HomeMy WebLinkAbout2021-04-26-minutes-it-study-session
2021-04-26 Minutes 1 Information Technology
Commissioners’ Minutes
Kittitas County, Washington
Commissioners’ Conference Room
Regular Meeting
Monday 11:00 AM April 26, 2021
Board members present: Chair Brett Wachsmith, Vice-Chair Laura Osiadacz, Commissioner Cory Wright
Others: IT Director Jim Goeben
Regular Meeting Information Technology
Meeting called to order at 11:01 AM.
Technology Policy Updates
There was discussion regarding the Technology Policy updates proposed by IT and recommended by the
IT Committee. The board approved the changes and directed Mr. Goeben to publish the changes
allowing for scrivener error corrections, and to notify staff of the applicable updates.
Webex Equipment Rotation
Mr. Goeben reported almost all department heads and elected officials who use Webex equipment
(Commissioner’s office, Superior Court, Lower District Court, Upper District Court, Community
Development Services, Public Works, and Jail) have integrated the equipment into their business
processes and have asked that the equipment be added to the Computer Replacement Internal Services
fund so the equipment replacement can be prefunded. The board approved the request.
Other Business
Mr. Goeben notified the board he is working with the State Auditor’s Office to engage their Lean
program services to improve the department’s service request process. The board said they were in
favor of a presentation by the State Auditor’s Office about Lean and the program services.
Commissioner Write reported he is working with Director Goeben and Network Administrator Doug
Fessler on rural broadband issues and will continue doing so and will bring the board into the
conversation about future actions.
Meeting adjourned at 11:18 AM.
Kittitas County Commissioners
Information Technology Director Kittitas County, Washington
_______________________________________ _______________________________________
Jim Goeben, IT Director Brett Wachsmith, Chair
Staff Report 1 Information Technology
Kittitas County Information Technology
Staff Report to the Board of County Commissioners
Date 4/26/2021
From Jim Goeben, IT Director
Subject Technology Policy updates
Request Approve updates to the County Technology Policies
Request Type Internal (policy, system upgrade) and external mandate (regulatory compliance)
Summary
IT is proposing updates to the County’s Technology Policy Manual to:
1. Meet requirements of the FBI’s Criminal Justice Information Services (CJIS) Security Policy,
Version 5.9 06/01/2020
2. Correct grammatical errors
3. Standardize terminology and formatting
4. Update references to current technology and practices
Background
The County is going into its triennial technical security audit by the Washington State Patrol for
compliance with the CJIS Security Policy. Many CJIS requirements are met by the County in practice but
have not been written in policy. The proposed updates will align the County’s policies with the CJIS
Security Policy. During this review, IT also corrected policy language to standardize terminology, correct
grammatical errors, and account for current technologies.
Interactions
On 4/13 and 4/19 the IT Committee reviewed the proposed changes and forwards a favorable
recommendation to the board to approve the updates.
Recommendation
IT Director and the IT Committee recommend the Board of County Commissions approve the
recommended changes and direct the IT Director to publish the updated policies, allowing the IT
Director to make scrivener error corrections, and notify employees of the applicable changes.
Board direction
Date 4/26/2021
Action Approved Denied Revised
Direction Publish the updated policies, allowing the IT Director to make scrivener error
corrections, and notify employees of the applicable changes.
G/1.01/ComGov
Kittitas County
Technology Policies
Regulatory Compliance and Other
Rewrite 2021
April 26,2021
1
Technology Policy 1 -Traininq and Enforcement
1.Traininq and Enforcement
1.1 Summary
Computer information systems are an integral part of Kittitas County's daily operation.These
policies have been recommended by the IT Committee and approved by the Board of
County Commissioners (EOCCBoCC)in-eFder-to:
•Maintain the systems used to provide services to the citizens of Kittitas County and
protect the substantial human and financial resources invested to create and
maintain these systems.
•Safeguard the information contained within these systems.
•Minimize business and legal risk.
1.2 References
•Personnel Policy Manual
•Records management policy and procedures
You must adhere to the Kittitas County {KG-)-Technology Policies and all related
administrative policies including employee conduct and rights,records management,
confidentiality,privacy,and security of County technology assets.
1.3 Definitions
None.
1.4 Policy
1.4.1 Administration
The KGKittitas County IT Director is responsible for the administration of the Technology
Policies.
1.4.2 Violations
If you violate Technology Policies you may be subject to progressive discipline (including
termination),revoked network access,and criminal investigation in accordance with Kittitas
County policy and applicable laws.(CJIS 5.9 §5.12.4)
1.4.3 IT Exemption
KGIT employees are exempt from these Technology Policies only as is-necessary to
administer and secure the network systems and infrastructure under the direction of the IT
Director.
1.4.4 Traininq
2
Employees who require computer access or a County email account shall receive and
acknowledqe:
1.Cyber security awareness traininq,prior to beinq qiven access,and biennially
thereafter.
2.This Technical Policy Manual,within two (2)weeks of beinq provided access.
Employees will direct any questions reqardinq technoloqy policies and traininq to IT.
Employees will also be required to participate in ongoinq security awareness traininq as
determined by the IT Director based on industry standards/best practices,and as directed by
the BoCC.
Failure to complete required traininq and acknowledqement will be considered a violation of
County policy.
1.5 Responsibilities
1.5.1 DHIEO
Each Department Head/Elected Official (DHIEO)is responsible for ensuring ydheir
staffemployees is-are_aware of and eemplies-comply with these policies.
1.5.2 Employees
1.Understand and follow Technology Policies.
2.Ask your DHIEO,supervisor,or IT if you have any questions about this or any other
policy.
1.5.3 IT
1.Provide appropriate support and guidance to assist employees to fulfill their
responsibilities under these policies.
2.Enforce Technology Policies in a consistent and thorough manner.
3.The IT Director shall develop and maintain written standards and procedures
necessary to ensure implementation of and compliance with these policies.
3
Technology Policy 2 -Requests for Service
2.Requests for Service
2.1 Summary Best Practice
Requests for IT servicelsupport are made throuqh TRThe Leave your computer/laptop
service request system on CAMAS (County's intranet)-wiM--be-powered on and connected to the
.The benefits of using the county network overniqht,at least
system are:one day a week,but save all
work,lock your computer,and
•Immediate submission to all IT s‡affemplovees.turn off your monitor when you
•Quick routing to the appropriate technician.leave at the end of vour shift.
•Efficient prioritization.
•Tracking of requests and responses.Turn off your computer and
monitor over your days off
2.2 References (weekend,holidav,vacation,etc.)
4.CAMAS -IT Service Request.
5.KGIT Service Level Agreements.
6.KGIT User Wiki -Requests for Service.
7.Records Management Policy and Procedures.
2.3 Definitions
None.
2.4 Policy
IT will track and prioritize all requests for assistance using the CAMAS -IT Service Request
system.
IT staffemployees will prioritize requests for service based on the level of impact to the
eeëntyCounty and its citizens,urgency,and criticality.
The IT Director is responsible for resolving prioritization conflicts.
2.4.1 Usage
All employees requesting non-emergency assistance are required to use the CAMAS -IT
Service Request system.Service Requests-requests are subject to public disclosure laws.
Do not include confidential er-sensitive-information (Category [link 7.4.10]3 or 4)in service
requests.
2.4.2 Tracking
All requests will be tracked to:
•Show hardwarelsoftware issue patterns and areas of additional need.
•Allow employees and IT to track progress of service.
•Allow employees to interact with the assigned technician,update,or close a request
4
as needed.
For more information see KGIT User Wiki -Requests for Service.
2.4.3 Päght--te-Restartinq Computers
To ensure security updates are applied to computers,IT may require you restart your
computer,or IT may restart your computer with prior notice.
2.5 Responsibilities
2.5.1 Employees
1.Use the service request system for all non-emergency requests.
2.In the event of aWTa technoloqv emergency,please call or visit IT.
2.5.2 IT
1.Track and prioritize all requests for assistance in the Service Request system.
5
Technology Policy 3 -Purchasing and Inventory of
Technology
3.Purchasing and Inventory of Technology
3.1 Summary
IT purchases and manages all inventoried technology.
3.2 References
.CAMAS -Purchase Request
.KGIT User Wiki -Software employees can install and update.
.Kittitas County Financial Policies.
.Technology Policy 1 -Enforcement.
.Technology Policy 6 -Personal Equipment
.Technology Policy 7 -Data Management,Access,and Protection.
.Technology Policy 13 -Mobile Devices.
3.3 Definitions
3.3.1 Computer
An electronic device for storing and processing data,e.g.desktop,laptop,notebook,and
tablet-eemputers.
3.3.2 Department software
Software that is used by one department or a limited number of departmentslemployees
(e.g.EsriArcGIS,GoToMyPC-and AFehiveSeeial)--),or is an-off-the-shelf lieense-(e.g.
Adobe Acrobat,PhantomPDF).
3.3.3 Enterprise software
Software that4s-used across all or most departments and-whether installed on premises has-
or subscription-based (e.g.Microsoft Office,GovQA,and
Laserfiche).
3.3.4 Inventoried technology
Any--hHardware or software items installed in/2 or connected to a computer or the
eeuntyCounty network that has a value over $100 or would be considered small and
attractive.
3.3.5 Peripheral equipment
Hardware items that can connect to a computer and have no operatinq system or storaqe
capacity-(e.q.,headsets,webcam,keyboards,mice,and speakers).For these technoloqy
policies,monitors are considered inventoried technoloqv and not peripheral equipment.
6
3.4 Policy
Only hardware and software reviewed and pre-authorized by IT or purchased by IT may be
attached to or installed inlon a County computer or device that can access the County
network throuqh a wired or wireless connection.
3.4.1 Purchasing
3.4.1.1 Purchased by IT
IT shall purchase for departmentsloffices:
1.Minor computer software (GL 53564,<$5000),a.k.a.off-the-shelf
2.Inventoried technoloqy
3.Enterprise software,as approved by the BoCC
Examples of inventoried technoloqy purchases made by IT are:
•Computers and monitors (see Kittitas County Financial Policies)
•Internal computer components
•Network devices,e.q.,Wi-Fi access points,routers,switches
•Desktop printers/scanners connected to individual computers
•Uninterruptable power supplies (UPSs)
•Minor computer software (Esri,GoToMyPC,Adobe Acrobat,Phantom PDF,
QuickBooks,etc.)
•GIS and GPS equipment
•External drives (portable hard drives,CD/DVD/optical,network attached storage)
•Smartphones
3.4.1.2 Purchased by Departments
IT Directorldesiqnee shall review and approve before DHIEOs purchase:
1.Contracts and aqreements before beinq signed by the County
•Capital software (GL 56404,>=$5000),
•Software subscriptions (GL 54915),i.e.,software-as-a-service,cloud software
2.Vendor supplied or required hardware
3.Surveillance video cameras
4.Audiolvideo equipment
5.Copiers/multi-function printers that are network connected
Technoloqy purchases requirinq IT reviewlapproval that did not receive IT Note:It is important new
reviewlapproval may not be installed on or connected to a County technoloqv is reviewed by
computer or server and may not be supported by IT.IT prior to purchase
because some technologies
DHIEOs may purchase and retain:are unable to inteqrate with
County systems.
1.Peripheral equipment (excludinq monitors),e.g.,headsets,
webcams,keyboards,mice,and speakers
2.Non-inventoried technology,e.q.,flash drives,device memory cards,CDs/DVDs,
toner and printer supplies,surqe protectors
7
See the KGIT User Wiki -Technology Recommendations knowledgebase for pre-approved
technology.
.Keyboar4s-and--ce
3.4.2 Standardized Computer Software and Hardware
IT designates standard computer software and hardware ifundeF-to ensure compatibility
between computer systems,protect the security of the County network and records,and
manage the provisioning of user support.If non-standard software or hardware is needed,IT
will work with the department to select an appropriate solution.
You may not use non-standard software or hardware on eeuntyCounty computer systems
without IT pre-approval.
You may not install personally
8
owned software on eeunty-eweedCounty-owned equipment (see Technology Policy 6 -
Personal Equipment).IT may remove any non-standard software or hardware that might
compromise the operation of the eeënty-Countv network or any eeuntyCounty-owned
computer,or any unauthorized software or hardware discovered during routine maintenance
operations or monitoring.IT will notify the DHIEO prior to software removal unless there is
an immediate threat to the computer or network in which case the DHIEO will be notified
after the removal.
3.4.3 Funding Source
3.4.3.1 Funded by IT
IT shall fund:
•Maintenance for enterprise computer software (e.q.Laserfiche,GovQA,Microsoft
Office),as approved by the BoCC
•Network hardware (everythinq to the computer but not including the computer
components),if a purchase was not budgeted,or is for the sole benefit of a non-
qeneral fund department,the department may be asked to provide fundinq,or the
purchase may be postponed until funding is available
3.4.3.2 Funded bY Departments
Requestinq department/offices shall fund:
•Computer and monitor replacements are funded by the Computer Replacement
Internal Service (CRIS)fund to which the general fund and non-general funds
contribute annually .
•Licenses for department--specific and enterprise computer software (e.q.Microsoft
Office,PhantomPDF,Esri,and Laserfiche)
•Maintenance for department--specific software (e.q.Esri,GoToMyPC)
•Computers and monitors added to the inventory (not replacements for equipment on
reqular rotation),or computers/monitors rotated before the reqular rotation occurs at
the request of the DHIEO
9
3.4.4 Servers
IT Director will only authorize the addition of a virtual server to the eeunty-County network at
the request of the department's DHIEO.
3.4.5 Computers and Monitors
Each user having a need for a computer will receive equipment appropriate to their duties.IT
will consult with users and DHIEOs to make this determination.
There will be one right-sized system per user,whenever possible.Standard equipment
combinations include:
•Standard or power dOesktop computer with one monitor (or 2 depending on monitor
size and need;additional monitors may be rented if required),standard keyboard and
mouse (no external speakers),or
•-Standard or power ILaptop computer with docking station and monitor (no internal
CD/DVD)-er
Non-standard equipment may be coordinated with the DHIEO and will be billed accordingly.
3.4.6 Software
AR-IT will purchase,inventory,store maintain and ensure licensinq compliance for all minor
computer software (GL 53564 <$5000)
department.For more
information see KGIT User Wiki -Software employees can install and update.
Each DHIEO shall purchase,inventory,maintain,and ensure license compliance for all
Gcapital software (GL 56404,>=$5000).
10
3.4.7 Inventory
•IT maintains the inventory of all computers,monitors,network hardware (includinq
access points),and enterprise software.(CJIS 5.9 §5.13.1.1)
•Departments maintain the inventory of their department software.
•DHIEOs are responsible for the custodianship of all technology residing within their
department and coordinating moves (locations,connections,and custodianship)with
IT.
•Disposalldecommissioning of all inventoried technology must be coordinated with IT.
