HomeMy WebLinkAbout2020-01-27-minutes-it-study-session2020‐01‐27 Minutes 1 Information Technology
Commissioners’ Minutes
Kittitas County, Washington
Commissioners’ Conference Room
Regular Meeting
Monday 11:00 AM January 27, 2020
Board members present: Chair Brett Wachsmith, Vice‐Chair Laura Osiadacz, Commissioner Cory Wright
Others: IT Director Jim Goeben
Regular Meeting Information Technology
Meeting called to order at 11:00 AM.
Updates to Technology Policy 13 ‐ Mobile Devices and Technology Policy 3 Purchasing and Inventory
of Technology for Mobile Device Purchasing and Management Software
There was discussion about the security risks of mobile devices that do not have controls to protect
sensitive data stored on them, to restrict access to authorized people, and to enforce county policies.
The board voted 3‐0 to adopt the proposed changes to Technology Policy 13.
Updates to Technology Policy 11 ‐ Websites
There was discussion about the policy changes needed to allow the 3rd party design, maintenance, and
hosting of the KVEC and Kittitas County Fair websites. The board voted 3‐0 to adopt the proposed
changes to Technology Policy 11.
Microsoft Office 365 and OneDrive
Mr. Goeben updated the board on the Microsoft Enterprise Agreement (EA) implementation and
discussed the use of OneDrive and Microsoft web apps; if either is approved by a department head or
elected official, access to both must be granted. There was discussion about funding of additional EA
licenses and the board directed IT to fund additional licenses.
Other Business
Mr. Goeben updated the board that Jesse Potts, GIS Analyst, started Tuesday, January 21.
Meeting adjourned at 11:30 AM.
Kittitas County Commissioners
Information Technology Director Kittitas County, Washington
_______________________________________ _______________________________________
Jim Goeben, IT Director Brett Wachsmith, Chair
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
MEMO
To: Board of County Commissioners
From: Jim Goeben, IT Director
Date: January 14, 2020
Subject: Proposed changes to Technology Policy 11 ‐ Websites
The board has authorized budget for the KVEC to use a 3rd party to design, host, and maintain the KVEC
and Kittitas County Fair websites. Technology Policy 11 – Websites needs to be revised to allow this.
Below is a DRAFT of the proposed change.
Technology Policy 11 - Websites
Kittitas County Technology Policy Manual
11. Websites
11.1 Summary
Kittitas County maintains a Web presence to facilitate communication to the public of its
services. The BOCC is responsible for the county online presence in all forms. KCIT is
responsible for the design and administration of the content of the county’s online presence.
11.2 References
1. CAMAS – ENSS Instructions
2. CAMAS – IT Service Request
3. CAMAS – Press Release
4. KCIT User Wiki – Codifying County Ordinances
5. KCIT User Wiki – Email Notification Subscription Service (ENSS)
6. KCIT User Wiki – Emergency Operations Web Site
7. KCIT User Wiki – New Application Development
8. KCIT User Wiki – Web Site Review by DH/EOs (including SiteCheck)
9. Technology Policy 1 – Enforcement
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
11.3 Definitions
11.3.1 Content
What is presented, e.g., text, images, video, audio, and downloadable files.
11.3.2 Design
How content is presented, e.g., the color, layout, user interface, and overall look and "feel".
11.3.3 Online presence
Web sites, user names, and email addresses.
11.4 Policy
11.4.1 Roles
11.4.1.1 BOCC
The Board of County Commissioners (BOCC) is responsible for the county’s online presence in
all forms. Only authorized persons may create, use, or promote any online presence intended to
that represents Kittitas County or a division thereof.
11.4.1.2 ITC
The Information Technology Committee (ITC) operates as an advisory board to the BOCC and is
under its direction. The ITC oversees the county's web sites and ensures adherence to these
policies.
11.4.1.3 Webmaster
The IT Web Developer acts as webmaster for all county Web sites and takes direction from the
IT Director. The webmaster is responsible for overseeing and prioritizing development of the
web sites and its supporting systems, and for the security of the web site. All content published
to the county’s Web sites will be uploaded by or in conjunction with the Webmaster.
The Webmaster, under the direction of the IT Director, sets the county style guide and design
elements of the county’s Internet presence.
11.4.1.4 DH/EOs
Each Department Head/Elected Official (DH/EO) is responsible for the content within their area
of operation as defined by this policy. The DH/EO or designee must approve all content and
ensure it complies with these policies before it is put on their Web page.
