HomeMy WebLinkAbout5J - City Technology Policy
AGENDA ITEM:
CONSIDER APPROVAL OF A RESOLUTION UPDATING THE CITY'S
TECHNOLOGY POLICY
DISCUSSION:
Introduction
The purpose of this agenda item is to consider adoption of a updated
Technology Policy that outlines the permitted uses of various technology, how
electronic media is managed, and identifies a schedule and procedure for
acquisition and replacement of hardware and software.
Historv
The City adopted a computer policy as part of its Personnel Policy in September
1997. The policy was updated in August 1998, but has not been updated since
that time. With the drastic change in technology over the past 10 years, it is
prudent to update the City's policy to set standards and procedures that protect
the security and integrity of the City's IT systems, establish a hardware and
software replacement process, and that provide guidelines for the appropriate
use of technology.
Current Circumstances
The attached Policy was originally drafted based on similar policies used by
other Minnesota cities. It has been reviewed on two occasions by the City's staff
technology committee which includes representation of all City departments. It
has also been reviewed by the Communications and Technology Advisory
Committee. Both recommend approval.
Conclusion
The Council should consider if the Technology Policy as proposed adequately
protects the City's information systems, and establishes a replacement policy for
computers that is reasonable and appropriate.
ISSUES: For the most part, the proposed Policy puts in writing our current practices.
However, there are a few significant items outlined below that the Council should
be aware of:
1. Com outer reolacement: Several years ago the City implemented a policy
of replacing computers on a rotating basis every four years in order to
keep pace with technology. That standard is maintained in the proposed
policy with the clarification that the replacements need to make sense
financially, and that the City may determine to accelerate or decelerate a
particular purchase based on other priorities or circumstances. For
example, a higher use position might get more frequent upgrades and
their used machines are reassigned to a lower end user. In this manner it
may be significantly longer than 4 years before the lower end user has
brand new hardware.
2. Auditinq: The City has always had the ability to manage the use and data
in its network. This Policy puts users on notice that the City may inspect,
audit or monitor thett~mpIO\leas' use of any City equipment.
www.chyotpnotlaK:e.com
F~ \Council\2009 Agenda 2f,OO\%c~gtr~~7p~~g,q\6'E~~~Po€.447.4245
3. E-Mail messaaes: Maintaining email content is increasingly more and
more important since there are a number of data practices implications
created by maintaining that content. The Policy provides that email is a
communication tool and should not be used for information storage.
Emails are not backed-up and will be automatically purged every 90
days. If the content of an email is important to be saved, it should be
printed and filed, or saved into a network folder (where it is backed up
as part of the City's network). A printed "Contacts" list should also be
kept and updated every 6 months in the evenHhe data is lost. In addition
to addressing email storage, the Policy also provides rules in order to
reduce the risk of viruses or other corruption of the network, prohibiting
users from forwarding any non-City business material, registering email
addresses with any online subscription, or accessing personal email
accounts through the City's network.
4. Web Site: The Technology Policy also incorporates the Web Site Policy
previously adopted by the Council.
FINANCIAL
IMPACT:
There is not direct financial impact related to approval of the Technology Policy.
The Council approves the funding for any replacement equipment annually as
part of its adoption of the budget. All purchases of hardware or software must
comply with the City's purchasing policy.
Indirectly, the controls imposed by the Policy will reduce the City's exposure to
data practices challenges and infection from viruses and/or spyware. If the City's
network is able to operate at optimum speed, the City will be better able to
manage its costs related to IT services, and network storage capacity.
ALTERNATIVES: 1. Motion and second as part of the Consent Agenda to adopt the Technology
Policy as proposed.
2. Remove this item from the Consent Agenda for additional discussion, and
provide staff with direction.
RECOMMENDED Alternative #1 - Motion and second to adopt the policy as part of the Consent
MOTION: genda.
