Lathrop City Council
April 10, 2023

CITY MANAGER' S REPORT
ITEM 4. 20
APRIL 10, 2023 CITY COUNCIL REGULAR MEETING
ITEM: GRAND 7URY REPORT RESPONSE UPDATE
RECOMMENDATION: Direct the City Attorney to Submit a Letter to the Presiding udge of the San 7oaquin County Superior
Court Responding with an Update to the Findings
and Recommendations of the Grand 7ury Report On
Cybersecurity.

SUMMARY
On September 12, 2022 at its regularly scheduled City Council meeting, the City Council accepted the 2021/ 2022 San Joaquin County Grand Jury Final Report for Case No. 0321 regarding cyber security ( Attachment A") and directed the City Attorney to send a response letter (" Attachment B"). Within Findings and Recommendations 3. 3 and 3. 4, The Grand Jury recommended the City develop, adopt and implement a formal, written Business Continuity Plan and develop, adopt and implement formal, written, internal policies and procedures for potential ransomware attacks.

The City agreed with Findings and Recommendations 3. 3 and 3. 4, and instructed staff to draft written cyber security policies and procedures.

BACKGROUND
On September 12, 2022 at its regularly scheduled City Council meeting, the City Council accepted the 2021/ 2022 San ] oaquin County Grand ] ury Final Report for Case No. 0321 regarding cyber security and directed the City Attorney to send a response letter. Within Findings and Recommendations 3. 3 and 3. 4, The Grand Jury recommended the City develop, adopt and implement a formal, written Business Continuity Plan and develop, adopt and implement formal, written, internal policies and procedures for potential ransomware attacks.

City staff, with the assistance of hired consultants and the City' s insurer, drafted Information Systems Department procedures and provided drafts of those policies regarding cyber security to the Grand Jury on March 28, 2023 as further response to the Final Report for Case No. 0321 Findings and Recommendations 3. 3 and 3. 4.

The Grand Jury provided the requested edits or changes. Therefore, to finalize the City' s response, staff requests City Council approval of the following updated responses:

Grand ) ury Finding F3. 3: " The City of Lathrop does not have an approved Business Continuity Plan, rendering the City relatively unprepared to restore essential services in a disruptive event."
CITY MANAGER' S REPORT PAGE 2
APRIL 10, 2023 CITY COUNCIL REGULAR MEETING

GRAND ) URY REPORT RESPONSE UPDATE
Grand Jury Recommendation R3. 3: " By January 1, 2023, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a Business Continuity Plan."
City Council Original Response: The City of Lathrop has an unwritten Business Continuity Plan but not a written one. The City of Lathrop City Council agrees with Grand Jury Finding F3. 3 and Recommendation R3. 3 and documentation is anticipated to be complete by January of 2023.

Proposed Followup Response: The City worked with its consultant on the development and standardization of the City' s unwritten Business Continuity Plan. Because those policies include confidential details that would allow a potential hacker to gain easier access to the City' s Information Technology resources, those were shared confidentially with the Grand ) ury on March 28, 2023 and Council adopts the same in compliance with the Grand Jury' s recommendation. Redactions on the attached Business Continuity- Disaster Recovery Plan are intended to protect security information.

Grand ) ury Finding F3. 4: " The City of Lathrop does not have a formal internal policy or procedure to address ransomware attacks. This absence of policy could cause confusion, delay and greater loss of security in the event of such an attack."
Grand ury Recommendation R3. 4: By November 1, 2022, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a formal internal policy and procedure for a ransomware attack." City Council Original Response: The City of Lathrop has an unwritten, internal procedure to address ransomware attacks and, in addition to such, has hired a consultant whom will assist the City in development and implementation of a formal written policy for procedures to address ransomware attacks. The City of Lathrop City Council agrees with Grand Jury Finding F3. 4 and Recommendation R3. 4 and anticipates documentation will be complete by January of 2023.

Proposed Followup Response: The City worked with its consultant on the development of the City' s unwritten, internal procedures to address ransomware attacks and standardize those into internal policies. Because those policies include confidential details that would allow a potential hacker to gain easier access to the City' s Information Technology resources, those were shared confidentially with the Grand Jury on March 28, 2023 and Council adopts the same in compliance with the Grand Jury' s recommendation. Redactions on the attached Information Security Policy and the inclusion of only the Executive Summary and Introduction of the Incident Response Plan are intended to protect security information.

CITY MANAGER' S REPORT PAGE 3
APRIL 10, 2023 CITY COUNCIL REGULAR MEETING

GRAND JURY REPORT RESPONSE UPDATE
RECOMMENDATION:

Staff recommends City Council consider approval of the City' s proposed updated responses to the Grand Jury and direct the City Attorney to submit responses to the Presiding Judge of the San Joaquin County Superior Court to the findings and the recommendations outlined in the Grand Jury Final Report for Case No. 0321.

FISCAL IMPACT:

None, except for staff time to prepare this report.

ATTACHMENTS:

A. Grand Jury Final Report, Case No. 0321
B. Letter to San Joaquin County Superior Court Presiding Judge in response to Grand Jury Final Report Case # 0321 dated September 13, 2022.

C. Draft Letter to San Joaquin County Superior Court Presiding Judge in follow- up response to Grand ) ury Final Report Case # 0321 D. City of Lathrop Draft Incident Response Plan Executive Summary and Introduction
E. City of Lathrop Draft Information Security Policy
F. City of Lathrop Draft Business Continuity- Disaster Recovery Plan CITY MANAGER' S REPORT PAGE 4
APRIL 10, 2023 CITY COUNCIL REGULAR MEETING

GRAND JURY REPORT RESPONSE UPDATE
APPROVALS:
a
To ernandes Date
irector of Information Systems
4 5 2' 1r
Salvador Navarrete Date
City Attorney
23 Stephen J. Salvatore Date
City Manager
Attachment A
2021- 2022 San Joaquin County Grand Jury
w• s.
r
San loaqujn County and Its Seven Cities:

Cybersecurity: Local Defense Against a Global Threat
Case# 0321
Summary
We hear reparts on a daify basis of cyberattacks occurring araund the worid. These attacks a e becoming increasingly sophisticated, disruptive and expensive. Attacks on government agencies can dtsrupt essential services, c ippling communitks. Agencies small and la ge are equally vulnerabl. There is an ever-growing demand for stolen data in an underground market.

Comprornise of information has proven to be a serfous threat on the cyber battleground, both domestically and internationally. Bad acto s hack intelligence, media and essential service systems.

Oth r disasters such as floods, fires, stonr s or p olonged power outages can tnterrupt essential services if providers' information systems are not adequately secure. According to one expert witness interviewed by the 2021- 2022 Grand 1ury," World War itl wiii be fought in cyberspace, not on the battlefield."
Grand Jury memben are nat technical experts but saught to understand the cybersecurity iandscape and local governments' ma agtment of their cybersecurity risks and vutnerabilities. In this investigation of inforrnation secn ity of San Joaquin County and its seven cities, the 2021-2022 Grand! ury made a" point in time" ass ssment of each entity' s information Systems Department ISDj, focusing primarfiy on tybersecu ity. The Grand Jury considered nine elements of any ISD and, through research of elevant Iiterature and input f om industry experts, established an expected standard for each of those elements. The G and 1ury then evaluated each of the agencies with respect to those expectations.

The Grand 1ury conduded that San Joaquin Courrty( S1C) has mature and robust security policies and systems. The County' s security arthitecture provided a model in evaluating each city' s systems.

The Grand ury determined that Escalon, lodi and Stockton met a tay person' s expectations for cybersecurity but were lacking efther a formal Business Continuity Plan( BCP) or Disaster P epared ess Plan( PP), Lath op, Manteca and' fracy were found to have adequate security systems in place but lack documented plans for both Business Continuity and Disaster Preparedness. Ripon was found to-need improvtment in meeting several of the Gra d 1ury' s expectations, with lack of personnel being thefr g eatest chalienge.

The Grand 1ury ecommends that the County and affetted cities:
dcvelop, adopt and implernent a Busincss Continuiry Plan; develop, adopt and implement an IT Disaster Preparedness Plan; remedy specific cybers curiry risks found in this investigation; and the City of Ripon undergo a data system security rcvi w by an expert third party to assess the Ciry' s tT systems and protocois.
1'he Grand 1ury recognizes that cybersecurity is a dynamic process, a continually moving target which needs constant monito i g and updating.

Glossary
Acxess: The ability and means to commu icate with or otherwise interact with a system; to use system resources to manage information; to gain knowledge of the information the system contains; to control system components and functions.

Actor. bad actor, t6reat actor or attacker: An individual, group, organizatian or government that attempts or exocutes an attack.

Attack: An inte tiona) attempt tv gain unauthoriud access to system sen+ices, resources or infocmation; an attempt to compromise system integrity.

Aut6eutication: The process of verit3+ing the identity or other aurilwtes af an entity( user, proctss or device).

Aatborization: A process of deternrining, by evaluating applicable access control information. whether a subject is aliowed to have the specified types of aecess tn a particula rosource.

HCP: Business Continuity Plan. A document thai scu foKh procodares for the continued performance of core capabilities, critical operations and user services during any disruption or potential disruption.

CCISDA: Californis Counry Infonnation Services Dircctors Association. This is the official o genization ofthc county IT dit+eetors and chief infamation vfficers throughout the state of California. CCISDA repnsents all 58 California counties in the area of infannation technology in county government.

CIO: Chief lnformation 4fficer.

Computer Aided Diapsteh Systems: Used by dispatchers, call-takcrs, and 911 opecators to prioritize and record incident calls, identify the status and iocations of responders in the field and eflcctively dispatch rospondecs.

Coniideati lity: A properry of information that is not disclosed to users, processes ar devices unless they havc been authorized to access the informatian.

Cyber event or iacident: An occunence that actually or potentially results in adverst consequences to an infonnation system or he information that the system processes, storcs or transmits and that may rtx uice a response action to mitigat the consequences. An occurrence that constitutes a vialation ar immintnt thrcat of vialatian of stcurity poticies, sccurity procedures or aeceptable use policies.
2 Cybersecurity: 7he activity, process, sbility, capability or state whereby information and communications systems and tfie information contained therein are protocted frorn at dlor defended against damage, unauthorized use, modification or exploitatian.

DPP: Disaster Preparedness Plen. A document that sets forth policies and procedures for restoration of information systems after a critica! incident or event from any sowce. The pian addnesses interim restorstion of iaformation operations in the short and medium term and ful! restoration ofa11 capabilides in the longer tenn.

Daa iategrity: The property that data is complete, intact and trusted and hss not been modified or destroyed in an unauthorized or accidentai manner.

Data security policy: A rulc or set of ruks thst govems the acceptable use of an organiution" s information and services to a level of acceptable risk and the mesns for protecting the organization' s infomtation assets.

Eneryptioa: The process of convecting data into a form that cannot be easily understaod by unaut wrized p ople or sgents.

FirewaU: A capabil'tty to limit netwark traffic between networks andlor information systems. A hardware! softwarc device, or a software pcogram, thst limiu netwodc traffic according to a set of nsles of what access is and is not aliawod or authorized.

Hacker. An unsuthoriud user wtw atternpts to or gains accass to en information system.

ISD: Infonr adon Systems Departmtnt.

IT: Information Technology.

KnowB4: A proprietary szcurity aw reness training pfatform. KnowB4 is usod by agencies for simuleted phishing activities and other email compromise tests, as welt as for othor IT sccurity training nceds.

Ms lw are: SoRwnre that cornpromises the operation of a system by performing an unauthoriud functian or pracess.

Mobik device maa ement tool: A security sottwaro tool designed to help organiaations secure, managa and monitor mobile devices such as smartphones and tablets.

Multi-fnctor authe tkatioa: An electronic authentication mechanism in which a user is granted access to an appiication only after presenting two or nwre piec s of evidence( fsctocs or keys only the authcntic user knows or possesses}.

Multi- tayer security acceas: Multi- layer security refers ta a system that uses numerous components to shield the IT infrasuucture. [ t is a defense mechanism that mitigatts, delays or prevcnts thrr,ats.

Network or eyber iafrastrnMuro: The infotmation and communication systems and services composexi of all hardwsre and software that process, store and communicate information; any combinstion of sll these elements.

Ne ct-gaoeration aystema: Security systems consisting of both firewall and intrusion prevention systems built in, ather than as edd- ons, abng with the feawres of basic fircwalls.

Ph hing: A digital form of sc cial rngineering to deceive individuals iato providing sensitive infocmation.

Ph ahing tat: A socurity training exercise designed to test usecs' wlnerability and rcinforce vigilance.

Preaidential E tecuNve Order 14028: " Improving thc Nation' s Cyb rsecurity"( issued May 12, 2021) reyuires agencies to enhance their cybersecurity system integrity. 3 Rsesomware: A type of maficious software designed to block access ta a computer systern unti) a sum of monay is paid.

Ransomware attack respoose plan: A set of prcdetermined and documented procedurcs to detect and respond to a cyber incident involving demand for ransom for recovery and restoration of data or systems.

Records Management System: The managemcnt of records for an organization throughout the records' life cycle.

Redundancy: Additionai or alternative systems, sub-systems, assets or processes that maintain a degtee of overal) functionality in case of loss or failure of another system, sub- system, asset or process. Typicalty applied ta power supplies and data backup systems.

Vuloerability: A characuristic oc specific weakness that rendcrs an organization or asset( such as information or an information system) open to exploitation by a given thrcat or susceptible to a given hazard.

Wi-Fi network: A family of wirekss nctwork protocols used for local area networking of devices and int rnet ccess, allowing nearby digital devices to exchang data by radio waves.

Background
The 2 8- 2009 San, loaquin County Grand Jury reported on information technolagy security, finding that seve a! County departments and two of the seven cities in the counry met expectations for information Technology(! i')security, while some County departments and five cities did not.

