City of Cotati: IT &
Emerging
Technology Policy
Why an IT Policy
Matters
Protects City systems from
cyber threats
Safeguards resident and
employee data
Enables responsible use of
new technologies
Maintains public-records
compliance
Policy Purpose & Scope
Applies to employees, contractors, vendors
Covers confidentiality, integrity, and
availability
Includes AI and emerging technology
oversight
Roles &
Responsibilities
City Manager & Admin
Services Director oversee
policy
Department Heads
ensure departmental
compliance
Employees adhere and
report issues promptly
Acceptable Use
of Technology
City devices for official
business only
Incidental personal use
allowed, if no risks
Use assigned credentials;
never share passwords
No installing unapproved
software or personal devices
Data Protection & Security
Requirements
• Encrypt sensitive data at rest and in
transit
• Classify data: public, internal,
confidential, protected
Encrypt
• Access based on roles; apply leastprivilege principle Classify
• Back up regularly; retire outdated
hardware/software
Access
Back up
Responsible Use of AI &
Emerging Technologies
• AI tools support, not replace, human
decisions
• Transparency: disclose when AI is used
• Do not input sensitive data into public AI
tools
• Approval required before adopting new
AI tools
Public Records Compliance
All City business
records may be
disclosable
AI-generated outputs
may be public records
too
Records retention
policy still applies
Incident Response & Reporting
IMMEDIATELY REPORT
CYBERSECURITY INCIDENTS
REPORT LOST OR STOLEN
CITY DEVICES
CITY MAINTAINS RESPONSE
PLAN: DETECTION,
CONTAINMENT, RECOVERY
Training &
Awareness
• Annual cybersecurity training
for all employees
• Biannual fraud training for
finance staff
• Ethical AI training for
authorized staff
Policy Review & Updates
REVIEW AT LEAST EVERY
TWO YEARS
UPDATE SOONER IF THREATS
OR LEGISLATION CHANGE
Enforcement
Violations may lead to disciplinary action
Access suspension or termination
possible
All employees must take cybersecurity
seriously
Peer Policies in Sonoma County
Sonoma County
IT Use &
Security Policy
Sonoma County
IT Governance
Policy
Aligns Cotati
with regional
best practices
Next Steps & Timeline
Present
• Present
policy for
Council
approval
Launch
• Launch staff
training and
awareness
Monitor
• Monitor
compliance
and metrics
Questions &
Discussion