~
prank S"oyles, City Manager
R\Council\2009 A,genda f~eports\04 20
Policy A(3Er~DAdoc
4646 Dakota Street S.E.
Prior Lake, MN 55372-1714
RESOLUTION 09-xxx
A RESOLUTION ADOPTING A CITY TECHNOLOGY POLICY
Motion By:
Second By:
WHEREAS, the City last updated its Computer Policy in 1998; and
WHEREAS, technology has changed significantly over the past 10 years; and
WHEREAS, the City relies on technology to provide efficient, cost-effective services to the public;
and
WHEREAS, the City desires to set forth standards and procedures to manage its network
technology in a manner that protects the security and integrity of the system.
NOW THEREFORE, BE IT HEREBY RESOLVED BY THE CITY COUNCIL OF PRIOR LAKE,
MINNESOTA as follows:
1. The recitals set forth above are incorporated herein.
2. The Technology Policy is adopted as proposed.
PASSED AND ADOPTED THIS 20th DAY OF April, 2009.
YES
NO
Haugen
Erickson
I Hedberg
I LeMair
I Millar
Haugen
Erickson
Hedberg
LeMair
Millar
Frank Boyles, City Manager
www.cityofpriorlake.com
n... \......VUll~.A] tLl.,iU;;J f4.yerHJa t1.epOilS\U4 ,:U U~1\ j eGnrHJlogy t-'OIlCY Kc:::iU, UUt...
Phone 952.447.9800 / Fax 952.447.4245
CITY OF PRIOR LAKE
TECHNOLOGY POLICY
ADOPTED: APRIL 20, 2009
4646 DAKOTA STREET SE
PRIOR LAKE, MN 55372
TECHNOLOGY POLICY
CITY OF PRIOR LAKE
SECTION 1: PURPOSE
The City of Prior Lake is a growing service organization which recognizes that the effective use of
technology can provide for the convenient, efficient and cost-effective delivery of city services.
The purpose of this policy is to set standards and procedures that protect the security and integrity
of the City's electronic communication and information systems from business interruption, misuse,
and/or unauthorized or inappropriate access; and to establish a hardware and software
replacement process to assure the efficient delivery of services.
SECTION 2: APPLICABILITY
The policy shall apply to all City employees, whether regular or temporary, consultants, vendors,
volunteers, or others who may have access to or use the City's IT systems both on and off City
property. All users must be authorized to use the City's IT systems through their Department
Head. Any remote access into the City's network system must be authorized by the Assistant City
Manager.
Failure to abide by this policy or its provisions may result in discipline up to and including
termination of employment or service contract.
This policy shall include all IT systems, including but not limited to desktop computers, laptops, e-
mail, Internet, printers, scanners, fax machines, digital cameras, personal digital assistants (pda),
and software.
SECTION 3: AUDITING / EXPECTATION OF PRIVACY
The City of Prior Lake reserves the right to inspect, monitor and audit any data, use or
setting of its IT systems at any time without consent from users. An inspection may
result in the removal of hardware, software, or data files not compliant with this policy.
As a government agency, the City is subject to public disclosure laws and the Minnesota
Government Data Practices Act. All files and documents, including personal messages
and Internet logs, are owned by the city and may be subject to public data requests.
Users should have no expectation of privacy.
2
SECTION 4: HARDWARE AND SOFTWARE ACQUISITION
4.1
HARDWARE ACQUISITION
Comouter Reolacement Proaram: In order to assure that computer hardware continues to meet
the operational demands of technology, and continues to efficiently aid in the cost-effective delivery
of municipal services, computers shall be replaced on a 4-year rotating schedule whenever
possible and practicable. It is recognized, however, that in some cases, depending on a particular
use, replacement of some equipment may be deferred in order to address higher priorities.
Further, replacement or addition of new equipment shall be accomplished within the annual budget
as approved by the City Council.
