Administration and Finance Committee

PUBLIC NOTICE ADMINISTRATION & FINANCE COMMITTEE Thursday, February 20, 2025 - 4:30 PM Village Hall - 31 W. Quincy Street AGENDA 1. Call to Order 2. Roll Call 3. Pledge of Allegiance 4. Public Comment 5. Approval of Minutes a. Minutes of the January 9, 2025 regular meeting. 6. Unfinished Business 7. New Business a. Fire Department Employee of the Year b. Fire Department Life Saving Awards c. Text Amendments with Community Development d. Fire Department Year End Report e. Village Purchasing Policy f. Information Technology Policies 8. Reports 9. Miscellaneous 10. Meeting Schedule 11. Adjourn Page 1 of 49 Page 2 of 49  ‭Administration & Finance Committee‬ ‭Thursday, January 9, 2025‬ ‭Minutes‬ ‭I.‬ ‭CALL TO ORDER‬ ‭II.‬ ‭ROLL CALL -‬‭Trustees: Guzzo, Liddle, Nero, and Barker.‬‭Mayor Gunter & Clerk‬ ‭Szymski. Staff: Manager May, Chief Gunther, Director Mielcarski, Assistant Parker, Director‬ ‭Altic, Director Hennerfeind, Director Ries, Deputy Chief Frank, Deputy Chief Fitzgerald, Director‬ ‭Brainerd, Director McIntyre, and‬ ‭III.‬ ‭PLEDGE OF ALLEGIANCE‬ ‭IV.‬ ‭PUBLIC COMMENTS - None‬ ‭V.‬ ‭MINUTES‬ ‭A.‬ ‭Approval of the December 19, 2024 meeting minutes‬‭of the Administration and‬ ‭Finance Committee. Motion to approve Trustee Nero, 2nd by Trustee Barker; all‬ ‭ayes.‬ ‭VI.‬ ‭UNFINISHED BUSINESS - None‬ ‭VII.‬ ‭NEW BUSINESS‬ ‭A.‬ ‭Director Mielcarski presented on the DuPage Mayors‬‭and Manager’s‬ ‭Conference Legislative Action Plan. A review of the four topics that will be the‬ ‭focus for the Spring legislative session. (see attached) A resolution accepting‬ ‭this item is on tonight’s Village Board agenda.‬ ‭B.‬ ‭Assistant VM Parker presented on the Outdoor Dining on Public Parkway grant‬ ‭program. As only two of the five restaurants are utilizing the outdoor dining‬ ‭areas, the question becomes do we want to extend the grant program longer to‬ ‭allow for the other businesses to purchase tables & chairs for the upcoming‬ ‭season in this fiscal year?‬ ‭a.‬ ‭Trustee Liddle stated that it was a fine idea, the businesses need to be‬ ‭able to put the right type of product out there.‬ ‭b.‬ ‭Trustee Barker asked what the maximum grant amount is? AVM Parker‬ ‭replied that it was $5,000.00. Reminder that it was only for equipment.‬ ‭c.‬ ‭Mayor Gunter hopes that in the Spring the businesses will begin thinking‬ ‭of outdoor dining. He also stated that inappropriate furniture will not be‬ ‭allowed in the extended brick parkway and an agreement must be signed.‬ Page 3 of 49  ‭C.‬ ‭Director Altic presented on the State of IL repeal of the 1% state wide grocery‬ ‭tax.(see attached) Discussion ensued regarding moving forward with an‬ ‭ordinance now, or waiting for the new new board to forward 1/1/2026.‬ ‭a.‬ ‭Manager May stated that all the DuPage communities are discussing‬ ‭when to move forward due to the upcoming election. All the communities‬ ‭are moving forward.‬ ‭b.‬ ‭Trustee Nero would like to move forward.‬ ‭c.‬ ‭Trustee Barker would like to open this up to having discussions at many‬ ‭meetings as possible for the public to attend and ask questions.‬ ‭d.‬ ‭Trustee Guzzo remarked that this is just the status quo and we will have it‬ i‭n place when the State removes their tax.‬ ‭e.‬ ‭Manager May stated it would be on the agenda for the 2nd meeting in‬ ‭February.‬ ‭D.‬ ‭Director Altic presented on funding for the Fire Station Facility. (see attached)‬ ‭a.‬ ‭A tax increase of 0.5% was discussed and the estimate of $18 million for‬ ‭the fire station, with a $30 million bond to move forward in a year or two.‬ ‭So, in talking with the villages bond advisor, the debt service on an $18‬ ‭million bond issuance is about $1.3 million in annual debt service over‬ ‭that 20-year time frame. So, that's the funding source that we got to come‬ ‭up with is $1.3 million annually over 20 years. And so then one thing I‬ ‭want to point out here is if that cost goes above that $18 million mark for a‬ ‭20-year bond, you're looking at about almost $100,000 in annual debt‬ ‭service. So that 1.3 becomes 1.4. So that's kind of the cost of a million‬ ‭dollars if we go over that $18 million mark.‬ ‭b.‬ ‭Ordinance needs to be passed by the state deadlines.‬ ‭c.‬ ‭Trustee Guzzo asked about the current rate of municipal bonds. Director‬ ‭Altic stated that 3.5-4% would be a guess.‬ ‭d.‬ ‭Mayor Gunter questioned the possibility of the bond refunding issuances‬ ‭and redemption opportunities, and the general/alternate bonds.‬ ‭Discussion ensued.‬ ‭e.‬ ‭Food for Thought - CUSD201 will have their referendum in the Spring.‬ f‭.‬ ‭AVM Parker asked for a decision as to which date is preferred, March or‬ ‭September. The final direction is to wait for September.‬ ‭VIII.‬ ‭REPORTS‬ ‭A.‬ ‭Committee Chairperson - None‬ ‭B.‬ ‭Village Manager‬ ‭■‬ ‭Elected/Appointed Officials - upcoming review‬ ‭a.‬ ‭Trustee Matt Scales‬ ‭b.‬ ‭PZ Commissioner John Simpson‬ ‭c.‬ ‭Clerk Ginny Szymski‬ Page 4 of 49  ‭d.‬ ‭Clerk Amanda Szymski‬ ‭There will be an executive session in February to review‬ ‭everything for new trustees.‬ ‭■‬ ‭Shared Services -‬ ‭a.‬ ‭Fleet Maintenance - Discussing with Oak Brook‬ ‭and working towards an IGA.‬ ‭b.‬ ‭Clarendon Hills - receptive to shared services‬ ‭c.‬ ‭Consolidation- union stations were reviewed‬ ‭d.‬ ‭Discussion of shared services re: fuel‬ ‭■‬ ‭Boundary Agreements - expired‬ ‭a.‬ ‭Downers Grove- north end by radio towers‬ ‭b.‬ ‭Willowbrook - expired‬ ‭c.‬ ‭Westmont/Willowbrook/Darien agreement‬ ‭■‬ ‭Involuntary Annexations‬ ‭1.‬ ‭History - 44 parcels to date since 2018‬ ‭2.‬ ‭Area 7 - Birchwood Ct.‬ ‭3.‬ ‭Area 8 - 59th/Richmond‬ ‭4.‬ ‭Area 9 - S Richmond (Darien & Willowbrook)‬ ‭5.‬ ‭Service Organization Signs - Director Ries discussed the‬ ‭signs and the possibilities of adding information. The policy for‬ ‭civic/religious organizations was reviewed. (see attached)‬ ‭■‬ ‭Snow and salt - public right away was reviewed.‬ ‭1.‬ ‭Tobacco Compliance check was perfect, no one sold to the‬ ‭underage agent.‬ ‭IX.‬ ‭MISCELLANEOUS - none‬ ‭X.