Score: +30
(31/24/1)
Marin County Grand Jury
• 2023-2024
Cyber Preparedness: Are We There Yet?
Published: May 17, 2024
22 pages
⚠️ Translation Notice: This content has been automatically translated. The original English text is the official version. Translation may contain errors.
⚠️ Este contenido ha sido traducido automáticamente. El texto original en inglés es la versión oficial. La traducción puede contener errores.
Findings and Recommendations 6 findings
F1
Contracts for Information Technology, Information Systems, and Cybersecurity services between third-party providers and Marin County governmental agencies should contain a Business Continuity clause, or other language, protecting that agency from a sudden cessation of services provided by the third-party provider.
Related Recommendations (1)
R1
Marin agencies should require a current (executed within the last five years), competitively-bid, written contract which includes business continuity language for any third-party Information Technology services they use.
F2
Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers’ services without a current contract.
Related Recommendations (1)
R2
The Board of Supervisors should authorize the creation of a new position within the Department of Information Services and Technology for the 2025-2026 fiscal year, with specific responsibilities to assist other County agencies in cybersecurity awareness, training, implementation, and monitoring of cybersecurity systems.
F3
Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement.
Related Recommendations (1)
R3
The Board of Supervisors should require that the Marin Department of Information Services and Technology evaluate the formation of a Cybersecurity Joint Powers Authority to raise overall cyber preparedness amongst its members, and for the purpose of acquiring and maintaining perimeter defense protection systems for preventing and eliminating ransomware and other more sophisticated cyberattacks.
F4
Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security.
Related Recommendations (1)
R4
The Board of Supervisors should create two new system-engineering positions to be filled by cybersecurity experts who would be responsible for conducting security risk assessments, providing recommendations and implementing cybersecurity solutions for public agencies in Marin, among their other tasks.
F5
Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin.
Related Recommendations (1)
R5
If and when a Joint Powers Authority is created, one of these positions would serve as a County member of the new organization and a liaison with the Chief Information Security Officer.
F6
The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties).
Related Recommendations (1)
R6
All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year.
Additional Recommendations 4
These recommendations are not explicitly linked to specific findings.
-
R7The Board of Supervisors should require that the Marin Department of Information Services and Technology: a) develop a plan to redefine a secure network infrastructure of the MIDAS system which solely focuses on providing access to law enforcement, emergency response and justice systems, or other online County services, and exclude Internet Service Provider services; b) take all steps necessary to transition administration of MIDAS from Marin IT to The County of Marin Department of Information Services and Technology.
-
R8The Board of Supervisors require that the Marin Department of Information Services and Technology and the Department of Human Resources develop a plan for negotiating the inclusion of language that allows for managed service agreements in new Collective Bargaining Agreements with MAPE and MCMEA that will start in July of 2025.
-
R9The Board of Supervisors requires that the Marin Department of Information Services and Technology update its Top 10 Cybersecurity Tips for Organizations at least once a year.
-
R10The Board of Supervisors requires that the Marin Department of Information Services and Technology more directly promote, through the Marin Security and Privacy Council, its Top 10 Cybersecurity Tips for Organizations to all of Marin’s public agencies.
Agency Responses 7
Government agencies' official responses to this report's findings and recommendations. Click on a response to see the structured breakdown.
▶
City of Mill Valley[PDF]
August 06, 2024
•
5 pages
• 8 responses
•
Score: +7
(+7, 1, 0)
View Details ▾
8 responses to findings and recommendations
F1
Contracts for Information Technology, Information Systems, and Cybersecurity services between third-party providers and Marin County governmental agencies should contain a Business Continuity clause, or other language, protecting that agency from a sudden cessation of services provided by the third-party provider.
Response: Disagree Partially
Score: 0
We agree with the finding. F2. Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers' services without a current contract. Response: We agree with the finding. F3. Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement. Response: We agree with the finding. F4. Having a completed, adopted and regularly updated cyb...
R1
Marin agencies should require a current (executed within the last five years), competitively-bid, written contract which includes business continuity language for any third-party Information Technology services they use.
