Loading...
HomeMy WebLinkAboutReso - CC - 112-2025RESOLUTION NO. 112-2025 RESOLUTION OF THE CITY COUNCIL OF THE CITY OF BURLINGAME DECLARING LASERFICHE A TRUSTED SYSTEM AND ADOPTING (1) A RECORDS MANAGEMENT POLICY, (2) PROCEDURES FOR MANAGING RECORDS, AND (3) PROCEDURES FOR SERACHING, STORING, AND DELETING RECORDS IN LASERFICHE WHEREAS, the keeping of numerous records related to City business (“Records”) is not required after a certain period of time for the effective and efficient operation of the government of the City of Burlingame; and WHEREAS, Section 34090, et seq, of the Government Code of the State of California provides the parameters whereby any City Record that has served its purpose and is no longer required may be destroyed, including the requirement that certain Records be reproduced on a “Trusted System,” as defined in California Government Code Section 12168.7, prior to destruction; and WHEREAS, California Government Code Section 12168.7 provides uniform statewide standards for storing documents in electronic media; and WHEREAS, the Secretary of State has adopted Trustworthy Electronic Document or Record Preservation regulations located in Chapter 15, Division 7, Title 2 of the California Code of Regulations, which govern the recording, storing, and reproducing of Records in electronic media where the intent is to destroy the original hard copy and maintain the electronic copy as the official Record; and WHEREAS, the City Clerk and the Finance Director have worked together to ensure that the City’s document management system, and all Records stored within the system, are kept in accordance with the State’s Trusted System requirements and the Trustworthy Electronic Document or Record Preservation regulations; and WHEREAS, on June 18, 2018, the City Council adopted Resolution Number 084-2018, creating a Records Retention Schedule that established procedures for retaining City Records in active files and inactive files, and for disposing of Records when they are no longer needed for administrative, fiscal, historical, or legal purposes; and WHEREAS, the City uses Laserfiche to electronically store Records in PDF format; and WHEREAS, Laserfiche has audit capabilities to track Records as they’re added, deleted, and viewed in the system; and WHEREAS, folder level permissions and restrictions have been established in Laserfiche to ensure only appropriate personnel have access to Records; and WHEREAS, the Records Management Policy, attached hereto as Exhibit A, has been developed for the implementation of the Retention Schedule and to provide for the routine transfer of Records into Laserfiche; and WHEREAS, Procedures for Managing Records, attached hereto as Exhibit B, has been developed for the implementation of the Retention Schedule and to provide for the routine transfer of Records into Laserfiche during the normal course of business; and WHEREAS, Procedures for Searching, Storing, and Deleting Records in Laserfiche, attached hereto as Exhibit C, has been developed for the implementation of the Retention Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A Schedule and to provide for the routine transfer of Records into Laserfiche during the normal course of business; and WHEREAS, the Laserfiche Cloud Security and Compliance document, attached hereto as Exhibit D, outlines Laserfiche’s governance and compliance including its WORM compliance for SEC 17a-4, privacy regulatory compliance, and that it is SOC 2 Type 2 certified; and WHEREAS, collectively, the City’s comprehensive Retention Schedule, Records Management Policy, Procedures for Managing Records, and the Laserfiche technology constitute a Trusted System in accordance with State law. NOW, THEREFORE, BE IT RESOLVED THAT THE CITY COUNCIL OF THE CITY OF BURLINGAME DOES HEREBY RESOLVE, DETERMINE, AND ORDER, AS FOLLOWS: 1. Laserfiche is declared the City’s Records storage repository; and 2. Laserfiche is backed up, and the backup copy is stored offsite on a routine schedule in a format that cannot be altered; and 3. The Records Management Policy attached hereto as Exhibit A is hereby approved and is considered the approved policy for the management of the City’s records, both paper and electronic; and 4. The Procedures for Managing Records attached hereto as Exhibit B are hereby approved and are considered the approved procedures for the management of paper and electronic Records; and 5. The Procedures for Searching, Storing, and Deleting Records in Laserfiche attached hereto as Exhibit C are hereby approved and are considered the approved procedures for the utilization of Laserfiche; and 6. The adopted Retention Schedule, Records Management Policy, Procedures for Managing Records, Procedures for Searching, Storing, and Deleting Records in Laserfiche, and Laserfiche technology collectively, establish the City of Burlingame’s Trusted System; and 7. Electronic Records stored in Laserfiche as deemed the City’s official Record, and the City Council approves the destruction of paper Records upon completion of quality control processes outlined in Exhibit B, “Procedures for Managing Records”; and 8. Electronic Records stored in Laserfiche can be deleted in adherence with the adopted Retention Schedule and with under the processes outlined in Exhibit C, “Procedures for Searching, Storing, and Deleting Records in Laserfiche; and 9. The City Clerk is hereby directed to establish training for the proper administration of the Records Retention Schedule, Records Management Policy, Procedures for Managing Records, and the Procedures for Searching, Storing and Deleting Records in Laserfiche for the storage of paper and electronic Records in the City of Burlingame. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A Peter Stevenson, Mayor I, Meaghan Hassel-Shearer, City Clerk of the City of Burlingame, certify that the foregoing Resolution was introduced at a regular meeting of the City Council held on the 6th day of October, 2025 and was adopted thereafter by the following vote: AYES: Brownrigg, Colson, Pappajohn, Stevenson, Thayer NOES: None ABSENT: None Meaghan Hassel-Shearer, City Clerk Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A Page 1 of 4 ADMINISTRATIVE PROCEDURES CITY OF BURLINGAME October 6, 2025 SUBJECT: Records Management Policy Section 1 - Purpose The purpose of this policy is to define the requirements for managing the records of the City of Burlingame (the “City”) in a cost effective and efficient manner, and in compliance with laws, regulations, and operational requirements. Section 2 - Policy It is the policy of the City that: 1. Records created or received in the course or conduct of the City’s business are assets of the City and are the exclusive property of the City. a. Records are subject to compliance with this policy, the associated Retention Schedule, and City procedures. b. Employees should have no expectation of privacy for any record or writing created during the performance of City business or while using a system for managing the City’s records and information. This includes records created or received on City-issued devices and records created or received on personal devices that relate to City business. 2. Employees are responsible for being responsive to requests for public records in compliance with the California Public Records Act. 3. Each department is responsible for maintaining its records in accordance with this policy. Records will be created, stored, and managed with the appropriate classification that enables their protection as well as necessary access for future use. 4. Records are to be retained in accordance with the City’s approved Retention Schedule. 5. The following are not necessary or convenient to the discharge of City duties and therefore should not be retained in the ordinary course of business: notes, drafts, non-City materials, reference materials, and duplicate copies. 6. Records, whether active or inactive, are to be appropriately stored and protected per the City of Burlingame’s Procedures for Managing Records. 7. Vital Records are to be identified by the City in a manner that establishes the priority of recovery of the records in a timely manner following a disaster. This process of identifying and inventorying Vital Records is outlined in the City’s Procedures for Managing Records. 8. Certain records that are deemed valuable for documenting the City’s history shall be designated as Historical Records and may be preserved beyond the Retention Schedule to ensure their ongoing availability and access. 9. Digital backups are duplicates of records retained elsewhere and are used for disaster recovery purposes. Thus, digital backups are not subject to the requirements of the Retention Schedule. 10. When records complete their retention period, regardless of their format, they shall be deleted, erased, or destroyed in compliance with Resolution 084-2018 and other applicable City procedures. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A Page 2 of 4 11. Maintenance of City records in a trusted electronic system, as identified by the City, is the preferred method of storage for official City records. Such electronic records should be indexed and full-text searchable. 12. Regardless of the format in which a communication is generated or received, including electronic mail (email), postal mail, or any other written format, the record must be retained in accordance with the City’s Records Retention Schedule. This includes communications relating to City business that are necessary or convenient to the discharge of City duties and that are sent or received on personal devices and personal accounts. Section 3 - Scope This policy shall apply to all City employees, temporary workers, and contractors of the City who have access to, or use of, City records. If there is a conflict between the requirements of this policy or the procedures implementing the policy on the one hand, and a department’s policy on the other hand, the more restrictive shall apply, unless compliance with the more restrictive requirement would conflict with State law. Section 4 - Definitions (in alphabetical order) 1. Classification: The systematic identification and arrangement of records and information into categories according to logically structured conventions, methods, and procedural rules. Also known as Indexing. 2. Inactive Record: Any record related to closed, completed, or concluded activities. Inactive records are no longer routinely referenced but must be retained in order to fulfill legal, operational, or other retention requirements. 3. Legal Hold: A procedure to cease destruction of certain records or information, even if the Records Retention Schedule mandates destruction, when litigation or government investigation related to those records is pending, imminent, or, in some cases, foreseeable. 4. Non-Record: Documents, studies, books, and pamphlets produced by outside agencies, and preliminary drafts not retained in the ordinary course of business. 