Request for Proposal - City of Lake Forest_Recreation_Software... · PROPOSALS RECEIVED AFTER DEADLINE WILL BE ... 1.rpose of Request for Proposal Pu ... The City offers a full range

The City of Lake Forest Recreation Software Assessment and Selection RFP

Request for Proposal Parks and Recreation Software Assessment and Selection

September 13, 2013

QUESTIONS AND INTENT TO RESPOND DUE DATE:

September 23, 2013, 4:00 p.m. (CDT)

PROPOSAL DUE DATE:

October 18, 2013, 4:00 p.m (CDT)

PROPOSALS RECEIVED AFTER DEADLINE WILL BE RETURNED UNOPENED

The City of Lake Forest Joe Gabanski

Assistant Director, IT Division 800 N. Field Drive

Lake Forest, IL 60045 (847)-810-3500

1/13


Table of Contents 1. Purpose of Request for Proposal .................................................................................................................................... 3

2. Background ..................................................................................................................................................................... 3

3. Scope of Work ................................................................................................................................................................. 4

4. Anticipated Project Schedule .......................................................................................................................................... 7

5. Intent to Respond ........................................................................................................................................................... 7

6. Proposal Submission Requirements ............................................................................................................................... 8

7. Evaluation Criteria and Selection Process ....................................................................................................................... 9

8. Award of Agreement ..................................................................................................................................................... 10

9. The City of Lake Forest Reservation of Rights ............................................................................................................... 10

10. Terms and Conditions ................................................................................................................................................... 10

11. Identity Theft Protection (Attachment B) ..................................................................................................................... 11

12. General Certification Requirements ............................................................................................................................. 12

13. City of Lake Forest Insurance Requirements ................................................................................................................ 13

2/13


1. Purpose of Request for Proposal

The purpose of this Request for Proposal (RFP) is to establish a contract between The City of Lake Forest and a

qualified professional(s) to assist with the assessment and selection of a Parks and Recreation Software System

for The City of Lake Forest Parks & Recreation Department.

Software requirements are to be solicited via meetings with all pertinent stakeholders. The selected consultant

will then work with a core project team to make the final software vendor selection. A project coordinator will

be assigned from the City of Lake Forest to work with the selected consultant.

2. Background

The City of Lake Forest is a prestigious North Shore community of about 19,000 residents located north of

Chicago.

The City of Lake Forest Parks and Recreation Department falls under the jurisdiction of the city government,

with the Parks and Recreation director reporting directly to the City Manager.

The City offers a full range of Park and Recreation services to local residents including, but not limited to, class

registration for an assortment of classes and lighted field events, boat launch facility with license tracking,

ticketing for theatre and dance productions, beach and park pavilion rental, beach and park facilities

registration with permits for tents requiring a certificate of fitness (to adhere to safety regulations), and special

city event coordination (currently do not, but would like to notify citizens if major event will interfere with their

private function), etc.

The City of Lake Forest Parks and Recreation department consists of a full featured recreation department that

host activities from a variety of facilities. The 50,000 square foot Recreation Center houses the administrative

offices, a gym, racquetball/squash courts, Kinderhaven preschool academy, dance studios, classrooms, fitness

center and a game room.

Stirling Hall Art Center is located at the beautiful Grove Cultural campus with a fully equipped, professionally

staffed multi-media art center with a ceramics studio, including Soda, Raku and High Fire Reduction kilns. Studio

space and classes for children are also provided for art activities such as drawing, mixed media, mosaics and

more.

3/13


The Wildlife Discover center, located at the historic Elawa Farm, is dedicated to global conservation and houses

a public viewing area of amazing reptile and amphibian collections, outdoor raptor exhibits, a venomous reptile

exhibit, educational programs, nature hikes, bird and wildlife watching as well as conservation education classes.

Deerpath Golf course is one of the oldest and finest municipal golf courses in the Midwest. It is a complete

facility with 18 holes, a green tee driving range, chipping and putting green, private and group lessons, golf shop

and the Sandwedge Grill.

Forest Park Beach includes 29+ acres with a large beach, grass areas, swimming and other water activities. It

includes sheltered pavilions, grills, a fishing pier, sand volleyball, boat launching ramp with a storage area,

walking paths, a concession stand and watercraft usage program during summer months.

Everett Park Classroom is a satellite site of the Recreation Department located at Everett School which offers

classes in early childhood education and youth enrichment. There are a variety of workshops, cooking classes,

store time and hands on activities offered year round.

The Parks and Recreation department is also responsible for parks maintenance and is proud of its many

beautiful parks and green spaces. It includes two community parks, eleven neighborhood parks, and an outdoor

skate rink, nature preserve, and bike trails. There are playgrounds, pavilions (available for rental during the

year), sport fields, walking trails and much more.