Response: Will Implement
Score: +1
This recommendation has not yet been implemented, but will be implemented by the start of the 2025-2026 Fiscal Year. R6. All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year. Response: This recommendation has not yet been implemented, but will be implemented by the start of the 2025-2026 Fiscal Year. 3
RESOLUTION NO. 24-46 A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF MILL VALLEY AUTHORIZING THE MAYOR TO EXECUT...
F2
Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers’ services without a current contract.
Response: Agree
Score: +1
agree with the findings numbered Fl, F2, F3, F4, F5 • We disagree wholly or partially with the findings numbered: F6 GRAND JURY RECOMMENDATIONS: • Recommendations numbered NA have been implemented.
F3
Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement.
Response: Agree
Score: +1
agree with the findings numbered Fl, F2, F3, F4, F5 • We disagree wholly or partially with the findings numbered: F6 GRAND JURY RECOMMENDATIONS: • Recommendations numbered NA have been implemented.
F4
Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security.
Response: Agree
Score: +1
agree with the findings numbered Fl, F2, F3, F4, F5 • We disagree wholly or partially with the findings numbered: F6 GRAND JURY RECOMMENDATIONS: • Recommendations numbered NA have been implemented.
F5
Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin.
Response: Agree
Score: +1
agree with the findings numbered Fl, F2, F3, F4, F5 • We disagree wholly or partially with the findings numbered: F6 GRAND JURY RECOMMENDATIONS: • Recommendations numbered NA have been implemented.
F6
The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties).
Response: Agree
Score: +1
agree with the findings numbered Fl, F2, F3, F4, F5 • We disagree wholly or partially with the findings numbered: F6 GRAND JURY RECOMMENDATIONS: • Recommendations numbered NA have been implemented.
R6
All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year.
Response: Will Implement
Score: +1
R6 have not yet been implemented, but will be implemented in the future.
▶
City of Novato[PDF]
July 23, 2024
•
5 pages
• 8 responses
•
Score: -1
(+0, 7, -1)
View Details ▾
8 responses to findings and recommendations
F1
Contracts for Information Technology, Information Systems, and Cybersecurity services between third-party providers and Marin County governmental agencies should contain a Business Continuity clause, or other language, protecting that agency from a sudden cessation of services provided by the third-party provider.
Response: Disagree Partially
Score: 0
agree with the findings numbered: F1, F2, F3, F4, and F5 * | (we) disagree partially with the findings numbered: N/A * | (we) disagree wholly with the findings numbered: F6 RECOMMENDATIONS e Recommendation numbered R1 will not be implemented because it is not warranted.
R1
Marin agencies should require a current (executed within the last five years), competitively-bid, written contract which includes business continuity language for any third-party Information Technology services they use.
Response: Will Not Implement
Score: -1
This recommendation will not be implemented because it is not warranted or is not reasonable. The City does not use third-party services to provide ongoing Information Technology operations. Novato adheres to the City's adopted purchasing policies and when applicable, includes business continuity language when executing all contracts.
F2
Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers’ services without a current contract.
Response: Disagree Partially
Score: 0
agree with the findings numbered: F1, F2, F3, F4, and F5 * | (we) disagree partially with the findings numbered: N/A * | (we) disagree wholly with the findings numbered: F6 RECOMMENDATIONS e Recommendation numbered R1 will not be implemented because it is not warranted.
F3
Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement.
Response: Disagree Partially
Score: 0
agree with the findings numbered: F1, F2, F3, F4, and F5 * | (we) disagree partially with the findings numbered: N/A * | (we) disagree wholly with the findings numbered: F6 RECOMMENDATIONS e Recommendation numbered R1 will not be implemented because it is not warranted.
F4
Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security.
Response: Disagree Partially
Score: 0
agree with the findings numbered: F1, F2, F3, F4, and F5 * | (we) disagree partially with the findings numbered: N/A * | (we) disagree wholly with the findings numbered: F6 RECOMMENDATIONS e Recommendation numbered R1 will not be implemented because it is not warranted.
F5
Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin.
