedback is encouraged with the use of the Diamond Drop program FULLY MITIGATED IMPACT / OCCURRENCE LIKELIHOOD LEVEL 2018 Risks Fully Mitigated Partially Mitigated Not Mitigated HIGH MEDIUM LOW HIGH 5 2 3 0 5 17 11 MEDIUM 17 5 12 0 LOW 11 6 4 1 Fully Mitigated Partially Mitigated Not Mitigated Total 33 39%58%3% 13 19 1 2018 Risks TOTAL REGISTER DROPDOWN KEYS IMPACT / OCCURRENCE LIKELIHOOD LEVEL MITIGATION STATUS Page 37 of 173 Risk Mitigation Report Page 38 of 173 OVERVIEW •Introduction •2018 Risk Assessment •Mitigation Completed •Near Term Actions Page 39 of 173 RISK CYCLE 1. Risk Identification 2. Risk Assessment 3. Risk Mitigation, Planning, and Implementation 4. Risk and Mitigation Tracking Page 40 of 173 DEPARTMENTS/DIVISIONS •City Secretary •City Manager’s Office •Controller •Emergency Management •Facilities •Finance •Fire •Human Resources •Information Technology •Parks •Police •Purchasing •Records •Utility (Customer Care, Water and Electric) Page 41 of 173 RISK UNIVERSE City of Georgetown Risk Universe Access to Talent IT Security Awareness, Training, and Education Billing for Citizen Services IT Third Party Roles and Responsibilities Budget and Planning Leadership Composition of Tax Base Legislation Disaster Recovery/Business Continuity Physical Security Emergency Notification System Failure Police failure Fire Department Failure Records Management Freedom of Information Act (FOIA)Regulatory Filings Fraud Segregation of Duties Grant Obligations State-Fed Regulations Health & Safety Succession Planning IT Access Management Talent Management IT Asset Management: Data Classification Tax IT contingency Plan Utility market IT Critical Security Event Identification Utility Outage IT Cybersecurity Governance Model Vendor Reliance IT Incident Response Management Page 42 of 173 11 14 14 15 12 14 12 14 14 14 15 19 14 13 14 14 9 14 13 12 12 14 14 12 14 4 4 1 2 3 2 2 3 1 2 4 3 1 1 6 4 4 2 3 1 1 2 2 3 3 3 1 4 3 1 1 1 1 4 3 3 3 0 5 10 15 20 25 30 AIR ASV ATT COD COM CRT CUS CVB ECO ENG FIN GFD GPD GUS PLH HUR BINS ITS LIB MGR PRK SEC SWR TSP WSV 2018 Residual Risks by KBD Low 1-8 Med 9-16 High 17> Page 43 of 173 MITIGATION SUMMARY IMPACT / OCCURRENCE LIKELIHOOD LEVEL 2018 Risks Fully Mitigated Partially Mitigated Not Mitigated HIGH 5 2 3 0 MEDIUM 17 5 12 0 LOW 11 6 4 1 Total 33 39%58%3% Page 44 of 173 SIGNIFICANT CHANGES SINCE 2018 •Electric Utility -Energy Portfolio Management •Reorganization of City •Workday ERP •COVID-19 •Impact On FY2020 Budget And Beyond •Lost EMS iPad •Possible HIPAA Breach •Senate Bill 2 (revenue caps) •Shot Clock Legislation •Back-Up Data Center Page 45 of 173 MITIGATION-INFORMATION TECHNOLOGY •Cybersecurity Policy •System and Network Contingency Plan •Security Information and Event Management System •IT Security and Awareness Training •Secondary Back-Up Data Center •Department of Homeland Security Audit Page 46 of 173 MITIGATION-PUBLIC SAFETY •HIPAA Audit •Guardian Tracking –Police Performance Management Software •CommUNITY Advisory Task Force •Police Training –Arbinger Institute •Replacement of Police Body Cameras •Fire Station 6 & 7 Page 47 of 173 MITIGATION •Emergency Management •COVID -19 Response •Hazard Mitigation Action Plan •City Secretary’s Office •Freedom of Information Act •Records Management •Facilities •Facility Access Policy •GMC and LWW Remodel Page 48 of 173 MITIGATION –CITY MANAGER’S OFFICE •Organizational Performance Management •Departmental Business Plans •Legislative Advocacy Page 49 of 173 MITIGATION -FINANCE •Financial and HR Management –Workday •Internal Audit Plan •Fee Collection Revenue •Hotel/Motel •Franchise Fees •Airport Revenue •Sales Tax Audit of City Enterprise Revenue Page 50 of 173 MITIGATION –HUMAN RESOURCES •Organizational Development •Organizational & Operational Excellence Office (OOE) •Learning and Development Coordinator and Plan •Policy Updates •Temporary COVID -19 Related •Workday Implementation •Safety and Risk Management Team •Citywide Page 51 of 173 MITIGATION -UTILITIES •Weaver Assessment •Cash Receipt Review •UMAX Business Process Mapping •Gartner Assessment •Customer Information System (CIS), Advanced Metering Infrastructure (AMI) and Meter Data Management (MDM) systems Page 52 of 173 MITIGATION -ELECTRIC •Energy Risk Management Program •Risk Oversight Committee •Risk Management Committee •3rd Party Electric Portfolio Management •Electric Advisory Board •Line Extension and Meter Connect Revenue Page 53 of 173 MITIGATION -WATER •Risk Assessment •Succession Planning •Water Rate Study •Long Term Water Planning •System Interconnects •Capital Improvement Projects •Water Leak Detection Page 54 of 173 NEAR TERM ACTIONS Conduct a citywide operational and enterprise risk assessment every 5 years- with the next study slated for FY23 Complete Hazard Mitigation Plan Implement consultants’recommendations as a result of the following studies: o Gartner Assessment of CIS/AMI/MDM systems o HIPAA Audit by SHI Page 55 of 173 NEAR TERM ACTIONS (Cont.) Finalize and initiate internal/external audit work plan Process improvement: o Streamline purchasing process and create training for power users to ensure compliance with procurement laws o Integrated Council agenda process across the City Manager’s Office,City Secretary’s Office,City Attorney’s Office and Purchasing department as well as creating and implementing training for power users on the agenda process Overall review every 2 years of citywide and departmental policies and procedures Providing public dashboards of departmental performance management metrics Page 56 of 173 QUESTIONS? Page 57 of 173 City of Georgetown UMAX Process Evaluation Points for Consideration (PFC) Matrix September 2018 Area Ref #Condition Risk or Exposure Risk Rating Recommendation PFC Type Management Response JANUARY 2019 FINAL RESPONSE NOVEMBER 2020 Mitigation Status Status Action Item No Category NC-01 The City of Georgetown manually enters online customer application information into the UMAX system when setting up new customer accounts. The City of Georgetown may experience inefficiencies in processing online customer applications and opportunities for data errors. Low The City of Georgetown should inquire with the vendor and determine if the online application can be integrated into UMAX in the appropriate corresponding fields. Integration Management's Response: Not originally scoped in the CIS project, however will work with vendor to determine a cost estimate and timeline for enhancement. Responsible Party: Customer Care, Business Systems, IT Implementation Date: 2019-20 Customer applications (for initiation (NC-01) and cancellation of service) are accepted on the utility website via an on-line form (Formstack). The application is then automatically routed to the Account Management workgroup to enter the information into UMAX. An automated process within the CIS system (via their CSS customer portal) is available on the more recent CLOUD 365 version of the CIS. This enhancement would require additional funds to implement in our current ONSITE version of the software. Not Mitigated Not Started Scope in new CIS upgrade No Category NC-02 The City of Georgetown does not have a process in place for reconciling customer accounts that are subject to deposits in UMAX with the General Ledger deposit account. The City of Georgetown could waive deposits for customers who do not meet the approved criteria. Moderate The City of Georgetown should develop a report to reconcile the customer accounts in UMAX that are subject to a deposit, with the value of the General Ledger deposit liability accounts. Reporting Management's Response: Developing ad hoc reporting tools to assist with analysis Responsible Party: Customer Care, Business Systems, IT Implementation Date: 2018-19 Deposits are automatically charged to all new accounts set up in UMAX. Reps can waive the deposit (based on established criteria) in the UMAX system and must include a reason code. A report that provides a listing of all accounts set up during a date range, was created and is reveiwed by management on a monthly basis. Mitigated Complete No Category NC-03 The City of Georgetown has procedures in place that require another employee to review customer application information manually entered into UMAX for completeness and accuracy. However, UMAX does not restrict Customer Care Representatives from reviewing their own application data entries. The City of Georgetown may set up new customer accounts incompletely or inaccurately within the UMAX system. Moderate The City of Georgetown should consider implementing functionality in UMAX that will restrict Account Management personnel from reviewing entries performed by the same user. Alternatively, the City of Georgetown could assign a second user ID to be used, in times of staff shortages, for personnel to review their own work accompanied by a report that is reviewed by UBO management. User Access Management's Response: Review of UMAX user access to determine appropriate segregation of duties within current staffing levels Responsible Party: Customer Care, Business Systems, IT Implementation Date: 2019-20 This is related to NC-01 above. As mentioned above, the Account Management workgroup enters the application information into the UMAX system and a member of the Billing workgroup reviews the data entered and identifies any anomolies. Mitigated Complete Billing and Invoice, Usage Reconciliat ion BI-01 The City of Georgetown does not have procedures in place to reconcile meter reads and customer account data transfers between UMAX and UCENTRA. Nightly, UMAX transfers customer account information to UCENTRA, so UCENTRA knows which utility meters require readings. On the billing read date, UCENTRA automatically obtains meter reads and generates a report of meter read data. The report containing the utility usage data is manually uploaded to UMAX. Currently, Billing staff do not perform a reconciliation of the transfer of customer account information or imported meter reads between UMAX and UCENTRA, to ensure that the information is accurate and complete. The City of Georgetown may have understated or overstated meter data and therefore, have an understated or overstated revenue account. High The City of Georgetown should implement a process to monitor the utility data transferred between UCENTRA and UMAX, to ensure data transfers are complete and accurate. This can be achieved by reviewing hash totals for imports or verifying record counts for each file transfer. Reporting Management's Response: Working with vendors to determine best approach in determining report and assigning role responsibilities. Responsible Party: Customer Care, Business Systems, IT Implementation Date: 2018-19 This risk was somewhat mistated. Meter readings from the MDM system are automatically uploaded in the UMAX software. Verification of file data is handled in the middleware software where an error file is produced if the data upload errors. IT advised that the recommendation to review hash totals for the imports was a project that they have been trying to get time on Rick’s schedule to work on. Unfortunately he is pretty busy and we have not been able to get to this one. At this time that item has still not been resolved. That project will roll into this year IT projects to get completed. Not Mitigated Not Started IT project plan for 2020-21 Billing and Invoice, Usage Reconciliat ion BI-02 The City of Georgetown has a target date to clear all billing errors within two business days. According to the Customer Care Manager, there are approximately 500 errors per billing cycle. They are currently clearing billing errors within three to five business days due to the back-log of customer care issues since the UMAX implementation. The City of Georgetown should strive to meet their target of clearing billing errors within one business day. The City of Georgetown may not be recording revenue in the correct period or have unbilled revenue. Moderate The City of Georgetown should track the errors to determine the root cause of the issues. This would allow the errors to be resolved in a systematic manner so the number of errors can be reduced in total. Business Process & Reporting Management's Response: Review business process & develop appropriate exception reports Responsible Party: Customer Care, Business Systems, IT, Implementation Date: 2018-19 The system and business processes have stabalized since implementation of the software in August 2018 and Customer Care is consistently meeting this metric 99.6% - 100% of the time - depending on billing cycle. Mitigated Complete Billing and Invoice, Usage Reconciliat ion BI-03 The City of Georgetown currently has not established criteria for what constitutes as a “significant” billing error. The City of Georgetown may not address errors consistently and as a result, have an understated or overstated revenue account. Moderate The City of Georgetown should develop criteria to determine which billing errors are significant for the billing error supervisory review process, including quantitative and qualitative considerations, to be used consistently by all Billing supervisory personnel. Business Process Management's Response: Review and document business process & criteria Responsible Party: Customer Care Implementation Date: 2018-19 An approval level for billings errors has been incorporated into the UMAX system and provides an automated workflow for Review. Billing error adjustments are routed for approvals based on monetary volues. Billing adjustments are primarily used for water leak adjustments. Mitigated Complete Billing and Invoice, Usage Reconciliat ion BI-04 The City of Georgetown does not currently have criteria or a documented policy to limit the number of times estimates can be used to create an invoice on customer accounts or the number of consecutive months a customer’s bill can be estimated. The City of Georgetown may estimate certain customer accounts repeatedly and have an understated or overstated revenue account. Moderate We recommend the City of Georgetown develop and implement a formal policy with criteria for the number of times customer accounts can be estimated or the number of consecutive billing periods before requiring an on-site meter read. Business Process Management's Response: Review current practice and incorporate policy into Ordinance Responsible Party: Customer Care Implementation Date: 2018-19 A Policy was developed and implemented whereby metered accounts will not be estimated for more than 2 consecutive months. (attached)Mitigated Complete Finalizing Policy Billing and Invoice, Usage Reconciliat ion BI-05 The City of Georgetown does not have procedures in place to ensure that a person, other than the person who corrects billing errors, reviews the error correction prior to releasing the bill. The billing errors may not be appropriately resolved and will result in an overstated or understated utility revenue account. Moderate The City of Georgetown should consider creating separate duties for processing and approving billing error corrections, prior to the release of the bill. User Access - Segregation of Duties Management's Response: Review of UMAX user access to determine appropriate segregation of duties within current staffing levels Responsible Party: Customer Care, Business Systems, IT A 2-step validation process for meter reads exists in the Customer Care/Billing work group. The Billing group corrects the identified billing errors, the billing software then creates the bill, and another work group reviews the bills prior to release. Mitigated Complete Billing and Invoice, Usage Reconciliat ion BI-06 The City of Georgetown does not have procedures in place to verify that all bills are printed and provided to customers. Currently, customer bills are printed by DataProse two days after the billing date and sent to customers. After the bills are printed, the Customer Service Supervisor receives an automated email from Data Prose containing the total number of printed bills. This total is currently not being compared to UMAX to ensure accuracy and completeness. City of Georgetown customers may not receive their bills timely, which will cause an increase in days in accounts receivable. Moderate The City of Georgetown should develop and implement a formal process to reconcile the customer bills printed by DataProse to billing information in UMAX. Reporting Management's Response: Develop a reconcilation report between internal/external systems Responsible Party: Customer Care, Business Systems, IT Implementation Date: 2018-19 Bill information sent to the 3rd party bill print provider (currently Dataprose) is reviewed by the Manager. Manager also reviewed a monthly report of all Active Utility Contracts to verify that those contracts have all had billings associated with them during the period. Mitigated Complete Billing and Invoice, Usage Reconciliat ion BI-07 Utility accounts that are billed on a consolidated basis are only billed on the latest date of all the utility bills. This could cause the billings for some utility meters to be delayed into subsequent accounting periods. This also results in the need for complicated accruals at period ends to produce accurate financial statements. The revenue may be materially understated.High We recommend the Customer Care Director and Accounting department work together to estimate the accrual for unbilled revenue (including consolidated) at year-end and change the billing cycles to be the same for consolidated meters. Changing the billing cycles to be the same for consolidated meters will reduce the complexity of periodic accruals. Reporting Management's Response: This has been implemented. Year end revenue accruals provided. Working on moving consolidated accounts back to individual cycles. Responsible Party: Customer Care, Vendor Implementation Date: Reconcilation done - Consolidate accounts - 2018-19 Consolidated Bill Cycles outside City limits, were removed and the accounts were configured to bill with the weekly cycle billings based on location. The accrual report was improved, further standardized, and is reviewed in the executive management Utility Finance Committee (UFC) meeting on a bi-monthly basis. Mitigated Complete Adjustment s and Cancellati ons AC-01 The City of Georgetown currently reviews all customer account adjustments on a monthly basis and refunds on a weekly basis, for appropriateness. However, currently there is no documentation of the review. There isn't sufficient evidence to support the review and the review may not be performed timely. Low The City of Georgetown should develop and implement procedures to formally document the review of customer account adjustments and refunds. Business Process Management's Response: Review and document business process Responsible Party: Customer Care Implementation Date: 2019-20 Practice was documented and a Policy developed (attached). Mitigated Complete Finalizing Policy end of December The following points for consideration (PFC) have been identified through our assessment of the in-scope areas and processes at the City of Georgetown. This list is presented for management's review and consideration of items identified through the date of this communication. Management should consider implementing the recommendations in order to address and mitigate risks surrounding the processes. Page 1 of 3 Page 58 of 173 City of Georgetown UMAX Process Evaluation Points for Consideration (PFC) Matrix September 2018 Area Ref #Condition Risk or Exposure Risk Rating Recommendation PFC Type Management Response JANUARY 2019 FINAL RESPONSE NOVEMBER 2020 Mitigation Status Status Action Item The following points for consideration (PFC) have been identified through our assessment of the in-scope areas and processes at the City of Georgetown. This list is presented for management's review and consideration of items identified through the date of this communication. Management should consider implementing the recommendations in order to address and mitigate risks surrounding the processes. Adjustment s and Cancellati ons AC-02 The City of Georgetown does not currently have a system restrictions to prevent Account Management personnel from reviewing their data entries related to customer requests for account cancellations. The City of Georgetown currently has a procedure in place that requires a different person than the person who prepared a customer cancellation request, to review the cancellation information in UMAX. However, the UMAX system does not automatically separate duties by requiring a different login to review a customer cancellation request prepared by a different employee. A Customer Care Representative has the ability to review their own work when processing and reviewing cancellation requests. The City of Georgetown may experience inaccurate information in the UMAX system related to customers' requests for service cancellation. Moderate The City of Georgetown should consider implementing functionality in UMAX that will restrict Account Management personnel from reviewing entries performed by the same user. Alternatively, the City of Georgetown could assign a second user ID, to be used in times of staff shortages, for personnel to review their own work accompanied by a report that is reviewed by UBO management. User Access Management's Response: Review of UMAX user access to determine appropriate segregation of duties within current staffing levels Responsible Party: Customer Care, Business Systems, IT Implementation Date: 2019-20 Customer applications (for initiation and disconnection/cancellation of service (AC-02)) are accepted on the utility website via an on-line form (Formstack). The application is then automatically routed to the Account Management workgroup to enter the information into UMAX. An automated process within the CIS system (via their CSS customer portal) is available on the more recent CLOUD 365 version of the UMAX software. This enhancement would require additional funds to implement in our current ONSITE version of the software. This is not a financial risk - cancelling/disconnecting the account in UMAX autoatically generates a work order to deactivate the service so monetarily the utility is not negatively affected. Partially Mitigated Complete Adjustment s and Cancellati ons AC-03 The City of Georgetown currently doesn’t have a review process in place to ensure initial and final meter reads entered into UMAX from ELSTER are accurate. The City of Georgetown may have an over or understated electric and water revenue account and accounts receivable. Moderate We recommend the City of Georgetown develop and implement processes and procedures to formally review the input of initial and final meter reads entered into UMAX from ELSTER. Business Process Management's Response: Review and document business process Responsible Party: Customer Care Implementation Date: 2019-20 UMAX software validates the MDM Readings when they are uploaded into the UMAX system base don criteria specified in the softwares configuration (i.e. average usage, % high, %low)Mitigated Complete Accountin g Interface AR-01 The Utility Billing Office edits the file exported from UMAX containing all daily transaction activity in order to correct errors and upload the file to INCODE. The Utility Billing Office doesn't have or isn't aware of an alternate process or procedure to correct the errors in UMAX instead of the source file. Data imported into INCODE may be incorrect or inadvertently altered. Moderate The Utility Billing