Cotati City Council
Agenda Staff Report
Item type: REGULAR CALENDAR (ACTION)
To: City Council
Subject: REVIEW OF THE CITY OF COTATI’S DRAFT
CYBERSECURITY AND DATA PROTECTION POLICIES
Date: January 27, 2026
Written by: Angela Courter, Director of Administrative Services Recommendation
It is recommended that the City Council for the City of Cotati review and provide comment, if any, on the draft Cyber Security and Data Protection Policy.
Background
The City of Cotati relies on information technology systems to support essential municipal operations, including finance, public safety, utilities, human resources, and communications. As digital threats have increased in both frequency and sophistication, public agencies face growing risks to the security of sensitive data, infrastructure, and public trust.
Recent guidance from the California State Auditor, the National Institute of Standards and Technology (NIST), and the California Department of Technology emphasizes the importance of formally adopting local cybersecurity policies to safeguard information systems, ensure regulatory compliance, and prepare for incident response and recovery.
Although the City has implemented various cybersecurity practices and protocols over time, and is part of the GovAI coalition, it does not currently have a consolidated Cybersecurity and Data Protection Policy. Establishing a formal policy will ensure that the City's cybersecurity efforts are aligned with best practices and demonstrates a clear commitment to protecting City systems and data as well as providing guidance to staff on the expected procedures.
Analysis/Discussion
The proposed Cybersecurity and Data Protection Policy establishes a comprehensive framework to safeguard the City's digital infrastructure and data assets, while also addressing the responsible use of emerging technologies, including artificial intelligence (AI). This policy ensures alignment with California law, including the Public Records Act, and recognized best practices such as the NIST Cybersecurity Framework. Key elements of the policy include:
- Clear Roles and Responsibilities: Cybersecurity is defined as a shared responsibility.
Oversight is delegated to the City Manager and Administrative Services Director, with departmental accountability and individual employee obligations for training and incident reporting.
- Acceptable Use of Technology: City systems are to be used primarily for official business, with strong controls on credentials, password sharing, software installations, and device use. Security measures such as multi-factor authentication and centrally managed updates are required.
- Data Protection Measures: Sensitive data must be encrypted during storage and transmission. Access controls follow the principle of least privilege, and system permissions are subject to regular audits. Routine backups and disaster recovery protocols are mandated.
- AI and Emerging Technology Governance: The policy encourages the innovative use of AI while establishing strict limitations. Staff may not input confidential or sensitive information into public AI tools, and all AI-generated content must be reviewed for accuracy and bias. Approval is required before adopting any new AI technologies. - Public Records Compliance: AI-generated content and other digital outputs are subject to disclosure under the California Public Records Act. The policy emphasizes proper labeling, storage, and retention of such records.
- Incident Response Protocols: The City maintains a formal response plan for cybersecurity incidents, with clearly defined reporting channels, containment strategies, and documentation requirements.
- Training and Awareness: Annual cybersecurity training is required for all staff, along with specialized training for those authorized to use AI tools. - Policy Oversight and Enforcement: The policy will be reviewed biennially, or more frequently as needed, to reflect changing technology and security landscapes.
At this point, staff are seeking review and feedback from the City Council, if any. The next step is to review the attached policy with City labor groups and then return to the City Council with a proposed final policy for adoption.
Financial Considerations
Staffing requirements to draft this policy were included within the proposed strategic plan and budgeted staffing for the fiscal year. There is no known direct fiscal impacts anticipated with the adoption of this policy. Increased training materials are included in the software for the City and managed in coordination with our IT services partner KLH Consulting Environmental Issues
The action of adopting this policy involves an administrative activity that will not result in direct or indirect physical changes in the environment. As such, adoption of the resolution does not constitute a project as defined by California Environmental Quality Act Guidelines Section 15378; therefore, no further environmental review is required.