Eauioment Assianment: Department Heads will work with their staff to assign appropriate
equipment for individual employees as appropriate. Instal/ation of personal or non- City-owned
hardware is strictly prohibited without prior permission from the Assistant City Manager. Home
use of City hardware is permitted on a limited basis in special circumstances if used to conduct City
business and in accordance with aI/laws, policies and procedures of the City. Home use of City
hardware must be authorized in advance by the Deparlment Head.
Eauioment Reauests: All requests for new or replacement equipment shall be submitted to the
Department Head prior to initial department budget deadlines for the subsequent year. All requests
for equipment shall then be reviewed and prioritized by the Department Head and submitted to the
Assistant City Manager for inclusion in the annual budget. Equipment requests must include
funding source, on-going maintenance costs, if any, and any conditions regarding the equipment.
(For example, certain grants may have restrictions on the use of the equipment).
Eauioment Purchases: Proposed equipment must be approved by the Assistant City Manager
prior to acquisition to ensure that the equipment is compatible with the design and architecture of
the City's existing network systems, to ensure IT consultants/staff can support it, and to inventory
equipment for future replacement. All equipment acquisitions must be in accordance with the
City's Purchasing Policy.
Inventorv: Periodically an inventory of all current hardware will be taken.
4.2
SOFTWARE ACQUISITION
Licensina: All software must be purchased by and licensed to the City. Software may not be
installed if there are insufficient licenses. All software manuals and original media must be stored
on City property.
Home Use: City-owned software may not be loaded on non- City-owned equipment.
Develooment: Any software programs, including but not limited to custom designed databases,
electronic logos, templates, web sites, or media, developed for use by the City is the property of
3
the City. Software programs may not be sold or distributed in any way without prior approval of the
City Manager.
New or Reolacement Software Reauests: All requests for new or replacement software shall be
reviewed by the Technology Committee in order to determine the potential for City-wide
application, compatibility with the existing systems, and ability for IT support. The Technology
Committee will submit its recommendation to the Communications and Technology Advisory
Committee for a recommendation to the Department Head and/or City Council, when appropriate.
All requests for software shall then be reviewed and prioritized by the Department Head and
submitted to the Assistant City Manager for inclusion in the budget. Software requests must include
funding source, on-going maintenance costs, and any installation parameters.
Inventorv: An inventory of all current software will be maintained on an on-going basis as software
is added or replaced.
SECTION 5: COMPUTER USE
5.1
USER NAMES AND PASSWORDS
All users must use City-issued login IDs for computer and network-related access. Login IDs are
not to be shared with others, and corresponding passwords must remain confidential. Multi-user or
generic login IDs are permissible only in special circumstances approved by Assistant City
Manager.
Appropriate network access shall be assigned by the City to each user login 10, and users may log
into computers and equipment only with their assigned login 10. Passwords are not to be shared
with anyone except the Assistant City Manager or the City's IT service provider. The network will
require the password to be changed periodically. If a password is forgotten or the employee
suspects that their password's security has been compromised, contact the Assistant City
Manager.
If an individual would like to change their password please inform the IT coordinator before
proceeding so that an up-to-date master list may be kept.
5.2
EMPLOYEE RESPONSIBILITIES
Provide Securitv,: City users are expected to provide reasonable security to their computer work
stations and related equipment. Providing reasonable security means, but is not limited to:
· Properly caring for and handling equipment
· Purging files when appropriate and in compliance with this policy and the City's
Records Retention Policy;
· Regularly installing Microsoft security updates;
· Ensuring that passwords are not written down in accessible places;
· Removable media is kept in a secure area;
· Logging out and shutting down computers when not in use, including turning off
monitors;
4
· Not keeping laptops and other portable equipment in vehicles.
Do Not Enaaae in Inaoorooriate Uses: Limited Personal Use: Personal use of the City technology
and equipment must not compromise the City's standards, values, or services to the public, and
must be done at appropriate times (breaks, before or after work). The City's equipment may not be
used for illegal activities or interfere with or negatively impact the performance of the City's
network. Personal files may not be stored on the file server or an employee's local hard disk.
