I. Purpose and Scope
The City of Cotati is committed to safeguarding the confidentiality, integrity, and availability of its digital systems and information. This policy outlines the expectations and requirements for all City employees, contractors, and vendors in handling information technology (IT) resources. It addresses both cybersecurity protections and the responsible use of emerging technologies, including artificial intelligence (AI), while ensuring compliance with applicable California laws, including the Public Records Act.
II. Roles and Responsibilities
Cybersecurity is a shared responsibility across the organization. The City Manager and Administrative Services Director, or their designees, are responsible for overseeing this policy’s implementation and enforcement. They will coordinate periodic reviews and updates to maintain alignment with evolving security risks, regulatory requirements, and technology practices.
Department Heads are responsible for ensuring department compliance with policies and procedures and articulating business requirements to staff under their management. Employees are responsible for adhering to the policy and participating in required training and incident reporting procedures.
III. Acceptable Use of Technology
City technology is provided for the purpose of conducting official City business. While incidental personal use is allowed, it must not interfere with job responsibilities, diminish productivity, or introduce security risks. All staff must access systems using their assigned credentials and must not share passwords. Strong passwords and multi-factor authentication are required wherever supported to prevent unauthorized access.
Installing unapproved software or connecting personal devices to City networks without authorization is prohibited. These activities can introduce unvetted software and vulnerabilities.
The City’s IT staff or consultants will manage software updates, device configurations, and other security controls to protect our infrastructure.
IV. Data Protection and Security Requirements
To protect sensitive and mission-critical data, the City follows recognized best practices, including elements from the NIST Cybersecurity Framework. All sensitive data must be encrypted when stored or transmitted.
For the purpose of this policy, “sensitive data” is defined as any information that, if improperly accessed, used, disclosed, modified, or destroyed, could adversely affect the privacy, security, or operations of the City or its residents. This includes, but is not limited to, personally identifiable 418 of 437
City of Cotati
Cybersecurity and Data Protection Policies
Adopted XXXXXXX, 2026
information (PII), financial or payment information, personnel records, protected health information (PHI), security credentials, legal documents, and confidential communications.
Data classification procedures will guide how different types of data—such as public, internal, confidential, or legally protected information—are managed. Procedures around classification of data are managed by the relevant departments generating each type of data and as outlined in the City-wide Records Retention Policy, or other overriding State or Federal regulations.
Access to systems will be based on user roles and the principle of least privilege. This means staff will be granted only the access needed to perform their duties. Regular audits will be conducted to verify that access permission remains appropriate.
The City will maintain regular data backups and test recovery procedures to ensure continuity in case of cyberattacks, system failures, or natural disasters. Outdated hardware and software, which are no longer supported by the manufacturer or cannot be repaired in a timely manner, will not be used on City networks.
V. Responsible Use of Artificial Intelligence and Emerging Technologies The City supports the innovative and efficient use of artificial intelligence (AI) tools to assist in analysis, drafting, and service delivery. However, AI use must be carefully governed to avoid legal, ethical, and operational risks. AI tools may support staff decision-making but cannot substitute for it in situations involving legal interpretation, financial approval, personnel decisions, or regulatory enforcement.
Transparency is of the utmost importance when using AI tools in any form of City business.
Employees must be clear and forthright when AI has been used in the creation of any product, document, communication, or analysis. Staff should acknowledge or cite that AI was used as part of the process, particularly when the AI is used in a material way for policy interpretations/development or content summaries that are relied upon in materials intended for public use, external communication, or policy development. Regardless, all AI-generated content must be verified by the user for accuracy, bias, and appropriateness before use in public communication or service delivery.
Staff may not input confidential, personally identifiable, or sensitive information into public AI tools like ChatGPT or Google Gemini, as these tools may not guarantee data privacy or meet public records requirements.
AI tools must be reviewed by the City Manager or Administrative Services Director (or their designees) before adoption for official City use.
VI. Public Records Compliance
419 of 437
City of Cotati
Cybersecurity and Data Protection Policies
Adopted XXXXXXX, 2026
Staff using Generative AI tools should consider that any questions posed or prompts used with a platform might be released publicly in response to a public records request, subpoena, accidentally, or as part of a data breach. Generative AI tools approved for use generally delete queries and prompts according to a set schedule. The City's Records Retention Schedule does not generally require that they be retained. If staff elect to retain any conversations, queries, or prompts relating to City work, they might be subject to release in response to a public records request and must comply with the City's retention policies. A standard evaluation under the Public Records Act would apply. In addition, users will need to comply with the California Public Records Act and other applicable public records laws for all City usage of Generative Al.
VII. Incident Response and Reporting
In the event of a suspected cybersecurity incident—such as phishing attempts, malware detection, or data loss—employees must immediately report the issue to either the City’s IT Helpdesk or the Administrative Services Department. Timely reporting helps contain threats and limit potential damage.
Employees must also immediately report any lost or stolen City-issued devices, including but not limited to smartphones, tablets, laptops, or other portable media. Prompt reporting allows the City to take rapid measures such as remote data wiping, access revocation, or system lockdown to minimize exposure and protect City data.
The City will maintain a cybersecurity incident response plan, which includes procedures for detection, containment, recovery, and documentation of security incidents. This plan will be reviewed and tested periodically.