‬ ‭ADJOURN‬ ‭Motion by Nero and second by Barker‬ ‭(next meeting is scheduled for February 20, 2025)‬ Page 5 of 49  DuPage Mayors and Managers Conference an association of municipalities representing 1,000,000 people 2025 Legislative Action Program A coalition of cities and villages working together, the Conference fosters collaboration and advocates for excellence in municipal government. Municipal Revenues and Freedom of Information Act Unfunded Mandates and Open Meetings Act Per-capita funding through the Local Common sense changes to the Freedom of Government Distributive Fund (LGDF) Information Act, such as adopting the federal benefits all municipalities, supporting definition of commercial requests & requiring community services such as infrastructure, a conviction for the public release of body social services, public safety pensions, and camera arrest footage to protect citizens’ unfunded mandates such as lead service line privacy, will preserve transparency & mitigate replacement. LGDF allows local officials to the abuse of FOIA for entertainment & profit. invest locally generated revenue where it is Open Meetings Act changes to allow remote needed most without raising taxes. meetings of committees and advisory boards Unfunded mandates preempt local control that refer final action to another decision- and divert revenue from essential programs making body will increase efficiency, and services our communities rely upon. transparency, and public participation. Sustainable Public Pension Transportation and Systems Infrastructure Municipalities take pride in generously Investments in local infrastructure and a compensating our heroic first responders robust, reliable, and affordable public transit and dedicated employees for their service to system are critical for the prosperity of our the community. “Safe Harbor” for municipal region. Legislation to reform public police and firefighters was fully addressed in transportation must prioritize consensus- 2019, and taxpayers are beginning to see the driven governance, local control, equitable benefits of Tier 2 and the consolidation of service levels across the region, and a downstate public safety pension funds. sustainable funding model. Public pensions, and the taxpayers that fund Municipal representation in transit governance them, must be protected by preventing must be preserved and strengthened to align further Tier 2 pension benefit increases for regional decision-making with the needs of police, fire, and IMRF. our communities. DuPage Mayors and Managers Conference │ www.dmmc-cog.org │ (630) 571-0480 For more information on our legislative priorities, please contact Suzette Quintell at squintell@dmmc-cog.org. Page 6 of 49 Village of Westmont Administration Finance Committee January 9, 2025 4:30pm Page 7 of 49  GROCERY TAX General Background ● Repeal of the 1% statewide grocery sales tax effective 1/1/2026. ● ● Non-home rule communities have the authority, without the need for referendum approval, to implement a local 1% grocery tax for implementation no earlier than 1/1/2026. ● Authorizing Ordinance passed by Village and remitted to Illinois Department of Revenue (IDOR). Page 8 of 49  GROCERY TAX Eligible Items Subject to the Tax 1. Food for human consumption off site from where sold 2. Infant formula 3. Vitamins & Supplements with NO medicinal claims 4. Does not apply to alcohol 5. Does not apply to food infused with cannabis 6. Does not apply to candy 7. Does not apply to food prepared for immediate consumption 8. Does not apply to food prepared to order or for takeout or delivery 9. Does not apply to grooming and hygiene products Page 9 of 49  GROCERY TAX Impact to the Village ● Aldi | Amazon Fresh | Jewel - Osco | Marianos | Nature’s Best | Standard Market ● Could apply to other stores like gas station, specialty markets, & convenient stores ● ≈ $1 million dollar impact to Village revenues Page 10 of 49  GROCERY TAX Tax Implementation Timeline ● Authorizing Ordinance to Village Board no later than September 2025 ● Must be in IDOR’s hands no later than October 1, 2025 ● Into effect no earlier than January 1, 2026 ● Page 11 of 49  Fire Station Facility Funding Cost of Fire Station ● Cost of a new fire station ≈ $18 million ○ Scope of the project has not been determined yet ○ Location has not been determined ■ Purchase of another location could add a few million dollars to the cost ● Annual Debt Service on $18 million bond issuance paid over twenty (20) years ○ ≈ $1.3 million annual debt service payment ○ Each additional $1 million in issuance needed adds ≈ $80,000 to annual debt service ● Annual Debt Service on $18 million bond issuance paid over ten (10) years ○ ≈ $2.2 million annual debt service payment for ten (10) years ○ Save about $4.5 million in interest over the life of the bond (10 years less interest) ○ Each additional $1 million in issuance needed adds ≈ $130,000 to annual debt service Page 12 of 49  Fire Station Facility Funding How to Fund ● Need a dedicated revenue stream of at least $1.3 million annually ○ To match annual debt service required on bond issuance ● Additional Non-home rule sales tax is the best solution ○ Village already has ½% (.50%) tax dedicated to Stormwater since 2015 ○ Recent state legislation allows non-home rule communities to approve an ordinance (no referendum needed) up to 1% for local non-home rule sales tax. ○ Additional ½% (.50%) sales tax would generate ≈ $2.2 million annually ○ This would pay for up to $18 million bond issuance over 10 years. Page 13 of 49 Municipal Imposed Sales Tax Page 14 of 49 Municipal Imposed Sales Tax Page 15 of 49  Fire Station Facility Funding Limitations on Non-Home Rule Sales Tax ● Public Infrastructure ● Property Tax Relief ● Village operations - only through July 1, 2030 ● Statute defines Public Infrastructure as: ○ Municipal roads and streets ○ Access roads, bridges, and sidewalks ○ Water and sewer line extensions ○ Water distribution and purification facilities ○ Storm water drainage and retention facilities Page 16 of 49  Fire Station Facility Funding Implementation Timeline - Non Home Rule Sales Tax ● Village ordinance passed and to IDOR in MARCH for JULY 1 Start ● Village ordinance passed and to IDOR in SEPTEMBER for JANUARY 1 Start Page 17 of 49 Gateway Signage Discussion Page 18 of 49 Gateway signs: Background The Village developed plans for gateway signage in 2017. Since then, gateway signs have been installed in 3 locations: - 63rd/Richmond - 67th/Cass - Ogden/Cumnor Other locations have been identified: - Ogden/Rt. 83 - 35th/Cass Page 19 of 49 Gateway Signs: Designs and Options Page 20 of 49 Requests for Civic Organization Signage The Village has received requests to allow civic organization signage. Discussion points: Criteria to determine which organizations are allowed? One central location or multiple locations? Who pays for the signs? Example signs Costs Page 21 of 49 Gateway signs: Next steps Do we want to accommodate civic organization signage? Any re-design of the original sign proposals? Focus area: Ogden/Rt 83 or 35th/Cass? Page 22 of 49 ‭Village of Westmont‬ ‭Purchasing Policy‬ ‭and‬ ‭Procedure Manual‬ ‭2/6/2025‬ Page 23 of 49  ‭CHAPTER 1 - INTRODUCTION‬ ‭A. Introduction/Statement of Policy‬ ‭The purpose of this Procurement Policy (“Policy”) is to provide guidance and uniform procedures for the procurement‬ ‭of goods, services and construction, and for the soliciting, processing, awarding and rejecting of bids, proposals, and‬ ‭quotations. It is created to ensure competitive and unbiased selection of qualified and cost-effective vendors. This‬ ‭document is adopted by majority vote of the Village Board and may only be amended by a majority vote of the‬ ‭Village Board.