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
11.4.2 The public site
http://www.co.kittitas.wa.us is the county’s official web site. All public Web content will be
placed within the co.kittitas.wa.us domain, except as provided within this policy. The mission of
the Web site is to support DH/EO’s in providing services and information to the public in a
highly usable, accessible, consistent, and intuitive manner.
11.4.2.1 Home page
The county home page is the portal to all county Web sites. It shall contain links to areas of the
site such as departments, services, general county information, important topics, events, and
employment.
11.4.2.2 Department pages
DH/EOs are responsible for providing information for their department Web page. DH/EO sites
shall be accessed as "http://www.co.kittitas.wa.us/[department name]".
11.4.2.3 County code
The Kittitas County Code is published on the public Web site. Updates to the code are made by
the Webmaster as directed by the BOCC in county resolution or ordinance. See KCIT User Wiki
– Codifying County Ordinances
11.4.2.4 Emergency operations
When an emergency is declared by the federal government, State of Washington, or a Kittitas
County local government, and for the duration of the activation of the Emergency Operations
Center (EOC), IT will provide web development services to the EOC to facilitate communication
between the Public Information Officer (PIO) and the public. See KCIT User Wiki – Emergency
Operations Web Site for more information.
1. As soon as possible after a declaration of emergency is signed, the Incident Commander or PIO
will contact the webmaster or IT Director and outline EOC needs and expectations.
2. Content must be submitted to the webmaster by the PIO.
3. Content must meet all content and page requirements outlined in this policy; however, it does
not need to be pre‐approved by the ITC.
4. Press releases sent by the PIO through the CAMAS Press Release feature will be posted on the
emergency page.
11.4.2.5 Content requirements
All content on the site must meet the following requirements; it must be:
1. In support of the public Web site mission.
2. Within the purview of the department adding the content to their own department site.
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
3. Information the public would expect to see on that department’s site.
4. Free and publicly available through other means, i.e., not the original and therefore not the
primary copy of a public record.
5. Void of broken links and out‐of‐date, irrelevant, or inappropriate content.
6. In compliance with all laws, i.e., copyright, privacy, and intellectual property.
7. Ready for public presentation, i.e., complete, accurate, void of spelling and grammar mistakes,
and formatted generally as intended to be presented.
8. If photo, imagery, audio, and video content, substantive and provide a necessary and significant
addition to the text content.
9. If downloadable print media:
1. PDF file format, made from the original electronic document when available
2. Void of viruses or malware
3. If a county document, include authoritative source information including, at a minimum,
the county name, the department name, and a published date. It should also include the
county logo, author’s name, and credited source information.
4. If a republished document, include the original publisher’s author information. The
DH/EO or designee must obtain the author’s permission to reprint. If available on the
publisher’s site and the site falls within this policies hyperlinking provisions, the link will
be to the publisher’s page and not to a copy on the county’s site.
5. Include metadata; at a minimum, the title of the document, the county name, and the
department name.
6. If a form, contain PDF form fields with Extended Features enabled.
10. Audio files must be MP3, SRS, or FTR format. A link to the player will may be provided.
11. Video files must be in WMV, MOV, AVI, or FLV format. A link to the player will may be provided.
Embedded video will be in FLV format.
12. Photographs taken by county employees in their capacity as county employees may be used on
the public web site with the following exceptions:
1. Photographs that include a person who appears to be a minor and is recognizable are
prohibited.
2. Photographs that include a person in a public venue, who does not appear to be a
minor, are permitted without obtaining the person's permission except where:
1. The image would be highly offensive to a reasonable person; and
2. The image is not of legitimate concern to the public.
3. Photographs of people in private venues are prohibited.
13. Photographs not taken by county employees require a license agreement (for stock
photography) or a signed release allowing use (for professional or amateur photographers).
Content must:
1. Not provide direct email addresses, except for those of elected officials.
2. Not be for commercial, non‐Kittitas County purposes, or personal or private gain.
3. Not link or provide a URL to web sites or content not on its own site except where the page or
content is controlled by one of the following:
1. Agencies over which Kittitas County has
1. appointing authority
2. a pass through contract
3. a contract to provide services
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
4. an agreement to provide or receive funding
2. Other US government or United Nations controlled web sites
3. Providers of file format reader software of county web published content, i.e., Adobe
Acrobat Reader, FTR Player, etc.
4. Providers with which Kittitas County has an agreement to provide a service
5. Organizations and associations of which Kittitas County has requested and accepted
membership
4. IT shall have the authority to deny linking to any site that is deemed not secure or which may
pose a security risk to the Kittitas County IT systems or users.
