Page 289

EAP Policy Manual FFY24 Chapter 15 Energy Vendors Page 17 Energy vendors can submit any changes in their registration information (e.g., change of business name, contact information, change in payment information, mergers or buyouts, etc.) to their local EAP Service Provider. The Service Provider will inform Commerce by emailing updated information to eheat.doc@state.mn.us. To change banking information, energy vendors must contact MMB. Implement and Maintain eHEAT Security Policies Energy vendors are required to have processes in place to manage eHEAT access to ensure only current, authorized users have eHEAT access. Users must only have access to eHEAT features necessary for their work assignments. Off-Boarding Process Energy vendors are required to immediately deactivate users when needed. If the energy vendor’s eHEAT Administrator needs to be deactivated, send email to eheat.doc@state.mn.us. Energy vendors must have off-boarding (staff leaving employment) procedures in place, for example an off-boarding check-list, that includes deactivating eHEAT access. eHEAT Access Check The energy vendor eHEAT Security Administrator should conduct routine eHEAT access checks to ensure only the appropriate users are active in eHEAT. There are two user statuses in eHEAT: • Active: user has eHEAT access. • Deactivated: user does not have current eHEAT access due to inactivity for over 60 days or because they were deactivated by an eHEAT Administrator. User needs to be reactivated by an eHEAT Administrator to regain access. eHEAT continues to list every user that had eHEAT access. The energy vendor eHEAT Security Administrator’s authorization includes: • Limiting access to authorized personnel only. • Ensuring each user is assigned a unique user ID. • Ensuring email addresses associated with each user ID are current. • Creating new user groups that combine features in eHEAT for staff positions. • Editing existing users’ user groups as new features are assigned or no longer performed. • Immediately deactivating eHEAT administrators and users: • Upon permanently leaving a position requiring eHEAT access. • Upon administrative leave or suspension. • When no longer employed by the energy vendor.