•Disposal of MALL data storage devices (including flash drives)must be
coordinated with IT who will ensure properaFe destructioneyed or eFased-erasure
prior to disposalldisposition (see Technology Policy 7.4.9 Destroying and erasing
media).
3.4.8 Computer and Monitor Replacement (rotation)
Rotation schedule:
•Computers -every 4 years
•Monitors -minimum of every 6 years
No equipment will be used after the rotation schedule unless authorized by the IT Director.
Shorter rotation schedules may be coordinated with the DHIEO and billed accordingly.
Departments are expected to use the equipment deployed to their staffemployees for the
entire rotation schedule.If staffing levels or job duties change resulting in a change of
equipment requirements,IT will work with the DHIEO to make appropriate changes to the
equipment.
When a computer or monitor is no longer needed by a department or has reached the end of
its life cycle,it must be returned to IT and become part of the CRIS inventory.The
department shall not be reimbursed frem--the--GRIS fund for equipment returned to IT or for
any_surplus value received by IT at disposition .
Grant funded and gifted equipment,unless required otherwise by contract,will have the
same rotation schedule-applieë4e them.When they have reached their scheduled rotation-
sehedule,the DHIEO will replace the equipment with other grant funded or gifted equipment,
purchase a replacement which will become part of the CRIS inventory,or take the
equipment out of service.All equipment that reaches the end of its rotation schedule will be
released to IT and become part of the CRIS fund inventory-or processed according to the
grant.
3.5 Responsibilities
3.5.1 DHIEO
LMake all inventoried technology purchases through IT.
3.5.2 Employees
2--
11
1.Protect any eeëntyCounty resources in their custody.
2.Keep IT informed of any changes in inventory,including custodianship.
3.Communicate known requirements for equipment to their DHIEO and IT at the time
of rotation to ensure appropriate equipment is selected.
3.5.3 IT
LMake all inventoried technology purchases.
2.Review purchase contracts/lease aqreements prior to beinq signed by the County.
4-3.Maintain inventory of all inventoried technology.
4.Replace computers at the direction of the IT Director and return replaced
computer to IT.
5.__Notify DHIEOs of their department's computer rotation.
6.Review disposalldecommissioninq requests and ensure equipment is ready for
destruction/disposition.
12
Technology Policy 4 -Account Management
4.Account Management
4.1 Summary
You are responsible for any-_aLactivity associated with your account.Keep your passwords
strong and safe.DHIEOldesignees will request new accounts and will immediately notify IT
of terminated employees.
4.2 References
•CAMAS -Notification of Separation from Service
•CAMAS -Pre-orientation Checklist
•KGIT Internal Wiki -Creating a Network Account
•_KGIT Internal Wiki -Terminated Employee Checklist
•Technoloqy Policy 1 -Traininq and Authorization
•Technology Policy 5 -Access
•Technology Policy 7 -Data Management,Access,and Protection
4.3 Definitions
4.3.1 Account
A user-Rameusername and password combination used to access a computerized system.
4.3.2 Shared account
One account with access shared among multiple employees,e.g.a department's public
email mailbox.
4.4 Policy
4.4.1 Passwords
4.4.1.1 Network Passwords
User-Rames-pNetwork passwords-and--aeeess--cedes-assigned for the use of eeanty-County
technology are confidential.Never disclose your network password to anyone,not even
IT,and never use it for any other password.
1.Employees are responsible for the security of their password and any activity
associated with their account.
2.Strong passwords are required.Passwords mastshall:
1.Be a minimum length of nine (9)characters
2.Expire every 90 days and must be chanqed
characters
3.Not be a single dictionary word or proper name
4.Not be the same as your user-Rameusername
5.Not be identical to the previous 10 passwords
13
6.Not be transmitted in the clear outside secure locations,e.q.,email,FTP,
Internet,etc.
7.Not be displayed when entered
8.Not be disclosed to anyone,at any time
(CJIS 5.9 §5.6.2.1.1)LCounty network passwords shall:
-Include both alpha and numeric characters
2.Not be used as passwords for any other password or purpose
6-3.Not be recorded in an unsecured or unencrypted location e.q.Internet
Explorer,Word document,sticky-note
4 4.If an employee suspects their password has become known to others,
the employee must change their network password immediately (Ctrl-Alt-
Delete,change password)and notify their DHIEO and IT.
12-5.Entering a password incorrectly 3 times in a 15eminute period will
automatically lock the employee's eagnetwork account.The system
automatically unlocks the account after 15 minutes.
6._Reset password requests
must come via a service request from the employee's DHIEO,manager,
supervisor,or someone in the employee's departmentloffice known to IT.If IT
is not certain of the identity of the requester or the validity of the request,IT
shall request a secondary verification.
4.4.1.2 Software Passwords
Passwords used to access County software and resources will not be the same as their
network password or passwords used to access non-County or personal resources such as
web sites,email accounts,state services,etc.
Employees will not share or disclose software user account passwords (e.q.QuickBooks,
Galaxy,Cayenta,VPN)to anyone,except at separation.Upon separation,emplovees must
disclose to their DHIEOlsupervisor all software passwords (not their network password
which should never be shared with anyone).
14
IT employees may share computer administrative,network administrative,and service
account passwords with other IT emplovees.
4.4.1.3 System and Hardware Default Passwords
IT shall ensure default administrative passwords are chanqed on all IT purchased devices
and software.(CJIS 5.9 §5.10.1.4(2))
DHIEOs shall ensure default administrative passwords are chanqed on all department
purchased devices and software.(CJIS 5.9 §5.10.1.4(2))
4.4.1.4 One-time Passwords
One-time passwords used as an authenticator shall:
•Be a minimum of six (6)randomly qenerated characters
•Be valid for a single session
•If not used,expire within a maximum of five (5)minutes after issuance (CJIS 5.9 §
5.6.2.1.3),however,new employee temporary account passwords will not expire and
must be changed by the employee at first login.
4.4.2 Shared accounts
Shared accounts are not allowed unless a strong business case is made,and the risks
accepted by the DHIEO.Shared accounts must be approved by the IT Director.
Shared accounts shall not be used to access Category [link 7.4.10]3 or 4 data.(CJlS 5.9 §
5.6.1)
4.4.3 Group membership
A group contains users who will receive email maßed--sent to the group (distribution list)or
have access to network resources (security group).
•One individual (or position)will be designated by the DHIEO as the owner of the
group.
•Access to group membership folders (security groups)must be requested of IT by
the DHIEO.
•Distribution list membership may be managed by the group owner.
4.4.4 Changes te--aGGountsAccess Control
•IT shall grant employees access to information systems based on least privileqes,
i.e.,the most restrictive set of rights/privileqes or access needed by employees to
perform assigned official duties.
DHIEOldesiqnee will communicate to IT requests for employee's access privileges
using the followinq systems,which will act as access privileqe chanqe loqs:HR-win-
o At hire,use the CAMAS Pre-orientation Checklist
15
o For chanqes,use the IT service request system (CJIS 5.9 §5.5.2.1)
•DHIEOldesiqnee will notify IT as soon as the employee's information system usaqe
or need-to-know changes,or when the emplovee is terminated or transferred or
associated accounts are removed,disabled,or otherwise secured.(CJIS 5.9 §5.5.1)
4.4.5 Account creation
•Only emplovees who have been requested by their DHIEO and who qo through HR
new hire orientation and complete traininq required in Technoloqv Policy 1 -Traininq
and Enforcement may have a network account.
•Each employee authorized to access the County network will have a unique ID as
their username.(CJIS 5.9 §5.6.1)
•New accounts will be created in accordance with procedures detailed in KGIT
Internal Wiki -Creating a Network Account.
•User-RameUsernames will be created as [first name].[last name](example:
jane.smith).If the useF-Rameusername is over 20 characters,the user-
nameusername will be created as [first initial].[last name](example:j.williams-
anderson).If the user-emplovee transfers departments,returns to employment in a
different department,or works in multiple departments,_a-[2--character department
abbreviation}will be appended to the user-Rameusername (example:jane.smith.it).
•An email account will be created for each new employee who has access to a
computer unless the CAMAS -Pre-orientation Checklist directs otherwise.
4.4.6 Terminated/separated employees
•DHIEO will notify IT of terminated/separated employees immediately using the
CAMAS -Notification of Separation from Service form.(CJIS 5.9 §5.12.2)
•IT will disable a terminated-separated employee's accounts after the last day worked
as notified by the CAMAS -Notification of Separation from Service form.
•The DHIEO is responsible for managing the employee records,including email.
•DHIEO is responsible for changing any passwords the employee used for
department business.
•For more information see KGIT User Wiki -Terminated Employee Checklist.
4.4.6.1 High--risk terminations
Employees terminated for cause will be considered high--risk.Other terminations may also
be elassified-considered a high--risk termination at the discretion of the DHIEOldesignee,HR
Director,or Commissioner.
In the event of a high--risk termination,the DHIEOldesignee,HR Director,or Commissioner
shall notify IT as soon as possible---pre-termination--to
coordinate IT disabling the employee's network account at the time of termination-and te-
DHIEOldesignee is also responsible for:
16
1.Ensurinq employee does not
access any eeëntyCounty computer or mobile storage device
after ‡hey-aFe-terminated-termination
2.Obtaininq any passwords used for software (except their network password)
3.Immediately disablinq any software and software-as-a-service accounts
45-4.Notifyinq IT of legal hold requirements,includinq hard drive and electronic
records
If records are to be placed on legal hold,the DHIEOldesignee will:
1.Identify all devices that could contain records subject to the legal hold
1.Computers (desktops,laptops,tablets,e‡eetm)
2.Mobile storage devices (USB drives,CD/DVDs,eteetm)
3.Smartphones
2.Turn off identified devices;once turned off do not allow the devices to be turned on
prior to IT taking possession
3.Ensure the employee does not have access to the identified devices;the employee
should not have personal files on eeuntyCounty devices,but should they have,the
DHIEOldesignee will have access to them a few days after termination and can
forward them to the employee
4.Notify IT of all electronic records to be placed on legal hekkhold,including
1.Employee(s)affected
2.Equipment affected (asset tags)
3.Lead Deputy Prosecuting Attorney involved
5.Give IT identified devices
IT will follow its internal procedures for legal holds.
4.4.7 Auditinq
IT shall validate information system level accounts and access rights with DHIEOs annually
and shall document the validation process.(CJIS 5.9 §5.5.1)
4.4.8 Privilege Rights
The allocation of information system level privileqe rights (domain administrator,local
administrator,elevated privileges,super-user,and root access)shall be administered by IT
as approved by the IT Director.Privilege rights will be assiqned to a separate user account,
and with MFA [link to 7.3.3]required wherever possible or when another compensatinq
control is not available.Privileqe accounts shall be used only to perform duties specifically
requirinq the privileqe riqhts.All other work shall be completed usinq the employee's non-
privileqed account.
Privileqe riqhts within software controlled by a DHIEO will be limited only to those employees
who need access to compete their assigned official duties.IT shall be provided at least one
administrative account to all systems and software for emerqency access.
4.5 Responsibilities
4.5.1 DHIEO
17
1.Send employment or personnel account change information to HR.
2.Send account access changes through IT service requests.
3.Coordinate high-risk termination with IT.
4.5.2 Employees
1.Ensure passwords are secure and confidential.
2.If you suspect your password has become known to others,immediately change your
password and notify IT and your DHIEO.
3.Not use eeuntyCounty passwords for non-eeenty-County or personal resources.
4.5.3 IT
1.Set employee eeuntyCountv network passwords to expire every 90 days.
2.Configure network security to require strong passwords when possible.
3.Immediately change passwords on or disable any account where the password is
thought to be compromised.
4.Maintain one user as the owner for each group account.
5.Only accept employment or personnel account change information from HR.
6.Only accept account access changes from the employee's DHIEO.
7.Name accounts using the standard naming convention.
18
Technology Policy 5 -Access
5.Access
5.1 Summary
Access to data will be limited to those resources required for an employee to perform their
assiqned official duties .(CJIS 5.9)
5.2 References
1.Technology Policy 6 -Personal Equipment
2.Technology Policy 7 -Data Management,Access,and Protection
5.3 Definitions
5.3.1 VLAN
A virtual local area network (VLAN)partitions network traffic into defined separate groups,
e.g.,departments or security groups.
5.3.2 Remote Access
Temporary access to a County information system by a user (or an information system)
communicatinq throuqh an external,non-County-controlled network (e.q.,the Internet).
5.4 Policy
5.4.1 Wireless access
Kittitas County may provide wireless access to the Internet.Any wireless network will be
separate from the eeunty-County's wide area network.Direct wireless access to the
eeuntyCounty network will not be provided.
5.4.1.1 Employees wireless network
SSID:l<ittitas County
1.County-owned equipment:when connecting wirelessly,employees must connect
eeuntyCounty-owned equipment to the employee wireless network.
2.Personal equipment:employees may only connect authorized personal equipment
to the employee wireless network.Non-authorized personal equipment may only
connect to the public wireless network.
3.Password Protection:the employee wireless network will be password protected.
The password will be changed quarterly and posted on CAMAS.Employees may not
share the employee wireless network password with non-employees unless
preauthorized by IT.IT may authorize State employees or other visitors working on
behalf of the eeunty-County who require encryption to access the internet using the
employee wireless network.
5.4.1.2 Public wireless network
19
SSID:Kittitas County Public
1.County-owned equipment:eeëntyCounty-owned equipment may not be connected
to the public wireless network.
2.Personal equipment:employees and the public may connect personal (non-
eeuntyCounty-owned)equipment to the public wireless network.
3.Password Protection:no authentication will be required to connect to the public
wireless network;however,users must accept the public wireless network terms and
conditions.
5.4.2 Access allowed by wired connection
IT will ensure wired access is controlled as follows:
1.Network jack with network authentication
1.Inside employee's department VLAN -network access provided
2.Outside employee's department VLAN -partial'network access provided
2.Network jack without network authentication -all access denied
3.Public access network jack -Internet access only;employees may use VPN to
connect to the eeunty-County network for partial1 network access.
1 Partial access -some resources provided through the eewaty-County firewall (like access to
State resources)may not be available unless you are connected within your department.
5.4.3 Remote access
IT shall authorize,monitor,and control all methods of remote access to the County's
information systems.(CJIS 5.9 §5.5.6)
5.4.3.1 County employees
CAMAS,NOVAtime-and--eeëntyCounty email,and other County employee technoloqy
services may be made available on the Internet through https://camas.co.kittitas.wa.us.
Utilization of this system does not supersede management's right to set work hours and
location,nor ownership of data or work products.Access to additional network resources
may be permitted from a remote location (e.g.home,field or business travel via a computer
or laptop)provided the following requirements are met:
1.Requests for remote access must be made by the employee's DHIEO.
2.Remote access may only be made using:
1.VPN -for eeuntyCounty-owned devices only.
2_GoToMyPC -only using the eeunty-County's GoToMyPC account.