Recommendations were made and generally accepted in agency responses. In terms of technology, 200& 2009 was at ieast a generation ago. Government agencies use and store vast amounts of sensitive data on their residents and their employees, including personal identification data, financiat data, health data and legal data. AdditionaHy, these agencies provide services essentiai to our day-to-day lives, including publit safety police and fire), public works, health servites, water services and commun9ty developme t. The Grand 1ury recognizes that we are lay people, ha dly experts, in the fieid of IT. It was the intent of the 2021- 1022 6rand Jury to examine how the county and city governments within San Joaqufn County are exercising due diligente to protect information, defend agatnst future cyberattacks, maintain current disaster plans and provide ongoing training to employees in these matters.

Reason for I vestigation
As stated in Presidential Executive Order 24028,"... the prevention, detection, assessment and remediation of tyber incidents is a top priority and essential to nationai economic security." 5an Joaquin County has experiencecf ransomware and cybe secuNty attacks firsthand. SChool districts, municipalities and county agencies have been victimized in recent years. Given the ise in compiexity of IT, the current sophistication of cybercrime, and the essentiai natu e of govemment servtces provided, the Z021- 2022 Grand Jury u dertook an investigation i to the current state of security and disaster prepar dness of the IT systems of San loaquin County and the seven incorporated cities within the county.

Method of Investigation
The 2021- 2422 Grand Jury surveyed six San oaquin Counry 17" depactment hcads and th City Manager or City Administretor of esch of the seven cities in the caunty; each resptmded to the survey. Subaequently, an sgency IT depsrtment head or staff member, an IT consuhant or a city administrator was interviewed to cl rify responses and to provide additionel material wi en applicable. The Grand Jury also interviewed independent cybersecurity experts. The expert witnesses have collectively more than 50 years' experience at diverse tevels of gove nment ranging from county to state to national infonr atlon systems and cy6ersecurity. R executives from one school dist ict were also interviewed. For this investigation, the Grand! ury intenriewed 16 individuais and attended cybersecurity presentatlons.

The Grand Jury also reviewtd numerous websites and newspaper and magazine articles relevant to this investigation. Additionally, the Grand 1ury reviewed dacuments provided, including network diagrams, ransomware Msurance polkies and other items.

Materisis Reviewed
2021• 2022 San Joaquin Counry Grand Jury surveys
Biden. Joseph. Executive Order o Improving the Natian' s Cybersscuriry. 12 May 2021.

Exccutive(? rdei# 14028
CaIfornia Jofnt Cyber Incfdent Response Gufde. California Office of Emergency Strvices Cyber Security Integration Center, 2 Aug. 2021
CyberAtockPreparedness! n Contra Casta County. Contra Costa County Civil C3rand Jury, 2021. Report 2104
Digilal Services arrd In»ovation Strategy. San Joaquin County, 19 Nov. 2020 How to Devslop a Ransonnvare Renudiatlon Plan. Rubrik, 2021 Informmton Technology Security. 2018- 2019 Santa Barbara County Grand Jury, 2019 Irrformation Technology Secta ity: Cities and San Joaquin County. 2008/ 2009 San Joaquin Courtty Grand Jury, 2009. Report No.03- 0$
Rarrsomware Deferrse for Dumnii s--2rid Edition. 2nd ed., Cisco Umbrella, 2021 Websites Visited
Cybersecurity& Infrsstructurc Security Agency." CYBERSECURITY CISA." Cisa.gov, Cybersecucity and Infrashucture Security Agency, 2019, www. cisagov/ cybersecw ity. Accesaed 6 May 2022.

Federal 7rade Commission. and Alvaro Puig." Cybersecurity Advice to Pmtcct Your Conrrocted Devices and Accounts:' SJgay. org, 24 Mar. 2022, www.sjgov. otg/ department/ da/ consumerale ts/consumer-slertsl'2022/ 03/ Z4/ cybersacurity- edvice-to-protect•your-cannected- devices- andaccounts. Accessed 6 May 2022.

Kuykendall, By Kristal." Cybecsecuriry Experts Call for More Tcanspacency and Immediate Resources for Schools-" The Journal, l7 Mar. 2022,
thejournal. com/ Articles/ 2022/ 03/ 17/ Cybersecurity- Experts- Call- For•More- Transparancy- andlmmediate-Resources-for-Schools.aspx?Page= 1. Accessed 6 May 2022.

S
Marcum Accounts Advisors." What Is a SOC 2T' T'Jre SSAE 18 Repor i»g Standard• SOC 1 - SOC 2- SOC 3( Formerly SSAE 16), 81an. 2022, www.ssae- 16.com/faq/what-is•a•soc- 2/.

Accessed 30 Apr. 2022.

National lnstitute for Cybersecuriry Carcers and Studies." Cybersecuriry Glossary National Initiative for Cybersecurity Careers and Studiea." Niccs. cisa.gov, nices. cisa. gov/ aboutniccs/ cy[ rstcurity- glossary. Accessed 6 May 2022.

Unisys." Cyber Attacks•- What You Need to Know" Unisys, 2022, www. unisys. com. Accessed 6 May 2022.

Discussions, Fndings and Recommendations
General Discussion
The Grand 1ury recognizes cybersecurity is an extremely complicated topic. Specialized knowledge, experience and expertise are requi ed fo a deep understanding of what is necessary for adequate policfes, systems and architecture. Lack ng such specialized knowledge, the Grand Jury resea ched numerous sources, including recognized experts in this fieicf to detemnine the fotlowing elements of any ISD and to deflne the foUowing expectations for adequate cybersecurity in today' s environment.

Expectations
Orgaoizxtion: Each ocganization should have a dctailcd Organizetion Chart demanstrating the structure of its independent IT department. Cities lacking an independent IT department should have a chart showing where IT resides in their overall structure.

Network Dlagram: Each organization should have a detailed necworlc diagram indicating the rclationships between all IT architectural elements. Best- practice guidelints suggtst that this diagram bc conlidential.

Data Contident ality: Each organization should have an organization- wick poticy determining data confidentiality and access control. Policy for data access should ba clearly defined and deskspecific or station- specific.

DAta Security: Each organizatian shouid have next- gcneration systems and controls to ensure both physical and cybor secu ity for a111T assets. Next- gcneration firewalls and endpoint management systems provide protection against ever- evolving means of cyberattack. Data should be protected with daily or continuous backup and srchival systems. Backups should be protccted against corruption, extemal encryption and or deswction. Agencies should require multi- factor authentication for aecess to netwvrk systems.

Busibess Contiauity Plan ( BCP): Each organization should have a detailed, current, comprehensive plan for restoring scrvices in the event of disruption from any source.

Disaster Prepsredness Plaa ( DPP): Each organization shouid have a formal, detailed plan to prepare for various possible IT disruptions. This plan should be tested frequently and updated regularly.

Ransomware Policy: Each organization shauld have an intemal ( confidmtial) documented policy for agency response to a ransomware attack.
6 Cyber Event Insurance: E h organization shoutd havc insurance coverage to help offset economic Iosses from cyber events.

Ongoiag Ewployea Training: Each organization shouid provide rigorous, frcquent training and ongoing testing of al! ernployees as an integral part of its cybersecurity profile.

Survey Results:

The tabte below indicatas whether an agency met( M), did not meet( N1Vn or was in the process of ineeting( IP) the nine d finad expoctations.
oR e o. a osa a on oa w. n c a. r T+ rr
awc a.a. n co lwa Mt s. wr nr Mqr w, a
S1G M M M M M M NM M M
Escsbn M M M M NM M M M M
t,athrop M M M M NM M NM NM M
trodi M M M M IP M M M M
MaMeq M M M M M M iP IP M
Rlpon M M M M NM NM NM M M
Stockton M M M M M M NM M M
Trary M M ; M M IP IP NM M M

1.0 San Joaquin County—Discussion
In Novtmber 2020, San loaquin County released a three-year( 2020-2023) strategic plan for ensuring continuing security, efficacy, cost- effectiveness and best- service outcomes to a11 end- users of County services and systems. The plan document" San Joaquin County Digitai Services and Innavatian Strategy" estabiished goals fer County digital service systems. fihese gaals— Modernizing and leveraging OurTechnology Environment— address objectives fcr a security posture:

1. Acquire and implemcnt cybersecurity technotogy to enable SJC to devefop industry- leading capabilities to help mitigate and addrcss cybecsecurity risk.

2. Develop snd mature security govemance end processes to meet dr exceed industry standards, enhanee security enforcement partnerships, and strcngthen Caunty pcaetiees.

3. Develop a robust security training program for thc County workforce, including enhanced trainin and develo ent for the securi workforce.

Excerpt fram" S n Joaquin County Digitel Services md lnnovation Strategy," November 19, 2020( page 6) San 7oaquin County has met these objectivts and continues tn update and enhance these processes as the cybersecurity landscape continues to evolve.
7 San Joaquin County ISD oversces sil Co nty departmcnts, making it ane of the largest county ISDs in California. San loaquin County ISD is an activ participant in the Califomia Counry lnformation Systems Depertment Association( CCISDA). This association provides opportunities for counties ta sharc information and exp ricnces and offers$ uidance, such as standards fvr best-prectice policies.

Several latgc and specialiud departments within the County have their own IT departments and deparqnent chicfs who tcport to thc County' s Chief 1nfaRnation Officer. Additionally, SJC has a dedicated Information Security Officer. All these IT executives form a cybersecurity governance committee which meets monthly, with subgroups mceting more frequently as needed.

Counry 1SD and Human Resource Depanments conduct frequent and on- going employee training and testing using proprietacy software. ln addition to these Counry depamnents, sevcral Independent Special Districts in S3C use County IT scrvices through various memoranda of understending.

The only element of the defined expectations aot met by SJC is having an interna) dvcumented policy for response to a ransomwart attack.

San Joaquin County is a modei agency in the realm of information technology and maintenance of cybersecurity.

Findings
Fi. i San laaquin County does not have a formal intemal policy concerning payments or procedures in ransomware attacks. This absence of policy could cause confusion, delay and g eater loss of securiry i the event of such an attack.

F1. 2 San Joaquin County has an exemplary proffle regarding tyberseturity nd should serve es modei for oiher govemment agencies within San Joaquin County.

Recommendations
Rl. i By Novembe 1, 2022, the San Joaquin County Board of Supervisors, in conJunction with San loaqu n County ISD, develop, adopt and implement a formal internal policy and procedure for respo se to a ransomware attack.

2.0 tity of Escalon—Discussion
The City of Escalon does not have an independent IT department but has a contract agreement with Mid Valley IT to provide al! IT servlces. In the City organization, IT functions repart to the Finance and HR Dtrectors. Each ernployee is given a level of access according to assig ed esponsibilities within their department. All empioyees receive info matlo security trainfng sp cific to their responsibitities as wel) as general security awareness training. The IT consultant employs an aggressive multt-fayered approach ta mitigate security threats through wftware and hardware protection measures. Critical o cnnfidential data is stored in multiple cloud- based lacations and systems employing numerous safeguards, including use of multi-factar authentication for access.

IT funttions a e protected with a standby generator and redundant backups in case of a system failure. The generator is tested periadically for functionality. 8 The ty of Escalon met all but one of the expectations for adequate cybersecu ity. Escalon is by far the smatlest city irt San loaquin County, but by using a contraded IT secvice provider, Escalon is meeting its cybersecurity needs. The Gty of Escafon dces not have a documented Business Continuity Plan.

Findings
F2. 1 The City of Escalon does not have a documented 8usiness Continuity Plan, leaving the City relatfvely u prepared ta restor essential services in a disruptive event.

Recommendations
R2.1 By lanuary 1, 2023, the Escalon C'ity Council, in conjundion with Mtd Valley IT, develop, adopt and implement a Business Continuity Pian.

3.0 City o l.athrop- Diszussion
The Gty of lathrop met six of the expectations for the ntne elements considered in this investigation. Lathrop' s IT organization includes a Directar of I formation Technology at the cabinet teadership level, a palicy strongly recommended by an R expert for maximum R security. Including the Di edor of IT in frequent, regular meetings with other depanment heads allaws effective communication of IT secuNty needs to all City departments.

Expectations for data confidentiality and data security were met. However, use of muftl-factor authentication for system access was not universal at the time of this investigation, leaving LaChrop at higher risk af attack. lath op provides an unsecured public Wi-fi etwark, separate fram the City' s setu e business network and accessible to any user. Hackers or other bad actors could take advantage of the unsecured network, possibly resulti g in compromise of log•in credentlals from that network and passibly exposing the City to costly liability sufts. Lathrop w s in the process of developtng and approving a BCP and OPP pian at the time af this investigatlon. Similarly, the Clty was updating an intemal pollcy for response to a ranwmware attack. At the time of this investigation, lathrop ladced insurance agalnst losses tncurred in a cybenecurity inddent.

Find ngs
F3. 1 The C'ity of E. athrop does not employ mufti-fador authenUcation unive sally, leaving City systems more vulnerabte to the activities of bad actors.

F3. 2 The Clty of Lathrop provides an unsecured public Wi- Fl network. Misuse of this unsecured network could expose the City to liability risks.

E3. 3 The City of i.athrop does not have an approved Business Continuity Ptan, rendertng the City relatively unprepared to restore essential services in a disruptive ev nt. 4 F3. A The City of lathrop daes not have a formal intemat policy or procedure to address ransomware attacks. This absence of policy cautd cause confusion, delay and greater loss of stcurity in the event of such an attadc.

F3. 5 The City of Lathrop does not have an insurance polity covering financial bsses f om a cyberattack, possibly exposing City financial resources.

Recommendattons
R3. 1 By November 1, 2022, the Lathrop Clry Councif, in conjunction with the Cit} s IT department, develop, adopt and implement a procedu e for universal multi- facto authentication for access to City data.