5. Not be a place‐holder for future content, such as “under construction” or “coming soon”.
6. Not link to, provide a URL for, or direct users to payment processing vendors unless they have
been approved by the Treasurer and legal counsel.
11.4.2.6 Page requirements
1. All Web pages will adhere to the co.kittitas.wa.us Style Guide.
2. Each department home page will include the department’s contact information.
3. Any page collecting information will describe how the information will be used and maintained.
4. No page will collect or store financial or other sensitive information. Payments will not be
accepted directly through co.kittitas.wa.us.
5. Pages will be generally accessible to the public.
6. Pages will protect against unauthorized access to data and the network.
11.4.2.7 Providing content
1. New content will be submitted by the DH/EO or designee via a CAMAS – IT Service Request to
the ITC for approval.
2. Updates or additions to current content will be submitted by the DH/EO or designee via a
CAMAS – IT Service Request.
11.4.3 KVEC sites
11.4.3.1 The KVEC site
http://www.kittitasvalleyeventcenter.com is the URL of the official KVEC Web site. The Event
Center Director, under the direction of the BOCC, is responsible for its design, content, and
hosting by a 3rd party. The KVEC site will follow all publishing policies set forth in this
document; however, exception is granted to allow 3rd party hosting, a distinctive design,
hyperlinks to 3rd party event Web sites, and links to the KVEC Facebook and Twitter sites. If
created, these social Social media sites must include prominent language directing users to the
official Web site.
IT will have administrative access to all 3rd party accounts.
11.4.3.2 The fair site
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
http://www.kittitascountyfair.com is the URL of the official Kittitas County Fair Web site. The
Event Center Director, as advised by the Kittitas County Fair Board of Directors, and under the
direction of the BOCC, is responsible for its design, content, and hosting by a 3rd party. The fair
site will follow all publishing policies set forth in this document; however, exception is granted
to allow 3rd party hosting, a distinctive design, information about Kittitas County Fair sponsors,
a hyperlink to each sponsor’s official Web site, and links to the Kittitas County Fair Facebook
and Twitter sites. If created, these sSocial media sites must include prominent language directing
users to the official Web site.
IT will have administrative access to all 3rd party accounts.
11.4.4 The county’s intranet
CAMAS is the county’s intranet and is not accessible to the public. It is accessed inside the
network through http://CAMAS and outside the network through by employees who have
authenticated to the county network. The mission of the county’s intranet is to provide
information and applications to increase productivity and efficiencies in and between employees
and groups of employees.
11.4.4.1 Department pages
Each department will have a CAMAS home page. Each employee’s Internet browser home page
will be their department’s CAMAS home page. The DH/EO is responsible for providing content
for their CAMAS pages.
11.4.4.2 Access
Employees may access CAMAS through the Internet at https://camas-net.co.kittitas.wa.us.
Security is hierarchically controlled; pages and applications may display content viewable only
by department employees, content restricted to only certain employees, or content for use by all
county employees. Pages and applications with configurable security will be controlled through
Multipass by DH/EO or designee. Utilization of this system does not supersede management’s
right to set work hours and location.
11.4.4.3 Applications
For development of new applications on CAMAS, see KCIT User Wiki – New Application
Development.
11.4.5 Web maintenance
Except as provided elsewhere in this policy, tThe IT Applications division will perform all web
site maintenance which includes editing and creating pages and application development for all
county web sites. The webmaster will be responsible for scheduling web maintenance. Higher
priority will be given to:
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
1. Increasing efficiencies of county employees
2. Providing service to the public
3. Providing time‐sensitive information
Web maintenance requests must be submitted in electronic format through a CAMAS – IT
Service Request. Minor edits will be made generally within 2 business days. Urgent requests
may be accommodated as priorities permit. Major edits will be prioritized and scheduled.
A content management system may be employed, at the webmaster’s discretion, to allow direct
content management by DH/EO or their designee.
11.4.6 Content Review
11.4.6.1 Annual review
An annual review of a department’s web sites must be conducted by the DH/EO to ensure
accuracy and awareness of content. See KCIT User Wiki – Web Site Review by DH/EOs
(including SiteCheck). The DH/EO must complete the review within 30 days of notice. The
Lower District, Upper District, and Superior Court Administrators and the Clerk of the Board of
County Commissioners may perform the review on behalf of their elected officials.
11.4.6.2 Broken links and misspellings
DH/EOs are responsible for all content on their pages. Broken links and misspellings must be
corrected within 10 days of notice. See KCIT User Wiki – Web Site Review by DH/EOs
(including SiteImprove).
