
PORT COMMISSION AUDIT COMMITTEE MEETING MINUTES
THURSDAY, DECEMBER 8, 2022
developing and maintaining an incident response capability to prepare, detect, and quickly respond
to an attack;
• the scope of this audit covered the Enterprise network; managed by the Port of Seattle’s (Port’s)
Information and Communication Technology (ICT) department, and the Access Control System
(ACS) network, Industrial Control System (ICS) network, and OpsLan network; managed by the
Port’s Aviation Maintenance (AV/M) department;
• Security Incident Response - part of the 18 critical Center for Internet Security (CIS) controls;
• CIS security controls are a prioritized set of best practices created to protect organizations and
data from cyberattack vectors;
• a comprehensive cybersecurity program includes protections, detections, response, and recovery
capabilities;
• the primary goal of incident response is to identify threats on the enterprise, respond to them
before they can spread, and remediate them before they can cause harm;
• the audit focused on the overall design and effectiveness of the security incident process to assure
the protection of critical information and systems; and
• based on the results of our audit, the IT Audit staff concluded that the security incident response
processes for the Enterprise network and the OpsLan, ACS, and ICS networks, were operating
effectively.
Members of the Committee thanked the Internal Audit Department for its review.
10. Avis Budget Car Rental LLC (See Report)
Presenters:
Glenn Fernandes, Director, Internal Audit
Dan Chase, Manager, Internal Audit
The presentation addressed:
• the Port’s agreement for a Consolidated Rental Car Facility Lease Agreement with Avis in July
2008;
• the agreement’s requirement of a Minimum Annual Guarantee equal to 85 percent of the total paid
to the Port for the previous Agreement Year;
• the requirement of the agreement of a daily Customer Facility Charge (CFC) of $6.00 on vehicle
rental transactions - effective January 1, 2021, the CFC increased to $6.50;
• approximately $38 million was paid to the Port during the audit period (June 2018 - May 2021);
• Internal Audit identified approximately $2,645 of CFCs not billed to the customer and subsequently
remitted to the Port;
• the Agreement requires the operator to bill a daily CFC on vehicle rental transactions, and to remit
the full amount to the Port, regardless of whether or not the full amount is actually collected;
• Internal Audit also identified $109,835.50 of CFCs that appeared to be overcharged to the
customers;
• The Audit recommendation to collect $2,645.60 plus any accrued interest and/or penalties and for
Aviation Commercial Management to request an explanation regarding what caused the overbilling
of $109,835.50 to determine whether systems and processes need to be adjusted.
Members of the Committee and staff discussed if there are any accountability measures in place with Avis.
Geoffrey Foster, Aviation Property Manager, provided management’s response, noting that Aviation