The City of Lake Forest Parks and Recreation department currently utilize Active Network’s Class computer

software. Approximately fifty-five (55) city employees use Active Network’s Class software to handle daily

activities. With added functionality, we expect to expand usage to additional Parks and Recreation employees,

and possibly other city departments.

The Class software no longer offers the required functionality to completely serve a community of this size and

complexity. The software is expected to reach end of life in 2015. At that point it is expected that Active

Networks will no longer support their Class software.

3. Scope of Work

The City requires a qualified professional to provide direction for selecting a comprehensive Parks and

Recreation computer software application. The selected consultant must have the ability to coordinate and

deliver the following:

3.1. Stakeholder identification and communication

4/13


3.1.1. Facilitate identification of all project stakeholders of the Parks and Recreations software and

formalize a communications plan.

Deliverables include:

3.1.1.1. Stakeholder register with communication options (who will get what status update,

how and when they will receive it).

3.1.1.2. Contractor communication plan (monthly contractor status report including completed

activities and anticipated completion dates for future tasks).

3.2. Software Selection

3.2.1. Interview all pertinent City of Lake Forest Staff to determine current Parks and Recreation

software deficiencies. The departments may include:

3.2.1.1. Parks and Recreation Department

3.2.1.2. Office of City Manager

3.2.1.3. Fire Department

3.2.1.4. Police Department

3.2.1.5. Public Works Department

3.2.1.6. Finance Department

3.2.1.7. Community Development Department

3.2.1.8. IT Department

3.2.1.9. CROYA (Committee Representing Our Young Adults)

3.2.2. Develop and present a business case for software purchase to the City of Lake Forest City

Manager.


3.2.2.1. Written business case (justification)

3.2.2.2. Presentation to the City of Lake Forest City Manager for approval to proceed to RFP

preparation.

3.2.3. Using appropriate facilitation techniques and interviews develop a required software features

and functions list to include in vendor RFP and selection process.


3.2.3.1. List of current software deficiencies.

3.2.3.2. Detailed list of required future software features and functions, including a traceability

matrix (who is requiring the functionality).

3.2.3.3. Needs assessment and recommendation report supporting acquisition of upgraded or

new Parks and Recreation software application system.

5/13


3.3. Software RFP Preparation and Delivery

3.3.1. Develop a detailed RFP for Parks and Recreation software procurement.

3.3.2. Include a detailed list of required software functionality.

3.3.3. Develop list of potential vendor RFP candidates


3.3.3.1. Written software RFP.

3.3.3.2. List of potential vendor candidates.

3.3.4. Attend vendor question and answer session.

3.4. Software Vendor Response Analysis

3.4.1. Work with Core Project Team to provide input and recommendations to assist with vendor

response review.

3.4.2. Develop consistent comparison criteria for a qualified vendor selection process, including:

3.4.2.1. A list of required features and functions to assist client in narrowing the list of

prospects.

3.4.2.2. Supported hardware and database platforms.

3.4.2.3. Any additional third party software requirements.

3.4.2.4. Format this list for side-by-side vendor comparison to allow easy visual feature

confirmation.

3.4.3. Identify required feature availability and deliverability.


3.4.3.1. Side-by-side vendor comparison matrix that includes required features, the feature

availability and/or deliverability, and supported hardware and database platforms,

along with costs.

3.5. Software Vendor selection

3.5.1. Prepare a vendor selection process, including a:

3.5.1.1. Vendor scoring matrix, including a price comparison.

3.5.2. Communicate vendor selection process documents and strategy to Core Project Team.

3.5.3. Attend and facilitate vendor product demonstrations.

3.5.4. Assist Core Project Team with final vendor selection.


3.5.4.1. Scoring matrix for each selected vendor to assist with final vendor selection.

3.5.4.2. Presentation of selected vendor for recommendation to Park Board and City Council for

purchase of Parks and Recreation software.

6/13


Note: It is imperative that the selected consultant demonstrate an ability to facilitate consensus to

ensure that the Core Project Team make final vendor selection for recommendation to the City Council.

Consulting assistance throughout implementation of selected software is NOT included in the scope

of this RFP, but may be considered at a later date.