Response: Disagree Partially
Score: 0
agree with the findings numbered: F1, F2, F3, F4, and F5 * | (we) disagree partially with the findings numbered: N/A * | (we) disagree wholly with the findings numbered: F6 RECOMMENDATIONS e Recommendation numbered R1 will not be implemented because it is not warranted.
F6
The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties).
Response: Disagree Partially
Score: 0
agree with the findings numbered: F1, F2, F3, F4, and F5 * | (we) disagree partially with the findings numbered: N/A * | (we) disagree wholly with the findings numbered: F6 RECOMMENDATIONS e Recommendation numbered R1 will not be implemented because it is not warranted.
R6
All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year.
Response: Implemented
Score: 0
R6 (a) has been implemented.
▶
Sonoma-Marin Area Transit System Board of Directors[PDF]
September 21, 2023
•
3 pages
• 9 responses
•
Score: +9
(+9, 0, 0)
View Details ▾
9 responses to findings and recommendations
F1
Contracts for Information Technology, Information Systems, and Cybersecurity services between third-party providers and Marin County governmental agencies should contain a Business Continuity clause, or other language, protecting that agency from a sudden cessation of services provided by the third-party provider.
Response: Agree
Score: +1
SMART Board agrees with the finding. F2. SMART has never attained the ridership levels that it promised in 2008. Response: SMART Board agrees with the finding. F3. SMART's past inability to be open and transparent about decision making and operations contributed to the erosion of public confidence leading to the defeat of the Measure I sales tax extension in 2020. Response: SMART Board agrees with the finding.
F4. SMART will likely be forced to discontinue services if Marin and Sonoma County voters do not approve a sales tax extension by the required supermajority in an election before 2029. ...
R1
Marin agencies should require a current (executed within the last five years), competitively-bid, written contract which includes business continuity language for any third-party Information Technology services they use.
Response: Will Implement
Score: +1
SMART Board agrees with the finding. F2. SMART has never attained the ridership levels that it promised in 2008. Response: SMART Board agrees with the finding. F3. SMART's past inability to be open and transparent about decision making and operations contributed to the erosion of public confidence leading to the defeat of the Measure I sales tax extension in 2020. Response: SMART Board agrees with the finding.
F4. SMART will likely be forced to discontinue services if Marin and Sonoma County voters do not approve a sales tax extension by the required supermajority in an election before 2029. ...
F2
Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers’ services without a current contract.
Response: Agree
Score: +1
SMART Board agrees with the finding. F3. SMART's past inability to be open and transparent about decision making and operations contributed to the erosion of public confidence leading to the defeat of the Measure I sales tax extension in 2020. Response: SMART Board agrees with the finding.
F4. SMART will likely be forced to discontinue services if Marin and Sonoma County voters do not approve a sales tax extension by the required supermajority in an election before 2029. Response: SMART Board agrees with the finding. F5. SMART's new leadership, especially its General Manager and Chief Financi...
R2
The Board of Supervisors should authorize the creation of a new position within the Department of Information Services and Technology for the 2025-2026 fiscal year, with specific responsibilities to assist other County agencies in cybersecurity awareness, training, implementation, and monitoring of cybersecurity systems.
Response: Will Implement
Score: +1
R2 has not been implemented but will be implemented no later than April 1, 2024.
F3
Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement.
Response: Agree
Score: +1
SMART Board agrees with the finding.
F4. SMART will likely be forced to discontinue services if Marin and Sonoma County voters do not approve a sales tax extension by the required supermajority in an election before 2029. Response: SMART Board agrees with the finding. F5. SMART's new leadership, especially its General Manager and Chief Financial Officer, appear qualified, energetic, and motivated to take on the many challenges that SMART is facing. Response: SMART Board agrees with the finding. F6. SMART does not have a comprehensive marketing and communications strategy. Response: SMART Boar...
R3
The Board of Supervisors should require that the Marin Department of Information Services and Technology evaluate the formation of a Cybersecurity Joint Powers Authority to raise overall cyber preparedness amongst its members, and for the purpose of acquiring and maintaining perimeter defense protection systems for preventing and eliminating ransomware and other more sophisticated cyberattacks.