Office should cease manually editing the copy of the export file that is saved to the Customer Care Operations Manager's computer in order to correct errors and post to INCODE. Additionally, we recommend that the City of Georgetown work with ITINERIS to learn procedures and features available in UMAX to correct errors in the Export File and re-run the nightly batch process in order to import and post the corrected Export File to INCODE. Future systems should have an Integration Management's Response: Implemented "no change" policy for file upload. CIS will be integrated with new ERP Responsible Party: Customer Care, Finance, Business Systems, IT Implementation Date: 2018-19 Practice was documented and a Policy developed (attached). Mitigated Complete Finalizing Policy Delinquent Accounts DA-01 The City of Georgetown does not have procedures in place to review and approve reversals of incorrect late payment fees on customer accounts. Currently, the Customer Care Operations Manager reviews the listing of delinquent accounts to identify accounts incorrectly coded as being delinquent. The late payment fee reversal in the customer's account in UMAX is also performed by the Customer Care Operations Manager. The City of Georgetown may experience a loss in revenue from increased late fee reversals. Moderate The City of Georgetown should require a secondary review of late payment fee reversals in customer accounts in UMAX. Businss Process Management's Response: Review and document business process & develop appropriate reports Responsible Party: Customer Care Implementation Date: 2019-20 Practice was documented and a Policy developed (attached). Mitigated Complete Finalizing Policy Delinquent Accounts DA-02 The Utility Billing Office only writes off bankrupt and closed accounts older than one year, which is inconsistent with accounting's methodology to write off bad debt on all accounts over 180 days. The City of Georgetown may have an understated bad debt expense account and overstated accounts receivable account balance. Moderate The City of Georgetown should consistently enforce its policy to write-off accounts older than 180 days, across all departments. The Accounting department, should review the write off to ensure consistency and accuracy. Business Process - Budget Management's Response: Review and document business process; develop appropriate reports Responsible Party: Customer Care, Accounting, Business Systems, IT Implementation Date: 2019-20 Customer Care, Finance, Utility Directors are currently working through a plan to provide adequate funding that adheres to the policy. Partially Mitigated Started Increased budget for bad debt write- off in Water and Electric to get closer to what is needed Delinquent Accounts DA-03 The Utility Billing Office is currently limiting the bad debt write-off to $300,000 per year. The City of Georgetown may be understating the bad debt expense by not recording the bad debt expense in the appropriate period. Moderate The Utility Billing Office should write off bad debt in accordance with the City of Georgetown accounting policy and the Accounting department should be involved in bad debt estimations and write-offs. Business Process - Budget Management's Response: Review and document business process; develop appropriate reports Responsible Party: Customer Care, Accounting, Business Systems, IT Implementation Date: 2019-20 Customer Care, Finance, Utility Directors are currently working through a plan to provide adequate funding that adheres to the policy.Partially Mitigated Started Increased budget for bad debt write- off in Water and Electric to get closer to what is needed Delinquent Accounts DA-04 The City of Georgetown does not currently perform a reconciliation of A/R Aging Report to the A/R Sub-Ledger. The City of Georgetown may have under or overstated Utility Account Receivable accounts. Moderate We recommend the City of Georgetown develop and implement a process to perform a reconciliation of the Accounts Receivable sub-ledger to the Aging Report. Reporting Management's Response: Review and document business process; develop appropriate reports Responsible Party: Customer Care, Accounting, Business Systems, IT Implementation Date: 2019-20 An aging report was created and is reviewed in the executive management Utility Finance Committee (UFC) meeting on a bi-monthly basis. Mitigated Complete Delinquent Accounts DA-05 The City of Georgetown methodology for the Allowance for Bad Debt is 5% of ending Account Receivable-Utility balances after write- off’s are performed. There is no written documentation to support the Allowance for Bad Debt methodology and the methodology does not include a "look back" evaluation to compare the estimate to historical trends. The City of Georgetown may experience inaccurate bad debt estimates and inaccurate financial statement accounts. Moderate The City of Georgetown should document the rationale for calculating the adjustment based upon 5% of the year- end accounts receivable balance and periodically update the methodology to ensure estimates align with historical experience. Business Process - Year End Management's Response: Review and document business process; develop appropriate reports Responsible Party: Customer Care, Accounting, Business Systems, IT Implementation Date: 2019-20 Budget is made on the existing data of bad debt over 180 days.Mitigated Complete Will double check the FY21 Budget Payment Receipts PR-01 The City of Georgetown does not have procedures to reconcile customer payments received by the City to customer payments recorded in the UMAX system. Currently, Customer Care Representative agrees the total number and amount of customer checks received to check totals included in the payment file which is imported into UMAX. No reconciliations are currently being performed for other payment types such as electronic checks, online payment, auto draft payments, and AVR payments. The City of Georgetown may not have a complete record of payments received in UMAX. High The Customer Care Representatives should develop a process to compare all payments received to payment applied in UMAX to ensure all payments were applied to customer accounts and ensure that all payments were deposited. Reporting Management's Response: Developing ad hoc reporting tools to assist with analysis Responsible Party: Customer Care, Business Systems, IT Implementation Date: 2018-19 This reconciliation is automatically done through the deposit Process. Any differences are flagged as exceptions which are then reviewed and corrected. Customer Care currently does reconciliations for all payment types as well as reviewing payment totals with the bank deposits and Mazik. Mitigated Complete Page 2 of 3 Page 59 of 173 City of Georgetown UMAX Process Evaluation Points for Consideration (PFC) Matrix September 2018 Area Ref #Condition Risk or Exposure Risk Rating Recommendation PFC Type Management Response JANUARY 2019 FINAL RESPONSE NOVEMBER 2020 Mitigation Status Status Action Item The following points for consideration (PFC) have been identified through our assessment of the in-scope areas and processes at the City of Georgetown. This list is presented for management's review and consideration of items identified through the date of this communication. Management should consider implementing the recommendations in order to address and mitigate risks surrounding the processes. Payment Receipts PR-02 The City of Georgetown does not currently reverse or "void" incorrect payments in the MASIK cashiering system. The City of Georgetown reverses or "voids" payments by reversing the entry directly in the customer account in UMAX. This results in a difference in payment information between the MASIK and UMAX systems. The City of Georgetown may have incorrect customer account payments and as a result, have an under or overstated revenue account. Moderate The City of Georgetown should discontinue the procedure of reversing void payments directly in customer accounts in UMAX and enable the negative payment entry feature in the MASIK cashiering system to immediately reverse an incorrect or "void" payment as soon as the transaction occurs. Additionally, the City of Georgetown should develop procedures for and conduct daily reviews of negative entries, as part of daily closing procedures. Business Process Management's Response: Process modified in UMAX; Supervisors are closing all cash drawers and reviewing all processed transactions Responsible Party: Customer Care Implementation Date: 2018-19 The "VOID" functionality was removed from the existing Cash Collection module. A corresponding credit to offset incorrect entries is used to ensure a record of the reversal.Mitigated Complete Payment Receipts PR-03 The City of Georgetown does not periodically reconcile the payment information in MASIK to the payment information in UMAX, specifically with regard to voided or incorrect payments. The City of Georgetown may have incorrect customer account payments and as a result, have an under or overstated revenue and accounts receivable account balance. Low We recommend the City of Georgetown reconcile voided payment information in MASIK to voided payment information in customer accounts in UMAX. These processes and procedures may involve developing or using existing reports in the UMAX, MASIK, or BI Reports systems. Business Process Management's Response: Developing ad hoc reporting tools to assist with analysis Responsible Party: Customer Care, Business Systems, IT Implementation Date: 2018-19 Mazik doesn't have voided payments. Rather it allows for Credit Payments which are then taken into account as part of the Mazik payment reconciliation.Mitigated Complete Payment Receipts PR-04 The City of Georgetown does not have procedures in place to monitor the Unapplied Credits General Ledger account or the aging of transactions within the account. The City of Georgetown may be susceptible to inaccurate liabilities, be required to refund money to customers, or escheat funds to the state. Moderate We recommend the Accounting Department implement procedures to reconcile and review the Unapplied Credits GL account on a monthly basis. Reporting Management's Response: Developing ad hoc reporting tools to assist with analysis Responsible Party: Accounting, Customer Care Implementation Date: 2018-19 Unapplied credits flow to the GL. Staff can run a report to reconcile and review.Not Mitigated In Progress LJZ will review report and compare to GL account by the end of the year. General GN-01 The City of Georgetown has not developed procedures to document the process and controls within the key processes reviewed: New Customer Set Up, Billing & Invoicing, Adjustments Disputes and Cancellations, Payment Processing, Unapplied Credits, Delinquent Accounts, Accounts Receivable Write-Offs, Transaction Imports, and Permit Fee Reconciliation. The employees may not utilize the same process and controls if the process isn't documented. Additionally, new employees will not have complete information on process and controls when key personnel leave City employment. Low The City of Georgetown should develop procedures and document controls for each process identified. Documentati on Management's Response: Working on this as part of the GUS standardized procedure project Responsible Party: Customer Care Implementation Date: 2018-19 Procedures and documented controls were developed and implemented based on existing practices with the exception of unapplied credits. Mitigated Complete Page 3 of 3 Page 60 of 173 Make the mark. CITY OF GEORGETOWN, TEXAS SEPTEMBER 25, 2018 Citywide Risk Assessment Results & Next Steps Page 61 of 173 September 25, 2018 Mr. David Morgan, City Manager City of Georgetown 113 E. 8th Street Georgetown, Texas 78627 Dear David, We have performed the procedures as agreed upon in our consultation agreement dated November 7, 2017. Those procedures were applied solely to provide consulting services to assist City of Georgetown, Texas (“City”) in developing a Citywide Risk Assessment (CRA) to understand the risk environment and internal control structure of your functional areas and processes to identify key risks and the internal controls over those risks. The results of this report contain our assessment of the key risks to your organization, rankings of current mitigation strategies, treatment plans to assist in the management of key risks, and emerging best practices in government industry control environments. We were not engaged to, and did not perform an examination, the objective of which would be the expression of an opinion of City of Georgetown, Texas’s internal control environment. Accordingly, we do not express such an opinion. We were not engaged to perform any specific internal control testing procedures beyond inquiry of management and, therefore, we have not done so. Had we performed additional procedures, other matters might have come to our attention that would have been reported to you. This report is solely for the information and use of the management of City of Georgetown, Texas and is not intended to be, and should not be, used by anyone other than the specified party. We would like to recognize and thank the staff of City of Georgetown, Texas for the cooperation and courtesy extended to us throughout this process. Sincerely, Doug Farmer, CICA Partner – Risk & Accounting Advisory Services Plante Moran, PLLC Page 62 of 173 TOC | Page Table of Contents Executive Summary 1 Project Scope and Approach 3 Risk Universe 4 Impact and Likelihood Criteria 5 Risk Assessment Results and Next Steps 7 Appendix A: Risk Treatment Action Plans 11 Appendix B: Information Technology Detail 40 Page 63 of 173 1 | Page Executive Summary Purpose and Introduction In 2017, staff updated the City’s Fiscal and Budgetary Policies to enhance the existing internal audit and risk program. The General Government and Finance Advisory Board and the Council added ongoing funding to the Finance Administration budget to support this change. As a first step in the program, the City procured a firm to perform a comprehensive risk assessment. The outcome of the assessment will be used to prioritize the steps to continue enhancing the audit program and mitigating risk. Plante Moran performed a Citywide Risk Assessment (CRA) of the City of Georgetown, Texas (“Georgetown”, “COG” or “City”) with the objective of helping the City achieve its strategic priorities and advance management’s process to identify, classify and mitigate risks to the organization. Our CRA services consisted of the following: 1. Interview key stakeholders to understand Georgetown’s viewpoint on risk management 2. Conduct interviews with key City Departments to assess inherent and residual risks of the risk universe 3. Assess the strength of Georgetown’s mitigating activities and risk treatment factors 4. Assignment of risk owners and actions steps for remediation plans, if necessary 5. Preparation of reports to management and Council detailing the results of our work and recommendations to manage risk and strengthen the control environment High Level Themes Noted: • The City is exposed to four high Information Technology (IT) residual risks. We recognize the City is currently in process of an ERP system upgrade and the status of these conditions will change in the near future: IT Cybersecurity, IT Asset Management: Data Classification, IT Access Management and IT Contingency Plan. See Appendix B for IT Risk Report. • The City lacks a clear process for the assignment and review of user access roles and responsibilities to achieve segregation of duties in three key business departments. We noted during discussions with Finance, Customer Care and Parks and Recreation one person can control more than two phases of a transaction exposing the City to unauthorized transactions and fraud risk. • The Georgetown Utility Service (GUS) electricity is a vertically integrated monopoly which is allowed in the State of Texas. The Texas Legislature granted an exception called OPT OUT of bundled services and this gets reviewed at each legislative session every two years. If this OPT OUT provision is rescinded, the City would still have the wires/ transmission equipment and would be the whole seller to the power companies but there would be significant effort and expense to the City to be OPT IN ready if the legislature changes position and the resulting transition would take about 2 years. • Management indicated several potential costly Texas legislative acts are due for review at future legislative sessions. • The City is challenged with documentation of operating policies and procedures. Currently, 15 out of 25 (60%) departments we interviewed have a lack of clearly written policies and procedures available to all employees. Page 64 of 173 2 | Page Project Approach and Scope Approach We met with management to develop the following: • Planning Meeting – This segment was dedicated to understanding the risks to key individuals in the organization. We worked with management to outline the risks impacting the City. • Ranking Criteria – Based on our conversations with key individuals, we created impact and likelihood criteria for grading / assessment of the risks. • Risk Assessment Interviews - We held risk assessment interviews with key individuals from key departments across the City to capture management’s view of inherent risks and mitigating activities. • Control Gaps & Observations – Using the information gained in the items above, we noted observations, identified the top residual risks to the organization, and offered recommendations for control and process improvements. Scope In context of this risk assessment, a “Key Business Department (KBD)” is defined as a vital business process, function or activity on which the organization spends a significant amount of financial or personnel resources to perform, or an activity over which they have primary responsibility within the City. The following 25 departments are considered KPD’s and in scope for this engagement: Key Business Departments (KBD) Listing 1. (AIR) Airport 14. (GUS) Georgetown Electric / (NRG) Energy Services 2. (ASV) Animal Services 15. (PLH) Planning/Housing 3. (ATT) City Attorney 16. (HUR) Human Resources 4. (COD) Code Enforcement 17. (BINS) Building Inspection Services 5. (COM) Communications 18. (ITS) Information Technology Services 6. (CRT) Municipal Court 19. (LIB) Library 7. (CUS) Customer Care / Conservation 20. (MGR) City Manager’s Office 8. (CVB) Convention & Visitor's Bureau 21. (PKR) Park & Rec 9. (ECO) Economic Development / Main Street 22. (SEC) Secretary / Records 10. (ENG) GUS Systems Engineering / GIS 23. (SWR) Solid Waste & Recycling 11. (FIN) Finance, Purchasing & Payroll 24. (TSP) Transportation 12. (GFD) Georgetown Fire Department 25. (WSV) Water Services 13. (GPD) Georgetown Police Department Plante Moran met with the department heads and key managers to discuss the risk universe, assess the inherent risks and document the key internal controls and mitigation strategies for each risk in the risk universe applicable to each department. Residual risk scores are calculated based on inherent risk minus strength of mitigation activities. Page 65 of 173 3 | Page Risk Universe A planning meeting was held with the City Manager and Assistant City Managers to co-develop a risk universe using a standard governmental entity risk profile customized to the Georgetown specifics for population, demographics, services offered, operations and complexity. The initial universe started with approximately 90 risks and the list was distilled down to the top 33 risks applicable to the City of Georgetown. We then met with each department individually to discuss the impact and likelihood to their department. It is important to note that not all 33 risks are applicable to every department. Only 14 out of 33 risks were determined to be citywide impacting all departments. The illustration below is the risk universe utilized for this assessment: City of Georgetown Risk Universe 1. Access to Talent 18. IT Security Awareness, Training and Education 2. Billing for Citizen Services 19. IT Third Party Roles & Responsibilities 3. Budget and Planning 20. Leadership 4. Composition of Tax Base 21. Legislation 5. Disaster Recovery / Business Continuity 22. Physical Security 6. Emergency Notification System Failure 23. Police Failure 7. Fire Department Failure 24. Records Management 8. Freedom of Information Act (FOIA) 25. Regulatory Filings 9. Fraud 26. Segregation of Duties 10. Grant Obligations 27. State-Fed Regulations 11. Health & Safety 28. Succession Planning 12. IT Access Management 29. Talent Management 13. IT Asset Management: Data Classification 30. Tax 14. IT Contingency Plan 31. Utility Market 15. IT Critical Security Event Identification 32. Utility Outage 16. IT Cybersecurity Governance Model 33. Vendor Reliance 17. IT Incident Response Management Note: the 14 bold risks were common citywide across all departments. The remaining risks were assessed on a case-by-case scenario by department. Information Technology risks were evaluated in three categories: 1) Centrally Managed, 2) Vendor Managed, and 3) Department Managed. Impact and Likelihood Criteria Key department personnel participated in the risk interviews to rank the risks to the organization using an impact and likelihood criteria developed with senior management. The impact and likelihood criteria table below is applied to each risk to assign the inherent risk. The inherent risk rankings are then used as the starting point to calculate residual risks. Impact Criteria Ranking 5 (high) 4 3 2 1 (low) Financial Impact: Expense or Lost Revenue >$150K $100K - 150K $50K - $100K $25K - $50K <$25K or Strategic Impact: Page 66 of 173 4 | Page Strategy/ Mission/ Legislature Failure to meet key strategic objective Major impact on strategic objective Moderate impact on strategy Minor impact on strategy No impact on strategy or Operational Impact: Reputation Extreme Severe Moderate Low None Process / System Shutdown > 7 Days 5 - 7 days 3 - 5 days 1 - 3 days < 1 day Compliance Impact: Regulatory - State/ Local/ HIPAA/ Debt Covenants Large-scale material breach of regulation Material breach but cannot be rectified Material breach which can be readily rectified Minimal breach which cannot be rectified Minimal breach which can be readily rectified Likelihood Criteria Ranking 5 (high) 4 3 2 1 (low) Probability of an event occurring in a given year: >20% 15 - 20% 10 - 15% 5 - 10% <5% or Event Occurrence (on average): Once a year or more 1 in 3 years 1 in 5 years 1 in 7 years 1 in 10 years Page 67 of 173 5 | Page Risk Identification and Ratings It is important to clarify the factors in determining the levels of risk as presented in the following departmental risk assessment graphs. For comparability purposes, risk is evaluated by distinguishing between types of risk and the following definitions are provided: INHERENT RISK – the perceived impact and likelihood associated with a process or activity that exists simply from the perspective of its current environment BEFORE consideration of mitigating activities such as insurance, internal controls or other risk treatment strategies. This assumes no significant actions taken by management to mitigate (address) those risks. For example, the City has inherent risks associated with its citizen demographics, funding sources, population, economic slowdown, structure of federal and state government, etc. This can then begin to be refined to the departments within the City government. RESIDUAL RISK – the level of impact and likelihood of an adverse event occurring to impede the City, Department, and/or Processes from achieving success AFTER identifying and testing of management’s mitigating activities and internal control structure. The citywide risk assessment considered primarily inherent risks, with limited identification of control risk as self-reported by management. We did not substantively test specific management controls in detail and therefore, do not render an opinion on the effectiveness of design nor the efficiency in implementation or existence. The ratings do not imply a judgment on how management is addressing risk and thus is not a specific assessment of management performance nor concludes on ‘Residual Risk’. Management will need to perform detail testing to determine: (1) if mitigation activities reported by management are actually in place, and (2) if the mitigation activities are designed and operating effectively. VELOCITY – the speed assessment of how quickly a risk will impact the organization: • Fast: These risks are becoming more relevant to Georgetown’s operations and can quickly impact the organization. Risks with a moderate to high residual risk ranking and fast velocity should be closely monitored as a risk event could occur quickly and without warning. • Moderate: No known or pending events suggest either an increase or decrease in the composite risk weighting. These risks will impact the organization at neither a fast nor a slow pace. • Slow: These risks will impact the organization over time and might require a playbook that extends over a longer period of time. Risk Assessment Results and Next Steps The following pages summarize the Risk Assessment Results from 3 different perspectives: Page 68 of 173 6 | Page Graph 1 - Net Risks by KBD 1: (1) Net Risks by Key Business Departments: the total number of risks from the Risk Universe that apply to each department. As noted earlier, 14 of the 33 risks have been identified as pervasive across all departments and the others are assessed on a case-by-case scenario. The net risk assessment by KBD revealed that Georgetown Fire Department, Information Technology Service2, Finance, Georgetown Police Department and Parks & Recreation fall within the high risk category based on Net Risks by Department. 