R3. 2 By November 1, 2022, the Lathrop City Council, in conjundion with the C1ty' s IT department, provide a secure public Wi-Fi networic.

R3. 3 By January 1, 2023, the lath op City Councfl, i canjunction with the City' s IT depanment develop, adopt and implement a Business Continuity Plan.

R3. 4 By Novembtr 1, 2022, the Lathrop City Council, in conjunction with the City' s I7 department, devefop, adopt and implement a formal inte nai policy and procedure for a ransomwa e attack.

R3. 5 By 3anuary 1, 2023, the lath op City Council, in conjundion with the City' s IT department, obtai an insurante policy to mitigate fiscai impact resulting from cyberattadc or othe crrtical information system loss.

4.0 City of I.odi—Discussion
The City of lodi has a large IT division, responsibie for ati IT functions of the City. The division is responsibte for the integrity of the City' s cyber infrastructu e, maintenan e and support of all hardware and software, and assuring secure access to all network esources. lodi fell victim to a ransorn attacic in Aprii 2019. 1'hat unfortunate event caused the City to change its management of cybersecurity, significantly elevating the importance of vigilance by all Gty staff. lodi has implementtd a robust cyber awareness training prograrn fo alt City employees, incorparating education in tactics used by bad actors both inside and outside the City' s network. Monthiy training is foliowed by testing in topics covered. Citywide campaigns oaur quarterly to test empioyee response to phishing and other email-based attacks. The IT division head reports directly to the Deputy City Manager and meets egulariy with all City department heads. The City of lodi met a! 1 expectations for cybersecurity except for having a compieted, vp-to-date Business Continuity Plan.

The City has contracted a business cansuhing fi m to create a BCP, projected to be completed and implemented by the end of June 2022.
10 Findings
F4. 1 The City of lodi does not have an approved 8usiness Continuity Plan, rende ing the City relatively unprepared to rcstore essent al services in a disruptive event.

F4. 2 The Gty of Lodi has fmplemented an excellent cyber awareness tra(ni g program for sll emplayets minimizing risk to darnage from cyberattack.

Recommendations
R4. 1 By lanuary 1, 2023, the lodi City Courxil, in conjunction with the City' s IT division, develop, adopt and implement a Business Continuity Plan.

5.0 City of Manteca- Discussion
The City af Manteca met seven of the nine expectations considered in this investigation. Manteca' s Info matian Technolagy department is independent in the City' s orga ization. The department director reports dJrcctly to the City Manager and meets weelciy with othe City departrnent heads.

User level of access is determined by position, badcg ound and other departmental factors.

Employees are trained on a rcgular basis. The training is mandatory for sll employees. Hard drives are encrypted, and a Mobile Device Managament tool Is used for tablets,( aptops and phanes.

Manteca' s ISD is cu rently updating its Information Technology Seturity Poltcy.' 1' his comprehdnsive policy has r ot been updated since 2010. Manteca's Oepartment of Informatio Technology and Innaystion is colla6orating with Gty administration and the qty Attorney to update all policies relating to information technolagy security. Similarly, the City is in the process of bringing both hardwa e and software systems up to ext-generation standards with new flrewall, malwa t, user access, backup systems and applicatw s in place. Employee t aining is executed th augh KnowB4, an industry- standard cybersecurity training program which includes phishing and other email compromise testing.

Rega ding firewalls and switches, roughly 6096 stiU operate off single nther than dual or redundant power wpplies. Over the next five years, the tity is phasing out aldcr devites as they reach end-oflife. indings
F5. 1 The City of Manteca has an Information Technology Security Policy whkh has not been updated since 2010, feaving the City relatively unprepared for a cyber event.

F5. 2 The Qty of Manteca lacks a policy and procedure for ransomwa e attacks. This absence of policy could cause co fusion, delay, and g eater loss of secu ity in the event of such an attack.

F5. 3 The C' ty of Manteca has a significant number of security devices with single power suppltes.

This latk of redundant power presents vulnerabiitty in major or p obnged power outages. 11 Recommendations
R5. 1 By lanuary 1, 2023, the Manteca City Cou cil, in conjunction with the City' s 15D, develop, approve and implement an updated Information Technology Security Policy.

R5. 2 By 3anuary 1, 2023, the Manteca City Council, in conjunttion with the City' s IS, develop, apprave and implement a confidential polky and procedure for esponse to a ransomware attack.

RS. 3 By March 1, 2023, the Manteca Gty Council, in co junction with the Ciry' s ISD, develop, approve and adopt an updated timeline to repiace single- owe ed units with dual-powered or redundant- powe ed units in thei network architecture.

6.0 City of Ripon- Oiscussion
7he City of Ripon has experienced turnover and vacancies in the IT Department in the past year.

The Director of IT resigned in eariy 2021. Subsequently, anothe IT Directar was hired but resigned within three manths. The City has contracted with a former IT employee as a temporary IT Director and is currently updating the job descriptfon for a permanent director of the R functions.

The City' s organizatiqn chart does not include an IT department or department head. The only IT position shown is within the Police Department.

Oata confidentiality is maintained through a three• tiered access structure. Management supervisors far each City department determMe who has access to appropriate info mation.

Sensitive data is held within a Computer Aided Dispatch Program or a Recards Management System within the IT division of the Ripon Poilce Depa trr ent. The se sitivity of data with afl other City departments is determined by superoisors.

Findings
F6. 1 It is unclear in the City of Ripon' s Organization Chart whe e responsibilities for IT and IT security lie, creating confusion over who is respansible to act in a disruptive event.

F6. Z The City of Ripon has a rudimentary network diagram outlini g the City's router and firewall relationship with networks used, but the diagrain lacks detail, leaving uncertainty about data security.

F6. 3 Although the City of Ripon met expectations in the areas of data confidentiaiity and security, lack of IT staff and leadership leaves these areas vuinerable to cyberattack. f6. 4 The City of Ripon lacks a Business Contlnuity Ptan, rendering the City relatively unprepared to restore essential services in a disruptive event.

Fb.S The City of Ripon does not have a Disaster Preparedness Plan, leaving the tity at risk for significant delay and cost to restore IT systems in the event o# a disaster.

F6. 6 The City of Ripon does not have formal policy or procedure to address ansomware attacks. This absence of policy could cause tontusion, delay and greater loss of security in the event of an attack.
12 Recommendations
R6. 1 ByJanuary 1, 2023, the Ripon City Council develop and make public an updated Gfty Organization chart showing details of the City' s IT functions, including ail IT posit ons.

R6. 2 Sy January 1, 2023, the Ripon City Coundl develop and adopt a detaikd Network Diagram to decrease security vufnerabilfties.

R6. 3 By January 1, 2023, the Ripon Qty Council obtain a third-party security review of the City' s IT department assets, positio s, a d po icies and an evaluation of data confldentiality, secu ity systems and protocols.

R6. 4 Bylanuary 1, 2023, the Ripon Gty Councit develop, adopt and impleme t a formai Business Continuity Pl n.

R6. 5 By January 1, 2023, the Ripon City Cound! develop, adopt and implement a formai isaster Preparedness Plan for IT functio s.

R6. 6 6y lanuary 1, 2023, the Ripon City Councli develop, adopt and implement a formal internal policy and procedure for response ta a ransomware attack.

7.0 City of Stockton- Discussion
The City of Stotkton has a large IT department that oversees IT functions for all the Cit s other departments. Data confidenttality and user auess are determined departmentally, foilowing uniform standards. Information is protected by many safegua ds aiming not only to minimize risk of penetration but also to detect any breach that might occur. Stockton has both a BCP and a DPP.

Stockton is one of very few dties havi g license to use a cyberucu ity tool integrating the City with the State of California' s Office of Emergency Senrices. Stockton' s IT Director meets weekly with other department heads, updating them on all matters related to cybtrsecurity.

Stockton met eath of the cybe security expectations except for the presence of a documented i temal policy and procedure fo response to a ransomware attack. However, the City daes have a Cybersecurity Response Book detaifing response procedu es far other cyber events. Employee secur ty awareness training is requfred every six months.

Findings
F7. 1 The City of Stockton does not have a formal intemal pollcy concerning payments o procedures in ransomware attadcs. This absente of pollcy could cause confusion, delay and greater loss of security in the event af an attack.

F7. 2 7he City ofStackto has a large IT Department which places cybersecurity and disaster preparedness at a high priority, minimizing risk to the City' s information and service systems. 13 Recommendations
R7. 1 By Movember 1, 2022, the Stockton City Councii, in conjunction with the City' s IT depanment, develop, adopt and implement a formai internai policy and procedure fo response to a ransomwa e attack.

8.0 qty of Tracy—Discussion
The Cty of Tracy met aii expectations for cybersecurity or was in the process of ineeting them when surveyed. The City has an Info mation Technology Divisicwn, which is pan of the Finance Department. This division supports ail departments and functiont of the City except water treatment. Data confidentiality and secu ity are guaranteed with industry• leading, next• ge eration firewalis and network access controls. Data storage, backup and cybersecuriry are monito ed cantinually. The lT Manager meets every two weeks with all other City department heads to address IT iswes, including cybersecuriry.

Tracy does not require encryption of thumb drives used on City devices a requirement that is considered a" best practice" by an expert wit ess.

Tracy does not have either a formal Buslness Continuity Pian ar Disaster Preparedness Plan in piace but is in the p ocess af developing both. The BCP was scheduled to be complete in April 2022.

Completion date fo the DPP was not specified by tf e City.

Fi dings
F8. 1 Lacking a requirement fo entryption of thumb drives used on City devices exposes the City of Tracy to potential data tfuft and contamination.

F8. 2 The City of Trary lacks a completed 8usiness Continuity Plan, rendering T aty relatively unprepared to restore essential services in a disruptive event.

F8. 3 Th City nf Tracy lacks a compieted Disaster Prepa edness Pian, leaving Tracy at risk for delay and cost to restore iT systems in the event of a disaster.

Recommendations
R8. 1 By November 1, 2022, the Tracy City Councii, in conjunctlon with the IT division, develop adopt and implement a policy requiring encryption of thumb drives used on City devices.

R8. 2 By Ja uary 1. 2023, the Tracy City Council, in conjunction with the IT division, develop, adopt and implement a fonnal Buslness Contlnuiry plan.

R8. 3 By January 1, 2023, the Tracy City touncil provide the Grand Jury with an updated formal Disaster Prepared ess Plan.
l4
Conclusion
San loaquin[ ounty is well pratected regarding tyberseturity. The seven cities in the county vary with respect to Grand 1ury expectations, most being wefi secured but latking deflned plans for Bustness Continuity and IT Disaster Prtparedness. Cybersecuriry is an evolvin concern and requires ongafng efforts by government entities tc remain current and vigilant against isks to their information Systems.
in this investigation the Grand Jary learned fram cyberseturity experts that three key elements lead to maximum agency cybersecurity:
a dedicated information security position within each organization, a" sest at the table" with other agency department heads in regular meetin s, and a rigoroas employee education a d training program in cybersecurity matters.

Disclaimers
Grand 1ury reports a e based on documentary evidence and the testimony of sworn ar admonished witnesses, not on conjectu e or opinion. However, the Grand 1ury is precluded by law from disclosing such evidence except upon the specific approval of the Presiding ludge of the Superior Court, or another judge appointed by the Presiding Judge( Penal Code Section 911. 924.1( a) and 929y. Similarly, tfie Grand 1ury is precluded by law from disclosing the identity of witnesses except upon an order of the court for narrowly defined purposes Penal Code 5ections 924.2 and 929}.

Response Requirements
California Penal Code Sections 933 and 933.05 require that speti t responses to all findings and recomrnendations contained in this report be submitted to the Presiding Judge of the San loaquin County Superior Court within 90 days of receipt of the repart. 7he San loaquin County Board of Superviso s and the City Countils of each city addressed shall respond to all findings and recommendations specific to their city.

Mail o hand delive a hard copy of the response to:

Nonorable Michael D. Coughlan, Presiding Judge
5an Joaquin County Superior Court
180 E Weber Ave, Suite 1306J
Stockton, California 95202
Alw, please email a copy of the response to Ms. Trisa Martinez, Staff Secretary to the Grand 1ury, at arandlurx sicourts. ora
IS
Attachment B
Ciiy of
O ace ofthe City Attorney 390 Towne Centre Drive- Lathrop, CA 95330 Phone 209- 941- 7235 Fax 209- 941- 7233
www. ci.lathrop. ca. us
September 13, 2022
Honorable Michael D. Coughlan, Presiding Judge
San Joaquin County Superior Court
180 East Weber Avenue, Suite 1306J
Stockton, CA 95202
Re: Response to Grand Jury Final Report Case No. 0321 ( 2021/ 2022).

Report received by the City of Lathrop on June 15, 2022 Honorable Michaet D. Coughlan,
Pursuant to Penal Code Section 933 and 933. 05, this letter is to inform you that on September 12, 2022 at a regularly scheduled City Council Meeting, the Cily Cuusxcll uf the City of Lathrop reviewed and approved the above referenced Grand Jury Final Report and directed me to write this letter ofresponse on their behalf.

The 2021/ 2022 Grand Jury Final Report found that:

Grand Jury Findin F3. 1: " The City of Lathrop does not employ multifactor authentication universally, leaving City systems more vulnerable to the activities of bad actors."
Grand Jury Recommendarion R3. 1: " By November 1, 2022, the Lathrop City Council, in conjunction with the City' s IT deparirnent, develop, adopt and implement a pracedure for universal multi-factor authentication for access to City data."
Citv Council Response: The City of Iathrop City Council agrees with Grand Jury Finding F3. 1 and Recnmmendation R3. 1 and multi- factor authentication security has been implemented and in effect since June of 2022.

Grand Jury Findinff F3. 2: " The City of Lathrop provides an unsecured public Wi-Fi network. Misuse of this unsecured network cauld expose the City to liability risks."

