HomeMy WebLinkAbout2019-07-22-minutes-it-study-session2019‐07‐22 Minutes 1 Information Technology
Commissioners’ Minutes
Kittitas County, Washington
Commissioners’ Conference Room
Regular Meeting
Monday 11:00 AM July 22, 2019
Board members present: Chair Cory Wright, Commissioner Laura Osiadacz
Board members absent: Vice‐Chair Brett Wachsmith
Others: IT Director Jim Goeben
Regular Meeting Information Technology
Meeting called to order at 11:00 AM.
Microsoft Enterprise Agreement Implementation Update
Mr. Goeben provided an update to the board. No direction was given.
Review Microsoft Enterprise Agreement Impact Minimization and Training Plan
Mr. Goeben presented the plan to the board. No direction was given.
Request to Approve Update to Technology Policy 7 – Data Management, Access, and Protection
The board approve the changes as presented.
GIS Analyst Shared with KITTCOM
Mr. Goeben apprised the board of the conversations between him and KITTCOM Director Darlene
Mainwaring regarding a possible shared GIS analyst position. No direction was given.
Review IT Director’s Project
Mr. Goeben presented a list and prioritization of the major projects he and his staff will be completing in
the next couple years. No direction was given.
Meeting adjourned at 11:30 AM.
Kittitas County Commissioners
Information Technology Director Kittitas County, Washington
_______________________________________ _______________________________________
Jim Goeben, IT Director Cory Wright, Chair
Implementation Plan
Microsoft Enterprise Agreement
Kittitas County Information Technology
Updated July 22, 2019
The Microsoft Enterprise Agreement implementation will include the following software migrations:
All servers from Windows Server 2008 RS to Windows Server 2018, including Microsoft
Exchange and SQL Servers
All desktops from operating system Windows 2007 to Windows 2010
All productivity suites from Office 2010 to Office365
Servers
All 84 servers will be upgraded from Server 2008 RS to Windows Server 2018. All 8 SQL Servers will be
upgraded from their current SQL Server version to SQL Server 2016 in the following phases.
1. Feb‐Mar 12 internal processes servers COMPLETED
2. Apr‐May 22 internal application servers 82% ‐ 18/22
3. Jun‐Jul 24 enterprise software and file servers (Laserfiche and GIS in Jul) 8% ‐ 2/24
4. Aug‐Oct 26 vendor dependent software servers 8% ‐ 2/26
5. Aug‐Nov Upgrade 8 SQL servers and migrate 18 instances (applications)
6. Sep‐Oct Exchange upgrade 2010 to 2016 (after O365 deployment)
Desktop Operating Systems
All 267 desktops, 186 laptops, and 23 tablets (476 devices) will be upgraded from Windows 7 to
Windows 10 in the following phases:
1. Feb Survey users COMPLETED
https://www.surveymonkey.com/results/SM‐R5G6PXP5V/
2. Mar Test and train
o Test and plan Windows upgrade for non‐rotated computers COMPLETED
o Create training materials on Windows 10 differences COMPLETED
http://camas‐wiki/user/wiki/Differences_from_Windows_7_to_Windows_10
Emailed everyone 5/7 and 6/21
3. Apr Create upgrade plan and communication templates COMPLETED
http://camas‐wiki/user/wiki/Computer_Rotation_Process
4. May‐Jul Rotate and upgrade computers 75%
Office 365
1. Jun‐Jul Setup and configure Government tenant in Microsoft
o Move EOP and ARP to Government tenant COMPLETED
Implementation Plan
Microsoft Enterprise Agreement
Kittitas County Information Technology
Updated July 22, 2019
o Download and configure O365 deployment tool 75%
o Install ADFS DirSync (Active Directory copy) 75%
o Move IT to O365, test 25%
2. Jul‐Aug Train and Install
o Training materials and classes on O365 programs and features,
including policy reminders (OneDrive, home use, records, etc.) 25%
o Home use option and instructions 25%
o Deploy O365 to all computers (after rotation complete)
Additional steps
During and/or following the above EA implement phases, the following will be complete.
1. Desktop firewall – develop policy and deploy to desktops
as part of security assessment findings.