1 Each department was assessed for the 33 risks outlined in the Risk Universe on p. 3. There are 14 risks that are pervasive across the City and the remaining risks were assessed on a case-by-case scenario. 2 For the purposes of risk ranking, certain Information Technology risks with similar mitigation activities and control objectives were combined for reporting purposes. The Risk Universe shows 8 IT risks and the detail IT Risk Assessment report is included in Appendix B has 11 risks. Page 69 of 173 7 | Page Graph 2 – Weighted Residual Risks by KBD: (2) Weighted Risks by Key Business Departments: the total number of risks weighted by rankings using the following weighting formula: Red 17 or > (3 points), Yellow 8-16 (2 points), and Green <8 to 5 (1 point), <4 (0 points). Therefore, the higher risk rankings carry a higher weighted risk. The Weighted Residual Risk by KBD reveals there are two (2) additional departments needing consideration as the ratio of high risks to total brings the residual risk to a high for Customer Service and Building Inspection Services, in addition to the KBD’s noted in Graph 1. Evaluation of these various factors provides indicators on prioritizing the potential Future State Risk Mitigation Activity recommendations outlined in Appendix A. Page 70 of 173 8 | Page Graph 3 – Citywide Composite Residual Risk Rankings X = Fast Velocity | = Moderate Velocity (3) City-wide Composite Residual Risk Rankings: the profile of consolidated highest ranking risks to the City regardless of KBD. As noted earlier, certain risks may only apply to a limited number of KBD and may be insignificant on a City-wide basis. Page 71 of 173 9 | Page Composite scores represent a cross-section view of risk without regard to KBD. The composite scores above are an average of the risk rankings for only the departments where the risks are applicable. For example, Billing for Citizen Services is a risk to the City but only applies to 13 out of 25 KBD’s. The scores above are an average of those applicable departments excluding the departments that do not do billing. Results from this graph illustrate the severity of risk regardless of the department which they fall under. Residual Risk Dispersion The following graph depicts the dispersion of the risk events between high, medium, and low residual risk (including the consideration of existing control or mitigation activities) categories. High indicates that the residual risk score fell beyond Georgetown’s risk tolerance. These risks require the most attention and strongest mitigation strategies. Medium indicates that the residual risk was within tolerance. Low indicates that the risk fell well below Georgetown’s tolerance. It may be possible that some of these risks are being over mitigated. Next Steps 1. Strengthen and implement mitigating activities for each risk to bring the residual risk down into tolerance (see Risk Treatment Action Plans in Appendix A). 2. Assign risk owners and control owners and determine what information needs to be reported back to the City Manager on a periodic basis (i.e., quarterly). 3. Identify a risk management resource to manage the risk owners and communicate all necessary information from the risk owners to the City Manager and City Council. 4. Risk Owners identify key risk indicators (KRI’s) for each risk. 5. Build execution playbooks for each risk treatment. RANK RESIDUAL RISK COUNT High > 16 7 Medium 8 – 16 14 Low < 8 12 Total 0 – 25 33 Page 72 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 10 | Page Recommended Risk Treatment Action Plans Page 73 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 11 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 1 IT Cybersecurity Governance Model A comprehensive Information Technology (IT) cybersecurity policy and procedures document has not been approved by management and communicated to all employees and relevant external parties, outlining responsibility and oversight for Information Security (IS) and policy administration. 21.00 IT Director 1) The City has a documented IT Acceptable Use Policy in place but it does not encompass an overall Information Security Program (ISP) containing the following elements: Purpose/Scope, Roles and responsibilities (including those related to regulatory requirements), Enforcement, Information Sharing, Data Classification, Information Risk Management (IRM), Data Backup and Retention, Data Destruction/ Retention Policy 2) Members of the IT department perform several duties beyond their originally assigned tasks and roles and responsibilities related to key initiatives such as Risk & Incident Management, Disaster Recovery & Business Continuity are not clearly defined 3) The IT department has taken measures in implementing security practices throughout the IS environment; however organizational cybersecurity risk management practices are not formalized, and risk is managed in an ad hoc/reactive manner; a citywide approach to managing cybersecurity risk has not been established 1) We recommend the City implement a governance framework that allows for the proper management of a successful ISP. An effective ISP involves participation from senior management to set the direction for proper information security practices, adequate staffing and compliance with policies 2) Further, we recommend the City adopt a practice of performing a Cybersecurity risk assessment periodically. The periodic approach may take either of the following approaches: (A) performing a full assessment every other year due to intensive resources required to facilitate such an exercise or, (B) a targeted approach done annually including: • revisiting this report findings and updating controls where appropriate, • re-assessing the City’s mitigation plan to update progress and note any further concerns, and/or, • selecting a few high-priority control areas (e.g. vendor management, or any business objective/goal identified by executive management) and re-assessing associated threats related to those areas The City is already taking several steps to comprehensively manage and enhance security: 1) Implementing IT Catalyst Plan – 5 year Strategic Plan 2) Developing documented policies to address various IT areas 3) Developing Cybersecurity Training 4) Conducted 2 security audits 5) Budgeting Lead System Security Analyst in FY19 6) Conducting PCI (Payment Card Industry) study 7) Implementing two factor authentication IT agrees that an Information Security Program (ISP) needs to be created. IT Immediate actions (next 12 months) 1. IT Cybersecurity Risk Assessment by the US Department of Homeland Security. 2. Determine best practices, implement security policies, and identify staffing/challenges to implement ISP. 3. Identify staffing needs to appropriately manage IT security challenges and ISP. IT future planned actions (12 - 36 months) 1. Continue Cybersecurity scanning on a yearly basis. 2. Implement ISP. 3. Assign security roles to existing staff and hire any security staff needed to manage an Information Security Program Page 74 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 12 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 2 Utility Market Exposure to fluctuations in the market price of utilities. 18.75 Deputy General Manager – Georgetown Utilities 1) The City has no physical risk and low financial risk from the power supply market. 2) ERCOT, the state run system operator, manages and controls the physical matching of supply to demand statewide, thus eliminating the City’s exposure to physical supply risk. 3) As a Utility within ERCOT, the City takes delivery of all power from ERCOT at the market rate, thus exposing inherent financial risk. 4) The City mitigates the inherent financial risk through hedging demand with offsetting, fixed-price power purchase agreements (PPA’s) and hedging transmission congestion charges through congestion revenue rights (CRR’s) which are forward contracts on congestion. Additional residual financial risk is further mitigated through the industry standard utility practice of passing the variance though to customers as a power cost adjustment factor (PCA). The City does currently use a form of the PCA pass- through, however it is not the current practice to adjust this on a monthly basis. 5) The City has a diversified portfolio of PCA’s with both short and long terms. The two principle agreements are a 20 year wind and a 25 year solar contract. Together, these two contracts exceed the City’s current needs and will accommodate growth. 6) The long duration power agreements at fixed price provide long term rate stability through a long term hedge. 7) A utility rate study is in progress, to update the most recent study from 2012 8) Quarterly financial updates are presented to the GUS Board and the City Council. 1) Continue to enhance the City’s forecasting tools and techniques to increase granularity and improve accuracy. 2) Continue development of a strategy to meet future peak demand growth with distributed generation and storage rather than remote central generation to mitigate exposure to transmission congestion. The City will continue its efforts to mitigate exposure to the utility market: 1) Implementing rate study recommendations 2) Will grow reserves for contingency and market fluctuations to comply with Fiscal & Budgetary Policy 3) Will perform rate study every 3 years 4) Providing quarterly reports to GUS board 5) and City Council. Page 75 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 13 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 3 IT Asset Management: Data Classification The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to business objectives and the organization’s risk strategy. 17.00 IT Director 1) The City has identified and catalogued its hardware and software via a tool called Lansweeper. This approach ties into an overall information flow enforcement (NIST SP 800-53 Rev. 4 AC-4) which ensures the confidentiality, integrity, and availability of critical data when defined and enforced 2) In addition, the City also maintains a manual list of all inventoried applications/ software 3) An information classification policy does not currently exist 1) The City should consider classifying data within the system based on its criticality and / or sensitivity (NIST SP 800-53 Rev. 4 RA-2). Classification of data will also help drive the above-mentioned information flow enforcement and help define the City’s security architecture 2) We recommend the classification of City data to define an appropriate set of protection levels and communication required for special handling Classifications and associated protective controls (including encryption for data at rest and data leak prevention tools) should take into account department needs for sharing or restricting information and the associated business impacts if such data were compromised. Successful data classification in an organization requires a thorough understanding of where the organization’s data assets reside and on what applications/devices they are stored. Handling procedures should include details regarding the secure processing, storage, transmission, declassification, and destruction of data. The City is currently taking several steps to classify and protect data: 1) Implementing IT Catalyst Plan – 5 year Strategic Plan 2) Developing documented policies to address various IT areas 3) Classification of HR and Finance data during Enterprise Resource Planning project 4) Payment Card Industry compliance audit IT sees value in creating a data classification policy that outlines how the city classifies data for each system. IT Immediate actions (next 12 months) *Work with new ERP vendor to develop classification framework for financial, asset and employee information. Create a Data Classification policy. IT future planned actions (12 - 36 months) Classify data in all systems city wide that IT is responsible for administering. Page 76 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 14 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 4 IT Access Management Access to assets and associated facilities is limited to authorized users, processes, or devices, and to authorized activities and transactions. 17.00 IT Director 1) New employees and vendors are required to sign off on the Acceptable Use policy 2) For financial system, Application Administrator is assigned responsibility of setting permissions for add/removal of users after approval from system owners 3) Security administration duties are assigned to various applications whereby all analysts have a designated system/application they are assigned to. Department directors are considered system owners; the IT department facilitates requests/approval of application owner for security access. All IT employees are CJIS certified 4) Application vendors must be CJIS certified and CJIS certification is also required in vendor agreements. It was noted that not all applications have a formal process of provisioning and de-provisioning 5) Every building is on its own VLAN and segregated, DMZs also exist which is separated by firewalls (in and out). SCADA systems are also air gapped and do not interact with other parts of the network 1) A role-based access scheme should be established to ensure consistent application of user access rights within the system. Users should be assigned their base set of access authorizations based on the concept of “Least Privilege Necessary” to perform their role or job function (as defined within their formal job description). Additional access beyond the previously established role-based access scheme should be formally requested, reviewed for conflicts and approved (NIST SP 800-53 Rev. 4 AC-2). Moreover, Management should consider integrating access rights with data classification efforts identified in Appendix B of this report 2) Ensure a process is in place to approve special access requests and timely de-provision access upon notification from HR The City agrees with these recommendations and is taking the following steps: 1) Implementing IT Catalyst Plan – 5 year Strategic Plan 2) Implementing 2 factor authentication 3) Implementing consistent role based access to CIS and ERP system functions through ERP conversion project IT agrees that additional process and policy is needed to enhance IT access control. IT feels ownership of physical security audits need to be conducted by the department(s) that maintain keys to buildings or the system controlling automated keycard access. IT Immediate actions (next 12 months) Implementation of Enterprise Application Access Control policy. Leverage new Systems Admin Lead to identify additional costs and resources to implement auditing of these changes in the future. IT future planned actions (12 - 36 months) Identify a way to audit Application Access on a yearly bases. Implement yearly audits for Application Access. Page 77 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 15 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 5 IT Contingency Plan Loss or inability to continue business due to natural disaster, system capacity or performance issues, interruption in communication, loss or corruption of data, or loss of critical vendors or staff members. 17.00 IT Director 1) The City has an extensive data backup strategy is in place in order to ensure that critical data for operations are available in the event of an interruption or incident 2) The current data backup plan has redundancy built into the datacenter environmental controls 3) Recovery processes are in place to restore systems/assets affected by cybersecurity events. However, CoG is yet to formalize a BCP/DRP 4) The City has prepared a five year IT Strategic Plan which includes a plan for implementing business continuity practices over the next 2-3 years Plante Moran recommends the City conduct and formalize: (1) A Business Impact Analysis (BIA) which identifies and analyzes mission-critical business functions, and then quantifies the impact a loss of those functions would have on the City, and (2) An information system contingency plan to mitigate the risk of critical system and service unavailability. The contingency planning process should occur after a formal Business Impact Analysis (BIA) is conducted, in order to correlate the system with the critical processes and services provided, and based on that information, characterize the consequences of a disruption. Three steps are typically involved in accomplishing the BIA: • Determine mission/business processes and recovery criticality • Identify resource requirements • Identify recovery priorities for system resources The City will continue with the efforts already planned to mitigate this risk: 1) Planning and funding fail-over data center 2) Developing and testing protocol to fail-over data center IT feels this risk is related to the lack of a City Wide Business Continuity plan. IT fully takes responsibility for Disaster Recovery of IT systems, a city wide BCP is needed to identify the Business Impact Analysis and criticality of City wide services to assist with proper implementation of Disaster Recovery activities IT Immediate actions (next 12 months) Identify how the city wants to address business continuity city wide. Work with Emergency Management to look for third party support to develop a BCP. Leverage new Lead System Admin to start planning and identified resources needed to create a DR plan. IT future planned actions (12 - 36 months) Develop consistent DR plan that can co-exist with city BCP. Page 78 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 16 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 6 Legislation Governmental laws change that impact the organization by financial, operating, strategic or compliance issues. 16.36 City Manager’s Office 1) The City Attorney’s office monitors legislative sessions for the City as a whole, and communicates the effects of legislation to appropriate departments 2) The Electric Department utilizes a third party engineering firm to monitor potential legislation that could impact the Department 3) The City has an agreement with an outside government affairs and advisory firm which specializes in advising and assisting municipalities in legislative activities 4) The Transportation Department has developed a detail plan of response to the effects of the City passing the 50,000 population threshold, specifically related to the traffic signal operation. After the 2020 census, the City will be responsible for operating all traffic signals in the City, which is double the number the City currently operates. A large financial commitment will be required to operate and maintain all traffic signals in the City 1) Council and Management should review and closely monitor the status of annexation plans for the City. After the 2020 census, the City will be limited in its ability to perform annexations due to Williamson County’s population surpassing 500,000 citizens 2) The City should work with legislators to clarify the impact of harmful legislation including revenue caps and limits on debt financing for infrastructure during the City’s period of high growth and should stress the removal of local control restrictions that impact citizens ability to impart changes in their local community The City will continue its efforts to monitor state actions and advocate for what is best for the organization and community: 1) Implement Council strategies and tactics related to influence with State government 2) Continue supporting TML efforts 3) Continue working with government affairs and advisory firm 4) Continue to build relationships with other governmental agencies Page 79 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 17 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 7 Segregation of Duties The Organization fails to adequately segregate roles and tasks between team members. 16.43 Finance Director 1) Each department communicates a personnel change to HR and IT to add/remove/change a staff member’s access 2) HR and payroll have segregated rolls for processing employee payroll and benefit information. Only Finance has access to process changes within the payroll module 3) Segregation within the finance department is maintained by separate individuals processing payroll and accounts payable 4) Utilities customer cash receipts are handled through Customer Care front facing staff. Cash drawers are reconciled and closed on a daily basis. Bank deposits are prepared by Customer Care back office operations daily and are couriered to the bank by Police Officers. Revenue financial reporting is done by Finance 5) A police officer travels to the cash locations to provide secure courier service on all bank deposits 1) An annual review of user access for all staff members within the City across all programs managed by IT should be performed 2) Departments that have not had an internal control review within the past five years should evaluate the design and effectiveness of their internal controls 1) Implementing new CIS and ERP systems which requires thorough review of system segregation controls. 