‬ ‭CHAPTER 2 - PURCHASING POLICIES‬ ‭A. Code of Ethics‬ ‭Village Code - Article VIII.-State Officials and Employees Ethics Act‬ ‭All Village personnel engaged in purchasing and related activities shall conduct business dealings in a manner above‬ ‭reproach in every respect. See Village Code Chapter 2,” Administration,” Article VII, “Code of Ethics.” Conflict of‬ ‭interest is specifically noted in Section 2-539 of the Village Code.‬ ‭B. Approval of Village Purchases‬ ‭No employee shall purchase goods or services on behalf of the Village without first seeking approval as required by‬ ‭this policy. All purchases shall require advance approval of the appropriate supervisor, department head, the Director‬ ‭of Finance, the Village Manager, and the Board of Trustees in accordance with the guidelines described below:‬ ‭Approval for purchases shall occur before the purchase is made. At the discretion of the department head, approval‬ ‭levels for supervisors may be increased to an amount not to exceed the department head’s authority. In addition, any‬ ‭person responsible for approving purchases at any level may delegate his or her approval authority to a designee in‬ ‭the event he or she is unavailable to approve purchases.‬ ‭The Finance Department (Accounts Payable) should be informed of the designee(s) and of individuals authorized to‬ ‭make purchases under $1,500. The designee cannot be someone who initiates and enters purchase orders.‬ ‭2‬ Page 24 of 49  ‭C. Purchase Order Requirement Exclusions‬ ‭Approved exceptions to the above requirements:‬ ‭1. Payroll payments/contributions including taxes, transfers, pension contributions and payroll withholdings‬ ‭2. Tax payments‬ ‭3. Utility, telephone and cellular payments‬ ‭4. Refunds or reimbursements to residents (Water deposits, Sidewalk squares, lead water services replacement)‬ ‭5. Vendor refunds‬ ‭6. Cash bond releases‬ ‭7. Impact fees‬ ‭8. Legal services‬ ‭9. Board approved contracts‬ ‭10. Intergovernmental agreements‬ ‭11. Stipends paid to commission members for meeting attendance / payments to building monitors during meetings‬ ‭CHAPTER 3 - COMPETITIVE QUOTES & EXCEPTIONS TO THE POLICY‬ ‭A. General Policy for Soliciting Quotes‬ ‭Employees are responsible for obtaining quotes for purchases in the instances outlined below. Quotes shall be added‬ ‭to the purchase order prior to the final purchase. The limits shall include all costs involved with a purchase,‬ ‭including shipping, installation, etc. Purchase orders submitted without the required quotes or a satisfactory‬ ‭explanation of why quotes were not obtained (e.g. sole source, emergency, standardized vendor, etc.) will be returned‬ ‭to the originator. For recurring purchases (supplies, office equipment, occasional repairs, software licenses, tools, auto‬ ‭parts, small equipment) periodic vendor comparisons are acceptable. Professional services and utilities are excluded‬ ‭from the requirements below.‬ ‭Up to $4,999‬ ‭One verbal quote is required; however, employees are encouraged to seek‬‭additional‬ ‭quotes when possible.‬ ‭$5,000 – $9,999‬ ‭Three verbal quotes must be obtained. The quotes must be listed‬‭in the purchase order.‬ ‭$10,000 - $24,999‬ ‭Three written quotes. The quotes must be listed in the purchase order.‬ ‭Copies (either‬ ‭electronic or physical) shall be obtained and retained in the department’s files for‬ ‭auditing purposes.‬ ‭$25,000 & Above‬ ‭Must be competitively bid in accordance with State law and Village‬‭ordinances. If no‬ ‭bid is required, three written quotes should be obtained consistent with the $10,000 -‬ ‭$24,999 range. Village Board approval is required for all contracts above $25,000.‬ ‭B. Joint Purchasing‬ ‭In accordance with Illinois Governmental Joint Purchasing Act (30 ILCS 525/0.01 et seq.), and the Illinois‬ ‭Intergovernmental Cooperation Act (5 ILCS 220/1 et seq.), joint purchasing agreements and cooperative contracts‬ ‭with any local, county, state or federal public entity or entities, or any association of public agencies, may be used‬ ‭without the Village undertaking a competitive procurement process itself; provided that the mechanism for the joint or‬ ‭cooperative purchase provided an opportunity for vendors of goods, services, and construction to submit competitive‬ ‭bids or proposals for the furnishing of such goods, services, or construction to a public entity or public agency.‬ ‭Employees shall be responsible, however, for ensuring that the goods or services are of a quality sufficient to meet the‬ ‭Village’s needs and that pricing is competitive‬‭.‬ ‭3‬ Page 25 of 49  ‭C. Sole Source Purchases‬ ‭When it is determined that a particular product, service or work cannot be competitively bid due to limitations arising‬ ‭out of the nature of the product, service or work or its availability, the Village may be required to negotiate and enter‬ ‭into contracts for materials or services with a sole source supplier. In such instances, purchases in excess of $25,000‬ ‭shall be presented to the Village Board prior to acquisition with a‬‭request to waive bids‬‭, approve‬‭the purchase and‬ ‭enter into a formal contract.‬ ‭D. Emergency Purchases Policy‬ ‭Emergencies are defined as events that could not have been foreseen where immediate action is necessary to‬ ‭safeguard the public’s health and safety. In the event of an emergency affecting the public health and safety, the‬ ‭Village Manager or his/her designee may authorize a vendor to perform work necessary to resolve such emergency‬ ‭without formal bid solicitation. Documentation of the emergency and the need for immediate action shall be‬ ‭presented to the Village Board in a reasonable period of time following resolution of the crisis. The department‬ ‭requesting the emergency purchase order shall enter the purchase order and contact the Finance Director or his/her‬ ‭designee in order to have the purchase order issued.‬ ‭E. Duties in Regard to Contracts‬ ‭See Village Code Chapter 2, “Administration,” Article 3, “Officers and Employees”, Division 3, “Village Manager”,‬ ‭Section 2-567, “Competitive bidding”‬ ‭CHAPTER 4 - COMPETITIVE BIDDING & REQUESTS FOR PROFESSIONAL SERVICES‬ ‭A. When a Formal Bid Is Required‬ ‭See Village Code Chapter 2,” Administration,” Article X, “Competitive Bidding”, Section 2-567, “Competitive‬ ‭bidding”‬ ‭B. Exceptions to Competitive Bidding‬ ‭See Village Code Chapter 2,” Administration,” Article X, “Competitive Bidding”, Section 2-568, “Exceptions to‬ ‭Competitive Bidding”‬ ‭C. Preparing the Bid Document‬ ‭1.‬ ‭It is the responsibility of the respective departments to prepare the bid document.‬ ‭2.