2-3.RemotePC -only usinq the County RemotePC account.
3.Remotely connecting to the County network is an employee's acknowledgment and
agreement that they are connecting to the eeanty-network at their own risk and the
seanty-County is not responsible for any damage that may result to their device.
5.4.3.2 Vendors
Vendors must complete a Confidential Information Agreement -Vendor Remote or On-Site
Support before access to the County network and their software will be provided.After a
20
signed agreement is received,IT will create a vendor account.Vendor accounts will remain
disabled by default.Upon request by a DHIEOldesignee through a service request,IT will
enable the vendor account for a temporary session until 11:59 pm the next business day
unless a longer peried--ef timeperiod is requested and required to resolve the issue.A
session may not exceed 3 calendar days unless IT is an active participant in the
pFejeetproiect,or the project is large in scope and approved by the IT Director or designee.If
longer time is needed an additional request must be made by a eeënty-County employee
through a service request.
Vendors may have unattended access only to their software server.If the vendor needs to
access a computer with a user loqqed in,the user must observe all work performed by the
vendor and be able to disconnect the vendor at any time.(CJIS 5.9 §5.5.6.2)
5.4.3.3 Publicly Accessible Computers
Publicly accessible computers (whether owned by the eewatyCounty or not)may not be used
to access,process,store or transmit Cateqory [link 7.4.10]3 or 4 eenfidential--information.
Publicly accessible computers include but are not limited to÷ hotel business center
computers,convention center computers,public library computers,public kiosk computers,
etc.(CJIS 5.9 §5.5.6.2)
5.4.4 Physical access
5.4.4.1 _IT_o_Office area
1.Access to the IT office will have the following restrictions:
1.Unrestricted access:IT staffemployees
2.When IT staff-isemployees are not present:Maintenance Director,Assistant
Maintenance Supervisor,and Maintenance Technician II who have passed a
background check
3.When accompanied by IT staffemployees:all other employees and non-
employees
4.For emergency purposes only:Commissioners,Sheriff,Undersheriffand the
Sheriffs command staff
2.The--exterier-IT entry doors will always remain locked or
attended and "Secure Area"will be prominently posted.
3.After-hours access must be scheduled with,or reported to,the IT Director or
designee.(CJIS 5.9 §§5.9.1.1-5.9.1.8)
5.4.4.2 Server Room
1.The server room will always be locked.
2.The entrance will be posted "Secure Area Authorized Personnel Only".
3.Authorized personnel are limited to IT staffemployees,Maintenance Director,
Assistant Maintenance Supervisor,and Maintenance Technician II who have passed
a background check.
4.Non-authorized persons who enter the server room must:
1.Be accompanied by an_lT staffemployee
2.Provide identification and credentials
3.Record their visit on the KGIT Server Room Secure Access Sign-In log (CJIS
5.9 §5.9.1.7)
21
5.4.5 Terminated employees
Immediately upon termination of any employee having physical access to IT,access codes
will be changed.
5.4.6 Monitoring
Kittitas County logs all activity traversing its network.IT may monitor and review logs for
operational analysis,security analysis,and policy compliance and provide reports to the
BOCCBoCC,HR,and DHIEOs.Requests for investigatory access to eeëntyCounty data is
governed by the CAMAS -Request for Access to Network Records form.
5.5 Responsibilities
5.5.1 Employees
1.Notify IT,with at least 48 hours'notice,when a vendor needs physical access.
2.Notify IT when a vendor needs remote access.
3.Prevent employee and non-employee access to IT without IT staffemplovee
supervision.
4.Prevent employee and non-employee access to IT restricted areas.
5.5.2 IT
1.Ensure a vendor NDA is signed prior to creating a vendor account for remote access.
2.Enable remote access for existing vendor accounts in a timely fashion when
requested by an employee.
3.Keep restricted area doors closed and locked.
4.Lock interior entrance door when IT stafNeemployees are-_not present.
5.Accompany and log visitors who access the server room.
22
Technology Policy 6 -Personal Equipment
6.Personal Equipment
6.1 Summary
The County allows use of some personal equipment to enhance productivity and safety.This
policy sets requirements for using personal equipment to conduct Kittitas County (KG)
business while maintaining the security of the network and public records.
If you use personal equipment for KCounty business,you must adhere to all related
administrative policies including employee conduct and rights,records management,
confidentiality,privacy,and security of County technology assets.
Kittitas County reserves the right to access,audit,and inspect your personal devices used to
conduct eeuntyCounty business and all information stored on them.You have no
expectation of privacy for materials viewed or stored on personal devices used to conduct
eeëntyCounty business.
6.2 References
1.Personnel Policy Manual 4-5 Outside Employment
2.Personnel Policy Manual 4-12 Technology Use
3.Records Management Policy and Procedures
4.Technology Policy 4 -Account Management
5.Technology Policy 5 -Access
6.Technology Policy 7 -Data Management,Access,and Protection
6.3 Definitions
6.3.1 Mobile device
A smartphone,laptop,notebook,tablet,or similar device that includes an operating system
and can run applications like e-mail,Internet aseessbrowser,and word processing.
6.3.2 Peripheral equipment
Hardware items that can connect to a computer and have no operatinq system or storaqe
capacity,e.q.,headsets,webcam,keyboards,mice,and speakers.For these technoloqv
policies,monitors are considered inventoried technoloqy and not peripheral equipmentA-
6.3.3 Personal equipment
Any equipment (wired or wireless,including computers,tablet PCs,USB,Bluetooth,serial
devices,flash memory,portable storage,MP3 players,wireless access points,routers,and
other network devices,)not owned by the eeuntyCounty,another government agency,or by
contract through which eeënty-County business is conducted.
23
6.3.4 Remote wipe
A process initiated outside of a mobile device that restores its configuration to the original-or
factory default-state.A remote wipe will remove all the data,settings,and apps you installed.
6.4 Policy
6.4.1 Authorization
Before you can connect personal equipment to any County system,you must first get
approval from your DHIEO-)and the IT Director.
To request connectinq a personal smartphone to Exchanqe (email),us_eing the Personal
Equipment Authorization Form (see CAMAS >Forms &Policies >Forms >Technology).
If you use authorized personal equipment for KGcounty business,you must adhere to all
related administrative policies including employee conduct and rights,records management,
confidentiality,privacy,security of County technology assets.
6.4.2 Public records
If you use authorized personal equipment to conduct eeunty-County business,you might be
required to produce equipment and phone records for public disclosure requests.If a court
order is served,your equipment may be searched and/or seized with or without your
knowledge or consent.
All primary records must reside on the network (see Technology Policy 7 -Data
Management,Access,and Protection).
If you are uncertain what any of this means or have any questions,see your Records
Manager/Public Disclosure Officer.For more information see the records management
policy and procedures.
6.4.3 Equipment support
KGIT provides support only for connecting authorized personal equipment to Exchange
Active Sync (EAS).KGIT will not provide training on how to use personal equipment;you will
need to contact the manufacturer or vendor for operating instructions.
6.4.4 Safety
It is your responsibility to use the-equipment prudently to ensure your safety and the safety
of your co-workers and the public.See the Personnel Policy Manual 4-12 Technology Use
for information on using mobile devices while driving a vehicle.
6.4.5 Public Wi-Fi
24
In certain areas of KG-County buildings,public Wi-Fi is provided.It is separate from ear--RKittitasCountyWi-Fi network.
You san-may connect personal equipment to the Internet over Wi-Fi using the Kittitas
County Public connection.
6.4.6 Attaching personal equipment
1.You may connect personal peripheral equipment (excludinq monitors)to your
computer.
2.You may not connect personal cell phones,tablet PCs,laptops,or other personal
non-peripheral equipment,directly or using VPN,to the KCounty network or to
computers connected to the network.(CJIS 5.9 §5.5.6.1)
Your DHIEOs may request IT give you remote access to your KGCounty computer using a_n
KGIT approved remote desktop solution.
You may not access,process,store,or transmit Cateqory [link 7.4.10]3 or 4 data on
personal equipment.(CJlS 5.9 §5.5.6.1)
6.4.7 Visitor and vendor owned equipment
1.Visitors and vendors may connect to the Internet via designated public access
network jacks or over Wi-Fi using the Kittitas County Public wireless network.They
may not connect to the Kittitas County wireless network unless pre-authorized by
IT.For more information see Technology Policy 5 -Access.
2.Vendors may connect to their equipment on the eeuntyCounty network via VPN over
the Internet.
6.4.8 Email
With DHIEO approval,KGIT will sync your mail-enabled personal equipment with Exchange
for email,contacts,and calendars.Email primary records are stored in KCounty's Exchange
Server.
If your authorized personal equipment is connected with--to EAS,you must follow these
rules:
1.Follow records management policy and procedures.
2.Check for and install security updates as they are made available by the
manufacturer.
3.Password protection must be enabled on the device and required after 15 minutes of
inactivity.Whenever possible the password must meet the requirements in
Technology Policy 4 -Account Management.
4.Smartphone passwords may be 4 digits if the screen lock is enabled after 1 minute of
inactivity;however,all digits may not be consecutive (e.g.,1-2-3-4)or duplicated
(e.g.,1-1-1-1).If the screen lock on inactivity is set for longer than 1 minute,the
password must,to the degree possible,meet the requirements in Technology Policy
4 -Account Management.
5.Do not share your password with anyone,including family,co-workers,and KGIT.
6.You must change your device password every 90 days.We recommend you make
25
this change when you change your County network password.
7.Report lost or stolen devices--as soon as the loss is noticed--to your DHIEO
regardless of time,day or night.DHIEOs must notify IT-staff-_or the IT Director as
soon as notified by their employee.KGIT will immediately remote wipe lost or stolen
devices.
8.Do not let your device store passwords automatically.
9.If you separate from service or change phones,you must visit IT to have your
KCounty email sync disableddisabled,and the email removed from your device.If
you do not,KGIT may wipe your personal phone.
10.You connect to the eeuntyCounty network at your own risk and tiKCounty is not
responsible for any damage to your device.
KGIT will register all devices connecting to EAS for KCountv email.
6.4.9 Smartphones and Tablet PCs
Smartphones and tablet PCs must meet the following standards:
Best Practice--Tip
1.Managed by EAS software which provides a remote data-
wipe capability Activate the find my phone feature if
2.Operate on Windows Mobile 6.1 or higher,Android available.
version 2.2 or higher,or Apple IOS 4 or higher Include 'return to'information,e.g.
See the Personnel Policy Manual 4-12 Technology Use for your name and a contact phone
cellular phone policies.number,on the device lock screen
wallpaper.
6.4.10 Portable storage devices
Portable storage devices include smartphones,laptop and tablet computers,flash (USB)
memory,MP3 players,and portable hard drives.They expose the eeantyCounty to security
risks such as:
•Loss/misplacement/theft of device and data
•Viruses and malware
•Multiple copies of documents creating possible version conflicts;see Technology
Policy 7 -Data Management,Access,and Protection
•The possibility for third parties to reconstruct files after they have been deleted.
You may not connect personal portable storage devices to any PC or other device
connected to the seanty-County network.If you need to transport records,a KG-
eweedCounty-owned portable storage device must be used.For more information,see
Technology Policy 7 -Data Management,Access,and Protection.
6.4.11 Repairs
As an employee of the eeuntyCounty,IT staff-employees will-may not work on an
employee's personal computer or equipment except for minimal phone troubleshooting for
issues relating to remote access.As an independent contractor,IT staff-emplovees may not
26
work on an employee's personal computer or equipment for any issue related to eeanty-
County business (see Personnel Policy Manual 4-5 Outside Employment).
6.4.12 County aData-access
Kittitas-The_County reserves the right to access,audit,and inspect your personal devices
used to conduct eeunty-County business and all information stored on them.
6.4.12.1 No expectation of privacy
You shall have no expectation of privacy for materials viewed or stored on your personal
devices used to conduct eeëntyCounty business.
6.5 Responsibilities
6.5.1 DHIEOldesignee
1.Ensure your staff-isemployees are aware of and compliesy with these policies.
2.Authorize device connection to the KCounty network using the Personal Equipment
Policy Authorization form,as needed for eeantyCounty business.
3.Report lost or stolen network connected personal equipment to an_lT staff-employee
or the IT Director.
4.Notify IT when employees who have network connected personal equipment
separate from service.
6.5.2 Employees
1.Manage and encrypt records on your network connected personal equipment.
2.Understand how to use your personal equipment.
3.Immediately report lost or stolen network connected personal equipment to your
DHIEOldesignee.
4.Immediately report virus or malicious software detection on your network connected
personal equipment to IT.
5.Keep your network connected personal equipment password protected,upgraded,
and patched.
6.Use your network connected personal equipment safely and securely.
7.Ask your DHIEO,supervisor,or IT if you have any questions about this or any other
policy.
6.5.3 IT
1.Register and document all personal equipment connecting to the KCounty network
and EAS.
2.Remote wipe any lost,stolen,or high--risk separation mobile network connected
personal equipment when notified.
27
Technology Policy 7 -Data Management,Access,and
Protection
7.Data Management,Access,and Protection
7.1 Summary
It is Kittitas-County policy to protect data from loss,misuse,destruction,theft,unauthorized
access,and environmental hazards.Every employee shares in--the responsibility for the
security of data by following this policy.
Kittitas County reserves the right to access,audit,and inspect eeuntyCounty-owned devices
and systems and all information stored on them.EmployeesEmployee shall have no
expectation of privacy for materials viewed or stored on eeuntyCounty-owned devices,
systems,computers,or servers.
7.2 References
1.CAMAS -Request for Access to Network Records
2.KGIT Internal Wiki -Network Backups
3.Kittitas County Code 2.55.030
4.Technology Policy 4 -Account Management
5.Technology Policy 5 -Access
7.3 Definitions
7.3.1 Data
Electronic files,e.g.,any electronic document,image,database,or report.
7.3.2 Designated records storage
A County network file share that is protected and backed up (i.e.,a letter designated drive
e.q.,G,H,and T),or a County provided application (e.q.,Laserfiche),or software-as-a-
service (e.q.,GovQA,OpenGov,Tyler Supervision,etc.)
7.3.3 Electronic records
Any data stored in diqital format used or created in the--couFee--efwhiledoing-conductinq
eeunty-County business.
7.3.4 Multi-Factor Authentication
The use of more than one type of authentication.The 3 factors of authentication are:
1.Somethinq vou know,e.q.,your password
2.Somethinq you have,e.q.,a token or one-time-passcode
3.Somethinq you are,e.q.,a fingerprint or retina scan
7.4 Policy
28
Employees shall only use systems and data for authorized purposes and disseminate
information only as authorized.(CJIS 5.9 §4.2)
7.4.1 Stored electronic records
All electronic primary records will be stored in a designated records storage netwerkfile-
share-appropriate for their data category [link to data categories].