2) Cameras being evaluated for various cash areas 3) Emphasize and explain segregation of duties attributes during training for new or revised financial policies and procedures. 4) Parks & Recreation has segregated deposit duties separate from cashiers. 5) Finance is reviewing the segregation of the vendor database duties for the new ERP system. IT feels this risk requires joint ownership with other departments. IT already has controls in place for user access to computer resources and access to applications. IT Immediate actions (next 12 months) Implementation of Enterprise Application Access Control policy. Train IT employees on the new policy. Enforce the new policy on new Enterprise systems as they roll out. Leverage new Lead Admin to identify resources, and costs associated with reviewing user access for all city computer resources and applications. IT future planned actions (12 - 36 months) Implement annual reviews/audits of user accounts with access to computers and enterprise applications. 8 Access to Talent Organization lacks sufficient staffing levels to carry out its routine operations. 11.75 HR Director 1) The growth of the City has resulted in a large talent pool for many positions within the City, with some job openings attracting over 300 applicants. Overall, the City gets sufficient applicants for general open positions 2) The City is in the process of performing an assessment of retirement eligibility for key personnel 3) Departments within the City utilize third party contractors to fill non-key positions on a temporary basis 1) The City should evaluate positions with required specialized certifications and determine whether entry level staff members can obtain certifications after hire 2) For specialized positions, including, but not limited to, building inspectors, paving foremen, and traffic engineers, the City should conduct an assessment of staffing levels with a 3-year outlook 3) The Fire Department should develop a plan to acquire the necessary EMS personnel talent 1) HR and Fire are continuously developing a recruitment strategy for future station staffing 2) The City currently recruits many positions such as 911 dispatcher and Electric Linemen Apprentices in the manner described in mitigating recommendation #1 and continues to review options as new vacancies arise. 3) The City works continuously to keep pay and benefits market competitive and HR staff is currently working on enhanced recruitment branding techniques to continue to bring in excellent talent. Page 80 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 18 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 9 Emergency Notification System Failure (ENSF) The City's Emergency Notification System fails to alert citizens in the event of an emergency. 13.81 Emergency Management Coordinator 1) There is a city-wide emergency notification system consisting of tornado sirens and reverse 911 (Code Red) which are tested on a regular basis. The outdoor warning system is place to notify citizens to take shelter and is not intended to be heard in doors 2) The City recently added a position dedicated to Emergency Planning 3) Incident Action Plans are developed for large scale community events, such as the Red Poppy Festival 1) The City should communicate Incident Action Plans for large scale events to all parties involved with the event, including the Convention and Visitors Bureau (CVB) 2) Management should inform all departments of the operating procedures related to the ENSF 3) The EMC should develop basic and advanced emergency management training for key stakeholders in the City (Division Managers) and conduct table top and/or practical training exercises that replicate local level emergencies The City agrees with these mitigating activities and will prioritize them in the EMC’s work plan Page 81 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 19 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 10 Fraud Customer, third party, or internal fraud occurs resulting in a significant misappropriation of assets and/ or incorrect financial reporting, or corruption/ kickback schemes. 13.75 Controller 1) The Finance Department performs a review of a small number of P-Cards to verify the legitimacy of the purchases 2) Fixed assets over $5,000 in value are tracked in the ERP fixed asset module 3) Currently no fraud prevention program is communicated to all employees with training to identify and prevent fraud. 4) The Finance team indicated internal controls can be strengthened around: • Communication, billing and collection from - Planning and Housing and GUS Engineering on construction/ development contracts with developers and as they have limited visibility on project status, progress, completion and timelines of payment due dates. Cannot get My Permit Now to reconcile to Accounting • Processing and internal controls around Grant Administration regarding collections and subsequent compliance reporting • Credit Card (P-Cards) payment procedures are inconsistently applied across City operations 5) The City lacks internal monitoring controls and audit logs around Master File Maintenance on IT databases (employee, customer, vendor, etc.) 6) Segregation of duties reduces the chance of fraud 7) The City has a personnel policy related to fraud 8) A fraud hotline is advertised to the City staff, so that staff can report fraud anonymously. The reports are collected by an outside firm, who sends information to representatives in Human Resources, Finance, and the CMO for investigation. The CMO follows up on any investigations 9) Purchasing cards have strict limits to ensure the risk of misuse by a single employee is limited to an average of $1,000. 1) The Finance Department should perform more robust reviews of P-Card purchases and consider utilizing software to perform regular audits of P-Cards 2) The Finance Department should perform annual reviews of P-Card users to evaluate whether the all users actually need P-Cards 3) The City should implement a more extensive asset tracking program, utilizing fixed asset tags on assets valued over $1,000 with consideration of periodic asset audits 4) Vendor Ship-To addresses should be limited to a “drop down” list consisting only of City facilities 5) The City should consider developing a fraud awareness and prevention training program with active participants across all City departments 6) All changes to IT databases deemed to be material should be tracked on an Audit File Log and reviewed by someone without access to the databases 1) Asset tracking and vendor shipping will improve as part of the ERP project. 2) The City has already implemented and conducted training on grant tracking and reporting. 3) Staff are currently developing a citywide fraud awareness and reporting training. Page 82 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 20 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 11 Health & Safety Exposure to potentially significant workers' compensation liabilities due to the inability to maintain compliance with applicable health and safety laws and regulations. 13.04 HR Director 1) All Public Works and Utility departments have a robust safety program consisting of monthly safety training, daily safety summaries, semi- monthly safety meetings, and detailed safety policies. Public Works departments also provide sufficient safety equipment to all relevant staff members 2) The Fire and Police Departments have a robust line of safety gear, training, fitness assessments, inspections, and safety policies 3) All safety incidents are communicated to Human Resources for review and to work as a liaison between the department and the employee 4) The Airport requires all non-airport employees to be escorted by a staff member with knowledge of Air Traffic Control communication 5) Parks and Recreation requires safety maintenance with swimming pools to ensure chemicals are in balance Overall, the City has robust health and safety procedures and should consider adding the following: 1) The Library should develop clear policies and procedures on a course of action when a customer, employee, or volunteer is injured at the facility. 2) The City should review the lifeguard policy for pool facility rentals. The City currently does not provide a lifeguard for pool rentals by the Georgetown Independent School District and does not require GISD to provide their own lifeguard. 3) Consider adding an Active Shooter response plan 1)HR and Library will work together to develop consistent injury procedure 2) The City has met with GISD swim coaches to brainstorm ways to mitigate lifeguard risk and is drafting a facility use agreement that outlines the lifeguard requirements of the City and GISD 3) HR and Police are developing Active Shooter training for departments Page 83 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 21 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 12 IT Incident Response Management Response processes and procedures are executed and maintained, to ensure timely response to detected cybersecurity events. 12.00 IT Director 1) The City has no formalized or documented information security incident response procedure 2) CoG's IT department has an informal (undocumented/ad-hoc) resolution process to ensure appropriate steps are taken to respond to incidents. The process is triggered in the event of a report/discovery of compromise, loss, or theft of system data We recommend the City implement a formal incident response plan including: 1) Provide a roadmap for implementing its incident response capability; 2) Describes the structure and organization of City of Georgetown’s incident response capability; 3) Provides a high-level approach for how the incident response capability fits into City of Georgetown as a whole and the overall Family of Companies; 4) Meets the unique requirements of City of Georgetown’s mission, size, structure, and functions; 5) Defines reportable incidents as well as requirements and guidelines for external communications and information sharing (e.g., what can be shared with whom, when, and over what channel); 6) Provides metrics for measuring the incident response capability within the organization; 7) Defines the resources and management support needed to effectively maintain and mature an incident response capability; and 8) Is reviewed and approved by senior management IT agrees a formal process and procedures need to exist to manage cybersecurity incidents appropriately. IT Immediate actions (next 12 months) Implement Incident response policy. Train IT staff on procedures to ensure policy is being met. IT future planned actions (12 - 36 months) Document formal incident response plan including all recommendations by Plante. 13 Utility Outage The City is unable to respond to mass failures of electrical, water, or sewage outages in a timely manner. 11.89 Utility Director 1) Control Center has monitoring alarms in the event of outages 2) Control Center has an outage management system to diagnose location of fault and provide area of impact and customer count 3) Response plan is in place for water, wastewater, and electric system failures. 4) Regular maintenance tracking of all critical equipment; replacement is made when showing signs of degrading through testing 1) Maintain equipment useful lives schedule and proactively monitor components which have reached their useful lives 2) Perform a vulnerability assessment to judge your preparedness for handling the increased likelihood for power outages Emergency Response Procedures have been expanded to include establishment of an Operations Command Center procedure for emergency response for large scale utility outages that do not rise to the level of EOC activation. Page 84 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 22 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 14 Disaster Recovery / Business Continuity Planning Inability of the organization to continue key business processes during a potential disaster due to lack of sufficient disaster recovery planning and/or execution. 11.60 City Manager’s Office 1) Most city staff members are able to work remotely via Virtual Desktop Infrastructure (VDI) 2) The Public Works Departments conduct assessments of potentially hazardous situations (ex: tree trimming to prevent outages during windstorms) 3) The Fire and Police Departments can immediately route 911 calls to the Williamson County 911 center 4) Tabletop disaster recovery simulations are performed on an annual basis by the Emergency Management Coordinator in conjunction with the Fire Department 5) No backup plan in place at Airport if fueling system or lighting vault fails. This has been identified as a weakness and accounted for in the Airport Master Plan to remediate over the next 5 years. 6) No DR/BCP plan at the Library, Communications, Convention & Visitor’s Bureau, Customer Care and Inspection Services 7) Back in 2005, the Municipal Court had a system crash and were unable to recover records. They had to recreate 2.5 months of records and it took about 6 months. The issue has not been resolved 1) The City has inconsistent DR/BCP across the organization. Some departments have a robust plan and others have none. A DR/BCP should be developed for every City department. Each of these department-level plans should then be integrated into a city-wide plan 2) Tabletop disaster recovery simulations should be performed with all City Departments 1) As the City buys new or upgrades existing software, we are prioritizing cloud options that improve security and access Page 85 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 23 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 15 Billing for Citizen Services Citizens are billed incorrect amounts or not billed at all for citizen services. 11.37 Customer Care Director 1) Rates and/or fees for Utility Services, Building Inspection Services, Animal Services, Permits, Fire, Police and Airport are approved by Council 2) Parks and Recreation rates are set and approved by the Parks and Recreation Director and submitted to the Council annually 3) Customer Care utilizes systems built into the meter data management (MDM) and customer information systems (CIS) that apply validation methodology to detect abnormal consumption or amount billed. These “exceptions” are identified in the systems for staff to review and validate manually (referred to as “Edit Process”) 4) Billing for EMS services is performed by a 3rd party service and any hardship write downs require the Fire Chief’s approval 5) Departments handling cash perform daily cash reconciliations 6) The Municipal Court clerks review all tickets/citations before being sent to the recipient 7) The Code Enforcement Department maintains evidence of violations to be billed, and the Energy Services Department maintains the police report as evidence for billing for damages 8) Airport uses a third party appraisal for lease amounts along with fuel prices set by City Council a. The fine schedule for the Municipal Court citations should be restricted to specific users b. All invoices should be created in a single system across the City and remit-to addresses should be limited by a “drop-down” function consisting of only addresses the City accepts payments c. Management should consider a third party revenue recognition study to validate all sources of revenue are complete and accurate across the City operations d. An outside party, Emergicon, reviews billing for EMS incidents as there are various rates depending on citizen’s ability to pay. Emergicon also collects funds and this helps reduce the occurrence of billing errors and improves collections. However, Emergicon also writes off funds and there is no reconciliation of EMS revenue to billings. We recommend the City enhance reconciliation controls around billing procedures and perform internal audits of quality control and verification of vendor compliance. 1) Implementing a new ERP system will include a thorough review of the Accounts Receivable/Billing module. 2) Once Emergicon has completed a full fiscal year of billings and collections, the City can audit and evaluate the performance and compliance of Emergicon’s processes and procedures. Page 86 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 24 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 16 Composition of Tax Base Changes in the balance of commercial and residential tax base result in losses of revenue from taxes. 10.63 City Manager’s Office 1) The City has performed a detailed mapping of how each square mile of the city will be used in the future 2) The City Manager’s Office completes regular fiscal impact models to determine the effects of commercial vs. residential development 3) The Economic Development Department has established a comprehensive strategic plan 4) Economic Development relies on demographic research for talking to prospects regarding future development. Works closely with the Planning Department 5) The Fire Department should be involved in all communications regarding commercial development in order to ensure the Department is able to acquire the necessary equipment to manage emergencies at large scale commercial properties 6) The Fire Department has increased its staff to respond to an increase in calls for service. The rate of EMS calls for service is growing at double the rate of population 7) The City is updating its Comprehensive Plan which will include an update to the future land use plan 8) Planning Dept. promotes and encourages a varied level of housing products and commercial tax base per the Comprehensive Plan. 1) The City should communicate potential new commercial and residential development to directly impacted City departments and evaluate how new development would affect each directly impacted department 2) Management should utilize a concentration strategy that is flexible and supported by realistic expectations The City is updating its Comprehensive Plan through a robust citizen engagement process during 2018/19. This plan will identify community standards and goals for growth. City staff from various departments impacted by development meet with the City Manager’s Office on a bi-weekly basis to discuss major development applications as well as to collaborate and problem solve on various issues. 17 Grant Obligations Organization fails to meet grant covenant requirements. 10.55 Controller 1) Grants filings across the City are monitored by various personnel within the Finance Department 2) Grant applications require City Council approval per the City’s Fiscal and Budgetary Policy 3) Federal and State grants require compliance filings and, if omitted, could impact future grant funding, as well as result in audit findings 1) The City should designate a staff member as a Grant Administrator. This staff member should be responsible for maintaining a repository of all grants being applied for, awarded, contact person, and any required filings associated with each grant. City should require that all Grants be managed through the new Grant Administrator 2) A Grant Status Report should be provided on a periodic basis to the City Manager’s office for potential budget considerations The City has completed these recommendations. The Controller is the Grant Administrator. A new policy was implemented in the spring and the status report is presented to Council in the quarterly financial report. Page 87 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 25 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 18 IT Third Party Roles & Responsibilities Security roles and responsibilities are not established for all third-party service providers and lack clear contractual obligations for service level agreements and KPI’s. 10.00 IT Director 1) The City has identified trusted partners with respect to hardware and hosted applications 2) Roles and responsibilities have been established but are not formally documented. Within the workforce, absence of a formal documentation poses a risk for segregation of duties and with third parties, accountability may be lacking 3) The contract between City of Georgetown and the service provider does not specifically outline the roles and responsibilities related to Cybersecurity controls handled by each organization 4) There is no monitoring of external party use of the system for potential Cybersecurity events We recommend management take the following actions: 1) Clearly identify the cybersecurity responsibilities to be outlined in the contract with the service provider including roles for identification, response, and recovery procedures 2) Establish Key performance indicators for third- party responsibilities including number of events, data breaches, number of notifications 3) Continuously monitor contract SLA’s and established key performance indicators IT has been working to ensure new contracts meet a higher level of security requirements. For example the Office 365 contract with Microsoft has advanced alerting for things like elevation in access privileges and enhanced reporting to view our security posture at any time. IT manages KPI’s for 3rd party contracts through simple notification of security events that can follow the city’s Information Security Response plan should provide adequate documentation for security events. Incident response risks are being addressed under Risk # 3 on this document. IT Immediate actions (next 12 months) Continue to monitor all new contracts to ensure proper cybersecurity language exists. Require all vendors to use multi factor authentication to access city resources. IT future planned actions (12 - 36 months) Review older contracts and make notes of where changes are needed during contract renewals. Page 88 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 26 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 19 Vendor Reliance Any termination of, or adverse change in, the Organization's relationships with its key suppliers, or loss of the supplies in support of one of the organization’s key services. 