‬ ‭All bid documents must contain the following information:‬ ‭●‬ ‭Cover sheet‬ ‭●‬ ‭Table of Contents‬ ‭●‬ ‭Notice to Bidders‬ ‭●‬ ‭General Terms, Conditions and Instructions‬ ‭●‬ ‭Specifications of the Item/Service‬ ‭●‬ ‭Bidding Forms‬ ‭●‬ ‭An appropriate sample contract (required if the bid is for goods, services, construction services or‬ ‭goods and installation services)‬ ‭●‬ ‭All contractor certification forms (e.g. sexual harassment, tax compliance, contract execution)‬ ‭3.‬ ‭Upon request, the Request for Bid is provided to prospective bidders. Public notice of bids shall be advertised‬ ‭in a public forum. The public forum advertising may include without limitation, publications, trade journals‬ ‭and websites.‬ ‭4‬ Page 26 of 49  ‭D. Additional Requirements for the Bid Document‬ ‭1.‬ ‭A bid bond or other approved security in an amount equal to at least 5% of the bid or any greater amount deemed‬ ‭necessary by the Village, is required to guarantee the successful bidder will sign a contract in the following‬ ‭instances: 1) the bid is for a construction project, 2) any other bid for which the Director of Finance deems it‬ ‭necessary to protect the interest of the Village.‬ ‭2.‬ ‭When preparing the bid document, departments should consider whether to require contractors to provide a‬ ‭performance bond if awarded the contract. In instances where the bid is for construction services or significant‬ ‭building improvements, it is customary to require the contractor to provide a performance bond. A performance‬ ‭bond, issued by a surety company, stipulates a legal, written obligation to guarantee 100% payment for any‬ ‭financial loss caused by default of the contractor. The contractor shall provide the performance bond with the‬ ‭appropriate Labor and Material Bonds (or payment bonds) within ten (10) calendar days of award of the bid.‬ ‭Bonds required to guarantee performance and payment for labor and material for the work shall be in a form‬ ‭acceptable to the Village‬ ‭3.‬ ‭During the term of the contract, the contractor shall provide the Village with a certificate of insurance.‬ ‭4.‬ ‭Prevailing Wage - The vendor on all public works contracts must comply with the Prevailing Wage Act (820 ILCS‬ ‭130). Also See Village Code Chapter 2, “Administration,” Article 1, “General”, Section 2-5, “Prevailing wage‬ ‭rates for public works construction.‬ ‭5.‬ ‭All companies or individuals who wish to bid on a good or service must submit their bids in accordance with the‬ ‭bid document before the stated deadline of the bid. A bid received after the deadline is returned to the vendor‬ ‭unopened, and any bids that are not compliant with stated specifications may be rejected.‬ ‭6.‬ ‭If a pre-bid conference is conducted, departments should specify in the Notice to Bidders whether attendance is a‬ ‭mandatory condition of bidding. At the pre-bid conference, the responsible department should ensure that all‬ ‭attendees sign a “sign-in” sheet to ensure compliance with this requirement of bidding.‬ ‭E. Bid Opening Procedures‬ ‭All sealed bids shall be publicly opened by a Village employee as assigned by the applicable department head at the‬ ‭date, time and place stated in the bid notice. At least one other employee shall serve as a witness and tabulate the bid‬ ‭results. All proposals shall be open to public inspection and a tabulation of all bids shall be available from the‬ ‭department head.‬ ‭F. Post Bid Opening Requirements‬ ‭After the bid opening has taken place, the responsible employee shall prepare a Bid Proposal Recommendation‬ ‭memorandum that explains the purpose of the bid, includes the names and addresses of the companies who submitted‬ ‭bids as well as the amount each company bid and recommends which company should be awarded the bid. The‬ ‭recommendation should be based on the following:‬ ‭a)‬ ‭The ability, capacity and skill of the bidder to perform the contract and provide the service required‬ ‭b)‬ ‭Whether the bidder can perform the contract or provide the service promptly, or within the time specified,‬ ‭without delay or interference‬ ‭c)‬ ‭The character, integrity, reputation, judgment, experience and efficiency of the bidder‬ ‭d)‬ ‭The quality of performance of previous contracts of services‬ ‭e)‬ ‭The previous and existing compliance by the bidder with laws and ordinances relating to the contract or‬ ‭service‬ ‭5‬ Page 27 of 49  ‭f)‬ ‭The sufficiency of the financial resources and ability of the bidder to perform the contract or provide the‬ ‭service‬ ‭g)‬ ‭The quality, availability and adaptability of the supplies or contractual service to the particular use required‬ ‭h)‬ ‭The ability of the bidder to provide future maintenance and service for the use of the subject of the‬ ‭contract‬ ‭i)‬ ‭Responsiveness to the exact requirements of the invitation to bid‬ ‭j)‬ ‭Past records of the bidder’s transactions with the Village or with other entities as evidence of the bidder’s‬ ‭responsibility, character, integrity, reputation, judgment, experience, efficiency and cooperativeness‬ ‭Once approved by the department head, the Bid Proposal Recommendation memorandum should be included with the‬ ‭Award of Bid Proposal on the next Village Board’s agenda.‬ ‭If a Department that has issued a bid desires to reject all bids, for whatever reason, the responsible employee shall‬ ‭prepare a memorandum that explains the purpose of the bid, includes the names and addresses of the companies who‬ ‭submitted bids as well as the amount each company bid, and provides the reasons why the Village should reject all‬ ‭bids. Once approved by the department head, the memo should be placed on the Village Board’s agenda.‬ ‭State law requires bid files be maintained for ten (10) years following the bid opening. Each department is‬ ‭responsible for keeping their bid files. Before work begins, the contract will be fully executed, performance bonds‬ ‭and certificates of insurance, when required, will be obtained.‬ ‭G. Bid Lists‬ ‭Each department shall be responsible for maintaining their own lists of qualified prospective bidders.‬ ‭H. Requests for Professional Services‬ ‭Some contracts, by their nature, are not adapted to award by competitive bidding. Examples include, but are not‬ ‭limited to, contracts for the services of individuals possessing a high degree of professional skill where the education,‬ ‭experience or character of the individual is a significant factor in determining their ability to meet the Village’s needs.‬ ‭Further examples include accounting, auditing, financial, recruitment, employment, marketing, procurement, public‬ ‭relations, information technology, software renewals, legal, land survey, architectural and engineering services. These‬ ‭contracts generally result from a request for proposal (RFP) or request for qualification (RFQ) solicited from‬ ‭consultants for “Professional Services.” The Village is required by the Local Government Professional Services‬ ‭Selection Act (50 ILCS 510) to follow specific procedures when hiring for certain professional services.