A. Initial Risk Assessment; Covered Accounts: Utility accounts for personal, family and household purposes are specifically included within the definition of "covered account" in the FTC's identity theft rules. Therefore, the municipality determines that with respect to its residential utility accounts it offers and/or maintains covered accounts. The municipality also performed an initial risk assessment to determine whether the utility offers or maintains any other accounts for which there are reasonably foreseeable risks to customers or the utility from identity theft. In making this determination the municipality considered: 1) the methods it uses to open its accounts, 2) the methods it uses to access its accounts, and 3) its previous experience with identity theft, and it concluded that it does not offer or maintain any such other covered accounts.
B. Program Updates; Risk Assessment: The program, including relevant red flags, is to be updated as often as necessary but at least annually to reflect changes in risks to customers from identity theft. Factors to consider in the program update include:
1. An assessment of the risk factors identified above.
2. Any identified red flag weaknesses in associated account systems or procedures.
3. Changes in methods of identity theft.
4. Changes in methods to detect, prevent, and mitigate identity theft.
5. Changes in business arrangements, including mergers, acquisitions, alliances, joint ventures, and service provider arrangements.
C. Training And Oversight: All staff and third party service providers performing any activity in connection with one or more covered accounts are to be provided appropriate training and receive effective oversight to ensure that the activity is conducted in accordance with policies and procedures designed to detect, prevent, and mitigate the risk of identity theft. (Ord. 1397, 10-20-2008)