9.81 Purchasing Manager 1) The majority of City Departments have multiple vendors available to supply goods & services and would not face disruption if they had to switch vendors 2) We noted 3 departments that have a reliance on key vendors and they are closely monitoring this process: Transportation (asphalt and concrete), Fire Department (specialty vehicle repair) and Animal Services (specialty veterinarian drugs and feed) 1) Assign one person the responsibility of monitoring all key vendors to the City 2) Create a subsidiary listing of all key vendors with contract details, SLA’s and performance metrics 3) Report back to City Manager when it is determined a vendor may become insolvent or is not meeting SLA’s 4) Prior to contract renewal, negotiate with all key vendors to capture volume discounts and preferred pricing 5) Management indicated Garland Power & Light currently reconciles their meter data to the scheduling data and the transaction settlement engine. This could be done in house but would require additional headcount as the process runs 24/7. Management should consider a cost/ benefit study to do this in-house The new ERP will enhance the ability to analyze vendor and contract details. The City’s purchasing policy receives quotes and/or formal bids for purchased over $3,000. Purchases over $50,000 are approved by Council so more review is given to these large expenditures. The management acknowledges that certain items noted are “sole source” which provides a reliance on key vendors in limited situations/purchases. Page 89 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 27 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 20 IT Critical Security Event Identification A formal risk event identification process is not in place to identify, classify and resolve security events 9.00 IT Director 1) Currently there are a variety of log generation methods in place for the system, however there is no catalog of security event types being identified and reviewed within the logs by security professionals 2) As noted in the Segregation of Duties risk, there are no documented audit log reviews of changes made to critical City databases 1) Identify high risk events that can be alerted from current logging capabilities (NIST SP 800- 53 Rev. 4 AU-6). Potential high risk events can be discerned through the risk assessment process (NIST SP 800-53 Rev. 4 RA-3), penetration testing, and best practice documentation. Some common threat events include: • Multiple failed login attempts • Elevations in access privileges • Changes to application code • Changes to security settings • Process specific actions 2) Consider alert generation techniques for risky events such as devices that connect to the network without authorization 3) Identified events should be responded to in accordance with the organization’s Incident Response Plan IT does not currently have designated security staff. This makes it challenging to implement controls at this level because of the time and knowledge necessary to keep a proactive approach maintained. IT agrees we should have an advanced alerting process on high risk events however continuing to maintain these types of processes can be staff intensive. IT Immediate actions (next 12 months) Hire a Lead System Administrator (approved for FY19) to assist with security activities. Identify high risk events that occur in current logging tools. Research methods for alerting based on events. Research staff time needed to implement and maintain an alerting process that always follows best practices. Research managed security services and costs. Discuss options with City Manager’s Office for implementation. IT future planned actions (12 - 36 months) Create an alerting strategy/process that alerts staff when appropriate. Implement alerting for high risk events. Implement managed security services if feasible. Page 90 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 28 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 21 IT Security Awareness, Training and Education Personnel are not informed of potential IT threats to the organization and are unable to respond effectively. 9.00 IT Director 1) The City has implemented an Acceptable Use Policy amongst other policies around proper use of computers and accessing digital information. However, to ensure compliance, there is a need to assess employee’s understanding of policies and response to cybersecurity threats via periodic awareness and training 2) IT staff monitors and reports email scams to all employees in an effort to increase awareness 1) Rely on end users as the first line of defense to limit exposure to social engineering frauds and threats 2) Consider increasing complexity of password requirements 3) Create a formal IT Awareness training and provide to all employees on a periodic basis 4) Require employees to formally acknowledge in writing that they have read and understand the security awareness training, and that they recognize the ramifications of non-compliance IT Immediate actions (next 12 months) Implement city wide security awareness program and training. Partner with HR to leverage use of LMS for security training. IT future planned actions (12 - 36 months) Continue to provide security awareness training and review annually for new material and best practices. 22 Fire Department Failure The Fire Department is not adequately equipped to handle responses to emergencies in the City. 8.00 Fire Chief 1) The GFD studies data points to best position their resources in order to minimize response times. In instances when there are no resources available, GFD has agreements with third party ambulance providers who are obligated to provide the same response time as the GFD 2) Also, the GFD have mutual aid agreements with neighboring communities to assist in calls when the City is not available 3) The GFD indicated they perform fire inspections of public buildings (schools, hospitals, government buildings, etc.) but there are not enough resources to do fire inspections/ capacity evaluations on all businesses in the City 4) The City is currently building two stations to ensure adequate response to the growing population 1) Consider an independent third party evaluation study of the GFD capabilities, response metrics and resource allocations to evaluate if there needs to be changes to the current resource allocation model 2) Consider cooperative agreements with ESD8 and/or contiguous municipalities to elevate synergistic programs (co-located/co-operated) fire stations and boundary drops (enhanced auto-aid). 3) Consider making licensed buildings be required to be inspected annually. Also, consider a self- inspection program for low risk properties and/or an inspection matrix as follows: • Low Risk – every 3 years • Medium Risk – every 2 years • High Risk – annually 4) Management should consider the implications for property owners and businesses when the Public Protection Classification (PPC) issued by the Insurance Services Organization (ISO) is not performed, as there may be a negative impact if not inspected annually. GFD regularly reviews KPIs and communicates with city management on service delivery standards. Mutual aid agreements are in place for assistance when additional resources are needed. Additionally, GFD is exploring partnership opportunities on a long-term future station with Round Rock. A Fire inspector has been added to the staff for FY19 to help address the backlog of inspections and keep up with the growing number of business inspections. Page 91 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 29 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 23 Physical Security Facilities are not appropriately secured from unauthorized access. 9.00 Asst. Parks & Recreation Director Overall the City has robust physical securities controls in Place: 1) Customer Care and Municipal Courts have robust physical security programs in place. Safes are utilized for cash and cameras cover registers and safes. Dual access controls with keys and codes are used at cash access points 2) Most City buildings require access badge/ fob to enter restricted (non-public) areas. 3) Police, Fire and Energy Services departments have restricted access areas 4) However, we noted several areas with limited physical security controls: • Animal Services – lack of physical security is a major issue as animals have been stolen. Cash is not well controlled and cameras are not in place on critical areas. The safe is not adequately secured. • Building Inspection Services, Public Works, GIS, Systems Engineering and the Georgetown Municipal Complex have poor physical security 1) Consider taking inventory of all key cards to validate none have been stolen or lost 2) Consider development of physical security training for all personnel regarding safeguarding of assets, restrictive access to high risk areas, etc. The City must support integrity of physical security through the organization with the assistance of the City’s Risk Manager 3) Standardize a consistent security plan across all locations appropriate for each facility 4) The City currently monitors physical access to the facility where IT resides to detect and respond to physical security incidents. However, CoG does not review physical access logs periodically 1) Cameras are being evaluated for various cash areas 2) Security access will be part of the current facilities study 3) Security access will be evaluated with the opening of each new or renovated facility. 24 Freedom of Information Act (FOIA) Non-compliance with FOIA requests 6.22 City Secretary 1) The procedure is for all FOIA requests to enter through Legal. They will decipher the request and handoff to the City Secretary office to obtain information. 2) FOIA request process is currently being transferred from Legal to City Secretary and is approximately 90% complete 3) GovQA is an electronic system used to maintain and track FOIA requests. 1) When the transfer of FOIA request process is complete, consider documenting the process with written policies and procedures 2) 1) The City has completed the transfer of FOIA request process to the Open Records Coordinator in the City Secretary’s office. 2) Citywide training has been completed by the Open Records Coordinator to provide guidelines and consistency to the process. 3) The City Secretary Department is in the process of completing Policies and Procedures for FOIA and should have completed within the next month. Page 92 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 30 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 25 Police Failure The Police Department is inadequately equipped to respond to emergencies or responds in an unauthorized manner. 6.00 Police Chief 1) Police department is aware of people, process, technology and regulatory requirements 2) Robust controls are in place to monitor progress and key performance indicators 3) A culture of clearly communicating expectations, behaviors, and training is in place so officers are held accountable for their actions 3) Guardian Tracking is a day-to-day tracking of personnel performance entry recordkeeping. Police management reviews and a conversation with the employees occurs when they handle situations incorrectly 4) Training includes the following: • Handling of persons with mental illness • Defusing techniques to encourage peaceful tactics • Non-lethal methods of restraint 5) Internal affairs division investigates all complaints against officers 1) Develop the following Key Risk Indicators (KRI’s) and monitoring controls which may indicate a risk event is about to occur a. Increase in City crime rates b. Increase in police misconduct/brutality incident claims c. Increase in squad car accidents d. Excessive overtime e. Unexpected cost overruns/continuous unfavorable budget variances f. Increase in dismissed cases due to insufficient evidence, improper procedures or failure to follow legal standards for police 1) The City will monitor quality of life crimes within the city and identify strategies for reduction where feasible. 2) The City will monitor and investigate all complaints, including use of force and pursuits and will identify strategies for reduction where feasible. 3) The City will monitor police overtime and identify strategies for reduction where feasible. 4) An annual report of crime statistics is presented publically to the City Council. 26 Talent Management Organization lacks a clear assessment and evaluation process to align qualified employees with specific business requirements and needs. 5.42 HR Director 1) The City personnel policy requires bi-monthly performance discussions with all employees 2) Formal annual and mid-year performance evaluations, including employee development and training plans, are performed on all employees 3) Energy Department has a robust training curriculum with a 4-year apprentice program 4) Police department uses Guardian Tracking to evaluate officer performance daily 1) Have HR department work collaboratively with business lines to gain in depth knowledge of resource needs and constraints 2) Consider using an outside party for diversity in pre-hire assessments 1) HR staff is developing a supervisor survey to identify employee development for current and future roles 2) HR staff trained all supervisors in 2017 on proper hiring techniques including ways to overcome various forms of hiring bias 3) The city conducted an employee survey in 2016 and again in 2018. 79% of employees believe their job makes good use of their skills and abilities. 84% believe their job provides opportunities to do challenging and interesting work. 27 Records Management No records management policy is in place, adhered to, or is inadequately designed. 5.27 Records Program Manager 1) The City’s records retention policy is in line with the Texas State Library records retention policy. The department receives alerts from the state library of any changes to policy 2) Finance indicated they are unclear on how electronic records storage should be handled 3) Parks and Recreation has a large quantity of waivers and registration hard copy forms 4) Animal Services has a lack of electronic records and believes there is a risk of information loss 1) Formalize Records Management policy regarding digital records and communicate to all departments 2) Consider additional training on electronic records management 3) Consider digitizing Parks & Recreation forms 1) The Records Team is training various departments on retention, destruction of records and digitalization of records. 2) Policies and Procedures have been completed and implemented. 3) The following information has been made available to employees via the internal GO site: a. Records Management Policy & Procedures b. Retention Schedules c. Off-site storage information d. Destruction authorization forms Page 93 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 31 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 28 Regulatory Filings Failure to comply with regulatory filings such as GASB, EPA, etc. 5.20 Controller 1) Water Services completes Environmental Protection Agency (EPA) and Texas Commission on Environmental Quality (TCEQ) permit reports every 3-5 years 2) Finance prepares annual CAFR and SEFA which is submitted to the clearinghouse 3) Customer Care prepares annual filings on storm water use survey breaking out how much water was taken in to the system. 4) City of Georgetown has an exemption from complying and filing necessary reports mandated by Senate Bill 898 (reducing energy consumption in City owned facilities) & administered via the State Energy Conservation Offices (SECO) because of the 100% renewable designation. 5) Customer Care is required by TCEQ to report water quality testing results to customers on an annual basis. Deadline for customer communications is 7/1. GUS must certify with TCEQ by 5/1 that we provided water quality testing results to water purveyors that obtain wholesale water from GUS. 6) Energy Services relies on outsource provider Snyder Engineering for all regulatory findings 7) Utility services is subject to an annual requirement with the ERCOT to validate that a risk management plan is in place 8) Airport has a significant amount of regulatory filings ranging from EPA, TCEQ, Stormwater, Airplane inventory, and Property Taxes through MCAT. Use Microsoft Outlook as reminders 9) Fire Dept. has numerous state health services filings regarding training, certifications, incidents, fatalities, etc. 1) There is a significant amount of regulatory filings across the City. Management should consider a consolidated Regulatory Compliance Landscape (RCL) ledger be compiled to have one list of all requirements outlining the filing dates. Further, Management should store this on a shared drive and assign all filings to an owner who is required to indicate when the filing is complete. Someone should be responsible for checking for missed filings Management is evaluating a contracts management system to track and comply with contractual and regulatory requirements. This may be part of the ERP implementation or a stand-alone system. Page 94 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 32 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 29 Succession Planning Leadership talent within the organization is insufficiently developed to provide for orderly succession in the future. 4.39 HR Director 1) No formal succession planning in place. Per Human Resources, they emphasize internal cross training to grow future leaders from inside the City organization 2) The City is in the process of performing an assessment of retirement eligibility for key personnel 1) The City should consider an outside party to implement a formal Succession Plan 2) Consider a mentor shadowing program to protect the City against unplanned terminations or leaves of absences 1) City initiated first Emerging Leader training program in 2018 with 20 graduates. Anticipate annual opportunity to grow employees at various levels each year 2) Supervisory Series initiated in 2017 and successfully completed by 168 supervisors. Additional curriculum to be added this year aimed at growing managerial skillset of all city supervisors 3) The city conducted an employee survey in 2016 and again in 2018. 76% of employees plan to continue working for Georgetown for 5+ years, which is significantly higher than most employers. 30 Budget and Planning Budgets and business plans are not realistic, based on appropriate assumptions, based on cost drivers and performance measures, accepted by key managers, or useful or used as a monitoring tool. 3.24 Finance Director 1) The City uses a robust budget and planning tool across the organization using historical data supplemented with forward looking analytics. Each Department head formalizes their budget and forward to Finance for consolidation 2) Finance utilizes Excel to manually consolidate the budgets and upload into the ERP system 3) Final budgets are presented to City Council for review and approval 4) Quarterly budget to actual reports are presented to City Council 1) Certain departments such as utilities, water, electric, etc. count on supplemental data to prepare their budget (see Data Governance risk #27). We recommend management validate and document the completeness and accuracy of assumptions for all budget line items 2) Management should set a clearly defined threshold for all material variances to be explained (e.g. +/-XX% and $YY,YYY) 1) The new ERP system will facilitate a central location of budget development information and reporting 2) Finance Administration’s performance measures include budget to actual variance targets 31 Tax Non-compliance with state or federal tax law. 3.00 Controller 1) Finance maintains schedule of tax payments and receipts to/ from County, State and Federal authorities 1) Consider the creation of a master tax filing schedule and reporting to City Manager The City agrees with this recommendation. 32 State / Federal Regulations Failure to comply with new or existing federal or state regulations. 2.44 Controller 1) Building Inspection Services provided that maintaining state licenses and Continuing Professional Education (CPE) is a challenge 2) State regulations require the Police Department to report all racial profiling and crime data 3) Parks and Recreation indicated that there is a State Health and Safety Code that requires public play equipment comply with the American Society for Testing Materials (ASTM) F1487-07 which provides performance standards for public playgrounds and this is NOT being done on a routine basis 1) Develop a Citywide license and CPE tracking system 2) Develop a process to ensure all City playgrounds comply with ASTM F1487-07. The code does not require a formal inspections process, just that the City complies with the ASTM F1487-07 standard The City will review a tracking system in context of all other technology needs. Employees and supervisors will continue to be responsible for tracking individual and departmental CPE and licensing. Parks Department is working on a schedule to evaluate older parks to replace equipment as needed. Newer parks and equipment is compliant. Page 95 of 173 APPENDIX A – RISK TREATMENT ACTION PLANS 33 | Page # Risk Risk Detail Residual Risk Score Risk Owner Current State Mitigating Activities Future State Mitigating Activities Management Response 33 Leadership The people responsible for the important City processes do not or cannot provide the leadership, vision, and support necessary to help employees be effective and successful in their jobs. 2.42 City Manager 1) All departments we interviewed provided the same issue on leadership – there is a strong management base that sets realistic strategic objectives and has an open communication line with each department head 2) Leadership has frequent meetings with department heads to check on status of operations and those concepts are clearly communicated throughout the organization 3) Detail performance evaluations are done at all levels of the City government and each employee is evaluated for job performance 1) The City should consider an upward feedback program to validate lower levels of employees are satisfied with management’s performance 1) A 360 evaluation process was implemented last year for Directors and will be rolled out to mid-level management in the upcoming year. 2) The city has implemented a bi-monthly check- in program where employees have the capability to provide upward feedback to their supervisor. 