4. Anticipated Project Schedule

This schedule represents the targeted project milestones for the Parks & Recreation software assessment and

selection. This schedule is subject to change by The City of Lake Forest:

Estimated Date/Time Process Step

September 13, 2013 Release of RFP

September 23, 2013 RFP Questions and Intent to Respond Due

October 18, 2013 RFP Proposals Due

November 12, 2013 Consultant Finalist Interviews in Lake Forest

November 14, 2013 Negotiations begin with Preferred Finalist

November 19, 2013 Park Board recommends Consultant approval

December 2, 2013 City Council Approval of Consultant

December 3, 2013 NOTICE TO PROCEED

January 24, 2014 Complete City Department Interviews

February 3, 2014 Present Business case to City Manager

February 25, 2014 Software RFP due

April 17, 2014 Software RFP responses due

June 17, 2014 Park Board recommends software approval

July 7, 2014 City Council software approval

5. Intent to Respond

All vendors who intend to respond to this RFP should signify their desire to do so by submitting an e-mail with all

contact information by September 23, 2013, 4:00 p.m. (CDT) to:

Joseph Gabanski, Assistant Director, IT Division The City of Lake Forest 800 North Field Drive Lake Forest, IL 60045

E-Mail address: [email protected] 7/13


6. Proposal Submission Requirements

6.1. Applicants must submit 1 original physical & 1 electronic copy of their Proposal to The City. Proposals shall

be submitted in a sealed envelope bearing the legend "Sealed Proposal for Parks and Recreation Software

Assessment and Selection". All proposals received after the time specified for proposals due shall be

returned unopened. The electronic copy must be in .PDF format and enclosed in the sealed envelope on CD

or thumb drive.

6.2. All inquiries or questions regarding this RFP are to be e-mailed only, along with the intent to

respond by September 23, 2013, 4:00 p.m. (CDT) to the following individual:

Joseph Gabanski, Assistant Director, IT Division The City of Lake Forest 800 North Field Drive Lake Forest, IL 60045

E-Mail address: [email protected]

6.3. Responses to questions will be provided by September 26, 2013.

6.4. Sealed Proposals to be mailed to:

Joseph Gabanski, Assistant Director, IT Division

Municipal Services Building

800 North Field Drive

Lake Forest, IL 60045

6.5. All proposals due by October 18, 2013, 4:00 p.m. (CDT).

Any proposals received after the deadline will be returned unopened.

6.6. Proposal Format:

6.6.1. RFP Cover letter – a signed letter briefly stating the proposer’s understanding of the work to be

done in compliance with the City’s Request for Proposal, a statement why the firm believes itself

to be the best qualified firm to perform the services, and a statement that the proposal is a firm

and irrevocable offer for 180 days. Any exceptions to requirements listed in the City’s Request

for Proposal must be clearly identified in the Cover letter, including exceptions to the desired

scope of services outlined in Section 3. The Cover letter must be signed by an authorized

representative of the firm.

6.6.2. Response to each item in Section 3. (Scope of Work).

6.6.3. Sample of each deliverable identified in Section 3. (Scope of Work).

6.6.4. The cost of services to be provided and an explanation of the basis on which fees are

determined. All potential services and associated pricing must be disclosed. The cost proposal

must include a not-to-exceed amount for the entire scope of services. 8/13


6.6.5. Resume(s) of staff to be assigned to this project.

6.6.6. Minimum of three (3) professional references for similar projects:

6.6.6.1. Please provide contact name and number for each reference (see attachment A).

6.6.6.2. Brief description of similar project (see attachment A).

6.6.7. Complete required signatures for The City of Lake Forest identity Theft and General Certification

Requirements understanding. Please submit a fully complete RFP Section 11 and Section 12.

7. Evaluation Criteria and Selection Process

7.1. It is anticipated that a group of consultant finalists will be selected for in-house interviews by a City of Lake

Forest staff RFP review committee to be conducted in Lake Forest, Illinois on Tuesday, November 12, 2013.

You must have the ability to meet with this committee. (See criterion 7.2.7. Finalist Interviews)

7.2. The City of Lake Forest will evaluate each firm’s proposal in a fair, consistent, and objective manner.

Selection of the consultant shall be based on response to questions or requirements identified in this RFP and

personal interviews. The final recommendation will be made by a City of Lake Forest staff RFP review

committee for Park Board and City Council consideration and approval. The staff RFP review committee will

carefully and thoughtfully consider all RFP responses. Each potential consultant will be evaluated on the

following criteria:

7.2.1. Completeness of Proposal

7.2.2. Conformance to RFP Requirements

7.2.3. Availability and ability to meet The City of Lake Forest anticipated schedule.

7.2.4. Qualifications – Include a summary of the firm’s qualification to perform the work outlined in

the RFP (see 6.6.1). A current resume must be provided for the individual(s) designated to work

on this project (see 6.6.5).

7.2.5. Customer References – Include a minimum of three (3) references from similar projects (see

Attachment A and 6.6.6).