VIII. Training and Awareness
Training is essential for effective cybersecurity and responsible technology use. All employees must complete annual cybersecurity training covering topics such as password management, phishing recognition, data handling, and reporting procedures.
In addition, employees in the Finance and Accounting divisions, as well as those in management or positions of higher financial or operational risk, are required to complete biannual fraud prevention and fraud detection training. This training will address topics such as identifying red flags of fraudulent activity, safeguarding financial systems, and complying with internal control measures designed to prevent misuse of City funds or data.
All staff must complete training on ethical AI use, legal limitations, and risks associated with automation. Training will be updated as threats and technologies evolve. 420 of 437
City of Cotati
Cybersecurity and Data Protection Policies
Adopted XXXXXXX, 2026
IX. Policy Review and Updates
This policy will be reviewed at least once every two years by the City Manager and Administrative Services Director or their designees. Reviews will ensure continued relevance and reflect best practices, regulatory changes, and new technologies. The City may update this policy more frequently if a security threat or legislative change necessitates immediate action.
X. Enforcement
Violations of this policy may result in disciplinary action, up to and including termination of employment, suspension of system access, or legal action. Examples of violations include knowingly introducing malware, sharing sensitive data inappropriately, or using AI tools in ways that compromises sensitive information or spreads misinformation. All staff are expected to take cybersecurity seriously and help foster a culture of awareness and accountability. 421 of 437
City of Cotati: IT &
Emerging
Technology Policy
422 of 437
Why an IT Policy
Matters
Protects City systems from
cyber threats
Safeguards resident and
employee data
Enables responsible use of
new technologies
Maintains public-records
compliance
423 of 437
Policy Purpose & Scope
Applies to employees, contractors, vendors
Covers confidentiality, integrity, and
availability
Includes AI and emerging technology
oversight
424 of 437
Roles &
Responsibilities
City Manager & Admin
Services Director oversee
policy
Department Heads
ensure departmental
compliance
Employees adhere and
report issues promptly
425 of 437
Acceptable Use
of Technology
City devices for official
business only
Incidental personal use
allowed, if no risks
Use assigned credentials;
never share passwords
No installing unapproved
software or personal devices
426 of 437
Data Protection & Security
Requirements
• Encrypt sensitive data at rest and in
transit
• Classify data: public, internal,
confidential, protected
Encrypt
• Access based on roles; apply leastprivilege principle Classify
• Back up regularly; retire outdated
hardware/software
Access
Back up
427 of 437
Responsible Use of AI &
Emerging Technologies
• AI tools support, not replace, human
decisions
• Transparency: disclose when AI is used
• Do not input sensitive data into public AI
tools
• Approval required before adopting new
AI tools
428 of 437
Public Records Compliance
All City business
records may be
disclosable
AI-generated outputs
may be public records
too
Records retention
policy still applies
429 of 437
Incident Response & Reporting
IMMEDIATELY REPORT
CYBERSECURITY INCIDENTS
REPORT LOST OR STOLEN
CITY DEVICES
CITY MAINTAINS RESPONSE
PLAN: DETECTION,
CONTAINMENT, RECOVERY
430 of 437
Training &
Awareness
• Annual cybersecurity training
for all employees
• Biannual fraud training for
finance staff
• Ethical AI training for
authorized staff
431 of 437
Policy Review & Updates
REVIEW AT LEAST EVERY
TWO YEARS
UPDATE SOONER IF THREATS
OR LEGISLATION CHANGE
432 of 437
Enforcement
Violations may lead to disciplinary action
Access suspension or termination
possible
All employees must take cybersecurity
seriously
433 of 437
Peer Policies in Sonoma County
Sonoma County
IT Use &
Security Policy
Sonoma County
IT Governance
Policy
Aligns Cotati
with regional
best practices
434 of 437
Next Steps & Timeline
Present
• Present
policy for
Council
approval
Launch
• Launch staff
training and
awareness
Monitor
• Monitor
compliance
and metrics
435 of 437
Questions &
Discussion
436 of 437
Cotati City Council
Agenda Staff Report
Item type: INFORMATION RECEIVED AFTER THE AGENDA WAS POSTED To: City Council
Subject: INFORMATION RECEIVED AFTER THE AGENDA WAS POSTED Date: January 27, 2026
Written by: Kevin Patterson, City Clerk
Recommendation
Information or written comments pertaining to this meeting, and which was received after the agenda was posted, is attached below.
Pursuant to City Council Policy 2025-03: City Council Rules section IV A., written Communications, interested persons or their authorized representative may address the Council by written communication on any matters concerning the City’s business, or any matters over which the Council has control.
1. To be considered for inclusion in the agenda packet, such written communication shall be delivered to the City Clerk no later than 11:00 a.m. of the Wednesday the week preceding the regular Council meeting for which such written communication is intended.
2. If received after the above date and time, but no later than noon the day before the meeting, written communications received by the City Clerk shall be posted on the website by the end of that day and notification provided to the electronic Agenda mailing list by the end of the day. All written communications received by the City Clerk by 5 pm on the City Council meeting day shall be made available to the City Council and public at the City Council meeting.
City Council Policy 2025-03 is available at the online meeting portal at www.cotaticity.gov or by request from the City Clerk at 707-665-3622 or [email protected]. 437 of 437