3) The city conducted an employee survey in 2016 and again in 2018. Employee response rates were 85% and 82% respectively and the city has involved employees in tactical action planning to further improvement engagement and enablement. Page 96 of 173 APPENDIX B Information Technology Executive Summary Appendix B Page 97 of 173 APPENDIX B CYBERSECURITY RISK ASSESSMENT EXECUTIVE SUMMARY Inherent Risk: Risk management is the ongoing process of identifying, assessing, and responding to risk. To manage risk, organizations should understand the probability that a threat event will occur and the resulting impact. The probability and impact analysis leads to identification of inherent risk (i.e., risk without consideration of controls) to the IT environment. With this information, organizations can determine the acceptable level of risk for delivery of services and can express this as their risk tolerance. Factors considered when performing the risk assessment are: • Probability: What is the likelihood that a threat will occur? • Impacts: What are the immediate damages if the threat is realized (e.g., disclosure of information, modification of data, disruption of key systems/processes, containment, and resolution costs)? • Identify Information Assets: What should be protected in relation to electronic data, IT applications and IT infrastructure? Our methodology takes into consideration any third parties or vendors that transmit, host, or process your organization’s data or IT systems. • Criticality Analysis: How critical are your information assets? Each technology layer (i.e., data, applications, and infrastructure) has its own unique criticality analysis. • Threats: Identify the natural to man-made threats that impact the confidentiality, availability, and integrity of your data and information systems. • Consequences: What are the long-term effects of the threat being realized (e.g., damage to reputation of your organization, loss of business or revenue, damage to your brand)? • Controls: What effective security measures (security services and mechanisms) are needed to protect the assets? In understanding the high risk areas for the IT applications and systems, several key questions came to mind when addressing the Cybersecurity considerations: • What security controls are needed to satisfy the security requirements and to adequately mitigate risk incurred by using information and information systems in the execution of organizational missions and business functions? • Have the security controls been implemented, or is there an implementation plan in place? • What is the desired or required level of assurance that the selected security controls, as implemented, are effective in their application? The answers to these questions are not uniquely answered in isolation but rather in the context of an overall effective risk management process suggested by the NIST Cybersecurity Framework. Through the control evaluation process, we isolated areas that City of Georgetown can continue to identify, mitigate, and monitor risks associated with cyber threats identified through the threat assessment. Logically, areas of high risk would require more extensive controls than low risk areas and in most cases, inherent risks can be controlled by the implementation of adequate countermeasures. Page 98 of 173 APPENDIX B NIST Cybersecurity Framework Maturity Summary The chart below indicates City of Georgetown’s overall picture of the current state versus it’s desired/target state in accordance with the Cybersecurity framework. Page 99 of 173 APPENDIX B Mitigation Plan Page 100 of 173 APPENDIX B 3.1 FINDINGS AND RECOMMENDATIONS 3.1.1 Cybersecurity Governance Model Assigned to: City of Georgetown Priority High Recommendations Currently, the City’s Information Technology department has no succession plan for key roles occupied by experienced staff. In addition, most members of the IT department perform several duties beyond their originally assigned tasks and roles and responsibilities related to key initiatives such as Risk & Incident Management, Disaster Recovery & Business Continuity are not clearly defined. According to Inform ation Security Governance Guidance for Boards of Directors and Executive Management, 2nd edition, the five basic outcomes of information security governance include: 1. Strategic alignment of information security with business strategy to support organizational objectives 2. Risk management by executing appropriate measures to manage and mitigate risks and reduce potential impacts on information resources to an acceptable level 3. Resource management by utilizing information security knowledge and infrastructure efficiently and effectively 4. Performance measurement by measuring, monitoring and reporting information security governance metrics to ensure that organizational objectives are achieved 5. Value delivery by optimizing information security investments in support of organizational objectives At a minimum, we recommend the City implement a governance framework that allows for the proper management of a successful Information Security program (ISP). An effective ISP involves participation from senior management to set the direction for proper information security practices, adequate staffing (with assigned roles and responsibilities) and compliance with policies. Furthermore, a commitment from management helps to ensure support and funding from for security activities requiring financial resources; and that organization-wide risk management programs are developed and implemented effectively. Source: http://www.isaca.org/Knowledge- Center/Research/ResearchDeliverables/Pages/Information-Security-Governance-Guidance- for-Boards-of-Directors-and-Executive-Management-2nd-Edition.aspx Page 101 of 173 APPENDIX B 3.1.2 Risk Management Assigned to: City of Georgetown Priority High Recommendations At the City of Georgetown, it is evident that the IT department has taken measures in implementing security practices throughout the IS environment; however organizational cybersecurity risk management practices are not formalized, and risk is managed in an ad hoc/reactive manner; an organization-wide approach to managing cybersecurity risk has not been established. As a result, security activities or business strategies may not be directly aligned with organizational risk objectives or the current threat landscape. The City has undertaken an effort through this assessment to evaluate the security controls needed to combat cybersecurity risks, but there is a need for an overall information security risk assessment to identify risks to the organization and threat mitigation strategies. To this effect, we recommend that management adopt a practice of performing a risk assessment periodically. The periodic approach may take either of the following approaches: (A) performing a full assessment every other year due to intensive resources required to facilitate such an exercise or, (B) a targeted approach done annually. The targeted approach may include: (1) revisiting Plante Moran’s deliverables and updating controls where appropriate, (2) re-assessing the City’s mitigation plan to update progress and note any further concerns, and/or (3) Selecting a few high-priority control areas (e.g. vendor management, or any business objective/goal identified by executive management) and re-assessing associated threats related to those areas. Irrespective of the approach selected, the process for performing a risk assessment typically includes: • Identification of information assets (data, applications, infrastructure, and vendors) • Assigning value to identified assets based on criticality (or dollar value in some cases) • Evaluation of vulnerabilities and threats In addition to the above, we also suggest that the City assess the penalties and impact of security breaches. From a regulatory perspective, such liabilities should be considered to ensure that risks to sensitive data is properly assessed and accounted for. Moreover assessing information security risks throughout the organization provides keen insight into management’s risk tolerance for implementing security layers within the organization. The IT risk assessment should be in-line with the City's risk management strategies for identifying risks, evaluating existing controls and mitigating controls, understanding residual risk and establishing a risk mitigation plan. Page 102 of 173 APPENDIX B 3.1.3 Policies and Procedures Assigned to: City of Georgetown Priority High Recommendations Security policies and procedures are key components of an Information Security Program. They reflect the organization's business processes and strategy, thereby enabling management to define the scope of security, what is expected from employees, dictate what must be protected and to what extent, and what the consequences of noncompliance will be. To this effect, in addition to the already existing Acceptable Use policy in place, we recommend management consider an organization-wide Information Security Policy, to include key sections such as the ones listed below: • Purpose/Scope • Roles and responsibilities (including those related to regulatory requirements) • Management commitment and business owner requirements • Enforcement • Information Sharing: Define and set requirements for relationships with or connections to information systems of other agencies. Additional policies that the City should consider adding include: • Data Classification • Information Risk Management (IRM) • User Access Provisioning and Review • Data Backup and Retention • Data Destruction/Retention Policy • Media Handling/Disposal Policy (this can be combined with the existing Computer Disposal Policy) • Data Protection and Encryption • Secure Configuration/Hardening • Physical Security Policy • Contingency Plan • Vulnerability Assessment and Remediation • Incident Response Policy (for breaches, events and other critical incidents) The ISP should be reviewed periodically (e.g. annually) by senior management and enforced through annual end-user acknowledgement signoffs. Page 103 of 173 APPENDIX B 3.1.4 Asset Management: Data Classification Assigned to: City of Georgetown Priority High Recommendations The City has identified and catalogued its hardware and software via a tool called Lansweeper. This approach ties into an overall information flow enforcement (NIST SP 800-53 Rev. 4 AC-4) which ensures the confidentiality, integrity, and availability of critical data when defined and enforced. The next step is to classify data within the system based on its criticality and / or sensitivity (NIST SP 800-53 Rev. 4 RA-2). Classification of data will also help drive the above- mentioned information flow enforcement and help define the City’s security architecture. Most organizations conduct the security categorization process as an organization-wide activity with the involvement of chief information officers, senior information security officers, information system owners, mission/business owners, and information owners/stewards. Plante Moran recommends the classification of City data to define an appropriate set of protection levels and communication required for special handling. Classifications and associated protective controls (including encryption for data at rest and data leak prevention tools) should take into account department needs for sharing or restricting information and the associated business impacts if such data were compromised. Successful data classification in an organization requires a thorough understanding of where the organization’s data assets reside and on what applications/devices they are stored. Handling procedures should include details regarding the secure processing, storage, transmission, declassification, and destruction of data. Page 104 of 173 APPENDIX B 3.1.5 Access Management Assigned to: City of Georgetown Priority High Recommendations Logical Access: Access provisioning to the system is completed on the practice of mirroring, that is, 'set up as another user within the system’. This practice can potentially lead to excessive access rights being provided to users. On the other hand, for existing users, additional access is provisioned without a formal review for SoD (Segregation of Duties) conflict. When users are terminated, access removal from all necessary applications may not be performed in a timely manner due to delayed notification from HR to the IT department. Furthermore, in all aforementioned scenarios (access provisioning, modification and termination), it was noted that not all applications have a formal process of provisioning and de-provisioning. A role-based access scheme should be established to ensure consistent application of user access rights within the system. Users should be assigned their base set of access authorizations based on the concept of “Least Privilege Necessary” to perform their role or job function (as defined within their formal job description). Additional access beyond the previously established role-based access scheme should be formally requested, reviewed for conflicts and approved (NIST SP 800-53 Rev. 4 AC-2). Moreover, Management should consider integrating access rights with data classification efforts identified in the findings within this report (See 3.1.4 above, for more details). Physical Security: The City currently monitors physical access to the facility where information system resides to detect and respond to physical security incidents. However, CoG does not review physical access logs periodically (e.g. quarterly/annually). We recommend management take the following actions: 1. Establish a role based access scheme that takes into account the job responsibilities associated with each role for City of Georgetown. 2. Establish a process to periodically review user access (including physical access) to ensure accuracy and adherence to existing/changed business processes. 3. Ensure a process is in place to approve additional or special access requests and timely de-provision access upon notification from HR. 4. Implement and enforce procedures to identify and document appropriate access requirements for removing, adding or modifying City personnel’s access to electronic PHI. The need for and extent of access should be based on an assessment of risk, cost, benefit and feasibility as well as business need, and permission to view, alter, retrieve and store ePHI. 5. Perform a periodic review of user access to PHI and ePHI (including access to the data center) to verify the list is accurate and to ensure access is still commensurate with job responsibilities. Page 105 of 173 APPENDIX B 3.1.6 Contingency Plan Assigned to: City of Georgetown Priority High Recommendations In order to ensure that critical operations are available in the event of an interruption or incident, redundancy is built into the datacenter environmental controls at the City and an extensive data backup strategy is in place. However, a formal contingency plan is not in place and related resources/systems are not catalogued and prioritized. Plante Moran recommends the City conduct and formalize: (1) a Business Impact Analysis (BIA) which identifies and analyzes mission-critical business functions, and then quantifies the impact a loss of those functions would have on the City, and (2) An information system contingency plan to mitigate the risk of critical system and service unavailability. The contingency planning process should occur after a formal Business Impact Analysis (BIA) is conducted, in order to correlate the system with the critical processes and services provided, and based on that information, characterize the consequences of a disruption. Three steps are typically involved in accomplishing the BIA: • Determine mission/business processes and recovery criticality • Identify resource requirements • Identify recovery priorities for system resources The information system contingency plan should consider three phases: (1) Activation and Notification Phase which outlines activation criteria and notification procedures, (2) Recovery Phase which outlines recovery activities, escalation, and notification, and (3) Reconstitution Phase which allows validating successful recovery and deactivation of the plan through activities such as validation testing, notifications, and event documentation. The contingency planning process should also include the following elements: • Roles and responsibilities • Scope as applies to common platform types and organization functions (i.e., telecommunications, legal, media relations) • Resource requirements • Training requirements • Exercise and testing schedules • Plan maintenance schedule, and • Minimum frequency of backups and storage of backup media Further, an effective contingency plan should tie into the City’s Incident Response Plan and should consider City’s personnel as information system contingency plans are not executed on their own and an incident will often impact individuals that are crucial to tasks related to information system operations. Personnel safety and evacuation, personnel health, personnel welfare, relationships with response organizations, and communication planning should be considered when developing the contingency plan. Finally, the agreed upon plan should be compatible with the enterprise-wide Business Continuity Plan. Sources: http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata- Nov11-2010.pdf Page 106 of 173 APPENDIX B 3.1.7 Incident Response Management Assigned to: City of Georgetown Priority High Recommendations Based on inquiry, it was noted that the City of Georgetown does not have a formal Incident Response Plan. Incident management includes a proactive and reactive phase. While reactive measures help to ensure that incidents are properly handled, proactive measures allow incidents to be detected in a timely and controllable manner (See finding 3.1.9). An improved approach will be to implement an Incident Management Program, which is initiated by an Incident Response Policy and include the following key elements: • Provide a roadmap for implementing its incident response capability; • Describes the structure and organization of City of Georgetown’s incident response capability; • Provides a high-level approach for how the incident response capability fits into City of Georgetown as a whole and the overall Family of Companies; • Meets the unique requirements of City of Georgetown’s mission, size, structure, and functions; • Defines reportable incidents as well as ; • Requirements and guidelines for external communications and information sharing (e.g., what can be shared with whom, when, and over what channel) • Provides metrics for measuring the incident response capability within the organization; • Defines the resources and management support needed to effectively maintain and mature an incident response capability; and • Is reviewed and approved by senior management We recommend management take the following actions: 1. Develop a more comprehensive plan incorporating the above elements. 2. Integrate City of Georgetown’s Incident Response Plan testing activities with relevant third parties. Page 107 of 173 APPENDIX B 3.1.8 Third Party Cybersecurity Roles & Responsibilities Assigned to: City of Georgetown Priority High Recommendations While the City has identified trusted partners with respect to hardware and hosted applications. We noted the following deficiencies related to third party roles and responsibilities: • The contract between City of Georgetown and the service provider does not specifically outline the roles and responsibilities related to Cybersecurity controls handled by each organization. • There is no monitoring of external party use of the system for potential Cybersecurity events. Security roles and responsibilities should be established for all third-party service providers (NIST SP 800-53 Rev. 4 PS-7). Responsibilities are key to ensure that the City of Georgetown and its service providers understand exactly who is responsible for which Cybersecurity controls; this is especially important in a business continuity situation. These roles and responsibilities should be formally documented in a contractual agreement. Service level agreements should be established based on Key Performance Indicators (KPI) where City of Georgetown’s expectations are set for each outsourced responsibility to its third-party service providers. Once established, KPIs should be monitored to ensure third- party service providers adhere to contractual obligations (NIST SP 800-53 Rev. 4 CA-7). Furthermore, adherence to Key Performance Indicators should be used to identify potential issues with vendor service that can be addressed through negotiations or seeking a new vendor. We recommend management take the following actions: 1. Clearly identify the cybersecurity responsibilities to be outlined in the contract with the service provider including roles for identification, response, and recovery procedures. 2. Establish Key performance indicators for third-party responsibilities including number of events, data breaches, number of notifications. 3. Continuously monitor established key performance indicators. Page 108 of 173 APPENDIX B 3.1.9 Critical Security Event Identification Assigned to: City of Georgetown Priority Medium Recommendations We noted a variety of log generation methods are in place for the system. These logs can be used to identify everything from system health to potential security violations. Presently, there is not a comprehensive catalog of security related event types being identified and reviewed within the logs by security professionals. To establish an effective event logging and monitoring program, City of Georgetown will need to first identify high risk events that can be alerted from current logging capabilities (NIST SP 800-53 Rev. 4 AU-6). Potential high risk events can be discerned through the risk assessment process (NIST SP 800-53 Rev. 4 RA-3), penetration testing, and best practice documentation. Some common threat events include: • Multiple failed login attempts • Elevations in access privileges • Changes to application code • Changes to security settings • Process specific actions For more risky events, such as devices that connect to the network without authorization, the organization may consider alert generation techniques while for less risky events they may simple review on a periodic basis. Identified events should be responded to in accordance with the organization’s Incident Response Plan (NIST SP 800-53 Rev. 4 IR-4, IR-5). Once event detection processes are implemented a process to test said processes should be established. Security assessments by internal or external independent parties can be an effective way to ensure logging and monitoring processes are effective (NIST SP 800-53 Rev. 4 CA-2). Management should seek continuous improvement opportunities for the event logging and monitoring program based on the results of security assessments. We recommend management take the following actions: 1. Identify the system events that may indicate a potential security event. 2. Define monitoring techniques commensurate with associated risk. 3. Establish formal policies and procedures related to defined monitoring activities. 4. Periodically test the effectiveness of event logging and monitoring processes. Page 109 of 173 APPENDIX B 3.1.10 Security Awareness, Training and Education Assigned to: City of Georgetown Priority Medium Recommendations The City has implemented an acceptable use policy amongst other policies around proper use of computers and accessing digital information. However, to ensure compliance, there is a need to assess employee’s understanding of policies and response to cybersecurity threats via periodic awareness and training. End users are the first line of defense against a variety of social engineering threats and must be relied upon to appropriately select strong passwords, perform secure day-to-day operations, and appropriately use equipment. By not providing formal training to all employees, the risk is increased that employees may not follow appropriate security procedures. We recommend a formal IT security awareness training be provided to all employees on a periodic basis. Employees should be educated on the organization’s information security policies upon hire, periodically (at least annually), and as major changes occur. In addition, employees should be required to formally acknowledge that they have read and understand the security topics discussed, and that they understand the ramifications of noncompliance. Management should consider allocating resources for security awareness activities (including other items, e.g. banners and posters), and enforce employee participation/attendance within the organization. Page 110 of 173 APPENDIX B 3.1.11 Unauthorized Mobile Code Detection Assigned to: City of Georgetown Priority Low Recommendations Mobile code is defined as any program, application, or content that is capable of being embedded and transferred (via email, document, website, etc.). Examples of mobile code include: JavaScript, Active X, PDF, VBscripts, etc. Avenues There are currently multiple avenues for mobile code to be introduced into the information systems supporting the system. Mobile code may be introduced from USB (current USB restriction only prevent data being copied to a USB), through email, and through downloads from websites. The City should identify the types of mobile code that are approved for use within the information system and educate users on the proper use of related technologies. Likewise, organizations should define which types of mobile code are not approved for use within the information system. Processes should be defined to identify unauthorized mobile code deployed within the environment. These processes could include configuration management controls, vulnerability scanning, etc. (NIST SP 800-53 Rev. 4 SC-18). City of Georgetown does have controls in place to mitigate the risk of malicious mobile code: antivirus controls, and limiting user access to administrator functions based on the concept of least privilege. We recommend management take the following actions: 1. Define acceptable and unacceptable mobile code and mobile code technologies. 