Response: Will Implement
Score: +1
R3 has not been implemented but will be implemented no later than December 1, 2023.
F4
Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security.
Response: Agree
Score: +1
SMART Board agrees with the finding. F5. SMART's new leadership, especially its General Manager and Chief Financial Officer, appear qualified, energetic, and motivated to take on the many challenges that SMART is facing. Response: SMART Board agrees with the finding. F6. SMART does not have a comprehensive marketing and communications strategy. Response: SMART Board agrees with the finding. RECOMMENDATIONS: R1. By December 1, 2023, the Board of Directors should initiate a fully transparent, public process to be completed by April 1, 2024, that examines how SMART might continue funding its oper...
F5
Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin.
Response: Agree
Score: +1
SMART Board agrees with the finding. F6. SMART does not have a comprehensive marketing and communications strategy. Response: SMART Board agrees with the finding. RECOMMENDATIONS: R1. By December 1, 2023, the Board of Directors should initiate a fully transparent, public process to be completed by April 1, 2024, that examines how SMART might continue funding its operations beyond April 2029, including an evaluation of when the voters would decide whether to continue levying a sales tax for SMART's operations. Response: Recommendation R2 has not been implemented but will be implemented no later...
F6
The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties).
Response: Agree
Score: +1
SMART Board agrees with the finding. F2. SMART has never attained the ridership levels that it promised in 2008. Response: SMART Board agrees with the finding. F3. SMART's past inability to be open and transparent about decision making and operations contributed to the erosion of public confidence leading to the defeat of the Measure I sales tax extension in 2020. Response: SMART Board agrees with the finding.
F4. SMART will likely be forced to discontinue services if Marin and Sonoma County voters do not approve a sales tax extension by the required supermajority in an election before 2029. ...
▶
Town of Corte Madera[PDF]
July 17, 2024
•
4 pages
• 8 responses
•
Score: +4
(+4, 4, 0)
View Details ▾
8 responses to findings and recommendations
F1
Contracts for Information Technology, Information Systems, and Cybersecurity services between third-party providers and Marin County governmental agencies should contain a Business Continuity clause, or other language, protecting that agency from a sudden cessation of services provided by the third-party provider.
Response: Disagree Partially
Score: 0
Agree. F2. Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers' services without a current contract. Response: Agree. F3. Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement. Response: Agree. F4. Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a governm...
R1
Marin agencies should require a current (executed within the last five years), competitively-bid, written contract which includes business continuity language for any third-party Information Technology services they use.
Response: Implemented
Score: 0
R1 has been implemented.
F2
Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers’ services without a current contract.
Response: Agree
Score: +1
Response: Agree.
F3
Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement.
Response: Agree
Score: +1
Response: Agree.
F4
Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security.
Response: Agree
Score: +1
Response: Agree.
F5
Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin.
Response: Agree
Score: +1
Response: Agree.
F6
The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties).
Response: Disagree Partially
Score: 0
Agree with the findings numbered: FI, - FS Disagree partially with the findings numbered: F6 Disagree wholly with the findings numbered: (Attach a statement specifying any portions of the findings that are disputed; include an explanation of the reasons therefor.
R6
All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year.
Response: Implemented
Score: 0
R6(a) has been implemented.
▶
Town of Fairfax[PDF]
July 17, 2024
•
3 pages
• 16 responses
•
Score: +7
(+7, 0, 0)
View Details ▾
16 responses to findings and recommendations
F1
Contracts for Information Technology, Information Systems, and Cybersecurity services between third-party providers and Marin County governmental agencies should contain a Business Continuity clause, or other language, protecting that agency from a sudden cessation of services provided by the third-party provider.
Response: Agree
Score: +1
agree with the findings numbered: F1-F6 = We disagree wholly or partially with the findings numbered: N/A.
R1
Marin agencies should require a current (executed within the last five years), competitively-bid, written contract which includes business continuity language for any third-party Information Technology services they use.