7.2.6. Cost Proposal

7.2.7. Finalist Interviews – a group of finalists will be chosen for in-house interviews. The finalists

should be available to discuss their qualifications at a designated location in Lake Forest, Illinois

on Tuesday, November 12, 2013.

9/13


8. Award of AgreementThe selected consultant will be required to enter into a written professional services agreement with the City.

Such agreement shall reflect the terms and conditions included in the RFP and the selected consultant’s

response, as well as any other provisions mutually agreed to by both parties. The agreement is subject to

approval by the City Council of The City of Lake Forest.

9. The City of Lake Forest Reservation of RightsThe City reserves the right, at its sole discretion, to use without limitation any and all information, concepts, and

data submitted in response to this RFP, or derived by further investigation thereof. The City further reserves the

right at any time and for any reason to cancel this solicitation, to reject any or all Proposals, to supplement, add

to, delete from, or otherwise change this RFP if conditions dictate. The City may seek clarifications from a

vendor at any time and failure to respond promptly may be cause for rejection. The City also reserves the right

to interview only those firms it determines shall provide the most advantageous services and to negotiate with

one or more vendors to develop contract terms acceptable to The City.

10. Terms and Conditions

10.1. This RFP is issued pursuant to applicable provisions of the City’s Purchasing Policies and Procedures.

Responses to this RFP shall be opened in private by City officials to avoid disclosure of contents that may

contain confidential or proprietary information to competing Respondents.

10.2. The City will not be liable in any way for any costs incurred by respondents in replying to this RFP.

10.3. An agreement resulting from the acceptance of a Proposal shall be on forms approved by the City’s legal

counsel and shall contain, as a minimum, the applicable provisions of this request for Proposal and the

Proposal itself. The City reserves the right to reject any agreement which does not conform to the request

for Proposal, the Proposal of the firm concerned, or the City’s requirements for agreements and contracts.

10.4. The contracted firm shall not assign any interest in the contract and shall not transfer any interest without

the prior written consent of the City.

10.5. If, through any cause, the contracted firm fails to fulfill the obligations agreed to in a timely and proper

manner, the City shall have the right to terminate the contract by notifying the firm in writing and specifying

a termination date not less than thirty (30) calendar days in advance. In such event, the contracted firm shall

be entitled to just and equitable compensation for any satisfactory work completed.

10.6. Modifications

Any modifications to or clarifications of this RFP will be distributed by the City to each Respondent requiring

to be so informed, who also provides a fax number, mailing address, and/or email address for such purpose.

10.7. Confidentiality 10/13


City officials shall direct the examination of the Proposals and other documents submitted to determine the

validity of any written requests for nondisclosure of proprietary or confidential information. After award of

the contract, all responses, documents, and materials submitted by the Respondent pertaining to this RFP

will be considered public information unless otherwise determined by the City. All data, documents and

other information developed because of these contractual services shall become the property of the City.

Based on the public nature of RFP’s a Respondent must inform the City, in writing, of the exact materials in

the submittal, which it believes, are proprietary or confidential, and should not be made part of the public

record in accordance with the Illinois Freedom of Information Act. The Respondent will be financially

responsible for all expenses of the City, its public officials, consultants, employees, agents and

representatives in defending the denial of access to such material pursuant to a Freedom of Information Act

request.

11. Identity Theft Protection (Attachment B)

All City vendors with access to sensitive material must acknowledge receipt of a copy of The City of Lake Forest’s

identity theft prevention program policy. All proposals submitted in response to this RFP must include a fully

executed certification (see 6.6.6.3):

IDENTITY THEFT PREVENTION PROGRAM CERTIFICATION

I certify that I have read, understood and agree to comply with The City of Lake Forest’s Identity Theft

Prevention Program.

______________________________ Institution

______________________________ Signature

______________________________ Title

______________________________ Date

11/13


12.) ) SS

General Certification Requirements

STATE OF ILLINOIS

COUNTY OF _________ ))) )

PROPOSER’S CERTIFICATION

The undersigned, being first duly sworn on oath, deposes and states that all statements made herein are made on behalf of Proposer, that this deponent is authorized to make them, and that the statements contained herein are true and correct. Proposer deposes, states, and certifies that Proposer is not barred from contracting with a unit of state or local government as a result of (i) a delinquency in the payment of any tax administered by the Illinois Department of Revenue unless Contractor is contesting, in accordance with the procedures established by the appropriate revenue Act, its liability for the tax or the amount of the tax, as set forth in 65 ILCS 5/11-42.1-1; (ii) a violation of either Section 33E-3 or Section 33E-4 of Article 33 of the Criminal Code of 1961, 720 ILCS 5/33E-1 et seq.; or (iii) a violation of the USA Patriot Act of 2001, 107 Public Law 56 (October 26, 2001) (the “Patriot Act”) or other statutes, orders, rules, and regulations of the United States government and its various executive departments, agencies and offices related to the subject matter of the Patriot Act, including, but not limited to, Executive Order 13224 effective September 24, 2001.