2. Deploy a process to monitor for the presence of mobile code 3. Integrate mobile code detection processes into the Incident Response Plan Page 111 of 173 APPENDIX B Page 112 of 173 City of Georgetown, Texas City Council Workshop N ovember 24, 2020 S UBJEC T: Overview and discussion regarding the purpose of P ublic Improvement Districts (P ID) and the City’s P ID P olicy -- Wayne Reed, Assistant City Manager I T EM S UMMARY: Staff is presenting an overview of the purpose o f P ublic Improvement Districts (P IDs) and the City’s P ID P olicy at this time, because the City has been approached by multiple developers seeking to submit P ID petitions to request Council to support the creation of new P IDs to assist with funding public improvements that will meet community needs. The City Council adopted a P ublic Improvement Distric t P olicy in December 2018. As stated in the City’s P ID P olicy, P ublic Improvement Districts (P IDs) provide a development tool that allocates costs according to the benefits received. A P ID can provide a means to fund improvements to meet co mmunity needs whic h co uld not othe rwise be constructed or provided and be paid by those who most benefit from them. Under current State Law, a P ID is a defined are a of properties, who se owners have petitioned the City to form a P ID. City Co unc il establishes a P ID by adoption of a re so lutio n after a public hearing. The public hearing is publicized and written notification of the hearing is mailed to all property owners in the pro pose d P ID. By petition, the owners pledge to pay an assessment in order to receive e nhanced services and/or improvements within the P ID. The P ID must demonstrate that it confers an extraordinary benefit, not only to the properties within the P ID, but also to the “public” which includes the entire City. The benefit sho uld be above and beyond typical improve ments and amenities to justify the City’s involvement. The City’s P ID P olicy is intended to assist City Co unc il in prioritizing approval of petitions for P IDs by providing clear and fair criteria by which to evaluate pro posals. The policy guides develo pers to improve the quality and community (public) benefit o f a project to a degree that is superior to the le vel of community benefits typic ally generated by real estate development projects not involving P ID financing. Such benefits include, but are not limited to, the following. 1 . Qual i ty Devel opment. The development meets or exceeds the intent of the de velopme nt, infrastructure, and design standards of City codes; 2 . Extraordi nary B enefi ts. The development provides extraordinary public benefits that advance the vision and goals of the Comprehensive P lan, such as, but not limited to, extension, financial contributio n, and/or enhancement o f master planned infrastructure, dive rsity o f housing, and enhanced parks, trails, o pen space, and recreational amenities that are available to the public; 3 . Enhance P ubl i c Servi ce and Safety. The development e nhances public services and optimizes service delivery through its design, dedication of sites, connectivity, and other features. 4 . F i scal l y Responsi bl e. The development is financially feasible, doesn’t impair the City’s ability to provide municipal services, and would not impose an undue financial burden on the citizens; 5 . F i nance P l an. The deve lo pe r(s) contributes financially to cover a portion of infrastructure expenses without reimburse ment by the P ID or the City and as reflected in co nditio ns placed on the issuance of P ID Bonds; 6 . Annexati on. A proposed P ID must be located within the City Limits. The City will not consider the creation of a P ID where any portion of the property is located in the City’s extra-territorial jurisdiction. It is not necessary that all community benefits be funded by P ID assessments. If a community benefit is not eligible for P ID financing based on section 372.003, Local Government Code, the petitioner must demonstrate sufficient funding of the benefit from other sources. F I NANC I AL I MPAC T: None. S UBMI T T ED BY: Page 113 of 173 R LD for Wayne Reed AT TAC HMENT S : Description P I Ds 101 and P I D P olic y O verview 11.24.2020 Approved P I D P olic y 12.11.2018 Page 114 of 173 City Manager’s Office Public Improvement Districts: an Overview Presented by Wayne Reed, Assistant City Manager November 24, 2020 Page 115 of 173 City Manager’s Office Overview •Why are we discussing PIDs? •What is a PID? •Why are PIDs desirable? •What improvements can be financed by PID monies? •What is the City’s Policy on PID creation? •What does it mean to live in a PID? •How do PIDs affect other City residents? •How do PIDs affect the City? Page 116 of 173 City Manager’s Office Why Are We Discussing PIDs? •Packsaddle Partners, LLC is proposing a PID to assist with the new Parks at Westhaven development. •115 acres at Maple St. and Westinghouse Rd. •401 Residential Units (SF and SF-Attached) •16 ac. Park •1 21/2 ac. Commercial lot Page 117 of 173 City Manager’s Office Why Are We Discussing PIDs? •Cordova Real Estates Ventures is proposing a PID to assist with the new Bluffview development. •Northeast corner of Southwest Bypass and Leander Road (RM 2243 ) •Approx. 68±acres •468 Residential Units (168 SF and 300 MF) •Parkland along South Fork of the San Gabriel River with public access and trailhead Page 118 of 173 City Manager’s Office What is a PID? What it is: •A PID is a designated geographic area within which special assessments are levied. •Two types of PIDs: •Maintenance PID (e.g., Georgetown Village PID) •Bond-issuing PID (the proposed Parks at Westhaven and Bluffview PIDS) Page 119 of 173 City Manager’s Office What is a PID? What it is not: •A PID is a not a separate governmental entity. •A PID assessment is not a tax. •A PID does not use City money or credit. Page 120 of 173 City Manager’s Office Why are PIDs Desirable? Developer’s Perspective: •Provide access to tax exempt capital •Lower financing costs •Reimbursement from PID Assessment revenues and/or from PID Bond proceeds Cities’ Perspective: •Landowner requested •Saved financing costs means more money for quality development •Expands/enhances public infrastructure network •No City money or credit •Reimbursement only per City PID Policy •Cost of ownership to homeowner is less than with a MUD Page 121 of 173 City Manager’s OfficeWhat Improvements Can Be Financed by PID Bonds? An improvement of the type listed that Council finds “promotes the interest” of the City and “confers a special benefit on a definable part” of the City Landscaping Libraries Fountains, lighting, signs Off-street parking and mass transit Sidewalks, streets Water, wastewater, drainage facilities Pedestrian malls PID formation and administrative expenses Art Parks and park improvements Page 122 of 173 City Manager’s Office What is the City’s Policy on PID Creation? •PID Policy adopted on December 11, 2018 •“To PID or not to PID?” •City’s PID Policy states: Public Improvement Districts (PIDs) provide a development tool that allocates costs according to the benefits received. A PID can provide a means to fund improvements to meet community needs which could not otherwise be constructed or provided and be paid by those who most benefit from them. Page 123 of 173 City Manager’s Office What is the City’s Policy on PID Creation? Quality Development Extraordinary Benefits Public Service/Safety Fiscally Responsible Finance Plan In-City Only (no ETJ PIDS) Page 124 of 173 City Manager’s Office What is the City’s Policy on PID Creation? Developer Thresholds: •Experience •Financial capability to pay for construction of the project up front, since payments from PID Bonds are made when construction is completed, as a reimbursement. •Creating an “extraordinary public benefit” •Indemnify the City Page 125 of 173 City Manager’s Office What is the City’s Policy on PID Creation? Development Thresholds: •Exceed UDC standards •Infrastructure meets City specifications and standards •Present an “extraordinary public benefit” to be eligible for reimbursement from PID Bonds •Have an HOA (residential) or POA (commercial) Page 126 of 173 City Manager’s Office What is the City’s Policy on PID Creation? Financial Thresholds: •PID assessment amount ≤ $0.55 per $100 Assessed Value •Min. AV to lien ratio for PID Bonds = 4:1 •Max. PID Bond maturity = 25 years after issuance •Last PID Bond issuance = 10 years after 1st issuance •Max PID Bond Limit = actual costs (plus reserves and capitalized interest) •MF development: –Pay PID assessment up front in one lump sum –Lump sum amount subtracted from reimbursement and PID Bond limit Page 127 of 173 City Manager’s Office What does it mean to live in a PID? •Pay a special assessment. •Have a special assessment lien attached to their tax parcel, just like for taxes. •Be subject to foreclosure for non-payment of the PID Assessment, just like for unpaid taxes. •PID Assessment runs with the land (i.e., is not a personal obligation) Page 128 of 173 City Manager’s Office What does it mean to live in a PID? •Compared to MUDS: –cost of ownership to homeowner in a PID is less than in a MUD –PID Assessment is certain because it is fixed and finite (ends when paid in full) –PID Assessment can be prepaid without penalty or paid in annual installments (w/ interest) Page 129 of 173 City Manager’s Office How do PIDs affect other City residents? •Financially, they don’t. •With respect to quality of life, City residents benefit from higher quality level of development and access to public improvements that provide “extraordinary public benefit.” Page 130 of 173 City Manager’s Office How do PIDs affect the City? What the City Council would have to do: •If PID Policy factors are met: –authorize staff to prepare resolutions, agreements, plans, ordinances per Council direction –Create the PID –Levy special assessments –Bill for and collect special assessments, and foreclose if unpaid (by contract with Tax Assessor-Collector) –Issue PID Bonds –Update service and assessment plan annually Page 131 of 173 City Manager’s Office How do PIDs affect the City? What the City Council would NOT have to do: •Use its money to reimburse developers •Use its money to create or administer the PID •Lend its credit Page 132 of 173 City Manager’s Office Questions? Page 133 of 173 City Manager’s Office Next Steps •The Parks at Westhaven (Workshop November 24, 2020) •Bluffview (Workshop TBD) Page 134 of 173 1 Policy and Guidelines for Reimbursement Public Improvement Districts I. OVERVIEW Public Improvement Districts (PIDs) provide a development tool that allocates costs according to the benefits received. A PID can provide a means to fund improvements to meet community needs which could not otherwise be constructed or provided and be paid by those who most benefit from them. Reimbursement PIDs are development financing tools authorized pursuant to Chapter 372 of the Texas Local Government Code, which the developer funds infrastructure and the issuer agreement to provide reimbursements to the developer, including through the issuance of debt obligations secured by and payable from PID assessments (“PID Bonds”), after key benchmarks are met. Under current State Law, a PID is a defined area of properties, whose owners have petitioned the City to form a PID. City Council establishes a PID by adoption of a resolution after a public hearing. The public hearing is publicized and written notification of the hearing is mailed to all property owners in the proposed PID. By petition, the owners pledge to pay an assessment in order to receive enhanced services and/or improvements within the PID. The PID must demonstrate that it confers an extraordinary benefit, not only to the properties within the PID, but also to the “public” which includes the entire City. The benefit should be above and beyond typical improvements and amenities to justify the City’s involvement. The purpose of the PID policy is to outline the issues to be addressed before the City Council Page 135 of 173 2 Policy and Guidelines for Public Improvement Districts can support the establishment and continuation of a PID. The policy outlines such things as petition requirements, information to property owners, and determination of annual plan of services, budget and assessments. It addresses City administration issues, which are in addition to the requirements of state law. Before consenting to the creation of a PID, the City Council will consider whether the creation of the PID is feasible, practicable, and necessary for the provision of the proposed services and would be a benefit to the land by producing a development that exceeds minimum development standards, and therefore warrants the City’s consent, consistent with the other considerations in this policy. II. COMMUNITY BENEFITS Subject to the requirements of this policy, the City Council will prioritize approval of petitions for PIDs supporting real estate development projects that provide for the following public benefits to a degree that is superior to the level of community benefits typically generated by real estate development projects not involving PID financing. Such benefits include, but are not limited to, the following. 1. Quality Development. The development meets or exceeds the intent of the development, infrastructure, and design standards of City codes; 2. Extraordinary Benefits. The development provides extraordinary public benefits that advance the vision and goals of the Comprehensive Plan, such as, but not limited to, extension, financial contribution, and/or enhancement of master planned infrastructure, diversity of housing, and enhanced parks, trails, open space, and recreational amenities that are available to the public; 3. Enhance Public Service and Safety. The development enhances public services and optimizes service delivery through its design, dedication of sites, connectivity, and other features. 4. Fiscally Responsible. The development is financially feasible, doesn’t impair the City’s ability to provide municipal services, and would not impose an undue financial burden on the citizens; 5. Finance Plan. The developer(s) contributes financially to cover a portion of infrastructure expenses without reimbursement by the PID or the City and as reflected in conditions placed on the issuance of PID Bonds; 6. Annexation. A proposed PID must be located within the City Limits. The City will not consider the creation of a PID where any portion of the property is located in the City’s extra-territorial jurisdiction. It is not necessary that all community benefits be funded by PID assessments. If a community benefit is not eligible for PID financing based on section 372.003, Local Page 136 of 173 3 Policy and Guidelines for Public Improvement Districts Government Code, the petitioner must demonstrate sufficient funding of the benefit from other sources. If it is proposed that PID Bonds are to be issued to reimburse a developer for infrastructure that a developer would ordinarily fund at its own costs, the petition must demonstrate how creation of the PID and financing of the infrastructure provides an extraordinary benefit to the City as a whole and to the property in the PID, such as accelerated development or demonstrable furtherance of a major City policy objective. The City will not create, nor consider, a PID to solely finance the costs of constructing infrastructure that only meets minimum City development standards. III. GENERAL 1. PID Services and Improvements: a. PID assessments may only be used to serve or improve public property and may not be used to benefit or enhance private property. Listed below are services and improvements which Georgetown’s PIDs may provide or maintain. Other improvements allowed by statutes will be reviewed and considered individually by the City. i. Improved landscaping and irrigation; ii. Enhanced entry features; iii. Installation of fountains, distinctive lighting, and signs; iv. Installation of art or decorations; v. Construction or improvement of pedestrian trails and sidewalks; vi. Establishment or improvement of parks and recreational amenities; vii. Enhanced regional infrastructure improvements; and viii. Construction of off-street parking facilities b. Listed below are services and improvements which Georgetown PIDs may not provide or maintain: i. Swimming pools; ii. Travel expenses; iii. Perimeter fencing; iv. Acquisition; construction, improvement or maintenance of privately owned facilities or land; and v. Any trails, parks, streets, or other public amenities that are located within a gated community or otherwise inaccessible location may not be funded or reimbursed by the PID. c. Except for public improvements specifically listed in a voter-approved City bond proposition, the City will not expend or pledge a tax increment, general fund revenue, general obligation or certificate of obligation debt proceeds, Page 137 of 173 4 Policy and Guidelines for Public Improvement Districts etc. to support the costs of PID improvements, unless explicitly approved by City Council as advancing a City purpose. 2. PIDs must be established carefully and only when related to a public purpose to avoid a proliferation of special districts. 3. PIDs must be self-sufficient and not adversely impact the ordinary service delivery of the City, except where City Council elects to participate in the project's costs. 4. A PID's budget shall include sufficient funds to pay for all costs above and beyond the City’s ordinary costs, including additional administrative and/or operational costs as well as additional maintenance costs resulting from the PID. 5. Use of assessments for partial recovery of a developer's capital costs will be allowed only in special cases where extraordinary public benefit is shown. Only those capital costs associated with continuing PID services will be considered for partial recovery. 6. Anyone selling land in a PID must include a "title encumbrance" which notifies any prospective property owner of the existence or proposal of special assessments on the property. All closing statements must specify who is responsible for payment of the PID assessment on a pro rata share thereof. 7. A PID may not overlap the boundaries of another PID. 8. Development of property within the PID may not require variances from applicable development regulations that result in a significantly lower standard of development. 9. The City will authorize PID Bond proceeds only to reimburse the costs of PID improvements that have been designed and constructed to the City standards. 10. For a residential PID, the City Council will look more favorably on a petition where the developer of a new subdivision has put in place an active homeowner’s organization. 11. If multi-family rental units are included within the proposed assessments, all of the multi-family assessments must be prepaid by either the developer or builder, and such assessments and prepayment amounts thereof shall be excluded any reimbursements to the developer, including from PID Bonds. 12. The annual assessment to property owners within the PID shall be no more than the equivalent of a $0.55 per $100 tax rate on the assessed value of their property. 13. The proposed development must be consistent with the entitlements on the property. All required zoning, other required land use approvals or other required permits must be in place for the development prior to the levy of PID assessments. 14. PID Administration is addressed in a separate policy. 15. All PID agreements between the City and the developer shall include language satisfactory to the City indemnifying the City and its officials, employees and representative. 16. Any requested adjustments or deviations from the terms of this policy for a PID shall be clearly requested and explained (including a detailed description of the basis for such a request under Chapter 372 of the Texas Local Government Code) in the PID Page 138 of 173 5 Policy and Guidelines for Public Improvement Districts petition for that PID. Any adjustments or deviations granted are at the sole discretion of the City Council. 17. Neither the City, a public official, employee or representative shall be responsible for any liability arising under or growing out of any approved PID. Any obligation or liability of the developer whatsoever that may arise at any time under the approved PID or any obligation or liability which may be incurred by the developer pursuant to any other instrument transaction or undertaking as a result of the PID shall be satisfied out of the assets of the developer only and the City shall have no liability. 18. The developer shall not have the right under any PID related agreement with the City to transfer or assign its reimbursement rights such that they may be pledged to the payment of debt service on public securities issued by any state of the United States or any political subdivision thereof without the approval of the City. 19. If the City elects to hire a qualified third party PID administrator to administer the PID, the costs for such administration shall be paid for with PID funds. The PID administrator will be required to review and comment on the budget and to attend the annual public hearing regarding the Service and Assessment Plan. Contracting with a third party PID administrator to manage the PID shall not preclude the City from entering into a contract with another taxing unit for the collection of the assessments levied for the PID. IV. PID APPLICATION REQUIREMENTS In accordance with Texas Local Government Code Section 372, a PID Petition must state: 1. The general nature of the proposed amendments; 2. The estimated cost of the improvements; 3. The boundaries of the proposed PID; 4. The proposed method of assessment, which may specify included or excluded classes of assessable property; 5. The proposed apportionment of cost between the PID and the municipality or county as a whole; 6. How the PID will be managed; 7. That the persons signing the petition request or concur with the establishment of the PID; 8. That an advisory body may be established to develop and recommend and improvement plan to the governing body; and 9. Evidence that the petition’s signatures meet the state law requirements or the petition will be accompanied by a reasonable fee (as determined by the City and in addition to the required application fee) to cover the city costs of signature verification. If the proposed PID is an expansion of an existing PID, a petition for the new portion of the PID must identify each subdivision, or portion thereof, within the Page 139 of 173 6 Policy and Guidelines for Public Improvement Districts proposed boundaries of the new PID, and each subdivision or portion thereof, that is not currently in an existing PID shall individually satisfy the requirements for a petition under Section 372.005 of the Texas Local Government Code. Subdivision has the meaning assigned by Section 232.021 of the Texas Local Government Code. Before the City will consider a PID, the petitioners must provide the following for evaluation: 1. Identification of the benefit of the PID to the affected property owners and to the city as a whole (i.e., public purpose). 