2. System Center – install and configure for better update and patch management
3. Verification – no Windows 7, no Office 10, no < Server 2016
Communication Plan
The following communication will be made, at a minimum:
1. Mar 26 Initial announcement (all staff) COMPLETE
2. May 7 Announce Windows 7 to 10 process and training materials (all staff) COMPLETE
3. Jun 24 Implementation Plan (BoCC then all staff) COMPLETE
4. Jul 1 O365 product overview (all staff) COMPLETE
5. Jul 22 Project update (BoCC and Management Team) COMPLETE
Training and Impact Minimization Plan (BoCC) COMPLETE
6. Aug 26 Project update (BoCC and Management Team)
7. Sep 23 Project update (BoCC and Management Team)
Soft launch report (BoCC)
8. Oct 28 Project update (BoCC and Management Team)
9. Nov 25 Project update (BoCC and Management Team)
10. Dec 23 Project update (BoCC and Management Team)
Postmortem report (BoCC and Management Team)
Impact Minimization and Training Plan
Microsoft Enterprise Agreement
Kittitas County Information Technology
July 22, 2019
Impact Minimization
Introduction to O365
By seeing the similarity between Office versions, users will feel more comfortable with the
upgrade. IT will show users how minimal the changes are; the same features they are used to are in
the same place, just presented a little more clearly. Smartphone users are already becoming used
to ever changing software as our devices get updated automatically and without warning.
Training
In the week prior to and the weeks immediately following the upgrade, IT will provide multiple
training opportunities so users can choose the most convenient time to attend and the format that
best fits their learning preference: articles for reading, videos for viewing, and in‐person session for
interaction. See the Training section below.
Upgrade tests
IT will begin using O365 well in advance of users. It will then upgrade select users so we can get
feedback and streamline the rollout process before pushing it out to all users.
Communication
IT will ensure the users are aware of the process at each step and give plenty of notice of changes.
Training
Wiki articles
IT will post wiki articles highlighting differences between the Office and Windows versions.
https://camas‐wiki.co.kittitas.wa.us/user/wiki/Category:Microsoft
Microsoft training site
Users can review Microsoft’s professionally developed training materials on the MS O365 help site
at their convenience.
https://camas‐wiki.co.kittitas.wa.us/user/wiki/Training_for_Microsoft_Software
In person training sessions
IT will schedule a few training sessions for the end of July and beginning of August to show users
what O365 looks like and how it functions. After the rollout in mid‐August, IT will host a few more
sessions to answer questions and help users become more familiar with new features.
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
MEMO
To: BoCC
From: Jim Goeben, IT Director
Date: 7/22/2019
Subject: Proposed changes to Technology Policy 7 – Data Management, Access, and Protection
With the increase in requests for cloud storage for sharing files in emergencies, for records requests,
and for working with contractors, and with the availability of OneDrive under Microsoft’s Enterprise
Agreement, the IT Committee requests the board approve the following policy change allowing the use
of OneDrive with department head/elected official approval and upon acknowledgement of technology
policies.
Below is a DRAFT of the proposed change.
7.4.1 Stored electronic records
All electronic records will be stored in a network file share where they will be backed up and
protected. IT is not responsible for data not stored on a network file share.
If working on an electronic record not stored on a network file share (such as on a laptop), the
updated version must be added to a network file share at the earliest opportunity.
Personal files (not county business) may not be stored on county network file shares or county
equipment.
IT is not responsible for any personal files, such as photos or music, stored on county equipment
and any files stored on local or removable storage.
7.4.1.1 G drive – Department
County electronic records will be stored on the department’s network file share (G drive). All
department personnel have full read/write access to the department drive unless a change is
requested by the DH/EO.
7.4.1.2 H drive – Employee
Employee's electronic records may will be stored in the employee’s network file share (H drive).
Department heads/designees will have access to all electronic records of their department
Kittitas County Information Technology | 205 W 5th AVE STE 13 | Ellensburg WA 98926 | 509‐962‐7510 | http://www.co.kittitas.wa.us
personnel, and elected officials/designees will have access to all electronic records of their office
personnel, without additional notice to the employee. All employees will have an H drive unless
a change is requested by the DH/EO.