If working on an electronic record not stored in designated records storage en a netwerkfile-
share-(such as on a laptop while travelinq),the updated version must be added to a
desiqnated records storaqe netwerk-file-shaFe-at the earliest opportunity.
Personal files (not eeunty-County business)may not be stored on eewaty-County designated
records storaqe netwerkfile-shaFes-or eeënty-County equipment.
IT is not responsible for records stored outside desiqnated records storaqe and for any
personal files,such as photos or music,stored on eewaty-County equipment-and-any--files-
Cateqory [link 7.4.10]4 data will be accessed,used,disseminated,retained,and
dispositioned as defined in applicable requlatory requirements.Category [link 7.4.10]4 data
stored outside a desiqnated records storaqe location or stored in the cloud (software-as-a-
service)must be 128-bit FIPS 140-2 certified encrypted.(CJIS 5.9 §5.10.1.2.1)
DHIEOldesiqnee is responsible for notifyinq IT where Category [link 7.4.10]4 data is stored
in designated records storage locations.
Improper access,use,or dissemination of Category [link 7.4.10]4 data is serious and may
result in proqressive discipline (includinq termination),revoked network access,and criminal
penalties in accordance with County policy and applicable laws.(CJIS 5.9 §4.2.5.2,5.12.4)
Employee questions reqardinq proper handlinq of Cateqory [link 7.4.10]4 data shall be
directed to their DHIEO.
7.4.1.1 G drive -Department
County electronic records will--may be stored on the department's network file share (G
drive).All department personnel have full read/write access to the department drive unless a
change is requested by the DHIEO.
7.4.1.2 H drive -Employee
Employee's electronic records may be stored in the employee's network file share (H drive).
DHIEOs will have access to all electronic records of their
department personnel,and elected officials/designees will have access to all electronic
records of their office personnel,without additional notice to the employee.All employees
will have an H drive unless a change is requested by the DHIEO.
7.4.1.3 T drive -Teams
29
County electronic records to be shared with other departments will--may be stored in the
teams'network file share (T drive).IT will create the folder and set permissions before files
may be added.
7.4.1.4 Cloud storage
Employees may use eeënty-County provided cloud storage for the storage and transmission
of secondary copies of electronic records if pre-authorized by the employee's depaFtment-
headleleeted--efficialDHIEOand the employee signs a cloud storage policy
acknowledgement form.
7.4.1.5 Laserfiche
Best Practice
Laserfiche is a County designated records storage location.
Laserfiche should be used for County
7.4.1.6 Additional locations primary records with a retention
requirement of qreater than 1 year,
Some software applications may require a data store in a unless stored in another County records
location specific to the application.Copies of such data are storaqe location that has records
not required to be stored en--the--G-N-er--T-drivesin another management functions (e.q.,not a
desiqnated records storaqe location.network file store).
7.4.2 Updates and Patch Management
All computer operating systems and software will be Best Practiceupdatedandproperlypatchedregularlywiththelatest
professionally acceptable updates ato reduce Provide it@co.kittitas.wa.us to vendors for
system vulnerability and to repairl-improve application upgrade notifications.IT will schedule andfunctionality.(CJIS 5.9 §§5.10.4.1 and 5.13.2(1))obtain update approval from the
DHIEOldesiqnees must notify IT when software upgrades DHIEOldesignee.
are available for capital software.
7.4.3 System access
A system is a software application (e.g.,Cashtax and Cayenta)or desiqnated records
storage file-sterelocation (e.g.,T drive subfolder)accessed via the eeunty County network-
.IT will grant access
following c-end tiensas follows:
1.For employees see Techno oqv Po icy 4.4.4 Access ControlAn e p eyee4Fem
2.For cGontractors,see Technology Policy 5 -Access.
30
The Kittitas County information systems and their component software and hardware are the
property of Kit‡itas-gCounty.The records,files,and data of an office headed by an
independently elected official are within the exclusive control of that elected official,while
acting in that capacity,and shall transfer to either a subsequently elected official for that
office or the BoCC in the absence of an elected
official.
Access to any records,files,or data under the control of such elected official is at the sole
discretion and authority of said elected official.Access to,and sharing of such records,files,
and data as necessary for the completion of work by other departments or offices shall not
be unreasonably withheld.
Disputes arising out of this policy shall be resolved by the
GemmissioneFSBoCC who shall have the final authority over the dispute.
If allegations of misconduct involve an elected official,the Human--ReseuFee Director and
Prosecutor must make a joint recommendation to the BoCC
to override this policy,based upon a determination that no other reasonable alternative to
conduct an investigation without access to such records exists,and provide documented
direction to IT via the CAMAS -Request for Access to Network Records form.
This policy will not supersede federal or state law governing access to data,e.g.criminal
justice and health records.
7.4.4 County aData--access
Kittitas County reserves the right to access,audit,and inspect eeën‡yCounty-owneddevices
and systems and all information viewed or stored on them.
7.4.4.1 No expectation of privacy
Employee shall have no expectation of privacy for materials viewed or stored on
eeuntyCounty-owned devices,systems,computers,or servers.
7.4.4.2 Request for access
Prior to granting an employee access to any electronic records of another departmentloffice,
including email and data regarding an employee's network and Internet usage,the CAMAS -
Request for Access to Network Records form must be completed.
7.4.4.3 Public disclosure
A½_Public diselesure-records requests will be processed by the DHIEO,or their designated
Public Diselesare-Records Officer,of the department maintaining the requested record.IT
will facilitate by providing access to records upon the DHIEO completing the CAMAS -
Request for Access to Network Records form.
County email,like all other public records,is subject to the Washinqton State Public Records
Act_and may be disclosed without prior consent or knowledge of the
sender or the receiver.
31
7.4.4.4 Investigations
Access to eeënty-County data may be granted without the DHIEO's knowledge or consent:
1.As ordered by a court of law and as advised by the Kittitas County Prosecutor.
2.As governed by the CAMAS -Request for Access to Network Records form.
7.4.4.5 Auditing
Kittitas County reserves the right to audit all activity on the eewatyCounty network.Access to
audit information is governed by the CAMAS -Request for Access to Network Records form.
7.4.4.6 Terminated/separatedemployees
Upon tennimationseparation,IT will provide the DHIEO or designee access to the
employee's secure files (H drive)and email.It is the responsibility of the DHIEO to ensure
retainable electronic records are moved into the appropriate location as defined in the
eeëntyCounty's record management policy.AfterUpon tennisationseparation,if requested,
IT will prepare the separated tennimated-employee's computer for reassignment.Also see
Technology Policy 4 -Account Management.
7.4.5 Backups
IT will maintain a backup of data stored _in_ea-the-eeunty-County network servers for 30 days
in a secure location.Surveillance videos and software-as-a-service will not be backed up.
Backups are not a data storage system;they are for business continuity and disaster
recovery only.Per Kittitas County Code 2.55.030,the County shall not search backup or
security systems for copies of public records.
7.4.6 UPS and surge protectors
All servers on the eeunty-County network will be maintained in an IT server room.All servers
will be powered through a UPS (uninterruptable power supply)that conditions the power
supplied to the server room protecting hardware and data from power related corruption.In
the event of a power outage,the UPS will power the servers while they shut down
automatically.
UPSs are recommended but not required for ad--desktop computers.If a desktop computer is
not plugged into a UPS,it must be plugged into a surge protector.IT will purchase UPSs as
requested and funded by the department.
7.4.7 Locking computers
All employees must maintain the security of their computer and the eeanty-County network
from unauthorized access.
·__When stepping away from controllview of their computer,employees will lock or log
out of their computer.
•_All computers will have the Windows Screen Saver set to engage after a maximum of
15 minutes of inactivity and require logon on resume.(CJIS 5.9 §5.5.5)
•In the interest of officer safety,devices that are part of a police vehicle are exempt
32
from the inactivity screen lock requirement.(CJIS 5.9 §5.5.5)
7.4.8 Transportationof eeuntyCounty data
Employees are responsible for protecting that-data and media under their control from loss,
misuse,destruction,theft,unauthorized access,and environmental hazards.
7.4.8.1 Physical transportation
Physical transportation of data is defined as copying data to removable media.Physical
transportation may only occur on eeunty-County equipment.
1.Employees will ensure that sensitive-confidential data (een-pub4eally
availableCategory 3 and 4 [link to 7.4.101)transported on any portable storage
device (not limited to USB flash memory,portable hard drives,laptops,CDs,DVDs)
are encrypted.IT will provide tools and assistance for encryption.--(CJIS 5.9 §
5.10.1.2.1)
2.Upon tennimationseparation,employees must decrypt any encrypted data or disclose
encryption passwords to their supervisor.
3.Portable storage devices must be stored in a secure location when not in use.
4.Environmental hazards to hardware,such as food,smoke,liquids,high or low
humidity,direct sunlight,magnetic fields,and extreme heat or cold,must be avoided.
7.4.8.2 Electronic transportation
All confidential information (Category 3 and 4 [link to 7.4.10])must be encrypted when
transported across any unsecured network (e.q.,email,the Internet,any non-County
network)or outside a physically secure area.
(Gd‡SCJIS 5.9 §§5.8.2 and 5.10.1.2)
7.4.9 Destroying and erasing media
Destruction of physical media means to damage the media making its data unreadable and
unrecoverable by any means.Erasing media means making data unrecoverable.
1.After backup media has passed its overwrite protection period it may be destroyed,
erased,or overwritten by IT-staff,and will not be searched for data.
2.Hard drives and removable media will be erased or Best PracticedestroyedbyITbeforebeingremovedfromeeunty-
inventory.At the time of erasing or destruction,IT will Verify with the vendor before theydocumentdateandmethodofdestructionintheasset's.arrive onsite to take the device thatinventoryrecord.they can provide this service.
3.When-Before computers or storage media are Fetamed-
redeployed or removed from County control (unless Make sure copier contracts forrequiredbyastateaqency)'purchase of the device provides fortheywillbeerasedandthedateandmethodwillbe.this removinq or erasinq the drivedocumentedintheasset's inventory record..onsite before purchasinq the copier.4_Optical disks (including software)will be destroyed when
removed from eeunty-inventory.Documents containing license information must also
be destroyed.
33
4-5.Copier/printer hard drives must be removed from the device and qiven to IT
for destruction or erased by the vendor with a 3-pass (DoD)wipe,prior to the device
leavinq County control.
(CJIS 5.9 §5.8.3 28-5-8-4)
7.4.10 Data Classification
Data classification refers to the sensitivity of the data and the impact to the County should
that data be disclosed,altered,or destroyed without authorization.Data classification is not
intended to be used to determine the disposition of documents subject to the Washington
State Public Records Act.
DHIEOs shall classify their data into one of the following categories:
Category 1 -Public
Public information is information that can be or currently is released to the public.It does not
need protection from unauthorized disclosure.
Category 2 -Sensitive
Sensitive information is for official use only and is not specifically protected from disclosure.
Sensitive information is generally not released to the public unless specifically requested.
Category 3 -Confidential
Confidential information is information that is specifically protected from disclosure by law.
Category 4 -Confidential with special handling
Confidential with special handling is information that is specifically protected from disclosure
by law and for which strict handling is required by statute,regulation,or agreement;and for
which serious consequences could arise from unauthorized disclosure.
IT will not be responsible for data misclassified by eeuntyCounty employees.
Edited from:Office of the CIO,Washington State
7.4.11 System Classification
System classification defines the hiqhest category of data that can be safelv stored in the
system without additional security measures,like encryptinq or redactinq data.
•IT will classify County systems.See Systems Classification wiki.
•Employees will store records in the appropriate system for the data's classification.
7.4.12 Network Diagram
IT will maintain a hiqh-level topoloqical drawinq depicting the interconnectivity of the County
network.The drawinq will be updated as chanqes occur and confirmed at least annually.
The drawinq shall include:
34
1.All communications paths,circuits,and other components used for the
interconnection,beginninq with the County-owned systems and traversing through all
interconnected systems to the County end-point.
2.The loqical location of all components (e.q.,firewalls,routers,switches,hubs,
servers,encryption devices,and number of computer workstations).
3."CONFIDENTIAL -DO NOT DISEMINATE (Category 4 -RCW 42.56.42)"markings.
4.The County's name and date (day,month,and year)the drawing was created or
updatedlreviewed.
5.Category [link 7.4.10]4 data and device locations (e.q.,CJIS and PCI).(CJIS 5.9 §
5.7.1.2)
7.4.13 Virtual Local Area Network Segregation
IT shall segregate,at a minimum,the followinq network traffic:
1.VolP (CJIS 5.9 §5.10.1.4(3))
2.Network printers
3.Each office and department
7.4.14 Network Equipment
Only IT shall access,modify,confiqure,or physically alter network equipment,e.q.,
switches,access points,etc.
7.4.15 Network Controlled Interfaces
IT shall ensure any connections to the Internet,other external networks,or information
systems occur through controlled interfaces (e.q.proxies,qateways,routers,firewalls,
encrypted tunnels).(CJIS 5.9 §5.10.1.1(3))
7.4.16 USB Storage Devices
USB storage devices (a.k.a.thumb drives,flash drives,USB drives,memory sticks,etc.)
represent a serious security risk to the County network and public records as they can be an
attack vector for malicious actors.
USB storage devices found in a public area or given to you by an untrusted source
(including the public),must be returned or discarded.Do not pluq it into any County
equipment.
Those qiven to you from a trusted official source,e.q.,vendor or conference,attorney,
consultant,law enforcement,etc.,must be scanned by IT prior to insertinq into any County
equipment,unless authorized by the IT Director.
USB storage purchased from a reputable store may be considered reasonably safe to use
out-of-the-box.
7.4.17 Credit Card Data and Devices
Credit card and cardholder data shall not be stored on the County network or any CVounty
device,including the followinq data:
35
•The credit card number or any portion thereof
•Expiration date
•Contents of the maqnetic stripe
•CVVICVC number
•PIN or the encrypted PIN Block
•Any other credit card,personal,or business identification information
Only PCI certified credit card equipment may be used for County business.
7.4.18 AdministrativeAccess
IT Director (and other IT employee as needed for business purposes)shall have
administrative access to all multi-user software and software-as-a-service for disaster
recovery/business continuity.
7.5 Responsibilities
7.5.1 DHIEO
1.Department Head/Elected Officials will use the CAMAS -Request for Access to
Network Records form if access to a current employee's files is required.
7.5.2 Employees
1.Store data on a network file server in the appropriate location.
2.Lock computers when away from controllview.
3.Encrypt data on portable devices.
4.Verify all eeunty-County records are removed from any computer or storage media
when no longer used.
5.When being removed from eeunty-inventory,send any technology equipment or any
media used for data storage to IT for proper disposition.
7.5.3 IT
1.Require use of the CAMAS -Request for Access to Network Records form to provide
access to current employee's files.
2.Backup all data stored on the network servers as scheduled,and maintain them in a
secure location (see KGIT Internal Wiki -Network Backups).