2. Map of the area, description of the boundaries of the PID for the legal notices and a "commonly known" description of the area to be included in the PID. 3. Description of all city-owned land within the PID. Property in the PID owned by the City shall not be subject to PID assessments. Property in the PID owned by another governmental entity may be assessed only pursuant to an interlocal agreement between the entity and the City. 4. “Market Feasibility Study” - The petitioner must provide evidence of the feasibility of the real estate development project and the PID, taking into account both the market for the proposed product types and the petitioner’s capacity to deliver the project. The feasibility study should also include a comparison of the combined PID assessment and ad valorem tax burden on owners in nearby developments. The feasibility study must be prepared externally by a third party that is approved by the City. 5. Assurance of long-term backing and support, which will include the financial plan and build out/phasing forecasts. If proposing reimbursements through PID Bonds, the value to lien ratio should be a minimum of 4:1. 6. Contingency Plan to address the maintenance or disposition of PID improvements and or property that has not been dedicated to the public if a PID is dissolved. 7. Sunset clause or procedures outlined for public review of the success of the PID and a determination of property owners whether to continue with the PID or dissolve it; provided that if dissolved the PID must remain in effect for the purpose of meeting obligations of indebtedness for improvements as required by state law. 8. Specified assurances to the City that the construction of improvements in the public right-of-way will be maintained by the PID and in no way obligates the City to future maintenance or operational costs, unless otherwise stated in a subsequent agreement. In addition, the following must be addressed before the City Council will take action on a petition: Page 140 of 173 7 Policy and Guidelines for Public Improvement Districts 1. A non-refundable "application fee" of $20,000 will be paid by the applicant to reimburse the City for the cost of evaluating the petition. If City costs exceed the initial fee, the developer shall replenish the account with an additional deposit. 2. A Professional Services Agreement will be entered into that outlines the responsibilities of the City and the developer. 3. The petitioner must agree to reimburse the City or directly pay for the City’s administrative costs for reviewing the PID petition, publishing related notices, reviewing the Market Feasibility Study and Service Assessment Plan, including the cost of services provided by the City’s third party PID Administrator, bond counsel, disclosure counsel, financial advisors and any other consultant selected by the City to assist the City in a PID-related matter. V. BOND SIZE LIMITATIONS AND FINANCING CRITERIA The following limitations and performance standards shall apply to a PID Bond issues approved by the City: 1. The minimum appraised value to lien ratio at date of each PID Bond issue shall be 4:1. The City in its sole discretion may require such values to be supported by an appraisal of the applicable parcels prepared by an appraiser selected by the City with all reasonable appraisal fees to be paid by the developer. 2. Maximum maturity for each series of PID Bonds (to extent allowed by law): 25 years from their date of issuance 3. The last PID Bond issuance for a PID shall be not later than the date that is ten (10) years after the date of the first PID Bond issuance for that PID. 4. The aggregate principal amount of PID Bonds required to be issued shall not exceed an amount sufficient to: a. reimburse the actual costs of the qualified PID improvements; b. fund required reserves; c. capitalized interest to the extent determined by the City in its sole discretion to be appropriate, if any, but not more than 12 months after the completion of construction; and d. pay any costs of issuance, arbitrage, administrative fees, third party fees, or other costs related to issuance. 5. Any PID Bonds issued must include a reserve fund funded from proceeds of such PID Bonds at the time of issuance. Refunding PID Bonds may satisfy this requirement in cases where an existing reserve fund is transferred to the refunding PID Bonds. All PID Bond reserve funds at the time of issuance shall be in an amount equal to the lesser of: a. The maximum annual debt service on the PID Bonds; b. 10 percent of the PID Bond proceeds; or Page 141 of 173 8 Policy and Guidelines for Public Improvement Districts c. 125 percent of the average annual debt service on the PID Bonds. 6. The City will apply to PID Bonds the same post-issuance compliance requirements the City applies to its general obligation and certificate of obligation debt. 7. Failure by the developer to timely submit required continuing disclosure filings will be deemed a breach under any PID development, reimbursement or financing agreement with the City. 8. Before the City will levy a PID assessment or authorize issuance of PID Bonds, the petitioners and the City must enter into a PID Development Agreement that establishes: a. the basic terms and conditions for creation of the PID, including the provision of community benefits and compliance with the requirements of this policy; b. payment or reimbursement to the City of both the City’s one-time and ongoing administrative and operational costs; c. the financing of the PID improvements and the payment of assessment revenue or PID Bond proceeds to reimburse the costs of the PID improvements; d. the planning, development, construction, management, and maintenance of the PID improvements; e. terms and conditions for ongoing PID administration, operation, and management, including collection of PID assessments; and f. any services to be funded by the PID. 9. Prior to levy of special assessments and issuance of PID Bonds the developer must be current on all taxes, assessments, fees and obligations to the City (i.e., City required improvements, utility agreements, including information required for timely disclosures as required by the applicable continuing disclosure agreements, etc.). 10. Prior to the issuance of PID Bonds, the City must have (1) confirmed the PID improvements to be reimbursed have been completed in accordance with all applicable design and construction requirements, including City codes and any PID related agreements between the City and the developer (2) accepted such improvements. As a condition to the City's acceptance of a PID improvement, the developer shall provide the City with an assignment of the warranties and guaranties, if applicable, to those improvements and a two year maintenance bond, all in a form reasonably acceptable to the City. The developer must also submit to the City for verification all invoices and other supporting documentation clearly evidencing the actual costs of the PID improvements to be reimbursed. 11. The City, in its sole discretion, will select the members of the financing team for the issuance of PID Bonds, including the underwriter(s) for the PID Bonds. Page 142 of 173 9 Policy and Guidelines for Public Improvement Districts 12. The City, in its sole discretion, will determine the credit criteria/quality, market suitability, debt structure, continuing disclosure requirements and investor suitability requirements of all PID Bonds. 13. In the event that issuance of PID Bonds in a calendar year causes other City debt issuances not to qualify as "qualified tax-exempt obligations" under section 265(b)(3) of the Internal Revenue Code of 1986, as amended, the developer will be required to pay the additional costs of the City incurred as a result thereof. In agreeing to form a PID for which PID Bonds will be issued to reimburse the costs of constructing qualified public improvements, the City will require the following: 1. The property owner/developer must demonstrate to the City that it has the expertise to complete the new development that the PID will support. 2. The property owner/developer must demonstrate its financial capability to initially fund improvements prior to reimbursement and to fund improvements not being reimbursed by the PID. Such parties must be willing to share confidential financial information with the City and its advisors. 3. The PID Financing Agreement (or other application PID documentation) shall contain a section, which clearly identifies the benefit of the PID to the affected property owners and to the City as a whole (i.e. public purpose). 4. PID Bonds will only be issued to reimburse the property owner/developer for costs already incurred. Page 143 of 173 City of Georgetown, Texas City Council Workshop N ovember 24, 2020 S UBJEC T: P resentation and discussion regarding the creation of a P ublic Improvement District (P ID) called P arks at Westhaven -- Wayne Reed, Assistant City Manager I T EM S UMMARY: Council is be ing aske d to provide directio n and feedbac k o n the creation of a new P ublic Improvement District (P ID) for the P arks at We sthave n development lo cated o n the northeast c orner of Maple Street and Westinghouse Road. The total project covers 115 acres and will contain 401 residential units, a 16 acre park, and a 2.4 acre commercial lot. Scott Rempe, on behalf of P acksaddle Real Estate P artne rs, LL C (d/b/a P acksaddle P artners), has approac he d the City to request a P ID to fund impro veme nts to me e t community needs and support public infrastructure asso c iated with the development. In wo rking with the City staff, he has enhanced the development by increasing funding for the neighborhood park to create a one of its kind in the so utheast quadrant of the City that will attract residents fro m surrounding neighborhoods. In addition, he has expanded the ho using diversity by providing different lots sizes and two housing types. Further, he has agreed to enhanced architectural standards for the commercial lot and for the residential homes. Staff has reviewed the proposal and finds the proposal meets the intent of the City’s P ID P olicy. Should Council determine that the P arks at We sthave n P ID proposal is consistent with the P ID P o licy factors, so me of the high-level next steps include: • Landowner to submit P ID P etition • City to review developer supplie d financial fe asibility study utilizing City’s Bond Counsel, Financial Advisor and Bond Underwriter • Council to accept P ID P etition and set public hearing for P ID creation (both at same meeting) • City staff and consultants to co mme nc e negotiating and drafting needed resolutions, agreements, plans, ordinances • City Council to hold a public hearing o n P ID creation and then co nsider resolution approving creatio n of P ID and ordinance approving P ID Financing and Reimbursement Agreement • Council to adopt Service P lan and Assessment P lan (SAP ) by ordinance • Levy special assessments After the creation of the P arks at Westhaven P ID, debt (revenue bonds) will be issued after there is enough assessed value on the ground consistent with the City’s P ID P olicy (equal to or gre ate r than 4 :1 ). Annual revenues from the P ID assessment are pledged towards debt payments. F I NANC I AL I MPAC T: None at this time. S UBMI T T ED BY: Wayne Reed, Assistant City Manager AT TAC HMENT S : Description 2 P resentation - P arks at Wes thaven P I D O verview 11.24.2020 Page 144 of 173 City Manager’s Office Parks at Westhaven PID Proposal Presented by Wayne Reed, Assistant City Manager November 24, 2020 Page 145 of 173 City Manager’s Office Overview •Purpose of Presentation •Proposed Parks at Westhaven –Development Overview •PID Policy Analysis –Developer –Development –Financial •Council Feedback and Direction •Next Steps Page 146 of 173 City Manager’s Office Purpose Staff is seeking Council’s feedback and direction on a proposed Public Improvement District (PID) for the Parks at Westhaven development. •Does Council support the creation of a PID for the Parks at Westhaven development? •Does Council support the financial terms, architectural standards, and the enhanced park, trails and open space improvements? Page 147 of 173 City Manager’s Office Parks at Westhaven Development •Location –115 acres at Maple Street at Westinghouse Road (northeast corner) •Developer –Packsaddle Partners, LLC •General Features –401 residential lots –1 commercial lot –16 acres Parkland/Open Space Page 148 of 173 City Manager’s OfficePIDPolicy Compliance Evaluation – Developer Criteria Developer Thresholds: •Identity –Packsaddle Real Estate Partners, LLC d/b/a Packsaddle Partners https://packsaddlepartners.com/ –Formed in 2017, based in Austin –Principals are Larry Rother and Scott Rempe •Relevant Experience –505 Lot SF PID in Hutto •Financial capability –Agreed to front costs, receive reimbursement on completion Page 149 of 173 City Manager’s OfficePIDPolicy Compliance Evaluation – Development Criteria Development Thresholds: •Exceed UDC standards? Yes. –UDC Parkland Dedication •UDC = 5 acres *Parks at Westhaven = 16 acres –Parkland Improvements •UDC = $401,000 *Parks at Westhaven = $1.4 million –Housing Diversity •UDC = None *Parks at Westhaven = 3 lots sizes and 2 housing types –Architectural Standards •UDC = None *Parks at Westhaven = Required Page 150 of 173 City Manager’s Office PID Policy Compliance Evaluation – Development Criteria -Enhanced Parks Page 151 of 173 City Manager’s Office PID Policy Compliance Evaluation – Development Criteria -Enhanced Parks Page 152 of 173 City Manager’s Office PID Policy Compliance Evaluation – Enhanced Parks Page 153 of 173 City Manager’s Office PID Policy Compliance Evaluation – Development Criteria -Enhanced Parks Page 154 of 173 City Manager’s Office PID Policy Compliance Evaluation – Development Criteria -Enhanced Parks •16 acres Parkland/Open Space •Enhanced Parkland Improvements •All Abilities Playground •Fitness Equipment •Covered Pavilion •2 miles of internal trails •Concrete and natural surfaces •Internally connected •Estimated Cost = $1.4M Page 155 of 173 City Manager’s Office PID Policy Compliance Evaluation –Development Criteria -Enhanced Housing Diversity •401 Residential Units •2 Housing Types –SF and Attached SF •3 Lot Sizes –Purple = 47’ wide SF (269 lots) –Orange = 52’ wide SF (78 lots) –Red = 45’ wide each/90’ wide total Attached SF (54 units) Page 156 of 173 City Manager’s Office PID Policy Compliance Evaluation –Development Criteria -Enhanced Architecture •Residential Exterior Materials •85% of front/street/public parkland = brick, stone, or stucco •50% of side/rear = brick, stone, stucco (1st floor) and brick, stone, cement (2nd floor) •Residential Front Elevation •Required articulation through choice of features Page 157 of 173 City Manager’s Office PID Policy Compliance Evaluation – Financial Requirements Financial Thresholds: •PID Reimbursement sought for : –Internal Streets –Offsite Maple Street –Water –Wastewater –Erosion and Sediment Control –Drainage –Parks –Grading and Trails –Administrative Costs (professional services fees, management fees, engineering, City fees, etc.) Page 158 of 173 City Manager’s Office PID Policy Compliance Evaluation – Financial Requirements Financial Thresholds: •POLICY: PID assessment ≤ $0.55 per $100 AV. PROJECT: $0.52 per $100 AV •POLICY Min. AV to lien ratio for PID Bonds = 4:1 PROJECT: 14.7:1 Page 159 of 173 City Manager’s Office PID Policy Compliance Evaluation – Financial Requirements Financial Thresholds: •POLICY: Max. PID Bond maturity = 25 yrs after issuance PROJECT: same; one issuance June 2023 •POLICY: Max PID Bond Limit = actual costs (plus reserves, capitalized interest, financing costs) PROJECT: $7.375M PID funded ; $10.9M Developer funded Page 160 of 173 City Manager’s Office Council Feedback and Direction Staff is seeking Council’s feedback and direction on a proposed Public Improvement District (PID) for the Parks at Westhaven development. •Does Council support the creation of a PID for the Parks at Westhaven development? •Does Council support the financial terms, architectural standards, and the enhanced park, trails and open space improvements? Page 161 of 173 City Manager’s Office Next Steps •Landowner to submit PID Petition •City to review developer supplied financial feasibility study utilizing City’s Bond Counsel, Financial Advisor and Bond Underwriter •Council to accept PID Petition and set public hearing for PID creation (both at same meeting) •City staff and consultants to commence negotiating and drafting needed resolutions, agreements, plans, ordinances •City Council to hold a public hearing on PID creation and then consider resolution approving creation of PID and ordinance approving PID Financing and Reimbursement Agreement •Council to adopt Service Plan and Assessment Plan (SAP) by ordinance •Levy special assessments Page 162 of 173 City of Georgetown, Texas City Council Workshop N ovember 24, 2020 S UBJEC T: Review and discussion regarding 2021 boards and commission appointments -- Robyn Densmore, City Secretary; and David Morgan, City Manager I T EM S UMMARY: It is the City’s practice to appoint board and commission members to terms of a March – February term with a term length of two years. Due to this practice and the times coinciding with the CO VID-19 pandemic, many board members were not able to participate in full engagement for most, if not all, of their term for the 2020-2021 year. This City Council Workshop item will review the board and commission appointment process. Additionally, the workshop will describe the impact CO VID-19 has had on board member participation in 2020. City staff will review an alternative to provide all members the option to extend their terms by one year. If a member does not wish to extend their term, then staff will gladly post and find a replacement for them. Staff will work with members to determine their desire to continue to serve or find a replacement for them if they are unable to extend their appointment. The Section 2.36.030 A of the Code of Ordinance which governs board appointments provides that the two-year term of office, as well as the two-term limit, can be varied with approval by City Council. F I NANC I AL I MPAC T: .. S UBMI T T ED BY: Robyn Densmore, City Secretary AT TAC HMENT S : Description P resentation for Board C ommission appointments Page 163 of 173 City Manager’s Office Board and Commission Member Activity during COVID -2019/2020 Presented by David Morgan, City Manager and Robyn Densmore, City Secretary November 24, 2020 Page 164 of 173 City Manager’s Office Overview •Current process for appointing boards and commissions •Statistics of board and commission actions in 2020 •Proposed changes to process •Council Feedback and Direction –Next Steps dependent on Council feedback and direction Page 165 of 173 City Manager’s Office Current process •It is the city’s practice to appoint board and commission members to terms running from March to February with a term length of two years. Page 166 of 173 City Manager’s Office Current process •Usual process runs November through February –Applications are open beginning the first week in November and remain open until the end of December. –Applications and staff recommendations are presented to Mayor and council members mid-January. –Mayor makes recommendations and council appoints new members and chairs in February. –Board member training, swearing in and appreciation reception are held in March. Page 167 of 173 City Manager’s Office Board Trends •Several boards did not initially meet in March due to COVID •Some boards did not meet March, April or June due to COVID •P&Z and HARC met “virtually” the entire time because of state statutes requiring timely actions •Boards are noted with a “*” if their lack of meetings were partially or fully due to lack of action items, not COVID related •Some boards normally only meet on an as-needed basis, i.e., ADA, BSC, ZBA, TIRZ Boards (not included) Page 168 of 173 City Manager’s Office Board Activities March -November Board Meetings held Meetings not held % held ADA Advisory Board (as needed)0 9 0% Animal Shelter Adv Board 4 5 44% Arts & Culture Adv Board 7 1 87.5% Building Standards Comm (as needed) 0 9 0% Commission on Aging 0 9 0% * Conv and Visitors Bureau Board 3 5 –no events 37.5% * GT Gov’t and Finance Adv Board 3 6 33% * GT Eco Devo Corporation 4 5 44% Electric Utility Advisory Bd 6 Started in June 100% Housing Adv Board 7 1 87.5% *GT Transportation Adv Board 3 5 37.5% Page 169 of 173 City Manager’s Office Board Activities March -November Board Meetings held Meetings not held % held *GT Transportation Enhancement Bd 4 5 44% *GT Village PID Advisory Board 5 4 55.5% GT Water Utility Board 6 0 –June start 100% *HARC 15 2 88% Library Advisory Board 6 3 66% Main Street Adv Board 6 3 –no events 66% Parks and Rec Adv Board 3 6 33% Planning & Zoning Comm 18 0 100% *UDC Advisory Board 5 3 62.5% *Youth Advisory Board 6 2 75% Zoning Board of Adjustment 1 8 11% Page 170 of 173 City Manager’s Office Sec. 2.36.030. -Appointment, terms and organization. A. Unless otherwise approved by the City Council, the term of office for all committees, boards, and commissions of the City shall be two years in length with normal, yearly appointments. Unless otherwise approved by the City Council, no member shall serve more than two consecutive terms on the same board, committee, or commission. If reappointment beyond the original two consecutive terms is approved by City Council or if a vacancy occurs, appointments shall be made to preserve staggered membership terms on the board and ensure a balance between new and continuing members. B. Members shall continue to serve until reappointment for that position takes place. C. Members of the City's commissions, committees, and boards shall be appointed pursuant to the City Charter. D. Annual new member orientation shall occur within two weeks after the annual appointments are made to each commission, committee, or board. E. The Mayor shall recommend a member to serve as chairman of each board, committee, or commission, and the City Council shall approve the recommendation by a vote of the majority of the Council, during the annual appointment process. Should the Mayor fail to recommend a chairman for each board, committee, or commission, and/or the Council fails to approve any chairman recommended by the Mayor, a majority of the Council plus one may approve appointment of a chairman to serve as chairman without a recommendation of the Mayor. Other officers are elected by a majority vote of the Members at the first meeting after the annual appointment process. The board, committee or commission shall select a vice- chairman, secretary and such other officers as it deems necessary. Officers serve for a term of one year. (Ord. No. 2015-23, §2; Ord. No. 2014-97, §2(Exh. A); Ord. No. 2011-20, §2(Exh. A)) Page 171 of 173 City Manager’s Office Possibilities •Nothing in the code declares when the terms begin or end, just length. Process is based on historical actions and is inconsistent with calendar year or fiscal year. •Application and appointment process takes approximately three plus months. •Council action in December delays current new appointments to at least April or May. •Requests have been made to roll all terms one extra year to maintain staggered terms and to allow current appointed members to further serve. Options would be given which allow any members who do not want to continue to serve to resign. Page 172 of 173 City Manager’s Office Discussion and Questions Next Steps –dependent on feedback Page 173 of 173