11.4.7 Webmaster email
The purpose of this policy is to direct the processing of email sent to
webmaster@co.kittitas.wa.us. The Web site will clearly note that the webmaster email is:
1. To be used to report problems encountered with the functionality of the Web site.
2. To suggest changes and enhancements.
3. Not intended for public disclosure requests. Public disclosure requests must be submitted to the
department maintaining the records.
4. Monitored at least once a week.
5. Handled in the following manner:
1. Junk email ‐ Unsolicited email of a non‐business nature that does not relate to county
operations will be deleted with no reply.
2. Unsolicited email ‐ Product, service, or general information of a nature related to county
operations will be forwarded to the appropriate DH/EO. No further action will be taken
by the webmaster.
3. Direct requests for non‐county information ‐ Requests for information not relating to
county operations will be responded to by the webmaster. If an answer or referral for
an answer can be determined within 5 minutes, it will be replied. If an answer or referral
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
cannot be determined in 5 minutes, a reply stating the question/inquiry does not fall
within county operation will be sent along with links to community resources that may
provide assistance.
4. Direct requests for county information ‐ All requests for county information will be
forwarded to the appropriate DH/EO copying the requestor. No further action will be
taken by the webmaster.
5. Web site information – Email regarding the operation of the web site will be handled
and answered by the webmaster within one week.
11.4.7.1 DH/EO
Each DH/EO will respond in a timely manner to email forwarded to them by the webmaster. In
the event an email is forwarded incorrectly, the DH/EO will immediately forward the email to
the correct office and copy the webmaster and the requester.
11.4.8 Email notification subscription service (ENSS)
The county ENSS is an email signup list the public can join to receive emails on specific topics.
Each department may make lists to which the public can sign up. Authorized employees may
send email to the list using the CAMAS – Email Notification Service. See KCIT User Wiki –
Email Notification Subscription Service (ENSS) for more information. DH/EOs will request
creation of new subscription lists via a CAMAS – IT Service Request for ITC approval.
Each email must:
1. Not violate county policies or laws governing email.
2. Be sent by the DH/EO or designee from the department email account or the DH/EO account.
3. Hide recipient email addresses from other recipients.
4. Include the approved anti‐spam notice. See CAMAS – ENSS Instructions.
11.4.8.1 ENSS functional requirements
The ENSS service must:
1. Allow public users to manage their subscription online.
2. Provide ability to reset forgotten passwords via email to the email address registered.
3. Post a privacy notice in the subscription area on the public Web site.
11.4.9 Vendor provided Web pages
Vendors with which Kittitas County has an agreement to provide a service may publish web
content on behalf of the county if:
1. The Kittitas County ITC has authorized the publication
2. The content is not branded as being a Kittitas County website; it must be clear to the user the
website belongs to the provider and not Kittitas County
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
1. The vendor website may not mimic the design of the co.kittitas.wa.us website
2. The county logo, if used must be below or to the right of the vendor’s logo
11.4.10 Enforcement
In addition to Technology Policy 1 – Enforcement, violations or failure to comply with this
policy may result in removal of the DH/EOs website or suspension of application development
upon notice by IT.
11.5 Responsibilities
11.5.1 DH/EO
1. Ensure all web content submitted meets content requirements.
2. Allow for 2 business day turnaround time on all non‐emergency requests.
3. Submit all requests in electronic format through IT service request.
4. Perform semiannual reviews of sites within 30 days of notice.
5. Monitor and correct broken links and misspellings.
6. Ensure all downloadable documents are virus‐free, in the correct file format, contain
authoritative source information, and contain appropriate metadata.
7. Respond in a timely manner to public email forwarded by the webmaster.
8. Request email notification lists in a service request to be approved by the ITC.
9. Only send ENSS email through department or DH/EO email address.
10. Ensure ENSS recipients email addresses are not seen by other recipients.
11. Ensure the anti‐spam notice is included in any ENSS email.
11.5.2 Information Technology
1. Publish county code as directed by BOCC resolutions.
2. Provide web development to the PIO during a declaration of emergency.
3. Ensure all pages meet page requirements and style guidelines.
4. Perform all web site maintenance or provide a mechanism for secure management by DH/EO or
designee.
5. Prioritize web maintenance and development.
6. Update the web sites as requested by the DH/EO and as approved by the ITC or policy.
7. Process all webmaster email in the manner defined above.
8. Provide ENSS with ability for public users to manage subscriptions, retrieve forgotten
passwords, and display the privacy notice on the signup page.
