New Jersey Administrative Code › Title 5 - COMMUNITY AFFAIRS › Chapter 30 - LOCAL FINANCE BOARD › Subchapter 9A - ELECTRONIC DISBURSEMENTS AND CLAIMANT CERTIFICATION › Section 5:30-9A.4 - Standard electronic funds transfer technologies; internal controls and conditions for use

Current through Register Vol. 56, No. 14, July 15, 2024
(a) Local units, local authorities, boards of
				education, and county colleges shall only initiate and approve electronic funds in
				accordance with this subchapter. Standard electronic funds transfer technologies
				shall incorporate, at minimum, the following features and safeguards:
1. The ability to designate specific individuals
				able to initiate disbursements, barring those not authorized to initiate
				disbursements from doing so;
2. The
				ability to designate individuals who may authorize disbursement, and segregate
				initiation and authorization functions. Password or other security controls shall be
				in place to restrict access based on an individual's authorized role;
3. The ability to confirm receipt of payment by
				vendor;
4. The ability to bar automatic
				debits from local unit accounts;
5. The
				ability for appropriate officials to view transaction history, generate activity
				reports, and conduct supervisory reviews of all transactions;
6. The ability to backup transaction data and
				store such data offline;
7. Measures to
				mitigate risk of duplicate payment;
8.
				The creation and maintenance of an audit trail, such that transaction history,
				including demands for payment and payment initiation, authorization, and
				confirmation, can be independently tracked and detailed through the use of an
				electronic data interchange or functional equivalent;
9. The following cybersecurity best practice
				framework shall be followed:
i. Any system
				supporting a standard electronic funds transfer technology shall:
(1) Be hosted on dedicated servers or in a FedRAMP
				Moderate Impact Level Authorized Cloud. When using cloud services, the vendor shall
				check provider credentials and contracts;
(2) Encrypt stored and transmitted financial
				information and personal identification information;
(3) Maintain only critical personal identification
				information. Social Security numbers shall not be utilized as identification numbers
				for system purposes;
(4) Employ a
				resilient password policy;
(5) Undergo
				regular and stress testing;
(6) Have
				regular security updates on all software and devices carried out;
(7) Have back-up plans, information disposal, and
				disaster recovery procedures created and tested;
(8) Undergo regular security risk assessments for
				detecting compromises, along with regular monitoring for vulnerabilities, with
				necessary patches and updates being implemented; and
(9) Develop a Cybersecurity Incident Response
				Plan; and
ii. The managing
				organization shall:
(1) Check provider credentials
				and contracts when using cloud services;
(2) Educate staff in good security measures and
				perform employee background checks; and
(3) Create a computer security incident response
				team, generally called a CSIRT;
10. Financial institution providers of standard
				electronic funds transfer technologies shall provide annual evidence of satisfactory
				internal control to the chief financial officer;
11. ACH payments shall follow rules set forth by
				the National Automated Clearing House Association (NACHA) or an equivalent successor
				banking industry standard. In addition, the following safeguards shall be
				instituted:
i. All electronic funds transfers
				through the ACH must utilize electronic data exchange (EDI) technology and be
				subject to an Electronic Funds Transfer and Indemnification Agreement;
ii. A user that can generate an ACH file shall
				neither have upload rights nor access that permits editing of a vendor routing
				number or vendor account number;
iii.
				Each edit to vendor ACH information shall be approved by a separate individual and
				be logged showing the user editing the data, date stamp, IP address, and the
				approval of the edit;
iv. Any ACH file
				that is in plain text format shall not be stored on a local computer past the time
				transmitted to a bank; and
v. If
				supported by the financial institution of a local unit, local authority, board of
				education, or county college, said entities shall avail themselves of the ability to
				recall ACH payments via NACHA file;
12. A charge account or charge card issued by a
				specific vendor, which can only be utilized for goods and services provided by said
				vendor, may be utilized by local units, local authorities, and county colleges, but
				must incorporate the following safeguards:
i.
				Outstanding balances shall be required to be paid in full each month. No local unit
				shall utilize revolving charge cards;
ii. Allows the local unit, local authority, or
				county college to designate specific employees authorized to utilize the charge
				account or card and track purchases by individual user;
iii. Allows dollar amount limits to be placed on
				each single purchase; and
iv. Provides
				the ability to receive itemized statements and pay by invoice; and
13. No charge account or charge card
				issued by a specific vendor may be utilized for travel or dining expenses.