RANSOMWARE ATTACK RESPONSE POLICY 14.01.020
SUBJECT: RANSOMWARE ATT ACK, INFORMATON
SECURITY
NUMBER: 14.01 .020
RESPONSIBLE OFF ICER:
City Manager
EFFECTIVE DATE:
09/01 /2022 ,
POLICY OWNER:
Director of IT, Information Technology
tAST UIDA).
il
N/A . '
tpo:
POLICY CONT ACT:
Director of IT, Information Technology
APPRO /ED:
r
it <1 I -" 1
POLICY
The purpose of this policy is to provide direction on the appropriate ransomware response if the City is faced with a ransomware attack.
Upon discovery that a ransomware attack is occurring or has occurred the Information Technology Department will take the following action:
Notify City Manager's Office
Notify City Attorney's Office
Notify the City Council
Contact appropriate Federal and State Law Enforcement agencies.
Contact Cyber Insurance Provider
If the attackers demand payment to recover files or to refrain from disseminating captured files to the public or by any other means tarnish the reputation or disrupt city operations, then the City Manager or designee in consultation with the stakeholders mentioned above will decide, based on the information and circumstances available, on what the appropriate response is to get the best outcome for the City.
RESPONSIBILITIES
Director of Information Technology
@ Notify the City Manager's and the City Attorney's Offices * Notify the appropriate Federal and State law enforcement agencies * Contact the City's Cyber Insurance provider
* Provide situational updates to the City Manager City Manager
* Notify the City Council
* In consultation with stakeholders, formulate the ransomware response plan.
City Council
* Provide the City Manager with the authority to enact the ransomware response plan.
ATTACHMENT C
City Attorney
@ Consult with City Manager and City Council on legal aspects of ransomware response. * Work with Public Information Officer and law enforcement on press releases.
Public Information Officer
* Work with City Attorney and law enforcement on information provided in press releases Information Technology Department
* Work with cyber insurance providers experts to assist with containment and recovery * Work with law enforcement agencies on evidence gathering * Work with other third parties assisting with the ransomware incident, as defined in the Information Technology's document titled, Cybersecunty Incident Response Playbook
RELEV ANT AUTHORITY
RELATED CITY POLICIES
Information Technoloqy Manaqement and Security Policy 44. 01. 010 RELATED aTY PROCEDURES
Cybersecunty Incident Response Playbook
RELATED FORMS, DOCUMENTS, OR LINKS
N/A
FREQUENTLY ASKED QUESTIONS
N/A
UPDATE HISTORY
09/01/2022 - Established
ATTACHMENT C