1.Monitor backup log files and correct or repair failures.
2.Test a restore from backup at least quarterly.
3.Maintain all eeunty-County servers and ensure they are protected by a UPS.
3.Destroy or erase storage media when removed from inventory and destroy license
information for destroyed software.
36
Technology Policy 8 -Email
8.Email
8.1 Summary
1.Email conducting eeënty-County business must be sent and received via the eeënty-
County email server or a County provided service.
2.Personal email may not be sent and received via the eeënty-County email server or a
County provided service.
3.Email is a document and is subject to public disclosure laws,documents retention
schedules,investigations,and auditing.
4.All confidential information must be encrypted to be transported outside the eewaty-
County Exchanqe email system.
8.2 References
1.CAMAS -Large File Transfer
2.CAMAS -Notification of Separation from Service
3.CAMAS -Request for Access to Network Records
4.KGIT User Wiki -Encrypting a Document
5.KGIT User Wiki -Large File Transfer (Over 10MB)
6.Records Management Policy and Procedures
7.Technology Policy 7 -Data Management,Access,and Protection
8.3 Definitions
8.3.1 County email
Email message including attachments that meet any of the following criteria:
1.Sent or received through the eeuntyCounty email system.
2.Conducting eeunty-County business.
3.Sent or received by an employee acting on behalf of the eeuntyCounty,regardless of
the email system used.
8.3.2 County email system
A system provided by the County for sendinq County business email that is controlled and
accessible by the County.These include Exchanqe,G-Suite,and some software-as-a-
service (e.q.,Tyler Supervision).
8.3.3 Exchange
The Microsoft Exchanqe Server that sends and receives co.kittitas.wa.us email (accessed
via Outlook or Outlook Web Access).
8.3.4 Phishing
The criminally fraudulent process of attempting to acquire sensitive information such as user-
nameusernames,passwords,or credit card details by masquerading as a trustworthyentity
37
in an electronic communication or via telephone.
8.4 Policy
Email conducting eewa‡y-County business must be sent and received via _a_¾
County email systemserver.If the-a_eeunty-County email server-system is unavailable and
email communication is required to conduct essential eeunty-County business as determined
by the DHIEO,staff-emplovees may utilize e‡her-another email systems;however,the email
must be feFwaFded-copied to the-a_eeënty-County email server-system at the employee's
earliest opportunity and the employee recognizes their-the_email account used may be
subject to public disclosure Feques‡sg.
Email is a document and is subject to public disclosure laws,documents retention
schedules,investigations,and auditing.
8.4.1 Security
All confidential information (Cateqory [link 7.4.10]3 and 4 data)must be encrypted to be
transported outside the eeunty-County Exchanqe email system (e.g.,to a non-
co.kittitas.wa.us email address).See KGIT User Wiki -Encrypting a File for LiFT.(GJiS-CJIS
5.9 §5.10.1.2)
8.4.2 Retention
Do not delete email fFem--Outteek-until the email has passed its retention requirement (see
the WA State Archives Local Government Records Retention Schedule),then delete it.
Email is a public record.
Public records must be kept in their original format until they have passed their retention
requirement.You may not print and delete email in lieu of retaining the digital email.
Records management (the storing and disposition of public records)is the responsibility of
each employee.IT is responsible only for maintaining the systems that store records;
employees are responsible for manaqement of records stored within the system.
8.4.3 County aAccess
County email is the property of Kittitas County.Kittitas County reserves the right to access
any eeunty-County email for any and all purposes including but not limited to public
disclosure,investigations,and auditing.See Technology Policy 7 -Data Management,
Access,and Protection.DHIEOs will have access to all
electronic records of their emplovees
without additional notice to
the employee.
8.4.3.1 No expectation of privacy
Employee shall have no expectation of privacy for materials viewed or stored on
eeuntyCounty-owned devices,systems,computers,or servers.
38
8.4.3.2 Terminated/separatedemployees
Af‡er-When an employee's separat_esien from service,IT will archive the employee's
Exchange mailbox in-E-xchange-and provide the DHIEO access to the employee's email
archive as directed on the CAMAS -Notification of Separation from Service form.The
DHIEO is responsible for management of their public records.When no retainable public
records remain in the separated employee mailbexemail archive,the DHIEO will request that
IT delete the account.
The DHIEO has 3 years to complete the disposition of the separated employee's email
archive at which time the email must be moved to another account for future disposition.At 3
years,separated elected official's email accounts shall be transferred to the OSOS for
appraisal,or to the diqital archives.
8.4.3.3 Transferring employees
When an employee transfers to another departments,IT will make--an-archive ti
employee's in--Exchange of their-mailbox.The DHIEO of the originating department will be
given access to the Exchange--archive.All email will be deleted from the employee's
Exchange mailbox so the employeey no longer have-_h_as_access to the originating
department's primaFy-records.
8.4.4 Personal email
Employees must-shall not use M_a_eeënty-Countyemail aseeëntservice for personal use.
8.4.5 SPAM and junk-mailfiltering
Kittitas County provides email filtering of eeunty-County Exchanqe email accounts.
Employees are responsible for monitoring the filtered messages for mistakenly filtered email.
Employees shall delete any SPAM or junk-mail filtered or received.
8.4.6 Phishing and Malware
Employees shall not click on unknown or unexpected links,download or open unexpected
files,or provide any sensitive or confidential information (e.g.User-nameusername,
password,and account numbers)via email,telephone,or web page without verifying that
the requester and method are authentic.
8.4.7 Sending Attachments
Attachment size in Exchanqe is limited to 25MB.The recipient's email
system may also place a size limit on emails (including attachments).If you need to send a
file larger than the limit use LiFT,the CAMAS -Large File Transfer feature or a DHIEO
authorized OneDrive account.See KGIT User Wiki -Large File Transfer (Over -WMB25MB).
8.4.8 Storage
1.Auto archiving and the use of personal PST files (a file format for storing email
messages and other Outlook files)are prohibited.
2.Primary email records may only be stored on the Exchange server in an employee's
39
mailbox or as an MSG file on a network file share.
8.4.9 Shared email accounts
A shared email account is defined as multiple users having access to one email account,
i.e.,the department's public email account aeeess--te--aseeunts-listed on the eeunty's-
County's public-web-site:Ídepartment--namel@co.kittitas.wa.us.
1.Access to shared email must be requested by the DHIEO.
LGFeup-Sharedemail access will be limited to 5 individuals.
3.Verification of need,monitorinq,and employee access will be provided by the
overseeinq DH/EO annually.
8.4.10 Review and Automatic Replies
Email accounts must be reviewed frequently to ensure proper public records request
response and customer service.If an email account cannot be reviewed on a weekly basis,
employees shall use an out-of-office automatic reply to notify senders how to obtain timely
assistance.
8.5 Responsibilities
8.5.1 DHIEO
1.Process public disclosure requests for email maintained by their department.
2.Request access to shared email for each required employee from IT.
8.5.2 Employees
1.Send and receive eeuntyCounty email through a eeanty-County email
aseeantsystem.
2.Retain eeunty-County email based on content according to their department's
retention schedule and document management policy.
3.Not use eeënty-County email systems for personal use.
4.Monitor filtered messages for mistakenly filtered email.
5.Delete any SPAM or junk-mail received.
6.Not click on unknown or unexpected links or provide sensitive information unless the
requester and method are authenticated.
7.Not auto archive eeunty-County email.
8.Store eeënty-County email in the County email system
ther-manbex or as an MSG file on a network file share,and not in PST files.
9.Not transmit copyrighted materials without permission of the copyright owner.
10.Encrypt confidential information sent via-outside the County Exchanqe email system.
8.5.3 IT
1.Facilitate processing public disclosure requests by providing departmental access to
email accounts.
2.Provide investigative and audit access based on an approved CAMAS -Request for
Access to Network Records form or valid court order.
3.Provide DHIEO access to their terminated employee's archived Exchanqe email as
40
directed on the Change of Service form.
4.Archive terminated employees'Exchanqe mailboxes.
5.Limit gFeup-shared email access to thFee-_5_individuals.
41
Technology Policy 9 -Internet
9.Internet
9.1 Summary
Access to the Internet is provided to employees for the benefit of Kittitas County.Misuse or
abuse may result in corrective action,including terminating an employee's access,
progressive disciplinary action,and/or termination.
9.2 References
1.CAMAS -Request for Access to Network Records
2.KGIT User Wiki -Safe Computing Best Practices
3.KGIT User Wiki -Software employees can install and update
4.Personnel Policy Manual 4-12 Technology Use
5.Records Management Policy and Procedures
6.Technology Policy 10 -Viruses and Malware
7.Technology Policy 13 -Mobile Devices
9.3 Definitions
9.3.1 Transitory communication
Non-archival and non-essential records with retention and disposition action defined as
"Retain until no longer needed for agency business then Destroy"by the Washington State
Archives.See the Records Management Policy and Procedures.
9.4 Policy
9.4.1 Acceptable use
See the Technology Use section of the Kittitas County Personnel Policy Manual for
acceptable use.
9.4.2 Unacceptable use
Employees must not use the Internet for purposes that are illegal,unethical,or may be
harmful to Kittitas County.
9.4.2.1 Internet-based communications Best Practice-Tip
No Internet communications method .
eeën‡yt--RetweFk-may be used to conduct eeuntyCounty business aon tobneept eossaaneds
unless a eeuntyCounty policy,contract,interlocal agreement,RCW,
federal,or Washington State agency governs or provides for the service.simple (e.g.,I'm at the
....inspection location.PleaseThisincludes,but is not limited to the following:call my next appointment
1.Instant messaging (i.e.,texting,Jabber,and chatting),except for and let them know I'm
transitory communications and/or those with minimal retention running behind).
value -see Secretary of State's definition of transitory
42
communication public records
2.Blogs
3.Forums
9.4.2.2 Streaming media
Streaming media for personal or non-Kittitas-County business use er-peFsenal--use-is
prohibited on the Kittitas County Wi-Fi.Use of streaming audio or video,e.g.online radio,
Real Audio,YouTube,Hulu,and Windows Media Player,is limited to business use only.
Personal use is allowed only on the Kittitas County Public Wi-Fi.
9.4.2.3 Downloads
Employees will not download and install files from the internet (e.g.,software,fonts,screen
savers,etc.)unless it has been pre-approved by IT.See KGIT User Wiki -Software
employees can install and update.
9.4.3 Internet Safety
See Technology Policy 10 -Viruses and Malware and KGIT User Wiki -Safe Computing
Best Practices.
9.4.4 Monitoring
See Technology Policy 5.4.6 Monitoring.
9.4.5 Blocking Content
Kittitas County reserves the right to block Internet activity based on category of site content.
9.5 Responsibilities
9.5.1 Employees
1.Not misuse or abuse Internet access.
2.Not use streaming media for non-eeënty-County business or personal use.
3.Not install downloaded software unless it is pre-approved by IT.See KGIT User Wiki
-Software employees can install and update.
4.Not click on unknown links or visit non-trusted Web pages.
9.5.2 IT
1.Maintain a list of software approved for download and installation.
2.Provide access to eeuntyCounty data as governed by the CAMAS -Request for
Access to Network Records form.
43
Technology Policy 10 -Viruses and Malware
10.Viruses and Malware
10.1 Summary
Each e_County employee plays a critical role in keeping the eeuntyCounty's information
secure.Viruses and malware represent a major threat to that security.Stop.Think.Connect.
10.2 References
1.KGIT Security Presentation
2.KGIT User Wiki -Safe Computing Best Practices
10.3 Definitions
10.3.1 Computer viruses and malware
Programs designed with the malicious intent to infiltrate and/or damage records or a
computer system without the owner's informed consent.
10.4 Policy
10.4.1 Malicious Code Protection
IT shall implement malicious code protection that includes automatic updates for all systems
with Internet access.Systems not connected to the Internet shall be kept current with
malicious code protection updates (i.e.most recent update available).(CJIS 5.9 §5.10.4.2)
IT shall employ virus protection mechanisms to detect and eradicate malicious code (e.g.
viruses,worms,Tro an horses)at critical points throuqhout the network and on all
workstations,servers,and mobile computinq devices on the network.(CJIS 5.9 §5.10.4.2)
10.4.2 Spam and Spyware Protection
IT shall implement spam and spyware protection,and shall:
1.Employ spam protection mechanisms at critical information system entry points (e.q.
firewalls,electronic mail servers,remote-access servers).
2.Employ spyware protection at workstations,servers,and mobile computinq devices
on the network.
3.Use the spam and spyware protection mechanisms to detect and take appropriate
action on unsolicited messaqes and spywareladware,respectively,transported by
electronic mail,electronic mail attachments,Internet accesses,removable media
(e.q.diskettes or compact disks)or other removable media as defined in this Policy.
(CJIS 5.9 §5.10.4.3)
44
10.4.3 Intrusion Detection
IT shall:
1.Implement network-based and/or host-based intrusion detection or prevention tools.
2.Maintain current intrusion detection or prevention signatures.
3.Monitor inbound and outbound communications for unusual or unauthorized
activities.
4.Send individual intrusion detection loqs to a central loqqinq facility where correlation
and analysis will be accomplished as a system wide intrusion detection effort.
5.Review intrusion detection or prevention loqs weekly or implement automated event
notification.
6.Employ automated tools to support near-real-time analysis of events in support of
detectinq system-level attacks.
(CJIS 5.9 §5.10.1.3)
10.4.4 Employee Accountability
All eeuntyCounty employees will practice safe computing by scanning removable media,not
knowingly introducing a virus,and not clicking on links or visiting non-trusted web pages.For
more safe computing practices,see KGIT User Wiki -Safe Computing Best Practices.
If a virus or malware infection is suspected,employees must notify IT and their DHIEO
immediately.IT may remove,disconnect from the network,or turn off any computer
suspected of being infected.
The employee may be responsible for payment of any expense incurred due to their
negligent or malicious use of eeuntyCounty technology at the actual rate of expense.
Outstanding debt may be recuperated through payroll deduction without the prior consent of
the employee.
10.5 Responsibilities
10.5.1 Employees
1.Not knowingly introduce a virus into Kittitas County computers or network.
2.Discontinue computer use and immediately contact IT if they suspect their
workstation has been infected by a virus or virus protection software is disabled or
suspected to be not up to date.
3.Not click on unknown links or visit non-trusted Web pages.
4.Be familiar with Technology Policy 6 -Personal Equipment.
10.5.2 IT
1.Install and maintain appropriate anti-virus software on all computers.
2.Respond appropriately to infections and intrusions.This may include a quarantine of
affected systems,destroying detected viruses,and repairing or destroying infected
files.
3.Install all security related software patches in a timely manner.This may include
integration testing.
45
4.Ensure all applications developed in-house follow best practices to guard against
known malicious attacks and intrusion methods.