Grand Jury Rec mmendation R3. 2: " By November 1, 2022, the Lathrop City Council, in conjuncrion with the Cifiy' s IT department, provide a secure public Wi- Fi network."
City_Council Re,gponse: The City of Lathrop disagrees with Grand Jury Finding F3. 2 and Recommendation R3. 2 because by definition, publicly available Wi-Fi is inherently" unsecured", although this designation is a misnomer because it eludes to an idea that publicly available Wi-Fi can either be secured nr unsecured, and that unsecured is less " safe" or more" risky" than secured. Neither are the case. An " unsecured network" only means that such Wi-Fi is publicly available for anyone to use. Wi-Fi networks, either secured or unsecured, cannot merge end- users between those networks. Secured and unsecured networks, and the end- users utilizing either, remain completely isolated from one another; it would be unfeasible for someone with access to only an unsecured Wi- Fi network to also have the ability to gain access to a separate, secured Wi-Fi network.

The commonly perpetuated idea of" risk" associated with the use of an unsecured Wi-Fi network inconectly shapes such " risk" as something that happens upon an end- user re ardless of their use ofthe unsecured Wi-Fi network, when in reality, risk can develop and potentially increases the more limited an end- user' s understanding of how their digital presence on the internet affects their wlnerability and security. End- users should be encouraged to utilize personal checks and balances to verify the Wi-Fi networks they choose to cannect to are verifiable and reputable, that their presence an the internet is not made easily availahle ta be tracked by others, and that they are visiting legitimate websites, in order to further maintain security of their personal data and informatzon.

Publicly available Wi-Fi is a critical asset to cities around the country. Publicly available Wi-Fi provides the public the opportunity to connect to critical and important information equitably and provides a consistent source of access to such information, promoting economic inclusion within the community. The City of Lathrop cutrently hosts an unsecured public Wi-Fi network entitled " Ciry of Lathrop Guest Cloud 1" and end- users who connect to this network to access the internet must agree to the terms and conditions of its use, and which the public is only able to remain connected to for time increments of thirty ( 30) minute, between 7am and 7pm, seven( 7) days per week.

Grand Jury Finding F3. 3: " The City of Lathrop does not have an approved Business Continuity Plan, rendering the City relatively unprepared to restore essential services in a disruptive event."
Grand Jury Recommendation R3. 3: " By January l, 2023, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implernent a Business Continuity Plan."
City Council Response: The City of Lathrop has an unwritten Business Continuity Plan but not a written one. The City of I,athrop City Council agrees

with Grand Jury Finding F3. 3 and Recommendation R3. 3 and documentation is anticipated to be complete by January of 2023.

Grand Jury Findina F3. 4: " The City of Lathrop does not have a formal internal policy or procedure to address ransomwaze attacks. This absence of policy could cause confusion, delay and greater loss of security in the event of such an attack."
Grand Jury Recommendation R3. 4: " By November l, 2022, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a formal internal policy and procedure for a ransomware attack." City Council Response: The City of Lathrop has an unwritten, internal procedure to address ransomware attacks and, in addition to such, has hired a consultant whom will assist the City in development and implementation of a formal written policy for procedures to address ransomware attacks. The City of Lathrop City Council agrees with Grand Jury Finding F3. 4 and Recommendation R3. 4 and anticipates documentarion will be complete by January of 2023.

Grand Jury Findin F3,5: " The City of Lathrop does not have an insurance policy covering financial losses from a cyberattack, possibly exposing City financial resources."
Gran.d Jury Recomm ndafiion R3. 5: " By January 1, 2023, the Lathrop City Council, in ccmjunation with the City' s IT department, obtain an insurance pnlicy to mitigate fiscal impact resulting from cyberattack or other critical information system lass."
Citv Council Respanse: The City of Lathrop City Council paztially agrees with Grrand Jury Finding F3. 5 and Recommendation R3. 5 and would like to further clarify that staff confirmed that the City of Lathrop does in fact have cybersecurity insurance coverage, and is currently in discussions with Risk Management to enhance said coverage.

Respectfully submi .,_.__-
r--'` ..__
Salvador V. Navarrete
City Attorney
SVN/ trb
Cc: Trisa Martinez at randiury a sjcowts-arA

Attachment C
City of
O ce ofthe City ttorney 390 Towne Centre Drive
Lathrop, CA 95330
Phone 209- 941- 7235
www.ci.lathrop.ca.us
April 1 l, 2023
Honorable Michael D. Coughlan, Presiding Judge
San Joaquin County Superior Court
180 East Weber Avenue, Suite 1306J
Stockton, CA 95202
Re: Followup Response to Grand Jury Final Report Case No. 0321 ( 2021/ 2022).

Honorable Michael D. Coughlan,
This letter is provided to the Grand Jury as a followup response to the City of Lathrop response to Grand Jury Final Report for Case No. 0321 ( 2021/ 2022). At its regularly scheduled City Council Meeting on April 10, 2023, the City Council ofthe City of Lathrop reviewed and approved the policies described herein and directed me to write this letter of response on their behalf.

The 2021/ 2022 Grand Jury Final Report for Case No. 0321 stated the following:

Grand Jury Finding F3• 3: " The City of Lathrop does not have an approved Business Continuity Plan, rendering the City relatively unprepared to restore essential services in a disruptive event."
Grand Jury Recommendation R3. 3: " By January 1, 2023, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a Business Continuity Plan."
City Council Original Response: The City of Lathrop has an unwritten Business Continuity Plan but not a written one. The City of Lathrop City Council agrees with Grand Jury Finding F3. 3 and Recommendation R3. 3 and documentation is anticipated to be complete by January of 2023.

Followup Response: The City worked with its consultant on the development and standardization of the City' s unwritten Business Continuity Plan. Because those policies include confidential details that would allow a potential hacker to gain easier access to the City' s Information Technology resources, those were shared confidentially with the Grand Jury on March 28,

2023 and Council adopts the same in compliance with the Grand Jury' s recommendation. Redactions on the attached Business Continuity- Disaster Recovery Plan are intended to protect security information.

Grand Jury Finding F3• 4: " The City of Lathrop does not have a formal internal policy or procedure to address ransomware attacks. This absence of policy could cause confusion, delay and greater loss of security in the event of such an attack."
Grand Jury Recommendation R3. 4: " By November l, 2022, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a formal internal policy and procedure for a ransomware attack." City Council Original Response: The City of Lathrop has an unwritten, internal procedure to address ransomware attacks and, in addition to such, has hired a consultant whom will assist the City in development and implementation of a formal written policy for procedures to address ransomware attacks. The City of Lathrop City Council agrees with Grand Jury Finding F3. 4 and Recommendation R3.4 and anticipates documentation will be complete by January of 2023.

Followup Response: The City worked with its consultant on the development of the City' s unwritten, internal procedures to address ransomware attacks and standardize those into internal policies. Because those policies include confidential details that would allow a potential hacker to gain easier access to the City' s Information Technology resources, those were shared confidentially with the Grand Jury on March 28, 2023 and Council adopts the same in compliance with the Grand Jury' s recommendation. Redactions on the attached Information Security Policy and the inclusion of only the Executive Summary and Introduction of the Incident Response Plan are intended to protect security information.

Respectfully submitted,
Salvador V. Navarrete
City Attorney
SVN/ trb
Cc: Trisa Martinez, Grand Jury Staff Secretary, San Joaquin County Superior Court via email at grandj urv(a,sjcourts. org

Attachment D
u`
d
N h,
b ,,
O'¢ City of Lathrop Incident Response Pian
Incident Response Plan
Version History
Version Date Author Reason/ Comments

1. 8 March 2023 Document Origination
t
J,Nwn
o
F
U- r
t
1a
A City of lathrop Incident Response Plan
Executive Summary
A Cyber Security incident is defined as an event that breaches ar violates the Confidentiality, Integrity or Availability( CIA) of City of Lathrop Information systems. Failure to act quickly and efficiently in accordance with best practices and relevant requirements can result in a loss of functionality a d reputation damage, but aiso potential steep financial penaities. To avoid the worst fallout of a cyber-incident, it' s vital that the companents of your incident response plan( IRP) are built with consideration of industry guidelines, cyber legislation, and your arganizations unique isk profile.

Incident Response Plan
An Incident Respanse plan is important to address issues that were not stopped by preventative systems and procedures. No system can be 100% secure. Reasonable steps and best practices such as Information Security Policies, Encryption guidelines, Secu ity Awareness training and other measures are implemented to prevent incidents from accurring. However, when an attacker is successful in penetrating the layers of security, a plan of actian needs ta be predefi ed ta ensure efficient containment and remediation of the event.

This policy provides the framework to addresses the seven steps necessary to minimize the negative effects of a security breach. These steps are as fallows:

Preparation: Identify risks and establish roles and responsibilities to address those risks.

Identification and Assessment: Training and evaluation for defining and detecting a threat and to determine if there is a need to activate the plan.

Containment and Intelligence: The containment section will autline the strategies for limiting the scope of the incident.

Eradication: The procedures for removing the threat from all affected systems througn to the recovery of all affected systems.

Recovery: Implementation of restore functions of the Data Backup and Retention Polity ta recover lost or damaged informatian as well as replacement or reconfiguration of damaged systems.

Lessons Learned: Once the incident is resolved it must be determined how the breach occurred, how to prevent similar incidents and preparation of a plan to address necessary changes.

Introduction
The City of Lathrop Incident Respanse Plan has been developed to provide guidance to the handling of informatian security incidents that adversely affect City of Lathrop information Resources. The City of lathrap Incident Response Plan applies to any person charged by the City of lathrop Incide t Response Commander with a response to information security related incide ts.

The purpose of the Incident Response Plan is ta allow the City of Lathrop to respond quickly and appropriately to information security incidents.

NWp,
o4d` G"
ir'
a
City of Lathrap incident Response Plan
Eveni De nition
Any abnormal observable accurrence in system, network, environment, process, workflaw, or personnel.

Events may or may not be negative in nature.

Adverse Events Deflnition
Events with a negative consequence. This plan oniy applies to adverse events that are computer security related, not events caused by natural disasters, power failures, etc, which are covered in the Business Continuity- Disaster Recovery Plan.
incident Definition
A violatian or imminent threat of violation of computer security poiicies, acceptable use policies, or standard security practices that jeopardizes the confidentiality, integrity, or availability of information resaurces or operations. A security incident may have one or more of the following characteristics:

A. Violatio of an explicit or irnplied City of Lathrop security policy B. Attempts to gain u authorized access to a City of Lathrop Information Resource C, benial of service to a City of Lathrop Information Resource D. Unauthorized use of City af Lathrop Information Resources E. Unauthorized rnodification of City of Lathrop information F. Loss of City of lathrap Confidential or Protected infarmation r,
Attachment E
i" u'r,
w.,
FT
x # .
x.

R'`-'' In{ armation 5ecurity Rolicy
City of i.athrop lnformation Security Policy
Version Histor
Version Date Author Reason/ Camments

1. 8 March 2023 Document Originatian
tN r
V. i
Information Security Palicy
Table of Contents
City af lethrr p
lnfatmauarr Security Pc licy..........................................,..................,..,...,.................................... 1 Versic n H`rstoty.....................»..........,,,..,.................,...........,,.,..,....,.................................,.,,..,..,,.....,..,..,.,....,,.. 1 Tableof Cc ntents ....................................................................................................................................... 2 lntrt ductian,..,...,...................................,........,_.............._........................,.....,..........,....................,..... ....... 4 ContactInfarmation'.................................,........,.....,..,..............................,.....,................,...............,....,..,.......... 5 Ratesand Responsibi6ities..................................................................................................................................... 6 ChieF# nfa rmation tlfficer{ CIO......................................................................................................................... 5 Cyber Securiry tnformation Se currty Te m{ CSfST)........................................................................................... 6 C5i5T Commander......................................................................................................... 5 I fQrmation S turity Team Memb rs`................................................................................................................. 7 Informat an S cunty Framework.....................,.. ........,.......,,.,,,....,..,....,...,,,...,.,,..,,.......................,................., Phase i— Organitatianal5ecutity.................................................................... a,.,....,,,......,., Phase tl-- Functional itesponsibii' rties............................................................................,...........................,.,....,.. 8 Phase I— Sepa ativn af uti s...................................................................................................................,..,.. 1 Phase fV—! rs# ormati n Risk tdlanagement..................................................................,,............................,........ 11 Ptras V— InformatiQa Classification nd Nandling............................................................................................ 11 PhaseVf— lnformation 5haring......................................................................................................,..,.......,..,.... 12 Phase Vf!— IT ilsset Mana emer t..._..._............................._...,....,......,,,.,.,,,...,,....,.......,......,......,.................... 14 Phas Vfll— Petsonnel5eeurity..............................................................-------..._....................._...........,.....,.... lA l hase!? t— Ir, formaiian eturity Incident Management............................._............,...,.,,,.,,,,,..,..,.,.,,..,.,..,....,.,.. I5 Phase X— Physical and Environmenta! Securicy..............._..........,................,...,..,...,.,.........,. ... ......._....,.......... 16 t hase X1— Accr unt Nlanagement artd Access Eontrol....................................,........._...........................,,.,...,.... 16 Pk1 5E XII- SyS l' 1{.' CUil/.................<,.,......,...,.........,...,...,.....,........._.,..................,................,.,.......,...,,..,...,..