DATED This ______ Day Of __________________, 20___.

Attest/Witness: Proposer’s Name:

By: ___________________________ By: _____________________________

Title: __________________________ Title: ____________________________

Subscribed and Sworn to My Commission Expires: _________________

before me this ____ day

of _____________, 200__.

___________________________ [SEAL]

Notary Public

12/13


13. City of Lake Forest Insurance Requirements

These requirements are baseline standards for insurance to be provided in City procurements. They may require adjustment from time to time based on a variety of factors, including the nature, scope, duration, and value of the procurement, subject to approval of the City Manager. I. DESIGN PROFESSIONALS AND OTHER SIMILAR CONSULTANTS:

A. Worker’s Compensation and Employer’s Liability with limits not less than: (1) Worker’s Compensation: Statutory; (2) Employer’s Liability:

$500,000 injury-per occurrence $500,000 disease-per employee $500,000 disease-policy limit

Such insurance shall evidence that coverage applies in the State of Illinois. B. Comprehensive Motor Vehicle Liability with a combined single limit of liability for bodily injury

and property damage of not less than $1,000,000 for vehicles owned, non-owned, or rented. All employees shall be included as insureds.

C. Comprehensive General Liability with coverage written on an “occurrence” basis and with limits no less than:

$2,000,000 Bodily Injury and Property Damage Combined Single Limit Coverage is to be written on an “occurrence” basis. Coverages shall include: - Broad Form Property Damage Endorsement - Blanket Contractual Liability (must expressly cover the indemnity provisions of

the Contract) - Independent Contractors - Personal Injury (with Employment Exclusion deleted) - Broad Form Property Damage Endorsement - Bodily Injury and Property Damage

D. Professional Liability Insurance, with a limit of liability of not less than $1,000,000 per occurrence and $2,000,000 in the aggregate and covering the supplier or vendor against all sums that supplier or vendor may be obligated to pay on account of any liability arising out of the contract. This requirement shall apply to design and consulting projects, as well as to contracts for professionals involved in construction projects.

E. Umbrella Policy. The required coverages may be in any combination of primary, excess, and umbrella policies. Any excess or umbrella policy must provide excess coverage over underlying insurance on a following-form basis such that when any loss covered by the primary policy exceeds the limits under the primary policy, the excess or umbrella policy becomes effective to cover such loss.

F. City as Additional Insured. The City shall be named as an Additional Insured on all policies except for: Worker’s Compensation Professional Liability (if applicable) Each such additional Insured endorsement shall identify the City as follows: The City of Lake Forest, including its City Council members and elected and appointed officials, its officers, employees, agents, attorneys, consultants, and representatives.

G. Other Parties as Additional Insureds. Other entities should be included and named as additional insured on appropriate policies.

13/13

Attachment A - References Please enter at least three(3) references similar in nature to project described in Request for Proposal

Customer Name

Contact Address:

Contact Telephone Number:

Contact E-Mail Address:

Installation Date of Comparative System: (mm/dd/yyyy)

Description of Comparitive System - Please be specific and detailed.

Customer Name

Contact Address:





Customer Name

Contact Address:





Customer Name

Contact Address:





PLEASE COPY FORM FOR ADDITIONAL REFERENCES

Attachment B THE CITY OF LAKE FOREST Administrative Directive 3-4 Office of the City Manager September 2010 Identity Theft Policy I. POLICY PURPOSE

This Policy is to help protect employees, customers, contractors, and the City from harm and damage related to, or caused by, the loss of misuse of sensitive information. The Policy also will assist the City in detecting, preventing, and mitigating identity theft. The Policy does so by identifying certain “red flags” that suggest or indicate the possibility of identity theft, and by providing guidelines on how the City should respond once it detects any such Red Flags. Further, the Policy will:

1. Define sensitive information; 2. Describe the physical security of data when it is printed on paper; 3. Describe the electronic security of data when stored and distributed; and 4. Place the City in compliance with state and federal law regarding identity theft protection. The policy also covers the Identity Protection Act (5ILCS179), which took effect June 1, 2010. The Policy has been tailored to the size, complexity and the nature of the City’s operations. The Policy also has been designed in order to:

1. Identify relevant Red Flags for new and existing covered accounts and incorporate those Red

Flags into the Policy; 2. Detect Red Flags that have been incorporated into the Policy; 3. Allow the City to respond appropriately to any Red Flags that are detected to prevent and mitigate

Identity Theft; and 4. Ensure that the Policy is reviewed periodically, and updated, if necessary, to reflect changes in

risks to customers or to the safety and soundness of the City from identity theft.