‬ ‭CHAPTER 5 - FINANCIAL POLICIES‬ ‭A. Change Order Policy‬ ‭"Change order" means a change in a contract term other than as specifically provided for in the contract which‬ ‭authorizes or necessitates any increase or decrease in the cost of the contract or the time to completion.‬ ‭It shall be the responsibility of each department head to ensure that all change orders are submitted to the Village‬ ‭Manager or Village Board for approval. In addition, department heads shall be responsible for monitoring all contract‬ ‭payouts and retainages to ensure that the amount of the change order is correct. The procedures outlined below shall‬ ‭not apply to professional service contracts (e.g. engineering, architectural or land surveying work). Changes to‬ ‭professional service contracts shall be treated as contract amendments.‬ ‭Change Orders, for other than bid construction projects, that are within 10% of the original amount, do not require‬ ‭additional approvals.‬ ‭6‬ Page 28 of 49 ‭1.‬ ‭Change Order Requiring Village Manager Authorization Only:‬ ‭a)‬ ‭Change orders to contracts for less than $25,000 in which the total contract (original contract plus‬ ‭change order) does not exceed $25,000 may be approved by the Village Manager, or his/her designee.‬ ‭Departments may receive approval by submitting a Purchase Order Change Order to the Finance‬ ‭Director, or his/her designee, who will review it for completeness and accuracy. Upon approval , the‬ ‭change order will also require approval by the Village Manager.‬ ‭2.‬ ‭Change Order Requiring Village Board Authorization:‬ ‭a)‬ ‭Change orders to bid contracts for $25,000 or more which increase or reduce the contract price by‬ ‭more than $25,000 require the approval of the Village Manager and Village Board.‬ ‭b)‬ ‭Change orders for bids which increase or reduce the time for completion of the contract by more than‬ ‭180 days (regardless of the original contract price) require Village Board approval.‬ ‭3.‬ ‭Procedures for Submitting Change Orders to the Board:‬ ‭a)‬ ‭Change orders requiring Village Board approval shall be placed on the Village Board’s agenda under‬ ‭New Business and shall be accompanied by the following:‬ ‭i)‬ ‭A memorandum explaining the need for the contract revision along with one of the following‬ ‭statements:‬ ‭(1)‬‭The circumstances said to necessitate the change in performance were not reasonably‬ ‭foreseeable at the time the contract was signed, or‬ ‭(2)‬‭The change is relevant to the original contract as signed, or‬ ‭(3)‬‭The change order is in the best interest of the Village.‬ ‭b)‬ ‭In special circumstances, the Village Manager or his/her designee may authorize a change order‬ ‭requiring Village Board approval prior to being placed on the Village Board agenda.‬ ‭4.‬ ‭Public Works Contract Change Orders:‬ ‭a)‬ ‭In accordance with the Public Works Contract Change Order Act, if there is a change order for a public‬ ‭works contract that authorizes or necessitates any increase in the contract price that is 50% or more of‬ ‭the original contract price or that authorizes or necessitates any increase in the price of a subcontract‬ ‭under the contract that is 50% or more of the original subcontract price, then the portion of the contract‬ ‭that is covered by the change order must be resubmitted for bidding in the same manner for which the‬ ‭original contract was bid.‬ ‭In instances where a final balancing change order (regardless of the amount) reduces the contract price, departments‬ ‭shall instruct Finance to close out the remaining encumbered funds.‬ ‭CHAPTER 6 - MISCELLANEOUS PURCHASING POLICIES & GUIDELINES‬ ‭A. Travel, Meals, and Lodging Expense Policies and Procedures‬ ‭See Village Board police AP-02 effective 4/20/2023 located in the Finance Department section of Inside‬ ‭Westmont intranet website.‬ ‭B. Disposal of Village Property‬ ‭Village property of value may not be sold or traded without prior approval of the Village Board. If the item has value,‬ ‭departments shall notify the Governmental Services Director and work to prepare a Village Board agenda item‬ ‭7‬ Page 29 of 49 ‭recommending disposal of the property. In instances where Village property no longer has value, department‬ ‭Directors may dispose of the property without Village Board approval.‬ ‭C. Use of Sales Tax Exemption Number‬ ‭Village purchases are not subject to sales tax; therefore, employees shall make efforts to inform vendors of the‬ ‭Village’s tax-exempt status and to ensure that sales tax is not paid for purchases‬‭.‬ ‭Sales tax, if charged,‬‭may be the‬ ‭responsibility of the purchaser to pay unless otherwise authorized. Employees shall provide vendors who request‬ ‭them with a sales tax exemption form signed by the Director of Finance. Use of the Village’s sales tax exemption‬ ‭number is restricted to purchases made on behalf of the Village.‬ ‭D. General Federal Guidelines‬ ‭Unless otherwise provided in this Policy, when procurement of goods, services, or construction involves the‬ ‭expenditure of State or Federal financial assistance or grant funds, the procurement shall be conducted in accordance‬ ‭with any applicable mandatory State and/or Federal laws and regulations.‬ ‭.‬ ‭Debarment and Suspension: No purchases shall be made from parties who have been involved in fraud, waste or‬ ‭abuse and are additionally included on any federal or state suspension or debarment list. The General Service‬ ‭Administration's (GSA) lists the names of parties debarred, suspended, or otherwise excluded by agencies, and‬ ‭contractors declared ineligible under statutory or regulatory authority on the System for Award Management.‬ ‭E.‬ ‭Whistleblower Act‬ ‭See Village Code Chapter 2,” Administration,” Article VII, “Code of Ethics”, Section 2-546, “Whistleblower‬ ‭Reporting Policy.”‬ ‭F. Prepayments‬ ‭The Village will not pay for goods and services until the goods are received or the service is rendered.‬ ‭Exceptions:‬ ‭1.‬ ‭Deposits on certain jobs when approved by the Director of Finance.‬ ‭2.‬ ‭Memberships and books or periodicals.‬ ‭3.‬ ‭Payments to local, State and Federal government entities.‬ ‭4.‬ ‭Service and maintenance contracts where necessary.‬ ‭5.‬ ‭Small orders (under $2,500) where the department head approves prepayment.‬ ‭6.‬ ‭Approval by the Director of Finance or Village Manager.‬ ‭G. Purchase Card (P-Card) Payments and Procedures‬ ‭See the Village’s procedures policy on the Purchase Card Procedures in the Finance Department section on the Inside‬ ‭Westmont intranet page.