Phase XIII— Collaborauve computing D uices.................................................................................................... 2p Phase X[V— Vulnerability Manager ent............................................................................................................. 21 Ph se XV— t7peration5 Security.............................................................._......._....,..........,.,.........................,...... 1 Reference..................................................................................................................,........................,..,........,.. 24 Appenc3ix!; 5e curity Awareness Eleferences...................................................................................................... 24 Accepiable Use of Technology IX7 17........................................_.,.................................._._......,.,,.,.............,....... 25 Vendor Remate log- tn Questionnaitt...................................._..........._........,.,..........,...,....,.,.,..,,...,.............._..... 32 CannputerSetup Checktist................................................................................................................ ..........., 33 i.
i
A' t
In#ormat on Seeurity Palicy
Cont ct In( ormation........................................................................_..._.,,.... .......,..,....... 34 Information Security Team Me nber................................................................:............................................... 35 Nwr.

Ok
i
u`+'. T.'
n' Information Security Folicy
Introduction
This policy defines the mandatory minimum information security requirements as defined belaw under Scope. Any department within the City of lathrap may, based on its individual business needs and spetific lega! and federal requirements, exceed the security requirements put forth i this palicy, but must, at a minimum, achieve the security fevels required by this policy.

Scope
This palicy applies to all employees, consultants, contractors, and vendors working on behalf of the City, that use or access any IT resource far which the City af I.athrop has administrative responsibility. While a vendor may adopt a different policy, it must inclutle the requirements set forth in this ane.

This policy encompasses aN systems, automated and manual, for which the arganization has administrative responsibility, including systems managed ar hosted hy vendars on behalf of the organizatian. lnformation
This policy acts as an umbrella document t all ather seturity policies and assaciated standards. This palicy defines the responsibility af all empfayees, consultants, cantractors, and vendors working on behalf of the City to:
pratect and maintain the confidentiality, integrity, and availability of information and related infrastructure assets;
manage the risk of security exposure or compramise;
ensure a secure and stable information technology{ IT environment; identify and respond to events involving information asset misuse, loss, or unauthorized disclpsure; monitor systerns far anomalies that might indicate compromise; and promote and increase the awareness oi information security.

Failure to secute and protect the confidentiality, integrity, nd availability af infarmation assets in taday' s highly networked environmer t can darnage or shut dewn systems that operake critical infrastructure, financlal and business transactions, and compromise data which cauld result in iegal and regufatary noncompliance, Compliance
This policy shall take effect upon publication. Policies and standards may be amended at any time as see fit by the Chief Informatian 01`ficer( CIO.

Gity af Lathrop employees who violate ihis policy may be subject ta appropriate disciplinary action up to and including discharge as well as both civil and criminal penalties. Non- City employees, including, without limitatian, contractors, may be subject to termination c f contractual agreements, denial oF access to iT resources, and other actions as well as both civil and criminal penalties.

Exceptions
No exteptions to ihis olicy will be appraved.
otJ
H r
e
u`!., ..
s
Information Security Policy
Contact Information+
trsted personnel rhaf shoutd be contacted in the evenf of data lass incidents.

Updated March 2023
j Name Titfe Ro1e Contact Information Escalation _
1- 3)*
Information Security Risk ' CSIST
Coordinator I Commander
Asset Manager CSIST
Commander
lnfrastrutture Manager ;T
Manager
Cl0 CI0 _ . _ ,
Communications CSIST member
Manager t
Legal CSIST member
Risk Manager CSIST member
E
HR Representative CSIST member
Physical Securiry CSIST member
i
Representative i
a
Party Support
r
i
FBI Regulatory/ Government
Reporting Body
Escalation level determines order in which notification should occur in the event of a data loss incident:
1 Notify Crst, required on all incidents

2. Required on al4 moderate or hlgh• severity incidents 3 Involve as needed
This information may be revised f om time to time, as internal[ ity personnef and external organizations change. For the most up ta date copy, please see Contaci lnfarma£ ion located in Appendix l: He( erence.

U,
tN+'.
u`^
A, ,
O±! T° Inforrnation Security PolicV
Roles and Responsibilities
Chief Information Officer ( CIO)
Ensure service level agreements with service providers clearly define expettations of ihe organization and the service pravider in relation ta hardware and software.

Ensure policies related to Information Security accurately represent the goals ot the city.

Ensure Cyber Insurance is maintained as necessary and appropriate stakeholders are informed.

Establish and maintain a security team and functiorr witt the ability to identify, proteci, detett, responti, and recover from attacks against City informa# ion resources.

Develop and maintain a centralized incident response plan capable of addressing major compramises of City information resources.

Cyber Security Information Security Team ( 5{ST)
Consists of legal experts, risk managers, and ather department managers that may be consulted or notified during data documentation and pplicy creation, Advise on Information Security policy activities relevant to their area of expertise.

Ensure Information Security activities are in accorda ce with legal, contractual, and regulatory requirements.

Respansibte for internal communications pertaining to lnformation Security.

CSIS7 Cammander
Cyber Security Infarmation 5ecurity Team Commander oversees development and is respansible for implementing and monitoring the lnformation Security Plan. Managing and appraving the Servite Level Agreements( SLAs) in place with third parties, and the roie third parties may play in lnfarmation Security.

Further responsibilities:

Assemble a Cyber Security Informatian Security Team{ CSISi').

Ensure personnel tasked with Information Security responsibilities are tra'rned and knowledgeable on how to periorrn Asset documentatian and mainienance.

U date securit olicies as needed
Review the security policies
Ensure team activities comply with legal and industry requirements for Information Security procedures.

Act as the primary Asset Manager, responsible for Asset integrity and confidentiality, managing team respanse activities.

Be aware af Cyber Insurance Policies, contact mechanisrns, and when to initiate Cyber tncident Respanse Team Notification.
ur.
4 s
Informati4n Security PolicV
Information Security Team Members
Updated March 2Q23
1' he Asset Manager{ tfl is supported by a team af technical staff that work directly with Information systems ta canfigure, perform, and dacument assets.

Further responsibifities:

No. CSIRT Member RoEe
1 CSIST Cammander
2 Network SubJect Matter Expert
3 Network Subject Mat#er Expert
4 Senior IT Staff
S Systems Engineer
6 Recorder
7 Recorde
il
m
This information may be revised from tirne ta time, as internal City personnet and external arganiza[ ions change. or the most up to date copy, please see lrrformotion 5ecurity Teom Members located in Appendix 1= Reference. iiiµ w
4 Ot
s` ;'
a p information Security Folicy
Information Security Framework
Phase I — Organizational Security
Information security requires
and an information technalogy security functian. It is recommended that the functions be per#ormed

1. The Information Security Risk Caordinator is responsible ta certify that information risk management functions are met, ensuring that:
i. risk- related considerations for information assets and individuaf information systems, including autharization decisions, are viewed wholly from the perspective of the City of lathrop regarding the overaU strategic goals and objectives af the City of Lethrop in carrying out its core missions and business functions; and ii. the management af information assets,
mission/ business success.

2. The Infarmation Security Risk Coordinator is responsible to certify that information technoiogy security functions are met.

Phase I1 — Functional Respansibilities
The City of lathrop CIO is responsible for:

2. identifying City of Lathrop information securi; y responsibiHtles and goals and integrating them into relevant processes;

3. supporting the consiste t irnplementatian of information security policies and standards;

4. supporting security within the City af Lathrap through clear directian and demonstrated commitment of appropriate resou ces.

5. promoting awareness of infarmation security best practices through the regular dissemination of materiafs provided by the Information Security Rick Coordinator rfl;

4. Hf or,
O..
t 4,
u, v: y
A`° Informatian Security Policy

6. implernenting a process for determini g infr rmatian classification and categorizatian, based an industry recommended practices, State directives, and legal and egulatory requirements, to deterrnine the appropriake levels of protection for that infarmation;( Appendix t: 5ecurity Awareness References. F1PS 199 Standards for Security Categarization of Federa! tnfvrmatran and Jnformation SysremsJ.
implementing the pracess for intormation asset identification, handling, use, transmissian, and disposal based on information classification and categorizakian;

8. determining who, within the City of Lathrop, will be assigned and serve as infarmation owners while maintaining ultimate responsibility far the confidentiality, integrity, ancf avaiiability of the data;
9, parti+ ipating in the response to security incidents;

10. complying with applicable notification requirements in the event af a breach o€ private informatian;

11. adhering to specific legal and regulatary requirements related to in#ormation security;

12. communicating the requirements of this palicy and the associated standards, including the consequences of nan- compliance, to the City af lathrop workfarce and third parties, and addressing adherence in third party agreements.

The City of lathrop lnformation 5ecurity Risk Coordinator{ tf) is responsible for:

1. maintaining familiarity with the City of l.athrap business functions and requirements;

2. maintaining an adequate level of current knowledge and proficiency in information security through annual Continuing Professianaf Education( CPE) credits directly related to information security;

3. assessing City of Lathrop complianc with information security policies and iegal and regulatory information security requirements;

4. evaluating infarmatian security risks and assisting the City af lathrop in understanding its informatian security risks and how to appropriately manage those risks;

5. representing and ensuring security architecture consideratians are addressed;

6. advising on security issues relateci to procurement af products and services; p
yj11l tlh,
V .
r
Information Securicy Policy

7. escalating security concerns that are not being adequately addressed according to the applicable reporting and escalation procedures;

8. disseminating threat informatian to apprapriate parties;

9. par#icipating in the response to potentia) security incidents; l0. participating in the development of enterprise policies and standards that consider the City of Lathrop needs; and

11. promoting information seeurity awareness.

The City of I. athrop Infrastructure Manager( tf} is responsible for:

1. supporting security by providing clear direction and cansideration of security controls in the data processing infrastructure and computing network{ s) which support the informatian owners;

2. providing resources needed to maintain a level of informatian security control cansistent with this palicy;

3. identifying and implementing all processes, policies, and contrals relatiue to security requirements defined by the City af Lathrop business and this policy;

4. implementing the praper controls for information owned by the City of Lathrop based on ihe City af Lathrop classification designatians; S. providing training ta appropriate technical staff on secure operatians{ e.., secure coding, secure configurationj;

6.{ ostering the participatian of information security and technical staff in pratecting information assets, and in identifying, selecting, and implementing apprapriate and cost- ef#ective security controls and procedures; and

7. imp{ ementing business continuity and disaster recovery plans The Gity of athrop workforce is responsible for:

1. understanding the baseline information security controls necessary to pratec# the confidentiality, integrity, and availability of information entrusted to City af Lathrop;

2. protecting City af Lathrop information and resources from unauthorized use ar disclasure;

3. protecting persanal, private, sensitive information( PP51} from unautharized use or disclasure;
SµRur., C+ t
fp4
MRA"Rb Informatian Securitv Policy

4. abiding by City af Lathrop Policy, Acceptabie Use af Infarmation Technalogy Resources( Appendix i: Securrty Aworeness References. Acceptable Use of Technology 00-17j.

S. reparting suspected information security incidents ar weaknesses to the appropriate manager and clesignated security representatives.

Phase III — Separation of Duties
i'he City af Lathrap shall maintain:

Phase IV — Information Risk Management
The City of Lathrop shall maintain:
b. Risk assessments are required for new projects, implementations aF new technalogies, any significant updates, or changes ta the aperating environment, ar in respanse to the discovery of significant vulnerabi4ities. Risk assessments are required regardless if the work is done by City of Lathrop, vendorJcontractar, or any other third party on behalf of the City af Lathrop.
c. Risk assessment results, and the decisions made hased on these results, must 6e documented.

Phase V — Information Classification and Handling
The City af Lathrop shall maintain:
a. A{ I information, which is created, acquired, ar used in support of City af tathrop business activities, must only be used for its intended business purpase. dk
x unr r,`
v• s=
ifi'..,
A°' Information Security Policy
b. AI1 information assets must have an information owner established by the City of Lathrop' s Enformatian Services Department( ISD}.
c. Information must be properly managed from its creation, through authorized use, to proper disposal.
d. All inFormation assets must be reviewed
Any changes to the individual data elements of an information asset requires an immediate review by the CiO.
f. lf the City of Lathrop
h. All repraductions of infarmation in its entirety must carry the same canfidentiality category as the original. Partial reproductians need to ae evaluated by the CIO to determine if a new category is warranted. i. Each category has an approved set of baseline controls designed to protect the data asset and
j. The City of lathrap must cammunicate the requiremer ts for secure handling of information to its workforce.

Phase Vi — Information Sharing
The City af Lathrop content made available to the general public must be reviewed by the City of Lathrop Attarney' s affice, defined and appraved according to the Public Records Act( PRA}. The process must indude the review and approval of updates to publicly available cantent and must consider the type and classification of informatian posted:
j„1NIu1 .
4 t r,. +.,.
r
Q"'° information Security PolicY
b. For non- public infarmation to be released outside the City of lathrop or shared between the City of Lathrap and external entities, a process must be estabiished that, at a minimum:

1. ensures that an information categorizatian has been perfarmed and dacumented for the informatian to be released or shared;

2. documents the intended use of the information;

3. identifies the responsibilities of each party fo protecting the informakion;
A. defines the process and minimum cantrols required to iransmit, stare, and use the information;

5. records the measures that each party has in place to protect the information;

6. defines a method for compliance measureme t;

7. provides a signoff procedure for each party to atcept responsibilities,

8. establishes a schedule and procedure for reviewing the controls; and

9. identifies an end date far the use of the informatian if applicable). c. ln additian ta the requirements in Phase VI 5ectian b, when infarmation categarized as having a High- impact Confidentiality requirement is ta be released ar shared, the City af Lathrop Attorney' s office must ensure that they:

1. have a farmai written agreement( e. g., Non- Disclosure Agreement( N DA), Acceptable Use Palicy, Memorandum of Understanding{ MOU), etc., which contains the requirements for the handling of inforrnation, in place prior to sharing that information with any other third- party.