II. POLICY DEFINITIONS

1. “Covered Account” means: (i) an account that the City offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, such as a utility account; and (ii) any other account that the City offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the City, including financial, operational, compliance, reputation, or litigation risks.

2. “Credit” means the right granted by a creditor to a debtor to defer payment of debt or to incur

debts and defer its payment or to purchase property or services and defer payment therefore. 3 “Creditor” means any person who regularly extends, renews, or continues credit; any person who

regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit, including utility companies.

4. “Customer” means a person that has a covered account with a creditor.

Administrative Directive 3-4 Page 2 Identity Theft Policy

5. “Identity Theft” means a fraud committed or attempted using identifying information of another

person without authority. 6. “Person” means a natural person, a corporation, government or governmental subdivision or

agency, trust, estate, partnership, cooperative, or association. 7. “Sensitive Information” means any name or number that may be used, alone or in conjunction

with any other information, to identify a specific person, including, but not limited to, a person’s credit card account information, debit card information, bank account information, drivers’ license information, social security number, mother’s birth name, date of birth, electronic identification number, computer Internet Protocol address, and routing code.

8. “Red Flag” means a pattern, practice, or specific activity that indicates the possible existence of

identity theft. 9. “Service Provider” means a person that provides a service directly to the City.

III. IDENTIFICATION OF RED FLAGS.

In order to identify relevant Red Flags, the City considers the types of accounts that it offers and maintains, the methods it provides to open its accounts, the methods it provides to access its accounts, and its previous experiences with Identity Theft. The City identifies the following Red Flags, in the following listed categories:

A. Notifications and Warnings from Credit Reporting Agencies

Red Flags 1. Report of fraud accompanying a credit report; 2. Notice or report from a credit agency of a credit freeze on a customer or applicant; 3. Notice or report from a credit agency of an active duty alert for an applicant; and 4. Indication from a credit report of activity that is inconsistent with a customer’s usual pattern or

activity.

B. Suspicious Documents

Red Flags 1. Identification document or card that appears to be forged, altered or otherwise inauthentic; 2. Identification document or card on which a person’s photograph or physical description is not

consistent with the person presenting the document; 3. Other documentation with information that is not consistent with existing customer

information (e.g. a person’s signature on a check appears forged); and 4. Application for service that appears to have been altered or forged.


C. Suspicious Personal Identifying Information

Red Flags 1. Identifying information presented that is inconsistent with other information the customer

provides (e.g. inconsistent birth dates); 2. Identifying information presented that is inconsistent with other sources of information (e.g.

an address not matching an address on a credit report); 3. Identifying information presented that is the same as information shown on other applications

that were found to be fraudulent; 4. Identifying information presented that is consistent with fraudulent activity (e.g. an invalid

phone number or an answering service, or fictitious billing address, mail drop or prison); 5. Social security number presented that is the same as one given by another customer; 6. An address or phone number presented that is the same as that of another person; 7. A person fails to provide complete personal identifying information on an application when

reminded to do so; and 8. A person’s identifying information is not consistent with the information that is on file for the

customer.

D. Suspicious Account Activity or Unusual Use of Account

Red Flags 1. Change of address for an account followed by a request to change the account holder’s name; 2. Payments stop on an otherwise consistently up-to-date account; 3. Account used in a way that is not consistent with prior use (e.g. very high activity); 4. Mail sent to the account holder is repeatedly returned as undeliverable; 5. Notice to the City that a customer is not receiving mail sent by the City; 6. Notice to the City that an account has unauthorized activity; 7. Breach in the City’s computer system security; and 8. Unauthorized access to or use of customer account information.

E. Alerts from Others

Red Flag 1. Notice to the City from a customer, identity theft victim, law enforcement or other person that

it has opened or is maintaining a fraudulent account for a person engaged in Identity Theft.

Administrative Directive 3-4 Page 4 Identity Theft Policy IV. DETECTING RED FLAGS.

A. New Covered Accounts

In order to try and detect any of the Red Flags identified above associated with the opening of a new Covered Account, City personnel should take the following steps to obtain and verify the identity of the person opening the Covered Account:

1. Require certain identifying information such as name, date of birth, residential or business

address, principal place of business for an entity, driver's license or other identification; 2. Verify the customer’s identity (e.g. review a driver’s license or other identification card); 3, Review documentation showing the existence of a business entity; and 4. Independently contact the customer if appropriate.