‬ ‭8‬ Page 30 of 49 Authentication Policy Effective 2025-02-20 Category ​Administrative Safeguard ​Physical Safeguard ​Technical Safeguard Applicable Trust Principals ​Security ​Availability ​Processing Integrity ​Confidentiality ​Privacy Purpose Village of Westmont ("Westmont") will implement procedures for creating, managing, and safeguarding passwords used to protect the confidentiality, availability and integrity of systems and information. Westmont will also effectively communicate password management processes to its managed users. Page 1 Page 31 of 49 Policy All systems in use by Westmont must adhere to minimum password settings outlined in this document. Practices for passwords: ●​ Maintain a 12-character minimum length requirement. ●​ Require character composition requirements. For example, three of the following four requirements: capital or lowercase letters, numeric, and special characters. ●​ Require mandatory periodic password resets for user accounts based on roll and system access. ●​ Educate users to not re-use their organization passwords for non-work related purposes. ●​ Enforce registration for multi-factor authentication (MFA). ●​ Enable risk-based multi-factor authentication challenges. General Requirements •​ Passwords will be issued or generated by the user, will be unique to individuals, and cannot be shared. •​ Multi-Factor Authentication (MFA) will be enabled and required for use by all users. •​ Passwords need to be changed immediately if inappropriately disclosed or it is suspected the password has been disclosed to an entity or individual other than the user. •​ Passwords cannot be reused for six (6) iterations, and some positions require this to be longer. •​ Educate users to not create passwords containing personally identifiable information (i.e., include birth date, spouse’s name, child’s name, etc.). •​ Educate users to create passwords with at least twelve (12) characters containing a mix of alpha-numeric characters including upper and lower case alpha characters, numbers, and special characters. •​ All systems should be configured to automatically prevent users from attempting to login for an appropriate length of time after multiple failed login attempts. Page 2 Page 32 of 49 •​ Westmont's system administrators responsible for overall password and authentication management will not reset a password unless the user can be positively identified. Authentication Security •​ To prevent password guessing attacks, the number of consecutive attempts to access a system or an application using an incorrect password will be limited. •​ Multi-Factor Authentication (MFA) should be enabled on all systems used by Westmont and should be required for all users to use as part of the authentication process. •​ An audit log will be created each time a user attempts to log into the system or an application unsuccessfully. The audit logs generated will be reviewed by the Security Officer or designee on a periodic basis. •​ Passwords must never be in readable form outside a personal computer or workstation (i.e., the password will not be displayed in clear text on the screen when the user logs on to a Westmont system, the user must not write down the password and store it in an easily accessible place near the workstation, etc.). •​ All passwords must be promptly changed if it is suspected the password has been disclosed or known to have been disclosed to unauthorized parties. •​ Whenever a system has been compromised by an unauthorized party, the Westmont Security Officer or appropriate manager must require users to immediately change every password on the involved system. Passwords & User Responsibility •​ Users accessing Westmont applications, data, or communication systems must be assigned initial passwords which are unique to each individual user. Following initial login, the user is required to change the password to a strong password only known to the user. •​ Password Sharing Prohibition: Passwords must never be shared or revealed to anyone other than the authorized user. •​ Users are responsible for all activity performed with their personal user IDs. User IDs may not be utilized by anyone but the individuals the unique ID was issued to. Page 3 Page 33 of 49 User Training Westmont will provide its workforce members with training and awareness on appropriately creating, changing, and safeguarding passwords used to verify users’ identities and to obtain access to Westmont's systems. Password management training and awareness will include the following requirements for access to company systems: •​ Westmont’s password standards and guidelines. •​ The process for changing temporary passwords when assigned for new login. •​ The importance of avoiding the practice of maintaining passwords in a paper record. •​ The significance of changing passwords and avoiding the reuse of passwords. •​ The significance of keeping passwords confidential. •​ The significance of using different passwords for personal and work accounts. •​ The importance of not including passwords in any automated login process. •​ The importance of changing passwords when there is an indication of password or information system compromise. •​ The importance of locking or logging off before leaving your device unattended. . •​ The importance of selecting a strong password (i.e., one that is twelve (12) characters in length or longer, is not easily guessable, and is a mixture of upper and lower case letters, numerals and special characters.) Page 4 Page 34 of 49 Version History Modification Date Change Description Modified By 2025-02-12 Initial Policy Creation Information Technology Last Approval Approval By: Administration and Finance Committee Approval Date: 2025-02-20 Page 5 Page 35 of 49 Cloud Security Policy Effective 2025-02-20 Category ​Administrative Safeguard ​Physical Safeguard ​Technical Safeguard Applicable Trust Principals ​Security ​Availability ​Processing Integrity ​Confidentiality ​Privacy Purpose This policy outlines the basic security requirements that must be followed for all cloud environments used by Village of Westmont ("Westmont") for infrastructure (IaaS), platform (PaaS), or software (SaaS). Page 1 Page 36 of 49 Policy All cloud environments utilized by Westmont will be managed according to the following security requirements. User Management ●​ User access to all cloud environments should be managed by the Westmont Information Technology department and should follow the requirements in the Access Management Policy. ●​ All accounts should be for named users as shared accounts (such as Admin) are not allowed in the cloud environment, which the pre-approved exception of users in the EP&L system. ●​ Two Factor Authentication (2FA) is required for all accounts. ●​ User authorization must meet the requirements of the Access Management Policy. Managed Cloud Server Administration ●​ Administration of any cloud servers or applications must