7.4.1.3 T drive – Teams
County electronic records to be shared with other departments will be stored in the teams’
network file share (T drive). IT will create the folder and set permissions before files may be
added.
7.4.1.4 Cloud Storage
Employees may use county provided cloud storage for the storage and transmission of secondary
copies of electronic records if preauthorized by the employee’s department head/elected official
and the employee signs a cloud storage policy acknowledgement form.
7.4.1.4 5 Additional locations
Some software applications may require a data store in a location specific to the application.
Copies of such data are not required to be stored on the G, H, or T drives.
g:\5.01\fms 20190628
Kittitas County Policy Acknowledgement Form
Cloud Storage Use
I acknowledge that I have received a copy of the Kittitas County Technology Policy Manual and
understand that this document describes my responsibilities and the conduct expected of me for the use
of cloud storage, including but not limited to:
Only secondary copies of records may be stored in the cloud, not primary records (7.4.1)
Confidential information (category 3 and 4) must be encrypted before it is added to cloud
storage (7.4.8.2, 7.4.10)
Remove records from cloud storage when they no longer need to be there (5.1)
If working on a record stored in the cloud you will copy the updated version to a network file
share at your earliest opportunity (7.4.1)
I understand that if I have questions regarding the policies I will consult with my immediate supervisor or
an Information Technology employee.
Further, I understand behavior that violates the policies of the county may result in the removal of cloud
storage access, disciplinary action (up to and including termination), and criminal prosecution.
Signature _________________________
Printed name _________________________
Date _________________________
Signature _________________________
Printed name _________________________
Date _________________________
Signature _________________________
Printed name _________________________
Date _________________________
Employee or Authorized Person Elected Official/Department Head
Information Technology
The original signed form must be sent to the Information Technology
department who will install the cloud software then forward the form to
the Human Resource Office to be filed in the employee’s personnel file.
IT Projects - Director
July 22, 2019
Project Authority Priority Est. Hours
Incident Response Plan Regulatory High 240 hrs
Policies and plan for responding to security incidents related to technology and electronic public records. To
include purpose, scope, roles, responsibilities, management commitment, coordination among organizational
entities, and compliance.
Microsoft Enterprise Agreement BoCC, 2019 Medium 180 hrs
Upgrade Microsoft software for servers and desktops (Windows OS and MS Office) to remain patched and
secure. DUE 12/31/2019. Implementation plan due 6/24, product announcement 7/1, training and impact
minimization plan 7/30, soft launch report 9/30, postmortem 12/31.
Risk Assessment Regulatory High 120 hrs
Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality,
integrity, and availability of electronic protected health information held by the County.
IT Customer Service Planning BoCC, 2019 Medium 120 hrs
Improve customer service with indicators. DH/EO meetings 7/31, improvement matrix to MGMT 9/30, update
SLA 11/30, data point performance indicators 1/31/20, tracking begins 3/1, published in newsletter 5/1.
Risk Assessment Policy Regulatory High 240 hrs
Risk Assessment Policy that addresses purpose, scope, roles, responsibilities, management commitment, the
expected coordination among organizational entities, and compliance requirements.
Security Plan Regulatory Medium 240 hrs
Comply with CCA 20 Critical Controls for effective defense as the foundation for the county’s security plan.
Business Continuity Plan Regulatory Medium 240 hrs
Establish a technology business continuity plan with policies and procedures for responding to an emergency
that damages systems that contain electronic protected health information.
Technology Systems Classification Regulatory Medium 120 hrs
Technology Policy 7.4.10 defines categories for data based on sensitivity. This classification will be applied to
technology system to help scope audits and prioritize investments for security mitigation.
IT Strategic Plan IT Committee Medium 180 hrs
Defines 5‐year direction for investment in resources to ensure IT is working towards goals of the agency.
Technology Policy Review/Rewrite IT Committee Low 240 hrs
Review policies for impact and include authority references. Reorganize into smaller sections written for users
and technology professionals. Organize into policy groups, e.g., for all users, for web and social media editors.