5. Office of Record: The department that keeps the original or “record copy.” Usually it is the department that originates the record, unless the item is for a City Council meeting (then it is the City Clerk.) 6. Record: A “record” is a thing that constitutes an objective lasting indication of a writing, event, or other information, is in the custody of a City staff member, and is kept either (1) because a law requires it to be kept, or (2) because it is necessary or convenient to the discharge of the staff member’s duties. a. Active Record: A record needed to perform current operations, subject to frequent use and usually located on site. b. Historical Record: Records documenting the history and significant milestones of the City as per the Records Retention Schedule. c. Duplicate Record: Unofficial copies of documents kept only for convenience or reference, working papers, appointment logs, stocks of publications and processed documents, and library or museum material intended solely for reference or exhibition. Also, documents such as rough notes, calculations, or drafts assembled or created and used in the preparation or analysis of other documents. d. Vital Records: Records that are fundamental to the functioning of an organization and necessary to continue operations without delay under abnormal conditions or in the event of a disaster. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A Page 3 of 4 7. Retention Period: The length of time a record must be retained to fulfill its administrative, fiscal, and/or legal function. 8. Transitory Records: Records not retained in the ordinary course of business: preliminary drafts, notes, or interagency or intra-agency memoranda and records having only transitory value. Examples: telephone messages, meeting room reservation schedules, logs, source records entered into a computer system that qualifies as a “trusted system”, etc. Section 5 - Responsibility 1. Office of Record a. The group, department, or office in the organization responsible for ownership of specified records for the full duration of the Records Retention Period. b. The Office of Record is responsible for declaring records obsolete in accordance with the Records Retention Schedule. 2. City Attorney a. Determines when a Legal Hold is necessary for records and information relevant to litigation, an investigation, or an audit and informs affected Departments. b. Works with the City Clerk to approve the destruction of obsolete records that have completed their retention period. c. Works with the City Clerk to update the Records Retention Schedule as needed. 3. City Clerk a. Works with the City Attorney to approve the destruction of obsolete records that have completed their retention period on the City’s Records Retention Schedule. b. Designates the Office of Record for various classes of records. c. Serves as the City’s official Custodian of Records and administers and provides oversight to the City’s records and information management program. d. Will facilitate, in consultation with the City Attorney, the update of the Records Retention Schedule as needed. e. Has the authority to decide which records, media, and information constitute “Historic Records.” f. Orchestrates regularly scheduled records clean-up days. 4. Department Head a. May authorize the destruction of duplicate records under his or her control that are no longer required. b. Designates a records coordinator within the department. In the event that a records coordinator is not named, this responsibility will default to the Department Head. 5. Supervisor or Manager a. Is responsible, when an employee, temporary employee, or contractor leaves the City, for complying with the requirements of this policy and any supporting procedures for retaining and managing the records of the exiting employee, temporary employee, or contractor. 6. Department Records Coordinator a. Shall be designated by the Department Head. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A Page 4 of 4 b. Maintains records in accordance with this policy. c. Works with the City Clerk to schedule and oversee records clean-up days. d. Identify records to destroy based on the City’s Records Retention Schedule. e. Is responsible for implementing the procedures within their department. f. Serves as a resource to department staff on matters related to records retention. 7. Employee a. Complies with the California Public Records Act. b. Follows the City’s Records Retention Schedule. c. Seeks guidance from their Department Head to determine the applicability of this policy and which electronic records to retain. d. Complies with the Electronic Communication Usage Policy (Formerly Email and Internet Policy) e. Complies with the Communications Equipment Use Policy (Formerly Cell Phone and Device Use Policy) f. Routinely reviews electronic content and deletes content for which retention is not required. Section 6 - References 1. City of Burlingame Records Retention Schedule 2. City of Burlingame Procedures for Managing Records Who to Contact Regarding this Policy City Clerk Approval This policy is approved by Resolution Number XXX-2025. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 1 of 7 CITY OF BURLINGAME Procedures for Managing Records The following records management practices are applicable to both paper and electronic records. All of the principles applicable to the paper filing system are also important to an electronic filing system and should be applied the same way, except where noted otherwise. The procedures in this document are organized according to the records life cycle, pictured in the figure below. There are several periods in the life cycle of a record: • The active period varies according to the record but is generally characterized as a record that is used frequently during the course of business and should be readily accessible. • The inactive period is when the record’s regular use declines, but the record is still required to be held per the City’s Records Retention Schedule. • The destruction occurs at the end of a record’s life cycle on the Records Retention Schedule with an Authorized Destruction of Records. Figure 1. Records Life Cycle 1. Active Records Departments should create filing systems that are simple, easily accessible by all staff, used department- wide, and closely monitor items filed to ensure timely disposition. There are several different ways to establish a filing system: alphabetical, numerical, alphanumerical, chronological, or series driven. Regardless of what type of filing system a department uses, records must be kept in accordance with the City’s Records Retention Schedule. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 2 of 7 CITY OF BURLINGAME Procedures for Managing Records 1.1 Choosing Files to Maintain Maintaining filing systems can be very costly, requiring the purchase of filing supplies, space, and staff time to establish, manage, and retrieve materials. Consider the following when determining which records to maintain: Guiding Questions: • “Is this record listed on the City’s Records Retention Schedule?” All records maintained at the department level should be on the Records Retention Schedule. • “Does this record exist as an official electronic record1?” Records that exist electronically should not be printed for the sole purpose of maintaining a paper copy. • “Is my department the Office of Record?” To answer this question, check the Office of Record column on the Records Retention Schedule. If another department is responsible for maintaining a record, a department may choose to keep it for a short time in a working file, but there is no need to maintain duplicate files. 1.2 Selecting Storage Areas Guiding Questions: • “Is this file area accessible by staff and centrally located to the workgroup that will be using the files?” • “Is the room appropriate for records?” i.e., space for the cabinets to be opened and closed with ease, climate-controlled, well lit, free of critters, etc. • “Can the room or file cabinets be secured to permit the storage of sensitive or confidential records? Can the access be restricted to prevent removal and ensure orderly return?” 1.3 File Tracking It is also best practice to maintain an electronic inventory to catalogue all active records maintained in a department. The inventory should include the name and location of the file, its contents, and typically the file date. 1.4 Training Staff Ensure all personnel are trained to handle records securely, including adhering to records classification schemes and file plans, cleaning up records according to the Records Retention Schedule and other applicable law and policies, and protecting sensitive information. 1 Electronic records must be maintained in a trusted system in a non-alterable format. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 3 of 7 CITY OF BURLINGAME Procedures for Managing Records 2. Vital Records Definition: Vital Records are those records that are fundamental to the functioning of an organization and necessary to continue operations without delay under abnormal conditions or in the event of a disaster. 2.1 Identifying Vital Records Each department must analyze its own operations and records to determine what information is vital to the performance of its critical mission. It is important that management be selective about choosing which records are absolutely necessary to conduct emergency operations. Guiding Questions: • “What records are absolutely necessary to continue or resume operations tomorrow?” • “If you evacuate your office, taking nothing with you, would you still be able to perform your Essential Functions?” Consider that you may have no access to the City server or internet for up to 72 hours – do you have what you would need? General areas to be considered when selecting vital information include records required to: 2.1.1 Conduct Emergency Operations o Records that specify how the City and its departments will operate in an emergency or disaster. o Examples: utility systems maps, locations of emergency supplies, emergency operations plans and procedures, lines of succession and delegations of authority, lists and contact information of City personnel, checklists, manuals, standard operating procedures, continuity of operations plan, memoranda of understanding, and urgent programmatic information (these examples are not inclusive) 2.1.2 Reestablish Normal Governmental Functions o Records necessary to the continued operations of the City o Examples: municipal code, governing rules and procedures, and financial records (these examples are not inclusive) 2.1.3 Protect the Interests and Rights of the Organization and Individuals o Records that protect the legal and financial rights and interests o Examples: accounts receivable, identity records, payroll records, retirement records and Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 4 of 7 CITY OF BURLINGAME Procedures for Managing Records insurance records; any records relating to contracts, entitlement, leases, or obligations whose loss would pose a