CITY OF COTATI
Cybersecurity and Data
Protection Policy
A Summary of the City’s Rules to Promote Excellent
Cybersecurity including Data Protection Including Allowed Uses for Artificial Intelligence (AI) and Other Emerging Technologies.
Purpose and Scope .............................................................................................................................................................2 Roles and Responsibilities ........................................................................................................................................2 Acceptable Use of Technology...............................................................................................................................................2 Data Protection and Security Requirements .............................................................................................................2 Responsible Use of Artificial Intelligence and Emerging Technologies..................................................................3 Public Records Compliance .............................................................................................................................................3 Incident Response and Reporting............................................................................................................................4 Training and Awareness..........................................................................................................................................4 Policy Review and Updates ....................................................................................................................................4 Enforcement............................................................................................................................................................5 City of Cotati
Cybersecurity and Data Protection Policies
Adopted XXXXXXX, 2026
I. Purpose and Scope
The City of Cotati is committed to safeguarding the confidentiality, integrity, and availability of its digital systems and information. This policy outlines the expectations and requirements for all City employees, contractors, and vendors in handling information technology (IT) resources. It addresses both cybersecurity protections and the responsible use of emerging technologies, including artificial intelligence (AI), while ensuring compliance with applicable California laws, including the Public Records Act.
II. Roles and Responsibilities
Cybersecurity is a shared responsibility across the organization. The City Manager and Administrative Services Director, or their designees, are responsible for overseeing this policy’s implementation and enforcement. They will coordinate periodic reviews and updates to maintain alignment with evolving security risks, regulatory requirements, and technology practices.
Department Heads are responsible for ensuring department compliance with policies and procedures and articulating business requirements to staff under their management. Employees are responsible for adhering to the policy and participating in required training and incident reporting procedures.
III. Acceptable Use of Technology
City technology is provided for the purpose of conducting official City business. While incidental personal use is allowed, it must not interfere with job responsibilities, diminish productivity, or introduce security risks. All staff must access systems using their assigned credentials and must not share passwords. Strong passwords and multi-factor authentication are required wherever supported to prevent unauthorized access.
Installing unapproved software or connecting personal devices to City networks without authorization is prohibited. These activities can introduce unvetted software and vulnerabilities.
The City’s IT staff or consultants will manage software updates, device configurations, and other security controls to protect our infrastructure.
IV. Data Protection and Security Requirements
To protect sensitive and mission-critical data, the City follows recognized best practices, including elements from the NIST Cybersecurity Framework. All sensitive data must be encrypted when stored or transmitted.
For the purpose of this policy, “sensitive data” is defined as any information that, if improperly accessed, used, disclosed, modified, or destroyed, could adversely affect the privacy, security, or operations of the City or its residents. This includes, but is not limited to, personally identifiable City of Cotati
Cybersecurity and Data Protection Policies
Adopted XXXXXXX, 2026
information (PII), financial or payment information, personnel records, protected health information (PHI), security credentials, legal documents, and confidential communications.
Data classification procedures will guide how different types of data—such as public, internal, confidential, or legally protected information—are managed. Procedures around classification of data are managed by the relevant departments generating each type of data and as outlined in the City-wide Records Retention Policy, or other overriding State or Federal regulations.
Access to systems will be based on user roles and the principle of least privilege. This means staff will be granted only the access needed to perform their duties. Regular audits will be conducted to verify that access permission remains appropriate.
The City will maintain regular data backups and test recovery procedures to ensure continuity in case of cyberattacks, system failures, or natural disasters. Outdated hardware and software, which are no longer supported by the manufacturer or cannot be repaired in a timely manner, will not be used on City networks.
V. Responsible Use of Artificial Intelligence and Emerging Technologies The City supports the innovative and efficient use of artificial intelligence (AI) tools to assist in analysis, drafting, and service delivery. However, AI use must be carefully governed to avoid legal, ethical, and operational risks. AI tools may support staff decision-making but cannot substitute for it in situations involving legal interpretation, financial approval, personnel decisions, or regulatory enforcement.
Transparency is of the utmost importance when using AI tools in any form of City business.
Employees must be clear and forthright when AI has been used in the creation of any product, document, communication, or analysis. Staff should acknowledge or cite that AI was used as part of the process, particularly when the AI is used in a material way for policy interpretations/development or content summaries that are relied upon in materials intended for public use, external communication, or policy development. Regardless, all AI-generated content must be verified by the user for accuracy, bias, and appropriateness before use in public communication or service delivery.
Staff may not input confidential, personally identifiable, or sensitive information into public AI tools like ChatGPT or Google Gemini, as these tools may not guarantee data privacy or meet public records requirements.
AI tools must be reviewed by the City Manager or Administrative Services Director (or their designees) before adoption for official City use.
VI. Public Records Compliance
City of Cotati
Cybersecurity and Data Protection Policies
Adopted XXXXXXX, 2026
Staff using Generative AI tools should consider that any questions posed or prompts used with a platform might be released publicly in response to a public records request, subpoena, accidentally, or as part of a data breach. Generative AI tools approved for use generally delete queries and prompts according to a set schedule. The City's Records Retention Schedule does not generally require that they be retained. If staff elect to retain any conversations, queries, or prompts relating to City work, they might be subject to release in response to a public records request and must comply with the City's retention policies. A standard evaluation under the Public Records Act would apply. In addition, users will need to comply with the California Public Records Act and other applicable public records laws for all City usage of Generative Al.
VII. Incident Response and Reporting
In the event of a suspected cybersecurity incident—such as phishing attempts, malware detection, or data loss—employees must immediately report the issue to either the City’s IT Helpdesk or the Administrative Services Department. Timely reporting helps contain threats and limit potential damage.
Employees must also immediately report any lost or stolen City-issued devices, including but not limited to smartphones, tablets, laptops, or other portable media. Prompt reporting allows the City to take rapid measures such as remote data wiping, access revocation, or system lockdown to minimize exposure and protect City data.
The City will maintain a cybersecurity incident response plan, which includes procedures for detection, containment, recovery, and documentation of security incidents. This plan will be reviewed and tested periodically.
VIII. Training and Awareness
Training is essential for effective cybersecurity and responsible technology use. All employees must complete annual cybersecurity training covering topics such as password management, phishing recognition, data handling, and reporting procedures.
In addition, employees in the Finance and Accounting divisions, as well as those in management or positions of higher financial or operational risk, are required to complete biannual fraud prevention and fraud detection training. This training will address topics such as identifying red flags of fraudulent activity, safeguarding financial systems, and complying with internal control measures designed to prevent misuse of City funds or data.
All staff must complete training on ethical AI use, legal limitations, and risks associated with automation. Training will be updated as threats and technologies evolve.
City of Cotati
Cybersecurity and Data Protection Policies
Adopted XXXXXXX, 2026
IX. Policy Review and Updates
This policy will be reviewed at least once every two years by the City Manager and Administrative Services Director or their designees. Reviews will ensure continued relevance and reflect best practices, regulatory changes, and new technologies. The City may update this policy more frequently if a security threat or legislative change necessitates immediate action.
X. Enforcement
Violations of this policy may result in disciplinary action, up to and including termination of employment, suspension of system access, or legal action. Examples of violations include knowingly introducing malware, sharing sensitive data inappropriately, or using AI tools in ways that compromises sensitive information or spreads misinformation. All staff are expected to take cybersecurity seriously and help foster a culture of awareness and accountability.