46
Technology Policy 11 -Websites
11.Websites
11.1 Summary
Kittitas County maintains a Web presence to facilitate communication to the public of its
services.The BOCC BoCC is responsible for the eeëntyCounty online presence in all forms.
KGIT is responsible for the design and administration of the content of the eewatyCounty's
online presence.
11.2 References
1.CAMAS -ENSS Instructions
2.CAMAS -IT Service Request
3.CAMAS -Press Release
4.KGIT User Wiki -Codifying County Ordinances
5.KGIT User Wiki -Email Notification Subscription Service (ENSS)
6.KGIT User Wiki -Emergency Operations Web Site
7.KGIT User Wiki -New Application Development
8.KGIT User Wiki -Web Site Review by DHIEOs (including SiteCheck)
9.Technology Policy 1 -Enforcement
11.3 Definitions
11.3.1 Content
What is presented,e.g.,text,images,video,audio,and downloadable files.
11.3.2 Design
How content is presented,e.g.,the color,layout,user interface,and overall look and "feel".
11.3.3 Online presence
Content and activity represented on the Internet under the County's name that can be found
via an online search,e.q.websites,email,social media services
emad--addFesses.
11.4 Policy
11.4.1 Roles
11.4.1.1 BOGGBoCC
The BoCC)is responsible for the eeuntyCounty's
online presence in all forms.Only authorized persons may create,use,or promote any
online presence that represents Kittitas County or a division thereof.
11.4.1.2 ITC
47
The Information Technology Committee (ITG)-operates as an advisory board to the BOCC
BoCC and is under its direction.The ITC oversees the eewatyCountv"s web-sites and
ensures adherence to these policies.
11.4.1.3 Webmaster
The IT Application Development Manaqer WeM)eveloper-acts as webmaster for all
eeëntyCounty Web-sites and takes direction from the IT Director.The webmaster is
responsible for overseeing and prioritizing development of the web-sites and its supporting
systems,and for the security of the web-sites.All content published to the eeuntyCounty's
Web sites will be uploaded by or in conjunction with the Webmasterwebmaster.
The Webmasterwebmaster,under the direction of the IT Director,sets the eewatyCounty
style guide and design elements of the eeëntyCounty's Internet presence.
11.4.1.4 DHIEOs
Each DHIEO)is responsible for the content within their
area of operation as defined by this policy.The DHIEO or designee must approve all content
and ensure it complies with these policies before it is put on their Web-we_bpage.
11.4.2 The public site
http://www.co.kittitas.wa.us is the eeuntyCounty's official web-site.All public Web content will
be placed within the co.kittitas.wa.us domain,except as provided within this policy.The
mission of the Web-w_ebsite is to support DHIEO's in providing services and information to
the public in a highly usable,accessible,consistent,and intuitive manner.
11.4.2.1 Home page
The eeunty-County home page is the portal to all eeanty-County Web-we_bsites.It shall
contain links to areas of the site such as departments,services,general eeuntyCounty
information,important topics,events,and employment.
11.4.2.2 Department pages
DHIEOs are responsible for providing information for their department Web page.DHIEO
sites shall be accessed as "http:llwww.co.kittitas.wa.usl[department name]".
11.4.2.3 County code
The Kittitas County Code is published on the public Web-w_ebsite.Updates to the code are
made by the Webmaster-webmaster as directed by the BOCC BoCC in eeantyCounty
resolution or ordinance.See KGIT User Wiki -Codifying County Ordinances
11.4.2.4 Emergency operations
When an emergency is declared by the federal government,State of Washington,or a
Kittitas County local government,and for the duration of the activation of the Emergency
Operations Center (EOC),IT will provide web development services to the EOC to facilitate
communication between the Public Information Officer (PIO)and the public.See KGIT User
48
Wiki -Emergency Operations Web Site for more information.
1.As soon as possible after a declaration of emergency is signed,the Incident
Commander or PIO will contact the webmaster or IT Director and outline EOC needs
and expectations.
2.Content must be submitted to the webmaster by the PIO.
3.Content must meet all content and page requirements outlined in this policy;
however,it does not need to be pre-approved by the ITC.
4.Press releases sent by the PIO through the CAMAS Press Release feature will be
posted on the emergency page.
11.4.2.5 Content requirements
All content on the site must meet the following requirements it must be:
1.In support of the public Web-wasite mission.
2.Within the purview of the department adding the content to their own department site.
3.Information the public would expect to see on that department's site.
4.Free and publicly available through other means,i.e.,not the original and therefore
not the primary copy of a public record.
5.Void of broken links and out-of-date,irrelevant,or inappropriate content.
6.In compliance with all laws,i.e.,copyright,privacy,and intellectual property.
7.Ready for public presentation,i.e.,complete,accurate,void of spelling and grammar
mistakes,and formatted generally as intended to be presented.
8.If photo,imagery,audio,and video content,substantive and provide a necessary and
significant addition to the text content.
9.If downloadable print media:
1.PDF file format,made from the original electronic document when available
2.Void of viruses or malware
3.If a eeuntyCounty document,include authoritative source information
including,at a minimum,the eeantyCounty name,the department name,and
a published date.It should also include the eeëntyCounty logo,author's
name,and credited source information.
4.If a republished document,include the original publisher's author information.
The DHIEO or designee must obtain the author's permission to reprint.If
available on the publisher's site and the site falls within this policy'ies
hyperlinking provisions,the link will be to the publisher's page and not to a
copy on the eeëntyCounty's site.
5.Include metadata;at a minimum,the title of the document,the eeantyCounty
name,and the department name.
6.If a form,contain PDF form fields with Extended Features enabled.
10.Audio files must be MP3,SRS,or FTR format.A link to the player may be provided.
11.Video files must be in WMV,MOV,AVI,or FLV format.A link to the player may be
provided.Embedded video will be in FLV format.
12.Photographs taken by eeuntyCounty employees in their capacity as eeuntyCounty
employees may be used on the public web site with the following exceptions:
1.Photographs that include a person who appears to be a minor and is
recognizable are prohibited.
2.Photographs that include a person in a public venue,who does not appear to
be a minor,are permitted without obtaining the person's permission except
where:
49
1.The image would be highly offensive to a reasonable person;and
2.The image is not of legitimate concern to the public.
3.Photographs of people in private venues are prohibited.
13.Photographs not taken by eeuntyCounty employees require a license agreement (for
stock photography)or a signed release allowing use (for professional or amateur
photographers).
Content must:
1.Not provide direct email addresses,except for those of elected officials.
2.Not be for commercial,non-Kittitas County purposes,or personal or private gain.
3.Not link or provide a URL to web sites or content not on its own site except where the
page or content is controlled by one of the following:
1.Agencies over which Kittitas County has
1.appointing authority
2.a pass--through contract
3.a contract to provide services
4.an agreement to provide or receive funding
2.Other US government or United Nations controlled web sites
3.Providers of file format reader software of eeantyCounty web published
content,i.e.,Adobe Acrobat Reader,FTR Player,etc.
4.Providers with which Kittitas County has an agreement to provide a service
5.Organizations and associations of which Kittitas County has requested and
accepted membership
4.IT shall have the authority to deny linking to any site that is deemed not secure or
which may pose a security risk to the Kittitas County IT systems or users.
5.Not be a place-holder for future content,such as 'under construction'or 'coming
soon'.
6.Not link to,provide a URL for,or direct users to payment processing vendors unless
they have been approved by the Treasurer and legal counsel.
11.4.2.6 Page requirements
1.All Web-w_ebpages will adhere to the co.kittitas.wa.us Style Guide.
2.Each department home page will include the department's contact information.
3.Any page collecting information will describe how the information will be used and
maintained.
4.No page will collect or store financial or other sensitive information.Payments will not
be accepted directly through co.kittitas.wa.us.
5.Pages will be generally accessible to the public.
6.Pages will protect against unauthorized access to data and the network.
11.4.2.7 Providing content
1.New content will be submitted by the DHIEO or designee via a CAMAS -IT Service
Request to the ITC for approval.
2.Updates or additions to current content will be submitted by the DHIEO or designee
via a CAMAS -IT Service Request.
11.4.3 KVEC sites
50
11.4.3.1 The KVEC site
http://www.kittitasvalleyeventcenter.com is the URL of the official KVEC Web-w_ebsite.The
Event Center Director,under the direction of the BOCCBoCC,is responsible for its design,
eententcontent,and hosting by a 3rd party.The KVEC site will follow all publishing policies
set forth in this document;however,exception is granted to allow 3rd party hosting,a
distinctive design,hyperlinks to 3rd party event Web-w_sites,and links to the KVEC
Facebook and Twitter sites.Social media sites must include prominent language directing
users to the official Web-website.
IT will have administrative ocess to all 3rd party accounts.
11.4.3.2 The fair site
http://www.kittitascountyfair.com is the URL of the official Kittitas County Fair Web-website.
The Event Center Director,as advised by the Kittitas County Fair Board of Directors,and
under the direction of the BOCCBoCC,is responsible for its design,content,and hosting by
a 3rd party.The fair site will follow all publishing policies set forth in this document;however,
exception is granted to allow 3rd party hosting,a distinctive design,information about Kittitas
County Fair sponsors,a hyperlink to each sponsor's official Web-w_site,and links to the
Kittitas County Fair Facebook and Twitter sites.Social media sites must include prominent
language directing users to the official Web site.
IT will have administrative access to all 3rd party accounts.
11.4.4 The eeuntyCounty'sintranet
CAMAS is the eeuntyCounty's intranet and is not accessible to the public.The mission of the
eeuntyCounty's intranet is to provide information and applications to increase productivity
and efficiencies in and between employees and groups of employees.
11.4.4.1 Department pages
Each department will have a CAMAS home page.Each employee's Internet browser home-
page will be their department's CAMAS home-page.The DHIEO is responsible for providing
content for their CAMAS page(s).
11.4.4.2 Access
Employees may access CAMAS through the Internet at https://camas-net.co.kittitas.wa.us.
Security is hierarchically controlled;pages and applications may display content viewable
only by department employees,content restricted to only certain employees,or content for
use by all eeunty-County employees.Pages and applications with configurable security will
be controlled through Multipass (a CAMAS security module)by DHIEO or designee.
Utilization of this system does not supersede management's right to set work hours and
location.
11.4.4.3 Applications
For development of new applications on CAMAS,see KGIT User Wiki -New Application
Development.
51
11.4.5 Web maintenance
Except as provided elsewhere in this policy,the IT Applications division will perform all web-
site maintenance which includes editing and creating pages and application development for
all eeunty-County web-sites.The webmaster will be responsible for scheduling web
maintenance.Higher priority will be given to:
1.Providing time-sensitive information
-3-2.Increasing efficiencies of eeëntyCounty employees
4-3.Providing service to the public
Web maintenance requests must be submitted in electronic format through a CAMAS -IT
Service Request.
A content management system may be employed,at the webmaster's discretion,to allow
direct content management by DHIEO or their designee.
11.4.6 Content Review
11.4.6.1 Annual review
An annual review of a department's web sites must be conducted by the DHIEO (may not be
deliqated)to ensure accuracy and awareness of content.See KGIT User Wiki -Web Site
Review by DHIEOs (including SiteCheck).The DHIEO must complete the review within 30
days of notice.The Lower District,Upper District,and Superior Court Administrators and the
Clerk of the Board of County Commissioners may perform the review on behalf of their
elected officials.
11.4.6.2 Broken links and misspellings
DHIEOs are responsible for all content on their pages.Broken links and misspellings must
be corrected within 10 days of notice.See KGIT User Wiki -Web Site Review by DHIEOs
(including Sitelmprove).
11.4.7 Webmaster email
The purpose of this policy is to direct the processing of email sent to the County webmaster
at webmaster@co.kittitas.wa.us.The Web-we_bsite
will clearly note that the webmaster email is:
1.To be used to report problems encountered with the functionality of the Web site.
2.To suggest changes and enhancements.
3.Not intended for public diselesure-records requests.Public diselesure-records
requests must be submitted to the department maintaining the records usinq the
County's public records portal.
4.Monitored at least once a week.
5.Handled in the following manner:
1.Junk email -Unsolicited email of a non-business nature that does not relate
to eeënty-County operations will be deleted with no reply.
52
2.Unsolicited email -Product,service,or general information of a nature related
to c-eunty-County operations will be forwarded to the appropriate DHIEO.No
further action will be taken by the webmaster.
3.Direct requests for non-eeëntyCounty information -Requests for information
not relating to eeenty-County operations will be responded to by the
webmaster.If an answer or referral for an answer can be determined within 5
minutes,it will be replied.If an answer or referral cannot be determined in 5
minutes,a reply stating the questionlinquiry does not fall within eeënty-County
operation will be sent along with links to community resources that may-miqht
helgm.
4.Direct requests for eeuntyCounty information -All requests for eeantyCounty
information will be forwarded to the appropriate DHIEO copying the requestor.
No further action will be taken by the webmaster.
5.Web site information -Email regarding the operation of the web-site will be
handled and answered by the webmaster within one week.
11.4.7.1 DHIEO
Each DHIEO will respond in a timely manner to email forwarded to them by the webmaster.
In the event an email is forwarded incorrectly,the DHIEO will immediately forward the email
to the correct office and copy the webmaster and the requester.
11.4.8 Email notification subscription service (ENSS)
The eeëntyCounty ENSS is an email signup list the public can join to receive emails on
specific topics.Each department may make lists to which the public can sign up.Authorized
employees may send email to the list using the CAMAS -Email Notification Service.See
KGIT User Wiki -Email Notification Subscription Service (ENSS)for more information.
DHIEOs will request creation of new subscription lists via a CAMAS -IT Service Request for
ITC approval.
11.4.8.1 ENSS email requirements
Each email must:
1.Not violate eeuntyCounty policies or laws governing email.
2.Be sent through the ENSS system,or by the DHIEO-er-/designee from the
department email account or the DHIEO%account.
3.Hide recipient email addresses from other recipients.
4.Include the approved anti-spam notice.See CAMAS -ENSS Instructions.
11.4.8.2 ENSS functional requirements
The ENSS service must:
1.Allow public users to manage their subscription online.
2.Provide ability to reset forgotten passwords via email to the email address registered.
3.Post a privacy notice in the subscription area on the public Web site.
11.4.9 Vendor provided Web-we_bpages
53
Vendors with which Kittitas-the_County has an agreement to provide a service may publish
web content on behalf of the eeënty-County if:
1.The Kittitas-Gewaty-ITC has authorized the publication
2.The content is not branded as being a Kittitas-County website;it must be clear to the
user the website belongs to the provider and not Kittitas County
1.The vendor website may not mimic the design of the co.kittitas.wa.us website
2.The eeunty-County logo,if used must be below or to the right of the vendor's
logo
11.4.10 Enforcement
In addition to Technology Policy 1 ---Traininq and Enforcement,violations or failure to
comply with this policy may result in removal of the DHIEOs website or suspension of
application development upon notice by IT.
