(A) Updating the program. The program shall be updated periodically to reflect changes in risks to customers or to the safety and soundness of the town from identity theft based on factors such as:
(1) The experiences of the town with identity theft;
(2) Changes in methods of identity theft;
(3) Changes in methods to detect, prevent and mitigate identity theft;
(4) Changes in the types of accounts that the organization offers or maintains; and
(5) Changes in the business arrangements of the town, including mergers, acquisitions, alliances, joint ventures and service provider arrangements.
(B) Oversight. Oversight of the program shall include:
(1) Review of reports prepared by staff regarding compliance. The reports should address materials matters related to the program and evaluate issues such as:
(a) The effectiveness of the policies and procedures in addressing the risk of identity theft in connection with the opening of covered accounts and with respect to existing covered accounts;
(b) Significant incidents involving identity theft and management’s response; and
(c) Recommendations for material changes to the program.
(2) Approval of material changes to the program as necessary to address changing risks of identity theft.
(C) Report. A senior management person responsible for development, implementation and administration of the program shall report to the Town Council if the program needs to be updated or revised.
(Ord. 2012-08, passed 12-17-2012)