be performed from a private management subnet and not from publicly accessible management ports. ●​ All management ports (i.e., Port 22, 161, 389, 3389) must be blocked from public access and must only be accessible from a private management subnet. ●​ Whenever possible, a bastion host should be implemented and used for management of the respective cloud environment. ●​ Private, encrypted VPN connections must be used to gain access to all management subnets. ●​ Cloud servers must meet hardening requirements set in Default Device Configuration Policy. Page 2 Page 37 of 49 All Servers used for providing web services, API services, web hosting or application hosting must meet the following requirements: ●​ All traffic must be transmitted using TLS 1.2 or greater or using a protocol with equivalent security and encryption, such as SSH or SFTP. ●​ All servers with public IP addresses must be protected from Internet access via a Firewall, Firewall Service, Network Access Control List, or a Private Cloud configuration to include deny-all default access control policies. ●​ Web Servers (ports 80 or 443) must be protected against OWASP attacks by a web application firewall or other appropriate application-level protections. Boundary Protections ●​ All cloud environments must be protected from the Internet utilizing whichever appropriate boundary protections are available. ●​ All services and ports must be secured behind a Firewall, Network ACL, or Security Group configuration preventing access to non-public ports. ●​ All ports not in public use, including management ports, must be blocked with appropriate rules. ●​ All Firewalls, ACLs, or Security Groups must have a default deny-all rule. ●​ All public facing web applications or web sites must use a Web Application Firewall (WAF) to stop OWASP Top 10 attacks and any other known application threats. Cloud Backups ●​ Cloud environments must have backup systems configured allowing all production systems and data to be restored in accordance with defined company RPO and RTO requirements. Page 3 Page 38 of 49  ●​ Backups must not reside in the same system or environment which they are backing up. Whenever possible, backups should be maintained in a geographically separate data center or region to ensure availability. DNS Security ●​ Unused DNS records must be removed from company-maintained zone records as soon as corresponding cloud endpoints are taken offline or deleted. ●​ DNS Zone records must be kept clean and audited on a regular basis to ensure no orphaned DNS records exist. ●​ All changes to DNS must be approved by Westmont and then formally communicated to the State of Illinois, who controls Westmont’s DNS records. Logging and Notifications ●​ All services, applications, and administration actions should be logged to centralized logging in the cloud environment and must be kept for a minimum of 90 days. ●​ Alerts and notifications must be configured to notify administrators of any security issues that may arise. Server OS & Software ●​ Patches and updates must be applied any time a security vulnerability is discovered during routine vulnerability scanning. The priority of the patch is to be determined by severity of the vulnerability. ●​ Patches must be applied a minimum of monthly for all public facing servers. ●​ Patches must be applied a minimum of monthly/quarterly for internal servers. ●​ Systems and Software that no longer have vendor supplied security updates must be removed from production before official support ends. Version History Modification Date Change Description Modified By 2025-02-12 Initial Policy Creation Information Technology Page 4 Page 39 of 49 Last Approval Approval By: Administration and Finance Committee Approval Date: 2025-02-20 Page 5 Page 40 of 49 On-premises Data Backup Policy Effective 2025-02-20 Category ​Administrative Safeguard ​Physical Safeguard ​Technical Safeguard Applicable Trust Principals ​Security ​Availability ​Processing Integrity ​Confidentiality ​Privacy Purpose Village of Westmont ("Westmont") will implement policies and procedures to ensure an exact copy of all organization data is recoverable in the event of a data loss. Page 1 Page 41 of 49 Policy Westmont will take reasonable and appropriate steps to back up and store all information maintained on its systems and to create exact and retrievable copies of the information. Westmont will document and implement a detailed plan for creating and maintaining backup data of all electronic media and information that: ●​ Defines who is responsible for taking reasonable steps to ensure the data backup occurs ●​ Defines a backup schedule ●​ Specifies the systems that are to be backed up ●​ Defines where backup systems are located ●​ Defines who may access the backup systems and transfer backups as required ●​ Defines restoration procedures to restore data from backups to the appropriate systems. Westmont will implement backup procedures based on its business model to: ●​ Generate up-to-date copies of the data that can be recovered in the event that systems are damaged by or during a disaster or other emergency in accordance with the Disaster Recovery Plan. ●​ Complete periodic testing of its restoration procedures for systems to confirm the effectiveness of those procedures and that the data can be restored in the time set forth in the covered component’s Disaster Recovery Plan. ●​ Document processes and procedures that ensure by default all data is backed up for a retention period of 365 days based on data becoming invalid after this retention period. ●​ Specific systems may have different data retention periods which may be defined and classified in the Data Security policy under the Data Retention section as well as in the Data Backup Plan. Page 2 Page 42 of 49  ●​ Store backup copies of all data, complete records of the backup copies, and document restoration procedures in a remote and secure location, within sufficient distance from the site. ●​ Provide physical, environmental, and technical security for the backup systems stored at the remote location that will be consistent with the security provided to the data onsite. ​ SaaS Outside Vendor Services ●​ Westmont contracts with multiple outside vendors and agencies for SaaS offerings. Each vendor or agency is responsible for the backup, retention, and recovery of data and systems. These are defined in the related agreements. ●​ Google Workspace is also backed up to a local on-premise server located inside of the Westmont network. Version History Modification Date Change Description Modified By 2025-02-12 Initial Policy Creation Information Technology Last Approval Approval By: Administration and Finance Committee Approval Date: 2025-02-20 Page 3 Page 43 of 49 Patch Management Policy Effective 2025-02-20 Category ​Administrative Safeguard ​Physical Safeguard ​Technical Safeguard Applicable Trust Principals ​Security ​Availability ​Processing Integrity ​Confidentiality ​Privacy Purpose The purpose of this policy is to describe the requirements for maintaining up-to-date security and functional patches and updates on all Village of Westmont ("Westmont") owned and managed Information Technology systems. The term “Patch” in this policy is used to define any software patch, software update, or software upgrade to either a program running on a computer, the computer's operating system, or any computing or networking device's firmware. Page 1 Page 44 of 49 Policy All system and software updates and patches are to be deployed on a regular schedule defined below unless vulnerabilities are discovered requiring a more urgent response. Updates and patches are closely monitored to ensure all urgent updates can be deployed as needed. All new hardware must be brought up to the latest patch levels prior to moving into production or being used by Westmont employees. Patches are only downloaded from approved sources which include Microsoft, hardware vendors, and software vendors. Patching Requirements Server OS & Software ●​ Patches and updates must be applied any time a security vulnerability is discovered during routine vulnerability scanning. The priority of the patch is to be determined by the severity of the vulnerability. ●​ Patches must be applied monthly for all public-facing servers. ●​ Patches must be applied monthly/quarterly for internal servers. ●​ A schedule for patching must be documented and actively followed by the Westmont Information Technology team and management. ●​ Systems and Software no longer having vendor supplied security updates must be removed from production before official support ends. ●​ Patches must be tracked in a change management system or ticket system which shows each server and dates the updates were applied. End User Desktops/Laptops/Mobile Devices ●​ Patches must be applied monthly for all end user desktops and laptops. ●​ Automatic system updates should be enabled wherever possible on all Windows endpoints, iOS devices, and Linux servers to allow timely updates as required by the OS. ●​ Users must not be able to modify or disable the update process dictated by the Westmont Information Technology team. Page 2 Page 45 of 49  ●​ Updates can only be delayed for seven (7) days max by an end user. Users should be instructed to allow updates to run at the end of business on the day they are first prompted with the update. ●​ Third party endpoint management of patching and updates should be used and monitored wherever possible. ●​ Systems and Software that no longer have vendor supplied security updates must be removed from production before official support ends. All Other Critical Equipment ●​ Patches and updates must be applied any time a security vulnerability is discovered during routine vulnerability scanning. The priority of the patch is to be determined by severity of the vulnerability. ●​ Patches must be applied monthly for all public facing equipment such as firewalls or routers. ●​ Patches must be applied quarterly or as available for internal equipment such as switches, access points or wireless LAN controllers. ●​ Systems and Software that no longer have vendor supplied security updates must be removed from production before official support ends. ●​ Schedules for patching should be documented and actively followed by the Westmont Information Technology team and management. Version History Modification Date Change Description Modified By 2025-02-12 Initial Policy Creation Information Technology Last Approval Approval By: Administration and Finance Committee Approval Date: 2025-02-20 Page 3 Page 46 of 49 Access Management Policy Effective 2025-02-20 Category ​Administrative Safeguard ​Physical Safeguard ​Technical Safeguard Applicable Trust Principals ​Security ​Availability ​Processing Integrity ​Confidentiality ​Privacy Purpose This policy outlines the requirements of the entire lifecycle of user or system access including access authorization, access creation, access modification, and access removal for the Village of Westmont ("Westmont") computer systems Page 1 Page 47 of 49 Policy Authorization & Creation The following are the base minimum requirements for authorizing access to systems or applications used by Westmont. ●​ Access for new Westmont employees or contractors will be requested by the hiring manager or Human Resources. This request will be sent to the Westmont Information Technology department via the internal ticketing system. ●​ Existing Westmont employees or contractors may request new access to a system or application by channeling a request through their manager. This request will then be sent to the Information Technology department via the internal ticketing system. ●​ All new user accounts or modifications to existing user accounts must be made by an authorized person or team inside the Information Technology department which has been granted prior authority by the Security Officer. ●​ All new user account access for cloud environments will be configured according to the Cloud Security Policy to ensure appropriate access levels based on the user's job responsibilities. ●​ Once the unique user account has been created, the employee will be notified of the account information and assisted with logging in and changing the temporary password to a strong password as defined in the Authentication Policy. Access Review & Account Termination ●​ On a regular basis, the Security Officer or an authorized Information Technology department member will review user accounts of both employees and contractors to ensure that each account is still authorized and in use and has the appropriate access level. ●​ If the Security Officer or an authorized Information Technology department member determines an account has incorrect access levels, they may modify access as required. All changes to access levels will be documented in the internal ticketing systems. Page 2 Page 48 of 49  ●​ Accounts which are no longer in use will be suspended or removed from the system or application and the suspension or removal will be documented in email or internal ticketing system. ●​ The Security Officer or an authorized Information Technology department member is responsible for removing accounts and access when a termination request is received from the HR department or from a user’s supervisor directly. All account removals will be documented in email or internal ticketing system. Version History Modification Date Change Description Modified By 2025-02-12 Initial Policy Creation Information Technology Last Approval Approval By: Administration and Finance Committee Approval Date: 2025-02-20 Page 3 Page 49 of 49