11.5 Responsibilities
11.5.1 DHIEO
1.Ensure all web content submitted meets content requirements.
2.Allow for 2 business day turnaround time on all non-emergency requests.
3.Submit all requests in electronic format through IT service request.
4.Perform semiannual reviews of sites within 30 days of notice.
5.Monitor and correct broken links and misspellings.
6.Ensure all downloadable documents are virus-free,in the correct file format,contain
authoritative source information,and contain appropriate metadata.
7.Respond in a timely manner to public email forwarded by the webmaster.
8.Request email notification lists in a service request to be approved by the ITC.
9.Only send ENSS email through department or DHIEO email address.
10.Ensure ENSS recipients email addresses are not seen by other recipients.
11.Ensure the anti-spam notice is included in any ENSS email.
11.5.2 Information Technology
1.Publish eeunty-County code as directed by BOCC BoCC resolutions.
2.Provide web development to the PIO during a declaration of emergency.
3.Ensure all pages meet page requirements and style guidelines.
4.Perform all web-site maintenance or provide a mechanism for secure management
by DHIEO or designee.
5.Prioritize web maintenance and development.
6.Update the web-sites as requested by the DHIEO and as approved by the ITC or
policy.
7.Process all webmaster email in the manner defined above.
8.Provide ENSS with ability for public users to manage subscriptions,retrieve forgotten
passwords,and display the privacy notice on the signup page.
54
Technology Policy 12 -GIS
12.GIS
12.1 Summary
IT serves as the GIS data steward.The department responsible for collecting and
maintaining the data is the owner of the data.
12.2 References
1.KGIT User Wiki -GIS Data Collection and Creation
12.3 Definitions
12.3.1 GIS
Geographic Information System (GIS)is a computer application used to store,view,and
analyze geographic information.
12.4 Policy
12.4.1 County GIS Data
12.4.1.1 Ownership
Ownership,for the purpose of this policy,is intended to prevent orphaned data,not to
control access.Many departments maintain data within the eeëntyCounty's GIS.The
department responsible for collecting and maintaining the data is the owner of the data;
however,arrangements may be made between departments for one department to maintain
another department's data.
12.4.1.2 Stewardship
The_lT GIS Coordinator serves as the County's GIS data steward.IT GIS employees creates
and maintains the systems and tools used to store,view,and analyze GIS data-The-IT-G‡S
arni Geordinater-will add all new data layers that meet this policy's requirements to the
seantyCounty's enterprise GIS database.
12.4.1.3 GIS data criteria
Data added to the eeuntyCounty's GIS will meet the following criteria:
1.Use State Plain Washington South coordinate system
2.Use North American Datum 1983 (NAD83)
3.Display units in survey feet
4.DHIEO data owner,in coordination with the GIS Coordinator,will develop accuracy
standards to which their data will adhere.
12.4.1.4 Metadata requirements
55
All data will contain metadata as defined in KGIT User Wiki -GIS Data Collection and
Creation.Data without metadata will not be added to the eeunty-County GIS database and
will not be posted on the eeënty-County Web-w_ebsite.
12.4.2 GIS data collection/creation
All data collected/created will follow procedures outlined in KGIT User Wiki -GIS Data
Collection and Creation.
12.4.3 Access to data
1.Only the data owner or their designee may edit their data.
2.IT will maintain a GIS mapping web application for employee and public use.
3.All eeuntyCounty-owned data meeting the requirements of this policy will be
downloadable in raw ESRI data layer format on the eeëntya-County's public
Websi‡ewebsite,unless the data owner DHIEO or designee makes arrangements
with IT or the ITC designates the data as sensitive.
12.4.4 Third party data
IT may include third party data in the eeunty%-County's GIS.This data may be used by
eeënty-County agencies.Third party data will not be provided for download on the eewaty%-
County's websiteWelvde.
12.4.5 GIS User Group
The GIS Coordinator will regularly convene a user group meeting for all users of the eeanty's
County's GIS.The meeting will be an open forum in which the GIS Coordinator will answer
questions,demonstrate functions,and solicit feedback about the eeantyb-County's GIS.
12.4.6 GIS Historical Data
The GIS Coordinator will save an annual backup of GIS County data layers and retain them
for 25 years then transfer to Washinqton State Archives for appraisal and selective retention
(DAN GS50-18-38 Rev.1).
12.5 Responsibilities
12.5.1 DHIEO
1.Ensure their GIS data is up-to-date and accurate.
12.5.2 Employees
1.Follow the criteria requirements for all GIS data created,collected,and edited.
12.5.3 Information Technology
GIS Coordinator must:
56
1.Manage the GIS data and systems.
2.Make all eeëntyCounty-owned GIS data available for download on the public Web-
w_e_bsite with exceptions noted above.
3.Maintain a mapping web application for employee and public use.
4.Regularly convene GIS user group meetings.
57
Technology Policy 13 -Mobile Devices
13.Mobile Devices
13.1 Summary
This policy sets requirements for connecting mobile devices owned by Kittitas County (KG)-
to the KG-County network to access public records while maintaining the security of the
network and public records.For personal equipment,see Technology Policy 6 -Personal
Equipment.
13.2 References
1.Personnel Policy Manual 4-12 Technology Use
2.Records management policy and procedures
3.Technology Policy 4 -Account Management
4.Technology Policy 6 -Personal Equipment
5.Technology Policy 7 -Data Management,Access,and Protection
13.3 Definitions
13.3.1 Mobile device
A smartphone,laptop,notebook,tablet,or similar device that includes an operating system
and can run applications like email,web browsing,and word processing.
13.3.2 Remote wipe
A process initiated outside of a mobile device that restores its configuration to its original--or
factory default--state.A remote wipe will remove all the data,settings,and apps you
installed.
13.4 Policy
13.4.1 Authorization
The purchase and provisioning of a eeuntyCounty-owned mobile device by IT must be
requested by the DHIEO.
13.4.2 Public records
Public records are anything documenting County business.It is your responsibility to
preserve any work you do on mobile devices (see Records Management Policy and
Procedures).Those records are subject to public records requests.All primary records must
reside on the--network designated records storage (see Technology Policy 7 -Data
Management,Access,and Protection).If you are uncertain what any of this means or have
any questions,see your Records Manager/Public DiselesuFe--Records Officer.
13.4.3 Purchasing
Unless preauthorized by the IT Director,KGIT will purchase and deploy all eeuntyCounty-
58
owned mobile devices.Funds will be provided by the Departmentdepartment/Office-office
requesting the purchase.
13.4.4 Use
If you use a eeëntyCounty-owned mobile device,you must adhere to all related
administrative policies including employee conduct and rights,records management,
confidentiality,privacy,and security of eeëntyCounty technology assets.
Mobile devices are subject to the same protection and guidelines as desktop computers.
See Technology Policies and Personnel Policy Manual 4-12 Technology Use.
1.You may not use eeuntyCounty-owned equipment to conduct personal business.
2.You must immediately return the device to IT if you determine it is no longer
necessary,if you leave County employment,or if requested by ITfor inspection or
return.If you are unable to return the device by the deadline provided you may be
required to reimburse the County the cost of a replacement.
3.You may only store secondary copies of records on a eeëntyCounty-owned mobile
device.If you create a eeuntyCounty record on a mobile device,it must be copied or
moved to ‡he-eeunty--RetweFkCountv desiqnated storaqe at your earliest opportunity.
4.If you store elass-Category[link 7.4.10]23,_or_34--eF-4-data (see Technology Policy
7.4.10 Data Classification)on a eeëntyCounty-owned mobile device the records must
be encrypted.Decryption information must reside with your supervisor and/or IT.
5.Password protection must be enabled and required after 15 minutes of inactivity.
Whenever possible the password must meet the requirements in [Technology Policy
4 -Account Management].You must change your device password every 90 days.
6.Violation of any local,state,or federal law;of any County policy;or for personal
financial gain,is prohibited.
13.4.5 Text and Instant Messaging Transitory Records
If authorized by your DHIEO,you may use text or instant messaging Public records that onlyforcommunicationsofminimalretentionvalueonpersonally-owned document information ofcellphonesandeeuntyCounty-owned cell phones;however,you..temporary,short-term value,must delete the transitory communication text when it is no longer and provided that the recordsneeded,and you will be responsible for contacting your service are not needed as evidenceprovidertoobtaincopiesofanyrecordsresponsivetopublicrecordsofabusinesstransactionandrequests.not covered by a more
specific records series.Text message primary records that conduct eeunty-County business (GS50-02-05 Rev.1)(those you send,and those you receive from non-eeantyCounty
employees)must be memorialized as they are sent or received.
13.4.6 Security
You must immediately report virus or malicious software detection,or possible security
violations to IT.
59
As the custodian of the device,you must regularly check for and install security updates as
they are made available by the manufacturer.County-owned mobile devices must have a
County asset tag in an easy to see location.
13.4.6.1 Mobile Device Management
KGIT will install Mobile Device Management (MDM)software on every eeuntyCounty-owned
mobile device to enforce eeunty-security policies.-
MDM will be confiqured and implemented to perform at least the followinq controls:
1.Remote lockinq of device
2.Remote wipinq of device
3.Settinq and lockinq device confiquration;device passwords must meet requirements
of section 4.4.1
4.Detection of "rooted"and "|ailbroken"devices
5.Enforcement of folder or disk level encryption
6.Application of mandatory policy settinqs on the device
7.Detection of unauthorized confiqurations
8.Detection of unauthorized software or applications
9.Ability to determine the location of devices
10.Automatic device wipinq after a specified number of failed access attempts
(CJIS 5.9 §13.2)
13.4.6.1--2 Lost or stolen devices
Best Practice
You are responsible for protecting eeuntyCounty-owned mobile
devices provided to you from theft,lessloss,or damage.You must Change the security password
immediately report lost or stolen devices--as soon as the loss is on your mobile device when
noticed--to your DHIEO regardless of time,day or night.DHIEOs you change your network
must notify IT staff-or the IT Director as soon as notified by their password.
employee.KGIT will immediately remote wipe lost or stolen devices.
(CJIS 5.9 §5.13.5)
13.4.6.3 Authentication
Finqerprint recoqnition is allowed for local device authentication.
Facial recognition is prohibited for local device authentication.
60
Direct access to Category [link 7.4.10]4 data,oriqinatinq from a County-controlled mobile
device outside a physically secure location requires MFA [link to 7.3.3.(CJIS 5.9 §5.6.2.2.2)
13.4.7 Safety
The County entrusts employees with communications equipment to enhance productivity
and safety.It is your responsibility to use the equipment prudently to ensure your safety and
the safety of your co-workers and the public.See the Personnel Policy Manual 4-12
Technology Use for information on using mobile devices while driving a vehicle.
13.4.8 Wi-Fi
You may not use non-County Wi-Fi hotspots unless they are secured with encryption,e.g.,
VPN and WPA2.
13.4.9 Smartphone
Best Practice
Use discretion when making sensitive or confidential calls as cell
phone calls are not secure-Include return to information,
e.g.your name and a contact
You may not jail break or root eeëntyCounty-owned mobile devices.phone number,on the device
Do not download games,ringtones,etc.,or non-werk--Felatedwork-
lock screen wallpaper.
related applications to eeuntyCounty-owned devices.For more
requirements for using smartphones,see Personnel Policy Manual 4-12 Technology Use.
13.4.10 Laptops and tablets
Do not download games,ringtones,etc.,or non-work related applications to eeantyCounty-
owned devices.
13.4.11 County aDevice Access
Devices and technology systems are the property of Kittitas County.Kittitas-The_County
reserves the right to access,audit,and inspect the devices and systems and all information
viewed or stored on them.
13.4.11.1 No expectation of privacy
Employee shall have no expectation of privacy for materials viewed or stored on
eeuntyCounty-owned devices,systems,computers,or servers.
13.4.12 Device Support
KGIT will help you with your eeuntyCounty-owned mobile device during normal business
hours.We will help you:
1.Select and purchase an Android (recommended)or Apple device
2.Secure the device and set your password
3.Install approved software
4.Connect to the network and KG-County Exchanqe email
61
Because of the variety of devices,we will not be able to provide you training on how to use
the device;you will need to search Google or contact the manufacturer or vendor for
operating instructions.
13.4.13 Category 4 data
If accessinq,processinq,storing,or transmittinq Category [link 7.4.10]4 data,vou shall:
1.Disable Bluetooth (CJIS 5.9 §5.13.1.3)
2.If usinq a County-owned mobile device as a mobile Wi-Fi hotspot,confiqure the
device as follows:
•Enable encryption on the hotspot
•Chanqe the hotspot's default SSID and not identify the device makelmodel or
County ownership
•Create a wireless network password (pre-shared key)
•Enable the hotspot's port filterinqlblockinq features if present
•Only allow connections from County-controlled devices
(CJIS 5.9 §5.13.1.4)
3.Encrypt Category 4 [link 7.4.10]data (CJIS 5.9 §5.13.3(4))
4.Erase cached information,includinq authenticators in applications,when session is
terminated.(CJIS 5.9 §5.13.3(5))
5.Run MDM that facilitates the ability to provide firewall services.(CJIS 5.9 §5.13.3(6))
6.Run MDM that facilitates the ability to provide anti-malware services.(CJIS 5.9 §
5.13.3(7))
7.Ensure software and operatinq system patches and security updates are installed in
a timely manner.(CJIS 5.9 §5.13.4.1)
8.Device passwords must meet requirements of section 4.4.1.(CJIS 5.9 §5.13.7.1)
13.5 Responsibilities
13.5.1 DHIEOldesignee
1.Ensure your staffisemployees are aware of and comply with these policies.
2.Authorize device purchase,configuration,and deployment as needed for
eeëntyCounty business.
3.Report lost or stolen devices to IT staff-or the IT direeterDirector.
13.5.2 Employees
4.Manage public records according to eeanty-County records management policies
and procedures.
5.Encrypt elass-category2-3-and 4 records on your mobile device.
6.Understand how to use your mobile device.
7.Do not use eeuntyCounty-owned equipment to conduct personal business.
8.Immediately report lost or stolen devices to your DHIEOldesignee.
9.Immediately report virus or malicious software detection to IT.
10.Return your mobile device to IT when you no longer need it,separate from service,
62
or if IT requests it.
11.Keep your mobile device upgraded,and patched,password protected.
12.Use your mobile device safely and securely.
13.Ask your DHIEO,supervisor,or IT if you have any questions about this or any other
policy.
13.5.3 Information Technology
1.Purchase and install MDM software on all eeëntyCounty-owned mobile devices.
2.Remote wipe any lost,stolen,or terminated employee mobile device when notified.
3.Wipe any mobile device returned to IT.
4.Ensure mobile devices are tagged and inventoried.