Personal e-mail accounts should not be accessed from the City's network.
Protect from Viruses: Employees are responsible for minimizing the potential damage of viruses.
Employees must be aware of the potential for corrupt data from removable media, newly
purchased software, e-mail attachments, downloaded files or software, or disks received from
others. Staff will immediately notify the Assistant City Manager if a virus is found or suspected.
Properlv Store Records: Each employee is required to maintain the home directory of their
computer so that it is accessible, organized and reasonably understood.
5.3
DATA MANAGEMENT
The Minnesota Government Data Practices Act governs all data stored on computer
media owned, leased, or rented by the city including information stored on local hard
drives.
Data Ownershio: All information developed or introduced into a city technology system
becomes property of the city. This data is subject to review, investigation and deletion at
the discretion of the city manager, department heads, IT coordinator, or law
enforcement.
Data Storace: All city data should be saved to a network drive on a city server (for
example, your H, R or department drive.) The City backs up all data stored on the file
servers. Please review the city's Records Retention Schedule for further information.
Users are responsible for deleting outdated files that are no longer needed for
compliance with the City Retention Schedule; this includes data files and email
messages. Questions regarding the retention schedule should be addressed to the
department head. Questions needing additional clarification should be referred to
Administration.
If a paper copy is being kept, then delete the electronic version when it is no longer
needed. This will simplify file maintenance and adherence to retention schedules.
Portable Files: To facilitate off-site work, users may copy necessary data files. A current
copy of the portable files should be maintained on the city server.
Password Protection: If any software product that the city has purchased has the option
to have files password protected, the password must always be on file with the Assistant
City Manager.
5
5.4
E-MAIL MANAGEMENT
Information Storace: The city e-mail system is a tool to be used for matters directly
related to the business activities of the city and as a means to provide services that are
efficient, accurate, timely, and complete. E-mail is intended as a medium of
communication, not for information storace: therefore, e-mail should not be used for the
storage or maintenance of official city records or other city information. Important
messages should be saved to the appropriate network folder, or printed and filed, and
the electronic message deleted.
Inaoorooriate Uses: Inappropriate use of the city e-mail system includes, but is not
limited to:
· Viewing or distributing by email inappropriate materials that are sexually
explicit; political; material advocating intolerance or disrespect for other
people, races or religions; activity for personal gain; pirating of software; or
copying copyrighted information.
· Transmitting non-business audio, graphic, or movie files (for example,
streaming audio and video, Mp3, Jpg, Tiff, Gif, Mpg, and AVI files); games;
jokes; instant messaging; and large data files not directly related to city
business.
· Registering your city e-mail address with any online subscription that could
have the potential of corrupting your account via SPAM or spyware.
· Accessing personal em ail accounts through the City's network.
Security: E-mail is not the most secure method of transferring data. Confidential or
private data should be transferred in a secure method. E-mail files can contain spyware
or viruses that can impact the network or pc performance. Users who receive suspected
corrupt files or inappropriate e-mail messages with content of an offensive or
pornographic nature, should report such message to Administration immediately.
Storace: E-mail messages will not be retained in the system for longer than 90 days.
The City does not back-up e-mail messages, including any folders contained
within the email box, contacts or calendars. A printed Contact lists should be kept
and updated every 6 months (or earlier) in the event the data is lost.
5.5
INTERNET
Intended Use: The Internet is available to users for research, education, and
communications directly related to the mission and work tasks of the City. Use of the
Internet through City computers is a privilege, not a right, and may be revoked at any
time for abusive conduct.
Prohibited Uses: Users of the Internet should minimize unnecessary network traffic that
might interfere with the ability of others to make effective use of this shared network
resource.