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
MEMO
To: Board of County Commissioners
From: Jim Goeben, IT Director
Date: 1/14/2020
Subject: Proposed changes to Technology Policy 13 ‐ Mobile Devices, and Technology Policy 3
Purchasing and Inventory of Technology
There are county‐owned mobile devices (smartphones and a few tablets) that do not have controls to
protect sensitive data stored on them, to restrict access to authorized people, and to enforce county
policies. These devices represent a security risk to the county network and public records stored on or
accessed by them. To protect county assets, IT recommends Mobile Device Management (MDM)
software be required on all county owned mobile devices. MDM software helps enforce county
technology policies such as password complexity, lock on inactivity, find my device, etc.
Below is a DRAFT of the proposed change using tracked changes.
Kittitas County Technology Policy Manual
13. Mobile Devices
13.1 Summary
This policy sets requirements for connecting mobile devices owned by Kittitas County (KC) to
the KC network to access public records while maintaining the security of the network and
public records. For personal equipment, see Technology Policy 6 - Personal Equipment.
13.2 References
1. Personnel Policy Manual 4‐12 Technology Use
2. Records management policy and procedures
3. Technology Policy 4 ‐ Account Management
4. Technology Policy 6 ‐ Personal Equipment
5. Technology Policy 7 ‐ Data Management, Access, and Protection
13.3 Definitions
13.3.1 Mobile device
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
A smartphone, laptop, notebook, tablet, or similar device that includes an operating system and
can run applications like email, Internet web accessbrowsing, and word processing.
13.3.2 Remote wipe
A process initiated outside of a mobile device that restores its configuration to the its original—
or factory default—state. A remote wipe will remove all the data, settings, and apps you
installed.
13.4 Policy
13.4.1 Authorization
The purchase and provisioning of a county-owned mobile device by IT must be requested by the
employee’s DH/EO.Before you can connect any device to the County network or any County
system, you must first get approval from your DH/EO using the Mobile Device Policy
Authorization form on CAMAS.
13.4.2 Public records
Public records are anything documenting County business. It is your responsibility to , so you
need to preserve any work you do on mobile devices (see Records Management Policy and
Procedures). Those records are subject to public records requests. All primary records must
reside on the network (see Technology Policy 7 - Data Management, Access, and Protection). If
you are uncertain what any of this means or have any questions, see your Records
Manager/Public Disclosure Officer.
13.4.3 Device supportPurchasing
Unless preauthorized by the IT Director, KCIT will purchase and deploy all county-owned
mobile devices. Funds will be provided by the Department/Office requesting the purchase.
KCIT will help you with your KC-owned Windows mobile device during normal business hours.
We will help you:
1. Select and purchase a Windows device
2. Secure the device and set your password
3. Install approved software (see devices below)
4. Connect to the network and KC email
We recommend Windows devices. We do not recommend mobile devices running other
operating systems and will only assist you connecting them to KC email.
Because of the variety of devices we will not be able to provide you training on how to use the
device; you will need to contact the manufacturer or vendor for operating instructions.
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
13.4.4 Use
If you use a KCcounty-owned mobile device, you must adhere to all related administrative
policies including employee conduct and rights, records management, confidentiality, privacy,
and security of county technology assets.
Mobile devices are subject to the same protection and guidelines as desktop computers. See
Technology Policies and Personnel Policy Manual 4-12 Technology Use.
1. You may not use KCcounty‐owned equipment to conduct personal business.
2. You must immediately return the device to IT if you determine it is no longer necessary, if you
leave County employment, or if requested by IT for inspection or return. If you are unable to
return the device by the deadline provided you may be required to reimburse the County the
cost of a replacement.
3. You may only store secondary copies of records on a county‐owned mobile device. If you create
a county record on a mobile device, it must be copied or moved to the county network at your
earliest opportunity.
3.4. If you store class 2, 3, or 4 data (see Technology Policy 7.4.10 Data Classification) on a county‐
owned mobile device the records must be encrypted.You must store County records in an
encrypted folder or hard drive. De‐encryption information must reside with your supervisor
and/or IT.
4. You may only store and use sensitive, confidential, or proprietary data on a KC‐owned mobile
device if it is a transitory secondary copy. The primary record must be stored on the network.
5. Password protection must be enabled and required after 15 minutes of inactivity. Whenever
possible the password must meet the requirements in Technology Policy 4 ‐ Account
Management. You must change your device password every 90 days.
5.6. Violation of any local, state, or federal law; of any County policy; or for personal financial gain, is
prohibited.