63
Technology Policy 14 -Social Media Use
14.Social Media Use
14.1 Summary
TheKittitas County recognizes the benefit of quick and directed communication provided by
social media.It also recognizes the challenges related to records management,public
disclosure laws,unrestricted public forums,and to the reputation of the County and its
representatives.
The purpose of this policy is to establish consistent standards for and ensure appropriate
use of Kittitas County-sponsored social media sites used by Kittitas-County
offices/departments in reaching out to the public with the purpose of sharing information
about Kittitas-Geentythe County.
This policy applies to all County-sponsored social media sites and to all Kittitas-County
employees and those performing business on behalf of a County officeldepartment.
14.2 References
1.Kittitas County Privacy Notice
2.RCW 42.56 Public Records Act
3.Records Management Policy and Procedures
4.Technology Policy 11 -Websites
14.3 Definitions
14.3.1 Public Record
Any writing containing information relating to the conduct of government or the performance
of any governmental or proprietary function prepared,owned,used or retained by any state
or local agency regardless of physical form or characteristics (RCW 42.56.010(3)).
14.3.2 Social Networking
Any internet site that is focused on creating networks of individuals such as Facebook,
Linkedln,YouTube,Twitter,Instagram,etc.
14.3.3 Social Media
Internet-based communication tools that provide for immediate and interactive information
sharing.Examples include forums,weblogs,microblogs,wikis,social networks,podcasts,
photo sharing,and chat.
14.3.4 Publishers
Employees and other individuals authorized to contribute to County-sponsored social media
sites.
14.4 Policy
64
14.4.1 Kittitas County's Official Website
T_h_eKit‡itas County's official Website-website at http://www.co.kittitas.wa.us is and-wiß-Femam-
the County's primary and predominant Internet presence.
14.4.2 Official County-Sponsored Sites
Every County-sponsored social media site account must be pre-approved by the BeaFd--ef
Geenty--GemmissioneFsBoCC.KGIT will create,configure,and have administrative access to
all County-sponsored social media sites and accounts.
TheKittitas-Kittitas_County'sintranet (CAMAS)may be used to post messages to the
County's website and to County-sponsored social media sites.Applications on social media
site shall not be used unless pre-approved by the I_T
Committee.
14.4.2.1 Right to Remove Sites
County-sponsored social media sites may be removed by the responsible DHIEO without
notice.
14.4.3 Use
All official Kittitas-County presence on social media sites are subject to all related
administrative policies,including,but not limited to,confidentiality,employee conduct,
records management,privacy,and security of County technology assets.
14.4.4 Front Page Requirements and Branding
To help distinguish County-sponsored social media sites from other sites,and to facilitate
their proper use,home pages of County-sponsored social media sites must:
1.Follow the Kittitas-County website style guide
2.State the site is maintained by Kittitas County and is subject to this Social Media Use
Policy
3.Identify the officeldepartment responsible for the information displayed
4.Provide a clear statement of the discussion topic of the site so that the public is
aware of the limited nature of the discussion and that inappropriate posts are subject
to removal
5.Have links to the County Privacy Notice and Social Media Disclaimer (section 14.4.7)
6.Have a link to the eeuntyCounty or officeldepartment home page
7.State the County disclaims any and anall responsibility and liability for any materials
that the County deems inappropriate for posting which cannot be removed in an
expeditious and otherwise timely manner.
14.4.5 Posting
Only publishers may post to County-sponsored social media sites.Prior to being given
access to a social media account,publishers must:
1.Review and sign the Social Media Use Policy Acknowledgement Form
65
2.Consult with their (or IT's)Deputing Prosecuting Attorney to be briefed on public
forum,records management,and Open Public Meetings Act concerns.
Publishers must adhere to content requirements described in Technology Policy 11 -
Websites.
14.4.5.1 Purpose of Posts
Posts shall be written to increase the public's knowledge,trust,and use of County
officeldepartments,programs or services and drive users to the County's website.
14.4.5.2 Official Business Only
Employees and other individuals authorized to use social media to communicate on behalf
of a County officeldepartment should be mindful that statements posted represent the
County,including its elected officials.Most social media sites do not allow editing of posts.
Use discretion when posting.
Posts shall always relate to work matters within the subject matter jurisdiction of the posting
officeldepartment and should be consistent with the County's public service mission.Only
information authorized by this policy shall be posted.Employees and other individuals
authorized to use County-sponsored social media sites must ensure that all information
posted is professionally presented,accurate,and appropriate for dissemination to the public.
Conducting official County business via social media is permitted only on approved County-
sponsored social media sites.Use of County-sponsored social media sites for
communications and postings that are not directly related to an official County business
purpose is prohibited.
A department headlelected official may authorize their social media publisher to provide the
following statement and link to the eeuntyCounty website when false,misleading,or
inaccurate information is encountered on non-eeantyCounty social media sites.
Official and accurate information can be found on the
Kittitas County website at http://www.co.kittitas.wa.us.
No other text/comment may be written,and no further engaging is allowed.Posting this
statement is optional and not required.Employees are not required to monitor information
posted on other sites.
14.4.5.3 Copyright Laws
Postings must adhere to copyright laws and reference or cite sources appropriately.This
includes,but is not limited to,quotes,text,images,and documents.
14.4.5.4 Political and Commercial Activity
Publishers must not use County-sponsored social media sites for advocacy of political
purposes or to conduct private commercial activities.
14.4.5.5 ConfidentiallSensitiveInformation
66
Confidential,sensitive,proprietary,or non-public information must not be posted.
Information posted on County-sponsored social media sites must not contain information
that relates,or can be connected,to an individual or group of individuals containing specific
health information (doctors,diagnoses,medication/prescriptions,etc.),personally identifiable
information (names with social security numbers,bank accounts)or information deemed to
be sensitive in nature or protected by Federal,State,or County rules and regulations.
It is the responsibility of the publisher to ensure that information posted on these sites does
not contain confidential,sensitive,proprietary,or personal information.
14.4.5.6 No Expectation of Privacy
Publishers should not have any expectation of privacy as to any posting.
14.4.5.7 Personal Use of Social Media
This policy is not intended to govern employees'establishment or use of personal social
media accounts for personal purposes,outside the workplace and using non-County
information systems.However,employees should be aware that their use of social media
may be perceived as representing the County and County government-and should tailor
their use accordingly.
Postings and user profiles on personal social media accounts must not state or imply that
the views,conclusions,statements or other social media content are an official policy,
statement,position,or communication of the County,or represent the views of the County or
any County officer or employee.
Employees utilizing social media for personal use shall not conduct official County business
on personal social media accounts,or use the Kittitas County Government seal or other
official County marks,or use the County government's name to promote or endorse any
product,cause,or political candidate.
14.4.6 Comments
While the County welcomes public comment by email,letter,and phone,the receipt of public
comments on a County social media site comes with certain legal risks and administrative
challenges.Where comments are not desirable or practical,the officeldepartment should
carefully consider both appropriate social media and other media tools.
14.4.6.1 Daily Monitoring of Comments
The posting officeldepartment must dedicate sufficient resources and time en--a daily-basis-
to monitor daily for disallowed comments or to respond to requests or questions.The social
media account will be configured to send email to the officeldepartment when a comment is
posted,if the option is available.
14.4.6.2 Right to Remove Content
KittitasThe-_County reserves the right to restrict or remove any content that is deemed in
violation of this social media policy or any applicable law.
67
14.4.6.3 Removal of comments
Any content removed based on these guidelines must be retained,including the time,
datedate,and identity of the poster when available.The reason for the removal of the
comment should also be documented and retained.
14.4.6.4 Disabling of Public Comments
There may be occasions where disabling public comments on a social media site is
desirable.In these instances,comments may be invited via email to a designated County
officeldepartment email address that is regularly monitored.
14.4.7 Social Media Disclaimer
This Social Media Disclaimer will be linked to from all County-sponsored social media sites.
Kittitas County Social Media Disclaimer
Thank you for using this Kittitas County social media site (the "site").
This site provides an opportunity for sharing and discussing information about
Kittitas County programs and activities.The comments and opinions expressed by
users of this site are theirs alone and do not reflect the opinions of Kittitas County
or its employees.
This site,including but not limited to all linked pages and subpages,is provided on
an "as is"basis,and users are fully and solely responsible for their use of the site
and for any results or consequences of such use.
Comments should be limited to comments related to the posted topic.This site is
not the proper place to express opinions or beliefs not directly related to that topic.
Comments will not be edited by Kittitas County or its staff.Comments will be
deleted if they contain:
•Language that is vulgar,offensive,harassing,graphic,obscene,explicit,
abusive,hateful,or intended to defame anyone or any organization.
•Discriminatory language based on race,national origin,age,gender,sexual
orientation,religion,or disability.
•Threats or personal attacks.
•Personal or sensitive information (e.g.,phone numbers,email,or postal
addresses).
•The suggestion or encouragement of illegal activity.
•Solicitations or advertisements.
•Apparent spam,such as the same comment posted repeatedly.
The_County reserves the right to respond to any comments containing incorrect or
misleading information and/or delete such comments.
All links posted by users on this site will be reviewed and may be deleted if
deemed in violation of this policy.Violations of this comment policy may cause the
68
author to be blocked from this site without notice.
We understand that social media is a 24/7 medium;however,our moderation
capabilities are not.Kittitas County may not see every inappropriate comment
immediately,and we are trusting in the maturity of our community to ignore
personal attacks and negative speech or respond politely.
This site might include photographs of the public taken at County
sponsored/hosted events.Photographs may be taken at County sponsored/hosted
events and subsequently shared on or posted to County Social Media Sites without
compensation and without further requirement for individual release(s)or approval
of images.Persons attending a County public event in a County public venue are
hereby deemed to have consented to their photograph(s)being taken and used by
the County.
Communications made through this site's email and messaging system will in no
way constitute a legal or official notice or comment to Kittitas County or any official
or employee of Kittitas County for any purpose.For example,a post or comment
that asks that Kittitas County provide public records will not be considered a public
records request until being sent through the proper channels (see
http://www.co.kittitas.wa.us/request/).Likewise,a post or comment related to a
proposed agency rule will not be considered by the agency.
In no event shall Kittitas County or its agencies,officers,employees,agents,or
representatives be liable for any direct,indirect,special,punitive,incidental,
exemplary or consequential damages arising from your accessing or using this
site,including but not limited to anything contained in,displayed on,or deleted
from this site.Nothing contained in or displayed on this site constitutes or is
intended to constitute legal advice by Kittitas County or any of its agencies,
officers,employees,agents,attorneys,or representatives.
14.4.8 Records Management
Content on County-sponsored social media sites shall not be offered in lieu of official
information on the County's official Websitewebsite.Wherever possible,content posted to
County-sponsored social media sites will also be available on the County's website and
contain links directing users back to the County's website for in-depth information,forms,
documents,or online services.
14.4.8.1 Public Records
County-sponsored social media sites are subject to State of Washington public records laws
(RCW 42.56).Any content published to a County sponsored site,including lists of
subscribers and posted communications,is public record.
14.4.8.2 Records Retention
Public records on County-sponsored social media sites will be archived and managed in
accordance with Washington State records retention schedules.
14.4.8.3 Requests for Public Records
69
Any requests for posts on a County-sponsored social media site shall be referred to the
officeldepartment maintaining the site.The posting officeldepartment must be prepared to
respond to requests for public records.
14.5 Responsibilities
14.5.1 DHIEOldesignee
1.DHIEOs are responsible and accountable for social media posts submitted by their
designated social media publishers.
2.Only authorized publishers may post,respond,comment,or manage County social
media content.Employees who post to or respond to comments on a County social
media site on behalf of the County and who are not authorized publishers are subject
to disciplinary action.
3.DHIEOs are responsible for the accurate and timely posting of information and
responding to comments/requests.
4.To prevent violations of the Open Public Meetings Act (OPMA),members of a
governing body shall avoid participation in discussions on social media concerning
agency business by a majority of its members.Discussions or comments need not
occur at the same time or even the same day to trigger OPMA.
14.5.2 Employees
1.Publishers are responsible for the content they publish on any social media site or
network and to manage their postings in a manner that supports a positive public
image for the County agency.
2.Only eeuntyCounty business may be conducted on County-sponsored social media
sites.
3.No personal posts may be posted to County-sponsored social media sites.
14.5.3 Information Technology
1.Setting up social media sites.
2.Applying branding following the Kittitas County style guide.
3.Linking to the County Privacy Notice and Social Media Disclaimer.
4.Adding approved publishers.
70
Technology Policy 15 -Video Monitoring Systems
15.Video Monitoring Systems
15.1 Summary
This policy sets requirements for non-recording video monitoring systems used by Kittitas
County offices and departments.It does not cover the courthouse security video surveillance
system.The primary purpose of these video monitoring systems is to assist with safety of
employees and security of facilities by providing views of obscured areas.
15.2 References
1.RCW 9.73.030(1)Intercepting,recording,or divulging private communication--
Consent required-Exceptions
15.3 Definitions
15.3.1 Video monitoring camera
A mounted video camera used to view eeunty-County facilities and/or people in eewaty-
County facilities,primarily for security purposes.
15.3.2 Video monitor
The display used to view video monitoring camera images for safety and security purposes.
15.4 Policy
15.4.1 Authorization
Requests for video monitoring systems shall be submitted to the eeënty%-County's Security
Committee who will make recommendations to the BoCC.
The board must approve requests prior to purchasing equipment.
KittitasT_he County reserves the right to install monitoring cameras in work areas for safety
and security purposes.
15.4.2 Recording
Monitoring system shall not record audio or video.
15.4.3 Typical use
Doors through which employees cannot see create a security and safety risk.Video
monitoring cameras are generally placed on the public side of such doors,and video
monitors just inside those doors.
15.4.4 Restricted use
Video monitoring cameras shall not be used in non-public areas or hidden from public view.
71
Video monitoring equipment covered in this policy shall not connect to the eeanty-County
network.
The state-State of Washington prohibits the recording of conversations or meetings unless
the consent of all parties involved is obtained.As such,recordings without permission of the
employer are prohibited in all eeunty-County locations.RCW 9.73.030(1).
15.4.5 System purchase and management
The-IT department-is responsible for recommending and purchasing equipment.IT will
configure and support only equipment it recommends and purchases.
The departmentloffice is responsible for funding the purchase,installation materials needed
by Maintenance,and replacement of video monitoring equipment.
15.4.6 No expectation of privacy
Employee shall have no expectation of privacy in public areas of the courthouse.
15.5 Responsibilities
15.5.1 DHIEOldesignee
1.Submit requests for video monitoring systems to the Security Committee who will
make recommendations to the board.
2.Submit a purchase request to have IT purchase the equipment after board approval.
3.Fund video monitoring equipment.
15.5.2 Employees
1.Employees should contact their supervisor or HR if they have questions about this
policy.
15.5.3 Information Technology
1.Specify standard equipment.
2.Purchase,configure,and maintain IT recommended and purchased equipment.
72