2. designate the level of management who can give written approval far:
i
1'tpR
s
r'''+!'° s " .
information 5ecurity Palicy
Phase Vll — IT Asset Management
The City of Lathrop shall maintain.
a. All IT hardware and software assets must be assigned by the City of Lathrop infdrmation Senrices Department( ISQ} to a designated business unit or individual within the Gity of lathrop for its use, however the asset continues ta be owned by I5D. b.' the City af Lati rop ISfl are required to rnaintain an inventory of hardware and so{ tware assets, ir cluding all system components( e. g., network address, machine name, software versian} at a level of granularity deemed necessary for tracking and reparting Phase VII1 — Personnel Security
The City of athrop shall maintain:
a. The City of l. athrop workforce must receive general infarmation security awareness training, to include recognizing and reporting insider threats, within 30 days of hire.

Additiona! training on City af Lathrop specific infarmation security procedures, if required, must be completed beFare access is provided to specific City of Lathrop sensitive information not covered in the general information security training. A11 information security training must be reinforced at least annually and must be tracked by the City of lathrop lnformation 5ystems Department( ISD).
b. The City of lathrop must require# he w rkforce ta abide by the following policies:
i. Policy 00- 15, Cellular and Personal Qigital Assistant ii. Palicy 00- 16, Password Control
iii. Palicy 00- 17, Acceptable Use of Technalagy
iv. Policy 00- 18, Automatic Lagoff Palicy
v. Palicy 00- 19, Physical Entry Contral Security
vi. Policy 00- 20, User Account
vii. Pa#icy 00- 21, Workstatian Security
viii. Policy 00-22, Data 8ackups
ix. Policy 0- 23, IT Helpdesk
x. Policy OQ- 24, Operatians and Fault Logs
xi. Palicy 00-25, Security Deuice and Media Cantrol
xii. Policy 00- 26, Website Links
xiii. Policy 40- 27, Website Policy
xiv. Palicy 00- 28, Television Broadcast
xv. Policy 00• 29, Social Media
xvi. Policy 00- 30, Video Monitoring and Retention
xvii. Polity 00- 31, Remote Working
1J
11llpt"^.
4 E° Information Security Policy
c. All job positions must be evaluated by the City of Lathrop Human Resources( HR) department along with approval by the direct department head to determine whether they require access to sensitive information and/ or sensitive information technology assets. d. For those job positions requiring access to sensitive information and sensitive information technology assets, the City of lathrop CIO must conduct workforce suitability determinations, unless prohibited from doing so by law, regulation, or contract. Oepending on the risk level, suitability determinations may include, as appropriate and permissible, evaluation of criminal history record information or other reports from federal, state, and private sourcesthat maintain public and non- public records. The suitability determination must provide reasonable grounds for the City of Lathrop Ci0 to conclude that an individual will likely be able to perform the required duties and responsibilities of the subject position without undue risk to the City of Lathrop.
e. A process must be established within the City of Lathrop to repeat or review suitability determinations periodically and upon change of job duties or position. f. City of lathrop Department Superviso s are responsible for ensuring al) City of Lathrop issued property is returned to HR prior to an employee' s separation. g. City of Lathrop ISD are responsible for ensuring accounts are disabled and access is removed immediately upon notification from HR of an employee' s separation# rom the City of lathrop.
h. HR is responsible for providing ISD proper notification of each employee' s separation from the City of Lathrop.
i. For sensittve positions, HR will provide notification to ISD pflOf to an employee' s separation from the City of Lathrop.
ii. For on-sensitive positions, HR will provide notification to ISD within ten{ 101 minutes of an employee' s separation from the Ci[ y of lathrop i. Within 24 hours, each department is responsible to provide ISD a Technical Service Request( TSR) with instructions on archiving or deleting the separated employee' s data, which includes emails.

Phase IX — Infarmation Security Intident Management
City of Lathrop must have an incident response plan, consistent with NIST sta dards, to effectively respond to information security incidents.
a. All obsen ed or suspected information security incidents or weaknesses are to be reported the City of Lathrop Information Services Department( ISD) as quickly as possible. If a member ofthe workforce feels that information security concerns are not being appropriately addressed, they may confidentially contact the CIO directly. f
SN%Ut.'r
r:
oE ,
cZ;i y
y`
Op v in#ormation SecuritY PolicY
b. The Cyber Security tncident Response Team must be notified incident
Phase X — Physical and En ironmental Security
The City of lathrop shall maintain;
b. An annuai risk assessment must be perfarmed by ISD far information processing and storage faciiities to determine whether existing controls are operating carrectly and if additional physica! security measures are necessary.
c. Information technolagy equipment must be physically p otected from security threats and environmental hatarcls. Special controls may also be necessary to protect supporting infrastructure and facilities such as electrical supply and cabling infrastructure. d. All information technology equipment and inforrnation media must be secured e. Visitors to information pracessing and storage facilities, including maintenance personnel, must be always escorted, Any maintenance performed remotely must be virtually escoried.

Far City of I. athrop information that has a High Confidentiality requirernent, software r automated processes must be implemented to keep track af individual electronic documents and files, devices, or media and the individuals who have passession of them. City of lathrop infarmation is currently monitored by
Phase Xt — Account Management and Access Cantrol
The City af I. ath op shall maintain:
a. AH accounts must have an individual em la ee or grau assi ned ta be res onsible for account management
b. Access to systems must be provided through the use of individually assigned, unique identifiers known as user- IDs.
c. Associated with each user- ID is an authentication token{ e. g., passwordj which must be used to authenticate the identity of the person or system requesting access.

J"N W!
d
ti t
i ,'.' S'
Information SecutitY Po GV
d. Automated techniques and controis must be implemented to lack a sessian and require authentication or re- authentication a ter a period of inactivity far any system where authentication is required. Infarmatian on the screen must be replaced with publicly viewable information( e. g., screen saver, blank screen, ctock) during the session lock. e. Automated techniques and controls must be implemenked to terminate a session after specific cflnditions are met. Specific conditions include:

1. Group Policy rule wi!! be rmplemented that ferminates session-- rnacfivity.
f. Tokens used to authenticate a person or process must be treated as confidentia) and protected appropriately.
g. Passwords must not be stored on paper, or in an electronic file, hand- held device, ar browser, unless they can be stored securely has been approved by the Chief Infarmation Officer{ CIQ).
h. Information owners are respansibie for determining who shou{d have access ta pratected esources within their jurisdiction
i. Access privileges will be granted by the City of I. athrap CIO in accordance with the user' s job title and will be limitec#only to thase necessary to accomplish assigned tasks in accordante with Ciry of Lathrop missions and business functians
j. Users of privileged accounts
k. Lagon banners must be implemented an aq systems where that feature exists to inform aH users that the system is for City of Lathrop business or ather approved use cansistent with City af Lathrop policy, and that user activities may be monitored, and the user should have no expectation of privacy.

I. Advance appravaf far any remote access connection must be provided by tne City of Lathrop. An assessment must be perforined and documented to determine the scope and methad of access, the tethnical and business risks invalved, and the contractual, process, and technical contrals re uired for such tonn
m. All remote connections must be made through managed paints- of-entry reviewed by the CIO.

Working# rom a remote location must be authorized by the City of lathrop City Manager and CIO, and best practices which ensure the appropriate protection of City of lathrop data in remote environments must be shared with the individual rior to the individual bein ranted remote Y
i
q ,
y
a!!`?`°¢ Informatian Security Policy
Phase XII — System Security
The City af athrop shall maintain:
a. Systems include but are not limited to servers, platfarms, networks, cammunications, databases, and software appiications.

2. The City of lathrap information Services Department( ISOf must ae assigned responsibility for maintenance and administration of any system depEoyed on behalf of the City af lathrop.

Z. { nformation security must be required at system inception and documented via electronic helpdesk ticket andjor change request form, as part of the decision to create ar modify a system Appendix!: Security A4vareness References. Computer Setup Check tisi).

3. A! I systems must be cieveloped, mainiained, and decommissioned in accordance

4. Each systern must have a set of controls commensurate with the categorizatian o( any information that is stored on ar passes thraugh the system( drj.

S. All system clocks must synchronize to a centralized reference time set to UTC{ Coordinated Universal Time which is itself s nchronized to st least three s nchranized time sources source

6. Environments and test plans must be established to validate the system works as intended prior to deployment in production

8. Formal change contral procedures for all systems must be developed, implerriented, and enforced. a. DatabasQs and software

1. All software written far or deployed an City of lathrap Nx ir,
i
u,
y
RrARATtV lnformation 5ecurity Policv
or
ii. sensitive data is masked ar overwritten with fictional information.

4. Where technicaily feasible, development saftware and tools must not be maintained on production systems.

7. P ivileged access to production systems by development staff must be restricted whenever possible.

8. Migration processes must be dacumented and implemented to govern the transfer of software from the develapment environment up through the production environment.
b. Netwark Systems:

1. Connections between systems must be au#horized by the City of Lathrop Chief Informatian Qfficer( CIO) of aH relevant City of Lathrop sites and protected by the implementation ot appropriate controls.

2. All connections and their configurat+ ons must be documented, and the dacumentation must be reviewed by the City of la#hrop CIO annuaUy, at a minimum, to ensure:
tH or,Crti
Information Security Palicy
i. the business case for the connection is stitl ualid and the con ection is still required; and
ii. the security controls in place
are appropriate and functioning correctly.

3. A network architecture must be maintained that inciudes, at a minimum, tiered network segmentation 6etween:
i.
ii.
an ot er systems; an
iii.

5. Two- factor auihentication( 2FA) is requi ed for all users cannecting ta City af Lathrop internal systems.

6. Network Authentication is required for all devices connecting ta City of Lathrop internal networks.

7. Only City of lathrop Information 5ervices Qepartment{ ISD} personnel may capture or manitar network traffic unless authorized by CIO for auditing purposes.

8. A risk assessment must be performed in consultation with the City af Lathrap CIO before the initiation of, or significant change to, any network technnlogy ar project, including but not limited to wi eless technology.

Phase XIII — Collaborative computing Devices
The City of lathrop Informatian Services pepartment ISDj shall purchase and maintain:
1, Collaborative camputing devices, including, for Example, networked white boards, cameras, and microphones.

2. Collaborative computing devices must:
a. prphibit remote activation; and
b. provide users physicatly present at the devices with an explicit indication of use.

3. City af lathrop must provide simple methods ta physically disconnect callabarative computing devices. Simpfe methods include physicaUy unplugging collaborative computing device from the computer or completely shutting down the computer.
wr
JJ
1<;.: a. s
l"
iN. .. ...
tnformation SecuritY Policy
Phase X! V — Vulnerability Management
The City af Lathrop shall maintain:
b.

Phase XV — Operations Security
The City af Lathrop shall maintain:
a. All systems, and# he physical facilities in which they are stored, must adhere ta the aperating instructions, menagement processes, and farmal incident management procedures listed within this docum n
b. System configurations must fallow CIO approved configuratian standards. c. Advance planning and preparation must be performed to ensure the availability of adequate capacity and resaurces. System capacity must be monitored on an angoing basis.

Naar,'
4 u„
I
Informatian Security Policy
d. Where City of Lathrop provides a server, application, ar network service to another site, operational and management respansibilities must be coordinated by all impacted sites. e. Host based firewal s must be instaped and enabled on all City oF Lathrop workstations to protect from threats and to restrict access to only that which is needed. f. Controls must be implernented across
City of lathrap systems
i. Cantrals must be in place to allaw only City of Lathrop approved saftware to run on a system and prevent executian of all other software.
j. All systems must be maintained at a vendor-supported level to ensure accuracy and integrity.

I. Any system, software, ar Operating System environment which is no langer supparted and cannot be patched to current versions( e.g. end vf life hardware/ software) must be decommissioned and removed from service.
q. Contingency plans( e. g,, bu5iness continuity plans, disaster recavery plans, continuity of operations plans

2. xAor.
y
o+• t;,
c,'
informatian Security Policy
s. 8ackups and restoration must be tested manthly. Separation of duties must be applied ta these funttions( drJ.

Sy1 tN!
Ot
c? a >;
R+t tto,+ tnfarmation Security Policy
Reference
Appendix I: Security Awareness References
r'
Q?'° information Security Policy
zµxcir,
e=,.
s
r;
informatian Security Policy
CITY QF LATHROP Acceptable
ADMINISTRATIVE REGULATIQN Use of
Technology
oo-.

Querview
The intention for publishing an Acceptable Use Policy is to clarify restrictions consistent witF the City of Lathrop established culture of openness, trust and integrity.

We are committed to protecting City of Lathrop' s employees and the City from illegal or damaging actions by individuals, either- knawing{y ar unknowingly.

InternetJlntranet/ Extranet- rekated systems, including but not limited ka computer equipment, software, operating sys ems, storage media, network accounts providing electranic mail, WWW browsing, and FTP, are the property af City of Lakhrop. These systems are to be used for business purposes in serving the inter sts a the Gity, and of our customers in the course af narmaf operations.

Effective security is a team effart ir volving the participation and support af every City af La hrop employee and a liate who deals with information andjor information systems. It is the responsibility of every camputer user to know khese guidelines, and to canduct their activities accordingly.

Ciky af Lathrop' s Acceptable Use Policy helps to safeguard system assets and data, incfuding Electronic Protected Information ( EPI), against unaufihorized use, disclosure, modification, damage, or loss.

Questions about this palicy should be directed via e- mail to the informatian Technologies Manager at helpdesk@ci. Iathrap. ca. us.

Purpose
The purpos of the Accepkable Use Palicy is to desc ibe City of Lathrop' s requirements for operations and is to outline the acceptable use of camputer equipment at City of athrop. These ru(es are in place to protect the employees and the Cifiy.

Inapprapriate use exposes City of Lathrop to risks including virus attacks, compramise of nefiwark systems and services, and legal issues.

Scr pe
This palicy applies to all City of Lathrop and a
liate em layees, including temporary
employees and employees of affiliated third- party organizations. This policy also applies ta all equipment that is owned, leased, operated, o maintained by City of Lathrap.

Revision Information
tµaor, G
a``
r,
boArl. v`* info mation Securitv PalicY
When this document is updated, the reason for revision wi(I appear here.