significant risk to the legal and financial rights of the City or persons directly affected by its actions; system documentation for any electronic information systems designated as records needed to protect rights (these examples are not inclusive) 2.2 Paper Records o A file containing Vital Records should be labeled distinctly from other records. An orange dot sticker should be affixed on the front of the file. o Vital Records should be stored together in designated filing drawers. The drawers must be prominently labeled by affixing a bright orange VITAL RECORDS sticker on the front outside of the drawer. o Confirm that the building or room in which records are stored is secure, equipped with fire and flood prevention and detection devices, and fitted with locks. o Protect paper records by always storing them in boxes or cabinets in cool, dry, secure locations, ideally away from windows, water pipes, or gas pipes, and at least 6” (15 cm) off the floor. o Inspect records storage areas regularly to ensure they are secure, safe, and free from any sign of deterioration, infestation, or damage. 2.3 Departmental Vital Records Inventory o Prepare and maintain an up-to-date Vital Records inventory. o Develop and implement a plan for protecting and accessing the vital records. o Update the inventory at least annually. o Update Vital Records, as needed, and remove and destroy outdated copies. o Send the Vital Records inventory to the City Clerk on an annual basis. 2.4 Training Staff Make sure all personnel are aware of and trained in records recovery emergency response procedures. 3. Inactive Records 3.1 Tips & Tricks: When you notice that a file has reached the end of its active life cycle and is closed but waiting to live out its retention period, identify it in some way (e.g., with a sticker, or crossing out the file label) so it is easy to pull out for inactive storage during records clean-up days. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 5 of 7 CITY OF BURLINGAME Procedures for Managing Records 3.2 Why Box Up Inactive Records? o Better utilization of space at City Hall and other City locations o More easily identify official records the City needs to keep in City buildings. 3.3 Boxing Files / Preparation of Records for Storage o Boxes should be filled but not packed so tightly that records cannot be easily removed or inserted into the box. o Boxes should be uniform, sized 15” x 10” x 12” o Boxes should be clearly labeled with the contents’ category and disposition information on the outside of the box, on both short ends so that it is always showing. e.g.: Box ID # City Council Agreements Records Terminate: January 1, 2012 – December 31, 2012 Destruction Date: December 31, 2022 o Box together files of a similar disposition category. o Do not co-mingle permanent records and non-permanent records in the same box. o A list of box contents should be taped to the underside of the box lid. The department should maintain an inventory of inactive records that includes at a minimum the following information:  Subject  File Data  Retention Category  Reference # (if applicable)  Box ID #  Destruction Date o A copy of the inventory of inactive records should be sent to the City Clerk’s Office with regular updates. 3.4 For Permanent Records: o Remove rubber bands and paper clips from all documents. o Replace paper clips with staples. o Check to see that papers are in correct chronological order within the file. o Use acid-free boxes. 3.5 Imaging of Records: 3.5.1 The California Government Code permits the City to destroy some original documents after they have been scanned in accordance with the policies and procedures set forth Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 6 of 7 CITY OF BURLINGAME Procedures for Managing Records in the Government Code whereby the electronic record can be considered the official record. 3.5.2 Before embarking on a major project to scan records, staff should check with the City Clerk’s Office. The City Clerk’s Office will evaluate your current records and can assist you in developing a plan to convert existing documents into electronic files and migrate the files to the City’s current Electronic Document Management System (EDMS). Staff should not scan and store records on local or internal drives as these do not provide the same searching, storage, or security features as an EDMS. Records that should be imaged may include:  Those used by many departments or many people in the same department;  Permanent records, particularly those that are accessed regularly;  Records that have a long retention period;  Records that start and end in an electronic format;  Records that are frequently requested by the public;  Record series that are voluminous, making onsite storage impossible, but that are accessed often and would involve offsite storage and retrieval fees. 4. Destruction of Records 4.1 Request Records Destruction o No records shall be destroyed until they have met the minimum retention period listed on the City of Burlingame’s Records Retention Schedule. In addition, any destruction of records requires department head or designee, City Attorney, and City Clerk approval. For more information, refer to the City of Burlingame’s Records Management Policy. o Staff can request authorization to destroy records that are at the end of their retention schedule by completing the City’s Destruction Form. o In cases where there is no schedule for a particular record series, contact the City Clerk’s Office for assistance. 