13.4.5 Text Messaging
Transitory Records
Public records that only
document information of
temporary, short-term value, and
provided that the records are not
needed as evidence of a business
transaction and not covered by a
more specific records series.
(GS50-02-05 Rev. 1)
Text message primary records that conduct county business (those you send, and those you
receive from non-county employees) must be memorialized as they are sent or received.
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
If authorized by your DH/EO, you may use text messaging for communications of minimal
retention value on personally-owned cell phones and county-owned cell phones; however, you
must delete the transitory communication text when it is no longer needed, and you will be
responsible for contacting your service provider to obtain copies of any records responsive to
public records requests.
Text message primary records that conduct county business (those you send, and those you
receive from non-county employees) must be memorialized as they are sent or received.
13.4.6 Security
KCIT will install Mobile Device Management software on every county-owned mobile device to
enforce county policies.KCIT will register all devices connecting to the KC network or to
Exchange ActiveSync (EAS) for KC email.
You must immediately report virus or malicious software detection, or possible security
violations to IT.
KCIT may monitor your activity on any KC-owned device.
As the custodian of the device, you must regularly check for and install security updates as they
are made available by the manufacturer.
KCounty-owned mobile devices must have a County asset tag in an easy to see location.
13.4.6.1 Passwords
Best Practice Tip
Change the security password on
your mobile device when you
change your network password.
Password protection must be enabled and required after 15 minutes of inactivity. Whenever
possible the password must meet the requirements in Technology Policy 4 - Account
Management. You must change your device password every 90 days.
13.4.6.2 Lost or stolen devices
You are responsible for protecting county-owned mobile devices provided to you from theft, loss
or damage. You must immediately report lost or stolen devices—as soon as the loss is noticed—
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
to your DH/EO regardless of time, day or night. DH/EOs must notify IT staff or the IT Director
as soon as notified by their employee. KCIT will immediately remote wipe lost or stolen devices.
13.4.7 Safety
The County entrusts employees with communications equipment to enhance productivity and
safety. It is your responsibility to use the equipment prudently to ensure your safety and the
safety of your co-workers and the public. See the Personnel Policy Manual 4-12 Technology Use
for information on using mobile devices while driving a vehicle.
13.4.8 Wi-Fi
You may not use non-County Wi-Fi hotspots unless they are secured with encryption, e.g., WPA
VPN orand WPA2.
13.4.9 Smartphone
Smartphones must meet the following standards:
1. Managed by Exchange ActiveSync software which provides a remote data‐wipe capability
Operate on Windows Mobile 6.1 or higher, Android version 2.2 or higher, or Apple IOS 4 or
higher
Best Practice Tip
Include return to information,
e.g. your name and a contact
phone number, on the device
lock screen wallpaper.
Smartphone passwords may be 4 digits if the screen lock is enabled after 1 minute of inactivity;
however, all digits may not be consecutive (e.g., 1-2-3-4) or duplicated (e.g., 1-1-1-1). If the
screen lock on inactivity is set for longer than 1 minute, the password must, to the degree
possible, meet the requirements in Technology Policy 4 - Account Management.
Use discretion when making sensitive or confidential calls as cell phone calls are not secure.
You may not jail break or root KCcounty-owned mobile devices.
Do not download games, ringtones, etc., or non-work -related applications to KCcounty-owned
devices.
You must activate a find my phone feature if available.
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
For more requirements for using smartphones, see Personnel Policy Manual 4-12 Technology
Use.
13.4.10 Laptops and tablets
We recommend Windows laptops and tablets.
Do not download games, ringtones, etc., or non-work related applications to KCcounty-owned
devices.
13.4.11 Device Access
Devices and technology systems are the property of Kittitas County. Kittitas County reserves the
right to access, audit, and inspect the devices and systems and all information viewed or stored
on them.
13.4.11.1 No expectation of privacy
Employee shall have no expectation of privacy for materials viewed or stored on county-owned
devices, systems, computers, or servers.
13.4.12 Device support
KCIT will help you with your county-owned mobile device during normal business hours. We
will help you:
1. Select and purchase an Android or Apple device
2. Secure the device and set your password
3. Install approved software
4. Connect to the network and KC email
We recommend Android devices.
Because of the variety of devices, we will not be able to provide you training on how to use the
device; you will need to search Google or contact the manufacturer or vendor for operating
instructions.
13.5 Responsibilities
13.5.1 DH/EO/designee
Department Heads, Elected Officials, and their Designees:
1. Ensure your staff is aware of and complies with these policies.
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
2. Authorize device purchase, configuration, and deploymentconnection to the County network
using the Mobile Device Policy Authorization form, as needed for county business.