Policy
General Use and Ownership

1. While City of Lathrop' s netwark administration desires ta pravide a reasonable levef af privacy, users should be aware that the d ta they create on the City systems r rnains the property of City of Lathrop. Management does not guarantee the canfidentiality af information stared on any netwark d vice belonging to City of Lathrop.
2, Employees are responsible for exercising goad judgment regarding fihe reasonableness af personal use and at department head discretion.

3. The City recornmends that any informatic n that users cansider sensitive ar vulnerable be encrypted.

4. For security and netwark maintenance purposesr authorized individuals within City of athrop may monitor equipmenk, systems and network traffic at any time.

S. Cifiy of Lathrap reserves the right to audit networks and systems on a perivdic basis to ensure compliance with this policy.

Security and Proprie#ary Information

1. Th user interface for information contained on lnternet/ Intranet/ xtranekrelated systems shoufd be cfassified s either confidential or not confidential, as defined by the City confidentiality guidelines to be public ar confidential, details of which can be found in Human Resaurces policies. Examples of canfidential infarmation include but are not limited to: Ernployee information, Payroll, customer lists, medical information, social security numbers, credit card numbers, vendar and bidder sensitive information, and lawyerJclient correspondence, research data. Ernployees should take al) necessary steps to prevent unauthorized access to this information.

2. Aufihorized users are assigned accaunts for their specific use based on their defined needs. Users are responsible for the security of their accounts.

3. Passwords are pravided to enable us rs to keep their account secure. Keep passwords secure and do not share accounts. Authorized users are responsible for the securi y of thei passwords and accounts. System level passwords are to be changed every 90 days; user level passwords should be changed every 60 days.

4. All PCs, laptops and workstatians should be secured wifih a password- protected screensaver with the autamatic activation feature set at 10 minutes or {ess, or by logging- aff (controi- alt-delete for Windows users) when the host wili be unattended.
x
v
Information Securitv Policy

5. Because information contained an portable computers is especialiy vuinerab#e, fihe computer' s hard drive is encrypted to prevent access to the data in the case of the computer being lost or sto{ en. Password and user accounts are not t be displayed or written anywhere in the portable computer.

6. Postings by employees from a City af Lathrop email address to newsgroups should contain a disciaimer stating that the apinions expressed are strictly their own and not necessarily those of City af Lathrop, unless posting is in the course of business duties.

7. AH hasts used by the employee that are connected ta the Ci y of Lathrop InternetJlntranet/ Extranet, wt ether owned by the employee or City of Lathrap, shall be continually executing approved virus- scanning software with a current virus database.

8. Ernployees must use extreme caution when apening e- mail attachments received from unknown senders, which may contain viruses, e- mail bombs, or Trojan horse code.

Unacceptable Use
The fiollowing activities are, in general, prohibited. Information Technologies Staff may be exempted from these restrictions during the eourse of their legitimate job respansibilities ( e. g., there rnay have a need to disable the network access af a host if that host is disrupting production services}. Under na circumstances is an employee of City af Lathrop authorized to engage in any activity that is iilegal under local, state, federal or international law while utilizing City of athrap owned resau rces.

The lists below are by no means exhaustive, but attempt ta pravide a framework for activities which fall inCo the categary af unacceptable use.

The following ac ivities are strictly prohibited, with no exceptions:

1. Violations of the rights of any person or protected by copyrighk, trade secret, patent ar ather intellectual property, ar similar laws ar regulations, including, but not lirnited to, he installation or distribution of " pirated" or other software products that are not appropriaCely licensed far use by City of Lathrap .

2. Unauthorized capying of copyrighted material including, but n t limited to, digitization and distribution of photographs from magazines, baoks or other capyrighted saurces, copyrighted music, and the installation of any copyrighted software for which City of Lathrap ar the end user does not have an active license is strictly prohibited,
KxAar
e
u.,,
i:;
OR"'" Information Security Policv

3. Exporting software, technical information, encryption software or technolagy, in violatian of internationai or regional export confirol laws, is iliegal. The appropriafie management should be consulted prior to export of any material that is in questian.

4. Introduction af malicious programs into the netwark or serv r ( e. g., viruses, worms, Trojan horses, e- mail bombs, etc.}.

5. Revealing your accaunt passwo- d to others or allowing use af your account by others. This includes family and other household members when work is being done at home.

6. Using a City of l.athrop computing asset to actively engage in procuring or transmitting mafierial that is in violation of sexual harassment or hostile workplace laws in the user's local jurisdictian.

7. Making traudulent affers of products, items, ar services originating from any City af Lathrop account.
8, Making statements aboufi warranty, expressly or implied, unless it is a part of narmal job duties.

9. E ecting security breaches or disruptions o P network communication, Security breaches include, but are not limiteti ta, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, un[ ss these duties are within the scope of regular duties. For purpases of this section, " disruption" includes, but is not limited to, network sni ng, ping d flaads, packet spaofing, denial of service, and farged routing infarmation for maliciaus purposes.

10. Port scanning or security scanning is expressly prohibited unless prior natificatian to the IT Department is made.
i1. Executing any form of netwark monifiaring which wil) intercept data not intended fior the employee' s host, unless this activity is a part of the employee' s norma{ jab/ duky.
1z. Circumv nting user authentication or security of any ha t, netwark ar account.

13. Interfering with ar denying service ta any user other than the rnployee' s host for example, denial of service attack).

14. Using any pragramjscript/ cammand, or sencfing messages of any kind, wikh the intent to interfere with, ar disabfe, a user's terminal session, via any means, locally or via the Internet/ fntranet/ Extranet.

15. Providing infarmation about, or lists of, City of Lathrop employees ko parties outside City of Lathrop,

16. Sending of "junk mail" or other advertising material to individuals who did not speci cally request such rnaterial ( email spam).

17. Any f rm of harassment via email, paging, whether through language, frequency, or size of inessages.

J,.µrur.'
4- ti
r'
Y'""?! information Security Policy

18. Unauthorized use, or- forging af emaii header infarmatian.

3. 9. Soiieitatian af email From any other email address, other than that of the past r' s account, with the intent to harass or to collect replies.

20. Creating or for-warding " chain ( etters", " Panzi'" or ather " pyramid" schemes of any type.

21. Use of unsalicited email originating from within City of Lathrop ' s networks af other Internet/ Intranet/ Extranet service providers an behalf of, or to advertise, any service hosted by City of Lathrop or connected via City of l.athrap ' s network.

22. Posting the same or similar non- business- related messages ta large numbers of Usenet newsgroups { newsgroup spam).

23. Video, audio and Jor any type of internet streaming not for business purposes.

Electronic Data Access
nly Department Heads or the Information Systems Manager with the approval pf fihe City Manager can authorize the reading of electronic media infarrnation, which includes, but is not limited to, e- mail and voicernail messages, for employees under their supervision. For City Manager would have fio be approved by at {east three City Caunci) Members. The City wil! also respond ta legal processes and fuffiEl any obligations to third parties with the approval af the City Attorney.

Privacy

1. All information created by emplayees or use by employees is not confidential or private. All of the City' s electronic media and informa ion relating to these electronic media are City property infarrnatian and records are also subject to cEisclosure to he public. Although employees have passwords that restrict acces to their computers, the City reserves the right to and routineiy does acce s this inforrnation.

2. It should e nated that even though information or files may have been deleted from electronic media, it daes nat mean khat they have been permanently erased from khe systems. This includes e- mail and messages stared on external electronic rnedia systems such as Microsoft Hotmail or Instant Messaging that may have been viewed, read, printed, or stored ( permanently or temporarily), on City equipment.

3. In addition to the foregoing provisions, employees should be aware that certain kinds of electranic media information may be subject to recard retentian requirements employees may not delete any such pratected records, either as public records" or pursuant to discovery in litigation.

Kxsor,
1'
lnformation 5ecurity Poiicy
Wireless Network Equipment

1. Written permission must be obtained from the IT Manager and authorized before any wireless network device can be connected to City af Lathrop networks.

2. Deployment of ANY wireless access points without IT Manager' s pe mission is strictly prohibited.

3. All wireless network devices onnecting ta City netwarks must be configured by the IT Department. A[ no time should laptop computers, handheld camputers or PDAs { Personal Digital Assistant), ar other wireless devices be conn cted ta the City' s internal netwark without the prior approval of the IT DeparCment. The exceptian would be any designateci public wireless access point ar public hotspot cieployed by fihe City of Lathrop.
nforcement
DiscipEinary actions tor City staff are de ned in the City' s Personnel Rules & Regulations Manual.

Definitions
Term Definition
Spam Unauthorized and/ or unsolicited
electronic mass mailings
EPI Electronic Protected Information -
Examples are; Employ e
information, Payroll information,
customer lists, medical information,
soclal security numbers, credit card
numbers, etc.
j,t xar.
o
p
u s. >',..
tti.

Infarmation Security Poiicy
Vendor Remote I. og- In Questionnaire
In/ ormatlon Systems Depanment 390 TOwne Ce tt'e Dr.- 1. 0thrOp, CA 9533Q Pt nna( 209) 941- 7A300- Fax( 204) 941- 7219
www. Cl. ldthrop. ca. us
Remote Lo -In Cluestionnaire
RequestorSignature Oate
Gry of Lathrop[ IQ 5ignature Date
tH ur.
ti
u. . Y. a
44i' 1i'"'°"*`° I formation Security Poiicy
i,z« c;
a. Information Security Policy
Contact Information
tis[ ed persanne! thai should be contocted in the event af data loss incidents.

Updoted March 2023
w_._. _
Name Title Role Cantact Informatian Escalat on '
1- 3}'"
Information 5ecurity Risk CSIST
Coordinatar Cornmander
Asset Manager CSlST
Commander
Infrastructure Manager ` CSIST
Manager
cio __ cio
W_._
M ______ _ _________ w._ __ _____ _ _
Communications CSI5T member
Manager
Legal i CSIST member
Risk Manager C515T member
HR Representative CSIST member
physical Security CSIST member
Representative
3' a
Party Support__ _
i
RegulatoryJGovernrnent
v
Reporting Bady
i I
Escalation leve! determines order in which notification shauld ocwr in the event o a ata oss incident:

1. Notify tErst, required on a! I incidents

2. Required on atl moderate vr high 5everity intidenis
3 involue as needed
Kxor
O Apt
Tj.
y:
j;
q .,
information Securitv Palicy
Information Security Team Members
Updated March 2023
No. CSIRT Member Ro( e
1 CSIST Commander
2 Network Subject Matter Expert
3 Network Subject Matter Expert
4 Senior IT Staff
5 Systems Engineer
6 Recarder
7 Recorder
d
Attachment F
rt" K"''"+
u*,.•.., s'; D1 AFT
f'
yR' Ma b
City of Lath• o Business Continuity- Disaster Recovery Pl n Version Histor
Versio Date Author ReasonjCamments

1. S March 2023 Document Origination
r
J,irw r r 4 .
a
p.... . '...
dl
CllAtF,
P
Table ot Contents
City o# L khfop Busines Continuity-f isaster Recrnrery Plan................................................................................ 1 Versic n History..................................................................................................................... ........................... 1 T b[ C cyf' antCnts .............................................................................,...,.........,.,...................,..,...........,.._.. 2 Part1...................................................................................................................................................................... 3 Intrc dttctian................................._......,._....---............,...,.,..,.,,,...,......,................ 3 Parti]..................................................................................................................................................................... 4 C esign oF the Plan............................................................................................................................................. 4 ConkactInf+ a mation....................................................................................................................a.....,..............,.... 7 Parifl1....................................................................................................................................................................

Ralesand Respc nsibilities................................................................................................................................. 8 Chi f Inforrtja tion C3Eficer CIO}........................................................................................ 8 8us[ ness C ntinuity Management" Ceam{ BCMT)......................................................................................... 8 art IV................................................................................................................................................................. 10 8us'rness Cantinuity Framewa rk..................................................................................................................... 10 Ph se I— Uisaster Detecticsn and Aetermination....................................................................................... 10 Phase II— Notification of Persc nne! Responsible for Recouery................................................................. 11 Phase Ifl— Initiat the 6usiness Ca tinuity Pfan...............................................................,,...,..,.,,..........,. 11 Pta se IV- d i aster Retc very 5trategy.............................................................,......,.....,,.,,,.,...,.,......,...,.. a 12 Scope of the 6usiness Continuity Plan...... a................................................................................................ 13 InFrarmation Systems listed by isk Category.,..,................................................................,....,....,.....,,.....,..,.... 14 J,ti wc
R4 a
T
u;
A` QiRMRATSP
Pa rt I
Introduction
Planning for the business continuity af City ot Lathrop in the aftermath of a disaster is a complex task.

Preparation for, response ta, and recovery from a disaster affecting the business functions of the City af lathrop requires the cooperative efforts of the Business Cantinuity Team( BCi'} in partnership with the essential departments of the City of lathrop. This dacument records the Plan that autlines and caardinates these efforts, reflecting the analyses by the City of Lathrap Chief Information Officer, Tony Fernandes.

The purpose of the City af lathrop Business Continuity- Disast r Recovery P{ an is ta aUow City af lathrop to respond quickly and appropriately to servic2 interrupting incidents.

Event Definitian
Adve se Events De( inition
How to Use This Document
Use this document to learn about the issues involved in pfanning far the continuity of the critical and essential business functions at City af Lathrop, for training personnel, and for recavering from a disaster. This dacument is divided into four parts, as described below.

Part Contents
Part I- Information about the dacument itself.

Purt II- pesign of the Plan that this document recards, including infarmation about the overal) structure af business continuity planning at Gty af l. athrop.

Fart III- General responsibilities of the i dividual City of Lathrop Suppart Teams that together form the Business Continuity Management Team, emphasizing the function of each team and its preparation respansibilities.