· Employees may not download unauthorized software, use instant
messaging or Internet Relay Chat, utilize unauthorized real-time services
(such as radio broadcasts, weather reporting services, stock market
reports, video broadcasts), or use peer-ta-peer networks or file sharing.
6
· Employees may not intentionally access web sites containing
inappropriate materials, including but not limited to, sexually explicit
material, political activities, material advocating intolerance or disrespect
for other people, races or religions, activity for personal gain, pirating of
software, or copying copyrighted information. Sworn police officers may
be authorized to access certain such web sites in the conduct of official
business with prior agproval from the Chief of Police.
Securitv: Users are responsible for adhering to city standards when browsing the
Internet. Failure to adhere puts the city and the individual at risk for legal or financial
liabilities, potential embarrassment and other consequences. The city may use
management software to monitor end user activity. This software may monitor and limit
Internet activity in order to ensure the most efficient use of the valuable resource in
accordance with this policy.
5.6
CITY WEB SITE
Puroose: The web site is provided as an additional communication tool between the City
and the public it serves for the purpose of communicating City business. The web site is
not intended as a public forum. Information related to events or business not sponsored
by the City shall not be permitted; however, if in compliance with the External Link policy
below, may be linked to the City's site. All information on the City's site will be provided
in the most positive, professional, user-friendly manner possible.
Particioation: Departments are expected to actively participate in maintenance of the
web site, and must check their information on a monthly basis to ensure that information
is current and fresh.
External Links: Links to other community or government information web sites may be
provided within the City's web site under the following criteria:
1. The information in the linking site is useful and informative to the entire Prior
Lake community rather than special interest groups.
2. The information is presented from a neutral viewpoint.
3. Typical organizations which are appropriate for linking include:
· Ad hoc committees appointed by the City Council;
· Quasi-government entities, such as watershed and park districts that include
Prior Lake;
· Other government entities;
· Public education institutions;
· Public utilities that serve Prior Lake;
· Non-profit Prior Lake civic, educational, athletic and recreational
organizations;
· Athletic Associations that serve Prior Lake and work collaboratively with the
Prior Lake Park and Recreation Department to provide athletic services for
Prior Lake residents.
7
4. Inappropriate links include, but are not limited to, sites which endorse a specific
candidate, represent a religious position, or operate for-profit.
The City of Prior Lake shall not be responsible for and does not endorse the information
on any linked website. Nor does the City of Prior Lake guarantee the accuracy,
completeness or timeliness of the information on those sites. The City of Prior Lake is
not liable for defamatory, offensive, or illegal conduct of linked sites. The links from this
site to other sites on the World Wide Web do not constitute or imply endorsement or
recommendation on the part of the City of Prior Lake.
Any organization meeting the above criteria seeking to link to the City of Prior Lake
website shall make a request in writing to the City's Communications Coordinator. The
written request shall describe the organization or entity's mission. The City reserves sole
and exclusive right to determine whether an organization or entity meets the enumerated
criteria, and whether to approve the link. The City also reserves the sole and exclusive
authority to discontinue Website linkage based upon this policy as interpreted by the
City.
Advertisements: No advertisements other than for City-sponsored events, paid or
unpaid, will be posted on the City's web site.
Disclaimer: The City of Prior Lake will make every effort to ensure the accuracy of the
information provided on its website. However, due to the possibility of unauthorized
modification of the data, transmission errors, HTML browser incompatibilities, human
error, changes made since the last update to the website or other aspects of electronic
communication that are beyond the City's control, the City does not guarantee the
accuracy of the information provided on its website and is not liable for reliance on the
information.
SECTION 6: TRAINING
Department Directors shall be responsible for addressing staff training needs as part of
the development of their annual budgets in an effort to ensure each user is adequately
trained to accomplish their job duties. Annual training needs shall be reviewed with
Administration in order to determine if there are cross-Departmental needs. Training
needs will be prioritized based on amount of need, training funds available, and
applicability to job functions.
8