B. Existing Covered Accounts

In order to detect any of the Red Flags identified in Section V above for an existing Covered Account, City personnel will take the following steps to monitor transactions with a Covered Account:

1. Verify the identification of customers if they request information (in person, via telephone, via

facsimile, via email, or otherwise); 2. Verify the validity of requests to change billing addresses; and 3. Verify changes in banking information given for billing and payment purposes.

V. PREVENTING AND MITIGATING IDENTITY THEFT

A. Securing Sensitive Information

City personnel are encouraged to use common sense judgment in securing sensitive and confidential information. Furthermore, in exercising such judgment, consideration should be given to the Illinois Freedom of Information Act (“FOIA”). If an employee is uncertain of the sensitivity of a particular piece of information, the employee should contact their supervisor or the Policy Administrator. Further, if the City receives a FOIA or other request seeking Sensitive Information, or documents containing Sensitive Information, said requests should be forwarded to the City Manager and the City Attorney. In order to further prevent the likelihood of Identity Theft occurring with respect to City accounts, the City shall make reasonable efforts to take the following steps with respect to its internal operating procedures to protect customer identifying information:

1. Take steps to ensure that the City’s website is secure or provide clear notice that the website is

not secure; 2. Attempt to ensure destruction of paper documents and computer files containing Sensitive

Information;


3. Keep file cabinets, desk drawers, cabinets, and any other storage space containing documents with Sensitive Information locked when not in use;

4. Lock storage rooms containing documents with Sensitive Information and record retention

area at the end of the work day or when unsupervised. 5. Attempt to ensure that office computers with access to Covered Accounts and/or Sensitive

Information are password protected and that computer screens lock after a set period of time; 6. Keep workstations, work areas, and offices clear of papers containing Sensitive Information; 7. Request only the last 4 digits of social security numbers (if any); 8. Attempt to ensure that computer virus protection is up to date; 9. Require and keep only the kinds of Sensitive Information that are necessary for the City’s

purposes; and 10. Account statements and receipts for Covered Accounts shall only include the last four digits of

the credit card, debit card, or the bank account used for payment of the covered account.

B. Electronic Distribution

Each employee, service provider, or contractor performing work for the City will comply with the following policies:

1. With respect to internal electronic distribution, Sensitive Information may be transmitted

using approved City electronic mail. 2. With respect to external electronic distribution, Sensitive Information should only be

transmitted in an encrypted format and should contain a statement such as this:

“This message may contain sensitive, confidential and/or proprietary information and is intended for the person/entity to whom it was originally addressed. Any use by others is strictly prohibited”.

C. Responses When Red Flags Detected

In the event City personnel detect any identified Red Flags, such personnel should take one or more of the following steps, depending on the degree of risk posed by the Red Flag:

1. Continue to monitor an account for evidence of Identity Theft; 2. Contact the customer; 3. Change any passwords or other security devices that permit access to Covered Accounts; 4. Decline or otherwise refuse to open a new Covered Account; 5. Close an existing Covered Account; 6. Reopen a Covered Account with a new number; 7. Notify the Policy Administrator for determination of the appropriate step(s) to take; 8. Notify law enforcement; or 9. Determine that no response is warranted under the particular circumstances.

Administrative Directive 3-4 Page 6 Identity Theft Policy VI. ILLINOIS IDENTITY PROTECTION ACT

A. In compliance with the Identity Protection Act, the City prohibits any employee from doing the following:

1. Publicly post or publicly display in any manner an individual's social security

number. 2. Print an individual's social security number on any card required for the individual to

access products or services provided by the City. 3. Require an individual to transmit his or her social security number over the Internet,

unless the connection is secure or the social security number is encrypted. 4. Print an individual's social security number on any materials that are mailed to the

individual, through the U.S. Postal Service, any private mail service, electronic mail, or any similar method of delivery, unless State or federal law requires the social security number to be on the document to be mailed. Notwithstanding any provision in this Section to the contrary, social security numbers may be included in applications and forms sent by mail, including, but not limited to, any material mailed in connection with the administration of the Unemployment Insurance Act, any material mailed in connection with any tax administered by the Department of Revenue, and documents sent as part of an application or enrollment process or to establish, amend, or terminate an account, contract, or policy or to confirm the accuracy of the social security number. A social security number that may permissibly be mailed under this Section may not be printed, in whole or in part, on a postcard or other mailer that does not require an envelope or be visible on an envelope without the envelope having been opened.

5. Collect, use, or disclose a social security number from an individual, unless (i) required to do so under State or federal law, rules, or regulations, or the collection, use, or disclosure of the social security number is otherwise necessary for the performance of that agency's duties and responsibilities; (ii) the need and purpose for the social security number is documented before collection of the social security number; and (iii) the social security number collected is relevant to the documented need and purpose.