3. Approve equipment recommended by IT.
4.3. Report lost or stolen devices to IT staff or the IT director.
13.5.2 Employees
1. Manage public records according to county records management policies and procedures
1.2. and eEncrypt class 2, 3, and 4 records on your mobile device.
2.3. Understand how to use your mobile device.
3.4. Do not use KCcounty‐owned equipment to conduct personal business.
4.5. Immediately report lost or stolen devices to your DH/EO/designee.
5.6. Immediately report virus or malicious software detection to IT.
6.7. Return your mobile device to IT when you no longer need it, separate from service, or if IT
requests it.
7.8. Keep your mobile device upgraded, and patched, password protected.
8.9. Use your mobile device safely and securely.
9.10. Ask your DH/EO, supervisor, or IT if you have any questions about this or any other
policy.
13.5.3 Information Technology
1. Purchase and install MDM software on Register and document all county‐owned mobile devices
connecting to the KC network and EAS.
2. Remote wipe any lost, stolen, or terminated employee mobile device when notified.
3. Wipe any mobile device returned to IT.
4. Ensure mobile devices are tagged and inventoried.
Technology Policy 3 - Purchasing and Inventory of Technology
Kittitas County Technology Policy Manual
3. Purchasing and Inventory of Technology
3.1 Summary
IT purchases and manages all inventoried technology.
3.2 References
1. CAMAS – Purchase Request
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
2. KCIT User Wiki – Software employees can install and update
3. Kittitas County Financial Policies
4. Technology Policy 1 ‐ Enforcement
5. Technology Policy 6 ‐ Personal Equipment
6. Technology Policy 7 ‐ Data Management, Access, and Protection
7. Technology Policy 13 ‐ Mobile Devices
3.3 Definitions
3.3.1 Computer
An electronic device for storing and processing data, e.g. desktop, laptop, and tablet computers.
3.3.2 Department software
Software that is used by one department or a limited number of departments (e.g. Esri,
GoToMyPC, and ArchiveSocial), or is an off-the-shelf license (e.g. Adobe Acrobat).
3.3.3 Enterprise software
Software that is used across all departments and has a server software component (e.g. Microsoft
Office and Laserfiche).
3.3.4 Inventoried technology
Any hardware item installed in or connected to a computer or the county network that has a
value over $100 or would be considered small and attractive.
3.4 Policy
3.4.1 Purchasing
IT will purchase all inventoried technology assets (refer to definition above). Non-inventoried
technology purchases will be made by the department. Refer to section 3.4.3 Funding Source.
Examples of inventoried technology purchases made by IT are:
Computers, monitors, and software (see Kittitas County Financial Policies)
Internal computer components
Network devices, e.g., Wi‐Fi access points, routers, switches
Printers/scanners
Uninterruptable Power Supplies (UPSs)
Minor computer software (GL 53564, <$5000)
GIS and GPS equipment
External drives (portable hard drives, CD/DVD, network attached storage)
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
USB devices (excluding flash drives)
Smartphones
Exceptions of department purchased equipment that you are strongly encouraged to have
reviewed by IT before purchasing (if the equipment will be connected to a computer or the
network):
Digital cameras
Smartphones – see Technology Policy 13 ‐ Mobile Devices
Copiers
Surveillance video cameras
Vendor supplied or required hardware
Capital computer software (GL 56404, >=$5000)
Computer software subscriptions (GL 54915)
Audio/video equipment
See the KCIT User Wiki – Technology Recommendations knowledgebase for pre-approved
technology.
Examples of non- inventoried technology purchases made by departments are:
Flash drives, device memory cards
CDs/DVDs
Keyboards and mice
Toner and printer supplies
Surge protectors
3.4.2 Standardized Computer Software and Hardware
IT designates standard computer software and hardware in order to ensure compatibility between
computer systems and manage the provisioning of user support. If non-standard software or
hardware is needed, IT will work with the department to select an appropriate solution.
You may not use non-standard software or hardware on county computer systems without IT
pre-approval. If IT approves installation of non-standard software or hardware, IT shall not be
responsible for its operation and/or maintenance. You may not install personally owned software
on county owned equipment (see Technology Policy 6 – Personal Equipment). IT may remove
any non-standard software or hardware that might compromise the operation of the county
network or any county-owned computer, or any unauthorized software or hardware discovered
during routine maintenance operations or monitoring. IT will notify the DH/EO prior to software
removal unless there is an immediate threat to the computer or network in which case the DH/EO
will be notified after the removal.