4.2 Records Decision Matrix To determine whether a record should be destroyed or not, please refer to Figure 2. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 7 of 7 CITY OF BURLINGAME Procedures for Managing Records What constitutes a “confidential” or “sensitive” document? An individual’s first name or first initial and last name in combination with any of the following: • Social Security Number • Driver’s license number or California identification number • Account number, credit or debit card number, in combination with any required security code, access code, password, or signature • Medical information • Health insurance information • A user name and email address • Check copies Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 1 of 4 CITY OF BURLINGAME Procedures for Searching, Storing, and Deleting Records in Laserfiche Scope These procedures apply to employees, temporary workers, and contractors who do business on behalf of the City of Burlingame. References • Records Retention Schedule • Records Management Policy • Procedures for Managing Records 1. Procedures for Searching in Laserfiche Purpose The purpose of these procedures is to provide the steps for searching in the City’s Records Repository. These procedures define the steps taken to search for records in Laserfiche. Common Searching in Laserfiche • Log into Laserfiche with username and password and navigate to the City’s Records Repository. • Use the search bar at the top of the page. Laserfiche is automatically set to “Common” search. • Type in a search term and click the magnifying glass icon. • The search results will appear in the middle of your screen. The “Context Hits” pane on the bottom of the screen will show where the search term appears in that particular document. • Either click open the document in the middle of the screen or double click the page result in the “Context Hits” pane on the bottom of the screen to take you to a specific page. • If you double click the specific page of a document in the “Context Hits” pane, you will see the search term highlighted in color. • Use the “Find in Document” icon in the top left of the document to move through where the search term is found. Advanced Searching in Laserfiche • For advanced searching, click “Advanced” to the right of the search bar. An “Advanced Search” window will appear. • A “Common” search bar will automatically appear for you to type in a search term. • Use the “Search Types” drop-down menu to select the advanced searching tool you’d like to use. • Here you can search by “Field”, “Name”, “Within Folder”, etc. to narrow your search down. If you choose to search by “Field” you can search for a certain template and its metadata. • Once you have selected the criteria for your advanced search, click “Search”. • The search results will appear in the middle of your screen. The “Context Hits” pane on the bottom of the screen will show where the search term appears in that particular document. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 2 of 4 CITY OF BURLINGAME Procedures for Searching, Storing, and Deleting Records in Laserfiche • Either click open the document in the middle of the screen or double click the page results in the “Context Hits” pane on the bottom of the screen to take you to a specific page. • If you double click the specific page of a document in the “Context Hits” pane, you will see the search term highlighted in color. • Use the “Find in Document” icon in the top left of the document to move through where the search term is found. 2. Procedures for Scanning, Uploading, and Importing to Laserfiche Purpose The purpose of these procedures is to provide the steps for adding documents to the City’s Records Repository. These procedures define the steps taken to scan, import and upload records into Laserfiche. Scanning Paper Directly to Laserfiche • Prepare documents (i.e. remove paperclips and staples, make sure pages are facing the same way, etc.) • Log into Laserfiche and navigate to the Repository. • Choose your department’s folder which you will be scanning into. • Click on the scanning icon in the upper left corner. A new window for scanning will open. • Place the pages to be scanned in the scanner. Scan one document type at a time (e.g. Resolutions, Ordinances, Minutes, etc.). • Click the “Start Scanning” at the top middle of the screen. Pages will be pulled through the scanner. Once scanned in, the pages will show up as thumbnails on your computer screen. • Count the pages on the screen to ensure all pages came through. Delete the pages that are blank. • If multiple documents are scanned in at the same time, separate the documents by right clicking the first page of the document you want to separate out and click “Separate”. • Give the document a name in the “Default Document Name:” field on the top right of the screen. • In the “Document Properties” pane, select a template from the “Template” drop-down menu. • Index the document by filling in the metadata. • Once all indexing is complete, click “Store” on the bottom of the indexing pane. The document will be moved into is respective folder. Note: If you scanned in multiple documents at one time, make sure all indexing fields are complete for each document before moving to the next document. Importing to Laserfiche • Click the “Import” icon on the top right of the screen. • The “Import File” screen will appear. Click “Browse” and find the document to be imported. • Click “Open” to import the document to Laserfiche and click “OK” in the “Import File” window. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 3 of 4 CITY OF BURLINGAME Procedures for Searching, Storing, and Deleting Records in Laserfiche • A new window will appear. Click the “Fields” tab, and choose a template from the drop-down menu. • Fill out the metadata fields and click “Import”. The document will then be sent to its assigned folder. Drag and Drop to Laserfiche • Open your department’s folder in Laserfiche. • Open location of document you wish to save to Laserfiche. • To drag a document to your department’s folder for indexing, left click and hold down on the mouse while dragging the document over into the chosen folder. Release your hold on the left click of the mouse once the document is over the chosen folder. • After the document has been uploaded, a new window will pop up. Click the “Fields” tab and choose a template from the drop-down menu. • Fill out the metadata fields and click “Import”. The document will then be sent to its assigned folder. 3. Procedures for Deletion of Records from Laserfiche Purpose The purpose of these procedures is to provide the steps to completed in destroying “official” electronic City records stored in the City’s Records Repository once their retention period has passed. Records that reside outside of the Laserfiche Repository are not addressed in this procedure. Procedures Annually, the City Clerk will initiate the process to delete obsolete electronic official records from Laserfiche. • The City Clerk contacts the City Attorney requesting information regarding any active or potential legal action(s) against the City to determine which category(s) of records may be relevant to the action and therefore should be preserved and placed on a Legal Hold. • The City Clerk searches for the relevant records, suspends their destruction date, and annotates the records to indicate that they are on a Legal Hold. • The City Clerk prepares a Records Notification containing a list of records eligible for deletion based on the Retention Schedule requirements. The notification specifies the date on which deletion of these records is scheduled to occur. • The City Clerk sends the Records Notification to departments regarding the required deletion of obsolete electronic records in Laserfiche. Included in the notification is a link to the Retention Schedule and who to call with questions. The Records Notification is to include the following: o Record categories that shall not be deleted due to their relevance in a legal action. o The list of records eligible for deletion according to the City’s Retention Schedule. o The date on which the obsolete records will be deleted. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A VERSION 1 DATED: 10.06.2025 Page 4 of 4 CITY OF BURLINGAME Procedures for Searching, Storing, and Deleting Records in Laserfiche • Departments are to notify the City Clerk’s Office within the specified timeframe on the Records Notification if any of the records to be deleted should be exempt from deletion and provide justification. In addition, departments are to notify the City Clerk if any of the documents on the list should be considered as having historical value. • The City Clerk prepares a Records Destruction Form for each department with records that have been approved by the Departments and Retention Schedule for deletion from Laserfiche. This form is to be approved by the Department Head, the City Clerk, and the City Attorney prior to records being deleted. • The City Clerk maintains the documentation of compliance with these guidelines in accordance with the Retention Schedule. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A Updated 11/24/20 laserfiche.com 1 Laserfiche Cloud Security and Compliance Laserfiche Cloud provides a scalable and secure environment for organizations across industries to automate processes, centralize content and address compliance requirements. Security Advanced data protection for your content with Laserfiche Cloud's robust security, administrative controls and advanced audit trail capabilities. Tenant isolation - Laserfiche Cloud provides tenant isolation by logically segregating customer data between accounts. Customers do not have access to any other customer’s data or services. Encryption in transit - All data sent between Laserfiche customers and applications is encrypted in transit using Transport Layer Security (TLS) with Perfect Forward Secrecy (PFS). Encryption at rest - Data-at-rest in Laserfiche Cloud is protected using industry-standard AES- 256 encryption. Vulnerability scanning - Laserfiche performs a vulnerability scan of backend servers that run in the Laserfiche Cloud hosting environment. Penetration testing - Laserfiche engages third-party vendors to conduct external penetration testing of the Laserfiche Cloud system. Intrusion detection - Laserfiche Cloud utilizes host-based intrusion detection systems to reduce the risk of data theft by individuals or organizations attempting to gain unauthorized access. Firewalls - Laserfiche Cloud's firewall configuration settings are regularly revi ewed based on industry standards. Fine-grained access control - Administrators can use access rights to limit and control access to individual documents and objects. For example, security tags restrict access to documents on a document-by-document basis. Access rights - Administrators can configure access rights and privileges to limit actions that users can perform across the repository based upon role assignments or group memberships. Multi-factor authentication - Multi-factor authentication can be enabled for a Laserfiche Cloud user account. Single sign-on - Laserfiche Cloud supports single sign-on with Active Directory Federation Services (ADFS) and Security Assertion Markup Language (SAML). Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A Updated 11/24/20 laserfiche.com 2 Password policies - Laserfiche Cloud supports industry-standard password controls, such as password minimum length, complexity and history. Repository audit log - The Laserfiche Cloud repository audit log includes details of user actions, including viewing, modifying, creating and deleting documents, and similar operations on metadata and other repository objects. Repository application auditing - Laserfiche Cloud supports auditing of both access to, and modification of, objects in repositories. Compliance With Laserfiche, governance and compliance can be a seamless part of how your organization operates. SOC 2 Type 2 - This report details the controls for Laserfiche Cloud related to the criteria for the security, availability, and confidentiality principles set forth in TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy AICPA, Trust Services Criteria). Privacy regulatory compliance - Laserfiche addresses privacy regulatory requirements in Laserfiche Cloud and as part of our business operations. This includes the California Consumer Privacy Act (CCPA) as well as leading international privacy standards such as the General Data Privacy Regulation (GDPR) of the European Economic Area. For more information, see: https://www.laserfiche.com/legal/privacy/. International data transfers and EU/Swiss/U.S. Privacy Shield Framework comp liance - Laserfiche complies with the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use and retention of personal data transferred from the European Union to the United States. Laserfiche has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. For more information, see: https://www.laserfiche.com/legal/privacy/#privacy-shield-framework-compliance. Data processing agreement - Laserfiche's Cloud Subscription Agreement incorporates, by reference, a standard data processing agreement for customers with operations in the European Economic Area. WORM Compliance for SEC 17a-4 - Laserfiche Vault is a solution package of services and cloud- based features that supports stringent non-alterable record archival requirements such as WORM (write once, read many) compliance required by SEC Rule 17a-4 for broker dealers. Beyond financial services, Laserfiche Vault’s strict compliance mode can also be applied to support rigorous records management practices for electronically stored information (ESI) requiring prevention of any unauthorized alternations or deletions of digital records. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A Updated 11/24/20 laserfiche.com 3 Voluntary Product Accessibility Section 508 Compliance - Laserfiche has published VPATs available for Web Client, Public Portal and Federated Search. Reliability Laserfiche's preventative, detective and corrective controls reduce risk while increasing uptime and availability. Business continuity and disaster recovery programs - Laserfiche Cloud SaaS services are hosted in multiple regions. Regions consist of multiple availability zones that are comprised of multiple data centers. These data centers are housed in separate facilities with redundant power, networking and connectivity. Laserfiche Cloud service levels - Laserfiche publishes a status page that displays the current status of Laserfiche Cloud applications, maintenance notices and outage reports. Automated backups - Laserfiche Cloud customer data is backed up multiple times per day. Backups are retained for defined periods with support for point in time recovery. All backup data is encrypted. Backup data is replicated and stored in geographically separate data centers. Backup and restoration is tested on at least a quarterly basis. Records Management Easily manage the lifecycle of documents and get notified when documents are ready for disposition. Auto-filing and classification - Auto-file newly created records according to industry regulations and corporate policies, and automatically classify and apply disposition schedules and other retention policies to incoming records. Notifications - Automatically notify records managers when a record needs to be archived or destroyed based on the record type. Deployment across devices - Enforce records management policies across all devices including mobile phones, tablets, laptops and desktops by storing only one copy of a record in a centralized repository. Disposition schedules - Automatically classify and apply disposition schedules and other retention policies to incoming records. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A Updated 11/24/20 laserfiche.com 4 Record transparency - Provide business units with multiple ways to view records without impacting the overall file plan and allow users who are not records managers to access documents without exposing the records management design. Records management search filters - Allow records managers to search for records based on retention schedules or cut-off dates. Centralized location for records - View the record timeline, modify properties of records, record folders, and record series, and perform record actions such as cutoff or final disposition, all from a single location. Docusign Envelope ID: 9EC87010-609C-4D21-8464-2F4DD085380A