The town adopts the following security procedure;
(A) All accounts will be opened in person at the Town Hall;
(B) Paper documents, files and electronic media containing secure information will be stored in locked file cabinets;
(C) Only specially identified employees with a legitimate need, will have keys to the cabinet, the Clerk-Treasurer, Utility Clerk and Administrative Clerk;
(D) Files containing personally identifiable information are kept in locked file cabinets except when an employee is working on the file;
(E) Employees will not leave sensitive papers out on their desks when they are away from their workstations;
(F) Employees will store files and lock cabinets when leaving their work areas;
(G) Employees will log off their computers when leaving their work areas;
(H) Visitors who must enter areas where sensitive files are kept must be escorted by an employee of the town;
(I) Passwords will not be shared or posted near workstations;
(J) Password-activated screen savers will be used to lock employee computers after a period of inactivity;
(K) Access to sensitive information will be controlled using passwords. Employees will choose passwords with a mix of letters and numbers and change monthly. User name will be different from password;
(L) Anti-virus and anti-spyware programs will be run on individual computers and on servers daily;
(M) The computer network will have a firewall where the network connects to the internet;
(N) The town will check references and do background checks before hiring employees who will have access to sensitive data;
(O) New employees will sign an agreement to follow the company’s confidentiality and security standards for handling sensitive data;
(P) Access to customer’s personal identity information is limited to employees with a “need to know”;
(Q) Procedures exist for making sure that workers who leave the town or transfer to another part of the company, no longer have access to sensitive information;
(R) Employees will be trained twice a year;
(S) Employees will be alert to attempts at phone phishing;
(T) Employees who violate security policy are subject to discipline, up to and including dismissal;
(U) Sensitive paper records will be shredded with a minimum of a cross cut shredder before being placed into the trash; and
(V) Any data with sensitive storage media will be disposed of by shredding, punching holes in or incineration.
(Res. 2009-02, passed 4-21-2009)