6. Require an individual to use his or her social security number to access an Internet website.

7. Use the social security number for any purpose other than the purpose for which it was collected.

The prohibitions set forth in items 5-7 do not apply in the following circumstances: 1. The disclosure of social security numbers to agents, employees, contractors, or

subcontractors of a governmental entity or disclosure by a governmental entity to another governmental entity or its agents, employees, contractors, or subcontractors if disclosure is necessary in order for the entity to perform its duties and responsibilities; and, if disclosing to a contractor or subcontractor, prior to such disclosure, the governmental entity must first receive from the contractor or subcontractor a copy of the contractor's or subcontractor's policy that sets forth how the requirements imposed under this Act on a governmental entity to protect an individual's social security number will be achieved.


2. The disclosure of social security numbers pursuant to a court order, warrant, or subpoena.

3. The collection, use, or disclosure of social security numbers in order to ensure the safety of: State and local government employees; persons committed to correctional facilities, local jails, and other law-enforcement facilities or retention centers; wards of the State; and all persons working in or visiting a State or local government agency facility.

4. The collection, use, or disclosure of social security numbers for internal verification or administrative purposes.

5. The disclosure of social security numbers by a State agency to any entity for the collection of delinquent child support or of any State debt or to a governmental agency to assist with an investigation or the prevention of fraud.

6. The collection or use of social security numbers to investigate or prevent fraud, to conduct background checks, to collect a debt, to obtain a credit report from a consumer reporting agency under the federal Fair Credit Reporting Act, to undertake any permissible purpose that is enumerated under the federal Gramm Leach Bliley Act, or to locate a missing person, a lost relative, or a person who is due a benefit, such as a pension benefit or an unclaimed property benefit.

VII. POLICY UPDATES

This Policy will be periodically reviewed and updated to try and reflect changes in risks to employees and customers and the soundness of the City from Identity Theft. At least once a year, the Policy Administrator will consider the City’s experiences with Identity Theft, changes in Identity Theft methods, changes in Identity Theft detection and prevention methods, changes in types of accounts the City maintains and changes in the City’s business arrangements with other entities. After considering these factors, the Policy Administrator will determine whether changes to the Policy, including the listing of Red Flags and internal practices, are warranted. If warranted, the Policy Administrator will update the Policy or present the Mayor and City Council with his or her recommended changes and the Mayor and City Council will make a determination of whether to accept, modify or reject those changes to the Policy.

VIII. POLICY ADMINISTRATION.

A. Oversight

Responsibility for developing, implementing and updating this Policy lies with the Identity Theft Committee. The Committee shall be headed by the Policy Administrator or his or her appointee. Two or more other individuals appointed by the City Council shall comprise the remainder of the committee membership. The Policy Administrator will be responsible for the Policy administration, for ensuring appropriate training of City staff on the Policy, for reviewing any staff reports regarding the detection of Red Flags and the steps for preventing and mitigating Identity Theft, determining which steps of prevention and mitigation should be taken in particular circumstances and considering periodic changes to the Policy.

B. Staff Training and Reports

City staff responsible for implementing the Policy shall be trained either by or under the direction of the Policy Administrator in the detection of Red Flags and Identity Protection Act, and the responsive steps to be taken when a Red Flag or problem is detected. Further training shall also be provided on a yearly basis or as needed to address changes in the Policy.


C. Service Provider Arrangements

In the event the City engages a Service Provider to perform an activity in connection with one or more Covered Accounts, the City will take the following steps to ensure the Service Provider performs its activity in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of Identity Theft.

1. Require, by contract, that Service Providers have such policies and procedures in place; and 2. Require, by contract, that Service Providers review the City’s Policy and report any Red Flags

to the Policy Administrator.

D. Specific Policy Elements and Confidentiality

For the effectiveness of Identity Theft prevention policies, the Red Flag Rule envisions a degree of confidentiality regarding the City’s specific practices relating to Identity Theft detection, prevention and mitigation. Therefore, under this Policy, knowledge of such specific practices is to be limited to the Identity Theft Committee and those employees who need to know them for purposes of preventing Identity Theft. Because this Policy is to be adopted by a public body and thus publicly available, it would be counterproductive to list these specific practices here. Therefore, only the Policy’s general Red Flag detection, implementation and prevention practices are listed in this document.

IX. Distribution

This policy will be distributed to all Administrative Directive holders, employees who deal with personal identification information, made available to all employees through publication on the Human Resources website.

Robert R. Kiely, Jr. City Manager

Created 10-2008