Part IV- Recavery actions for the City of athrop 5upport' feams and important checklists such as the notificatian list for a disaster and an inventory of resources required for the environment.( Nate: If a disaster" situatian arises, Section IV of the Pla is the only section that needs to be referenced. It contains a! I the procedures and suppart informatian for recovery.
a
J,tawr c,4
4 5. .=
T
i
rnlMT b
Audience
This document addresses several groups within the City of Lathrap central administration with differir g levels and types of responsibilities for busi ess continuity, as folfows:

Administratian
E3usiness Continuity Management Team( BCMT}
City of Lathrop 6usiness Continuity Team( BCT)
External C} rganizations
It shauld be emphasized that this dacument is addressed particularly ta the members of the Business Continuity Management Team, since they have the responsibility of preparing for, responding to, and recovering from any disaster that impacts City of Lathrap. Part NI of this document describes the composition of the Business Cpntinuity Management Team in detaii.

Distribution
As the written recard of City af Lathrop' s Business Cantinuity Plan, this document is distributed to each member of the Business Continuity Management Team.

It is also distri6uted ta City of Lathrop Department Fieads and other Cammunity Organizatians and while nat primarily involved with the direct recover effort, will require ativanced knawledge of planned actions and needs. Community Qrganizations include Physical Plants, security prouided by the Palice, and service pravided by the Fire Depa tment.

Part II
Design of the Plan
Part II describes the philosaphy of business continuity planning at City of Laihrop generally, and the kind af analysis that produced this Plan, It alsa provides an overview of the functions of the Business Continuiry Management Team in implementing this Plan.

Pu rpose
City of lathrap increasingly depends on computer-supported information processing and telecommunications. The increasing dependency on computers and telecommunications for aperationa) suppart poses the risk that a lengthy ioss of these capabilities could seriously affect the overall business performance of the City of lathrop_
City ot lathrop Infarmation Services Department recognizes the low probability of severe damage to data pracessing telecammunications and computer information systems. Nevertheless, because af the potential av,;tuKor, car
o
v"•
Rh+ trp a
impact ta City of Lathrap,
The Business Continuity Plan( BCP) identifies the critical functions of the City of Lathrop and the resources required to support them. The BCP provides guidelines for ensuring that needed personne{ and resources are available 1`or both disaster preparatian and response and that the praper steps will be carried out to perrnit the timely restoration of services.

This 8CP specifies the responsibilities of che Business Cantinuity Management Team, whose mission is to establish ity of l.athrap level pracedures to ensure the continuity of City of lathrop' s business functians. In the event af a disaster affecting any of the functional sites, the Business Continuity Management Team serves as liaison between the functional site( s) affected and other community organizations praviding major services. These services inciude the support provided by Physical Piants, security provided by the Palice, service provided by the Fire Department, and public information dissemination handled by the City af lathrap Communications 7eam, among other.

Assumptions
The City of latt rap Plan is predicated on the validity of the following three assumptions:

It shauld be noted hawever, that the Plan will still be functiona! and eFfective even in an area-wide disaster,
The Plan is a document that reflects the changing environment and requirements of City of Lathrop. Therefare, the Plan requires the continued allocation of resources to maintain t and to keep ii in a canstant state of readiness.

Develapment
City of Lathrop' s Chief Information C} fficer is responsible for developing the City of lathrap' s Business Continuity Plan. Development and support of individual City of Lathrap Department Plans are the responsibility of the Department F{ eads planning far recovery. tt ur
a
t.

RhIRAt p
Maintenance
nsuring that the Flan reflects an oing changes to resaurces is cr ccial. This task includes updating the Pian and revising this dacument to reflect updates; testing the updated Plan; and training personnel. The Business Continuity Management Team Coordinatars are responsible far this comprehensive maintenance task.

The Business Continuity Management Team Coordinators ensures that a formal review is initiated whenever there is a significant change required for the plan. Annually, the Business Continuity Management Team Coordinators initiates a c mpieke review of the P{ an, which cou( d result in major revisions to this document. These revisions will be distributed to ali autharized personnel, who exchange their old plans for the newly revised plans. At that time the Caordinatars will provide an annual status repart on continuity planning to the City of I. athrop Chief fnformation Officer.

Testing
i wr,
i
s
y
M. ass°.'`
Contact Inforrnation"
tlpdated March 2a23
Name Title Role Contact Information Escalation
1-3j•
Business Continuity BC mana er
Management Team
Coordinator
Infrastructure Manager BC Manager
n. s v____......_,__..___.___._.....___. e_a..

CI(] CIO
Comrnunications BCMT
Manager member
mm_, . v__._ __,..______.._____
legal BCMT
member
Risk Manage BCMT
member
e_. __.____.

NR Representative 6CM' t
i member
Physical Security BCMT
Representative i member
m
3` Party Network
Support
FBI Regulatory/ Government :.
j Reporting Body
Escalation level determines order in which notificatian should accur;

1. Notify tirst, required on aii incidents

2. Aeguirad on all moderate or high-severity incidents

3. involve as needed
This information may be revised from time to time, as lnternal ity persannei and external organizations change. For the most up ta date copy, please see Contact lnjormation located in Appendix 1,- Supporting Dorument Lrst. tit ur,
s
i ,,
4'*
Ar°
Part III
Roles and Responsibilities
Chief Informatian Officer ( CIO)
Seek approva{ from City Manager far the administration of the Business Continuity Frogram.

Caordinate response activities wikh department heads and external resources as needed to minimize damages to iniormation resources.

Provitte updates on response activities to Business Gontinuity Management Team ( BCMT} and ather stakeholders during an incident.

Ensure service level agreements with service providers clearly define expectations of the organizatian and the service provider in relation to Business Gantinuity.

Ensure policies related to recavery management accurately represent the goals of the City of Lathrop.

Fieview the Business Continuity Plan (° the Plan"} to ensure khat it meets policy abjectives and accurately reflects the goals of ihe City.

Ensure Cyber insurance is maintained as necessary and appropriate stakeholders are informed.

Ensure lessons learned are applied/ weighed based o risk for Business Continuity incidents.

Business Continuity Management Team ( BCMT)
Under the overal) direction of the Business Continuity Manager, support is provided ta assist City of lathrop functional site' s recouery by the Business Continuity Team memhers and external vendors. These teams uvork the problem candition to restore services and provide assistance at the City of Lathrop level. Support from external vendors is generally documented in a procedure' s manual for the City of Lathrop. The eusiness Cantinuity Plan is an adjunct ta that documentation and highlights the interfaces between the vendor ievel service and the Business Continuity Team aperations requirements. In cases where the documentation in this Plan and the vendor' s dc cume ts differ, the vendor' s documentatian has precedence, Advise on recovery response activities relevant to their area of expertise.

Maintain a general understanding of the Plan and poficies pf the City o# Lathrop.

Ensure business continuity activities are in accordance with legal, ca tractual, and regulatory requirements.

Participate in tests of the Business Continuity pfan and procedures.

Responsible tor i terna! and external communicatians pertaining to recavery activities. 3usiucss Cn iti iuity ltlar uger
The Bus ness Continuity manager aversees and prioritizes actions during the incident. They are also responsible for conveying the special requirements of high severity activities ta the rest of the City of Lathrop personnef. AdditionaUy,# hey are responsible for understanding the SLAs in pface with third party vendors, and the role third parties may play in specific response scenarios.

Further responsibilities:

Assernble a Business Continuity Respanse Team{ CSIRTy.

Ensure personnel tasked with business continuity responsibilities are trained and knowledgeable on how to respqnd to incidents.
avr.
i
v!;. s`
ry i1, M11AY p
Update Business Continuity PEan and procedures as needed Initiate tests of the business Cantinuity Plan
Ensure team activities compiy with legal and industry requirements for Business Continuity pracedures.
t
Act as the primary Business Continuity Manager, responsible for declaring a disaster intident, managing team response activities, and approving close of recovery incidents. l3uci res Couti ruih' Tean1 A1cnrGers
The Business Continuity Manager is supported by a team af technica! staff that work directly with the affected informatian systems to restore service to end users. Team members are typically comprised af subject matt2r experts( SMEs}, senior level IT staff, third part+es, autsourced security, or forensic partners.

Teams and responsibilities:

Damage Assessment/ Salvage Team. Headed by the Infrastructure Manager and activated during the initial stage of an emergency, the team repvrts directly to the Business Continuity Management Team, evaluates the initial staws of the damaged functional area, and estirnates both the time to reoccupy the facility and the salvageability of the remaining equipment.

Transportation Team. A ternporary City of i.athrop Support Team headed jointly by the Infrastructure Manager and Physical Security Representative responsible for transporting resources, personnel, equipment, and materials to back- up sites as necessary.

Telecommunications' fearn. Headed by the Infrastructure Manager is responsibfe for establishing voice and data communications between the affected site and the City af athrop. ttuar,
C„
u.__.
s
a,£ £
x u. O'
TAltl. h: 1: CITl QF LATHROP I3US1 Ili55 CON' f1iVlIITY TE;AM1I 1 IE1111tiERS' tlpdoted March 2a23
o. BCT Member Role
i__
1 Business Continuity Manager
w. i
2 Network SME ______
3 Network SM E
4 Seniar IT Staff
S Systems Engineer
S
6 Business CantinuityTeam Member m Recorder
7 Business Continuity Team Mernber- Recorder
Tl is information may 6e revised from time ta time, as internat City personne end external argankzatac, ns cta: arti e, Fcsr th* rran t up to date coPY, please see Table 1° City of tathrop Business Continuity Feam A+fembers Ir cat c in Ag, enrtix f S; rnnrrir cr 3rscument l.ist.

Part IV
Business Continuity Framework

4. isaster Recavery Strategy
Each subsec#ion below identifies the organization( s} and/ a position( s) responsible for each af these respor ses.

Phase I — Disaster Detection and Determination
a°
JS r
t't;;M a
Phase li - Notification of Personnei Responsible for Recovery When a situation occurs that could result in interruption of processing The Business Cantinuity Managerl
The Business Continuity Teaml
f7eJer to puge T; Contact tnfarmotron
Phase III - Initiate the Business Continuity Plan
Initiation of this Plan is the responsitaility af the Business Continuity Management Team Coordinator ar any member af the Business Continuity Management Team.

Activation of a Designated Hot Site
Hot Site:

The respansibility for activating any af the designated hot sites or back-up resaurces is delegated ta Ghief Information Clfficer( CIO). tn the absence of the G0, responsibility reverts to the tommunitations Manager. ihe CIC?, or aiternate, determines
Infrastructure Manager and[ ommunications Manager.

Disseminatian of Public Information
The Communications Manager is responsible for directing al( meetings and diseussians with the news media and the public, and in conjunction with the BCT Manager and necessary BC7 personnel not actively participating in the ecovery operatian. In the absence of khe Cammunications Manager, the responsibiiity reverts to the senior afficia! present at the scene.

Recovery Status lnformation Number
ISO Helpdesk; is th2 predefined number estahlished as the voice mail information number far posting recc very status and information natices.

ZN ur
u`!.
4;'
RMutf
Provision of Support 5ervlces to Aid Recavery
During and follawing a disaster, at the directian ot the CIO, each department head shail have their respected department personnel availabie
Phase IV - Disaster Recovery Strategy
The disaster recovery strategy explained below
Subsectians below explain the context in which the City of Lathrop' s Business Continuity Pla operates.
7his section addeesses th ee phases of disaster recovery:

1. 2.

8. Emergency Phase
The emergency phase begins with the initial response to a disaster. During this phase, the existing emergency plans and procedures are impfemented for direct effarts ta protect life and property. Security aver the area is established as lacal suppart services such as the Police and ire Departments are enlisted through existing mechanisms. The 8usiness Continuity Manager is alerted and begins to monitar the situation. wr.

4..
w
u!-. ' i,
M R!( St
Back- up Phase
Fiecovery Phase
The time required for recouery of the functianal site and the eventual restoration of normal processing depends an the dama e caused by the disaster.

The primary goal is to restore normal operations
as saan as possibte.

Scope of the Business Continuit Plan
The object of this Plan
Nore:
t
r%
x A
Tab1e 7: Categorizotion of Federal Information and InPormntinn Systems SNwr,
a
4 k
v,.; r.;
i;+++a p.
information Systems listed by Risk Category
Deliverable Pending}
w.
o J! ',"
u`!',. r'
4+'MtxsN`
Appendix I: Supporting Document List
Tt e fr flowing dc cuments have been defined to assist in incident respanse Eor the City af lathrop.

Contatt Information
Table 1: Citv of Lathrop Business Continuitv Team Membe s ' iJSN wr. t i,`
u`
1 n{ M At p
Contact Information
Updo# ed Morch 2Q23
Name Title Role Contact Information Escalatio `
13«
Business Continuity BC manager
Management Team (
Caordinator
Infrastructure Manager BC Manager
cio cio
Communications BCMT
Manager rnember
Legal BCMT
member
Risk Manager CMT
member
NR Representative BCMT
member
Y_. , .

Physical Security BCMT
Representative member
3"' Party Network
Suppart
BI Regulatory/ Government ` --_______
i Reporting Body
3 1
I
v .,...,. - a.r.,...._ .._ _. .,>. d_.... v_ w. __... __ Escalation leve# determines order in which notification should accur i, Natify iirst, required on all incidents

2. Required on ail morferate ar high- seuariry incidents

3. Involve as needed
ot,.
uur.
v+:'
a
4 y'
OIIX1 p
Table 1: City of Lathrop Business Continuity Team Members tlpdated March 2Q23
No. BCT Member Role
1 Bustness Continuity Manager
2 Network SME
J„_~
3 iVetwork SME
4 Senior IT Staff
S Systems Engineer
6 Business Continuity Team Member- Recorder
7 Business Continuity Tearn Member- Recorder