3.4.3 Funding Source
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
Licenses for department specific and enterprise computer software (e.g. Microsoft Office,
Adobe Acrobat, Esri, and Laserfiche) are funded by the requesting department.
Maintenance for department specific software (e.g. Esri, GoToMyPC, and ArchiveSocial) is
funded by the requesting department.
Maintenance for enterprise computer software (e.g. Laserfiche, Microsoft Office) may be
funded by IT as approved by the BOCC.
Network hardware (everything to the computer) is funded by IT. If a purchase was not
budgeted, or is for the sole benefit of a non‐general fund department, the department may be
asked to provide funding or the purchase may be postponed until budgeted.
Computer and monitor additions to the county inventory (not replacing equipment on rotation)
are funded by the requesting department.
Computer and monitor replacement is funded by the Computer Replacement Internal Service
(CRIS) fund to which the general fund and non‐general funds contribute annually.
3.4.4 Servers
IT Director will only authorize the addition of a virtual server to the county network at the
request of the department’s DH/EO.
3.4.5 Computers and Monitors
Each user having a need for a computer will receive equipment appropriate to their duties. IT
will consult with users and DH/EOs to make this determination.
There will be one right-sized system per user, whenever possible.
Standard equipment combinations:
Desktop computer with one monitor (or 2 depending on monitor size and need; additional
monitors may be rented if required), or
Laptop computer with docking station and monitor, or
Tablet computer with docking station and monitor
Non-standard equipment may be coordinated with the DH/EO and will be billed accordingly.
Additional equipment internal or external to the computer will be purchased by the DH/EO and
may be retained by the DH/EO. Examples include: mouse, keyboard, expansion card, and
external optical disk drive.
Only computers, monitors, and network equipment purchased by IT may be connected to the
network or a computer connected to the network. Departments/offices/others may not purchase
this equipment and connect it to the network or a computer connected to the network. Computers
and monitors provided to the county by a third party must be pre-coordinated through IT before
they may be connected to the county network or a computer connected to the network.
3.4.6 Software
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
All software less than $5000 will be purchased by, stored in, and maintained by the IT
department. IT will ensure compliance with software copyrights and licenses. For more
information see KCIT User Wiki – Software employees can install and update.
3.4.7 Inventory
IT maintains the inventory of all computers, monitors, network hardware, and enterprise
software.
Departments maintain the inventory of their department software.
DH/EOs are responsible for the custodianship of all technology residing within their department
and coordinating moves (locations, connections, and custodianship) with IT.
Disposal/decommissioning of all inventoried technology must be coordinated with IT.
IT will ensure ALL data storage devices (including flash drives) are destroyed or erased prior to
disposal/disposition (see Technology Policy 7.4.9 Destroying and erasing media).
3.4.8 Computer and Monitor Replacement (rotation)
Rotation schedule:
Computers – every 4 years
Monitors – minimum of every 6 years
No equipment will be used after the rotation schedule unless authorized by the IT Director.
Shorter rotation schedules may be coordinated with the DH/EO and billed accordingly.
Departments are expected to use the equipment deployed to their staff for the entire rotation
schedule. If staffing levels or job duties change resulting in a change of equipment requirements,
IT will work with the DH/EO to make appropriate changes to the equipment.
When a computer or monitor is no longer needed by a department or has reached the end of its
life cycle, it must be returned to IT and become part of the CRIS inventory. The department shall
not be reimbursed from the CRIS fund for surplus value or unused replacement fees.
Grant funded and gifted equipment, unless required otherwise by contract, will have the same
rotation schedule applied to them. When they have reached their rotation schedule, the DH/EO
will replace the equipment with other grant funded or gifted equipment, purchase a replacement
which will become part of the CRIS inventory, or take the equipment out of service. All
equipment that reaches its rotation schedule will be released to IT and become part of the fund
inventory, or processed according to the grant.
3.5 Responsibilities
3.5.1 Employees
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
1. Make all inventoried technology purchases through IT.
2. Protect any county resources in their custody.
3. Keep IT informed of any changes in inventory, including custodianship.
4. Communicate known requirements for equipment to their DH/EO and IT at the time of rotation
to ensure appropriate equipment is selected
3.5.2 IT
1. Make all inventoried technology purchases.
2. Maintain inventory of all inventoried technology.
3. Replace computers at the direction of the IT Director and return replaced computer to IT.
4. Notify DH/EOs of their department’s computer rotation.