Response: Will Implement
Scheduled: Working to secure a current and up-to-date contract
Score: +1
The Town of Fairfax is working to secure a current and up-to-date contract for Information Technology, Information Systems, and Cybersecurity with a third-party provider which includes a Business Continuity clause, or other language.
F2
Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers’ services without a current contract.
Response: Agree
Score: +1
We agree with the findings numbered: F1-F6
R2
The Board of Supervisors should authorize the creation of a new position within the Department of Information Services and Technology for the 2025-2026 fiscal year, with specific responsibilities to assist other County agencies in cybersecurity awareness, training, implementation, and monitoring of cybersecurity systems.
Response: Unknown
Score: 0
R2-5 Are recommendations to the Marin County Board of Supervisors. They are not applicable to this jurisdiction and should be commented on only by the Board of Supervisors.
F3
Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement.
Response: Agree
Score: +1
We agree with the findings numbered: F1-F6
R3
The Board of Supervisors should require that the Marin Department of Information Services and Technology evaluate the formation of a Cybersecurity Joint Powers Authority to raise overall cyber preparedness amongst its members, and for the purpose of acquiring and maintaining perimeter defense protection systems for preventing and eliminating ransomware and other more sophisticated cyberattacks.
Response: Unknown
Score: 0
R2-5 Are recommendations to the Marin County Board of Supervisors. They are not applicable to this jurisdiction and should be commented on only by the Board of Supervisors.
F4
Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security.
Response: Agree
Score: +1
We agree with the findings numbered: F1-F6
R4
The Board of Supervisors should create two new system-engineering positions to be filled by cybersecurity experts who would be responsible for conducting security risk assessments, providing recommendations and implementing cybersecurity solutions for public agencies in Marin, among their other tasks.
Response: Unknown
Score: 0
R2-5 Are recommendations to the Marin County Board of Supervisors. They are not applicable to this jurisdiction and should be commented on only by the Board of Supervisors.
F5
Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin.
Response: Agree
Score: +1
We agree with the findings numbered: F1-F6
R5
If and when a Joint Powers Authority is created, one of these positions would serve as a County member of the new organization and a liaison with the Chief Information Security Officer.
Response: Unknown
Score: 0
R2-5 Are recommendations to the Marin County Board of Supervisors. They are not applicable to this jurisdiction and should be commented on only by the Board of Supervisors.
F6
The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties).
Response: Agree
Score: +1
agree with the findings numbered: F1-F6 = We disagree wholly or partially with the findings numbered: N/A.
R6
All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year.
Response: Unknown
Score: 0
The Town of Fairfax is working to secure a current and up-to-date contract for Information Technology, Information Systems, and Cybersecurity with a third-party provider which includes a Business Continuity clause, or other language. R2-5 Are recommendations to the Marin County Board of Supervisors. They are not applicable to this jurisdiction and should be commented on only by the Board of Supervisors. R6. All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; Response: We are taking steps to acquire an appropriate .gov or .ca.gov domain...
R7
The Board of Supervisors should require that the Marin Department of Information Services and Technology: a) develop a plan to redefine a secure network infrastructure of the MIDAS system which solely focuses on providing access to law enforcement, emergency response and justice systems, or other online County services, and exclude Internet Service Provider services; b) take all steps necessary to transition administration of MIDAS from Marin IT to The County of Marin Department of Information S...
Response: Unknown
Score: 0
R8
The Board of Supervisors require that the Marin Department of Information Services and Technology and the Department of Human Resources develop a plan for negotiating the inclusion of language that allows for managed service agreements in new Collective Bargaining Agreements with MAPE and MCMEA that will start in July of 2025.
Response: Unknown
Score: 0
R9
The Board of Supervisors requires that the Marin Department of Information Services and Technology update its Top 10 Cybersecurity Tips for Organizations at least once a year.
Response: Unknown
Score: 0
R10
The Board of Supervisors requires that the Marin Department of Information Services and Technology more directly promote, through the Marin Security and Privacy Council, its Top 10 Cybersecurity Tips for Organizations to all of Marin’s public agencies.
Response: Unknown
Score: 0
▶
Town of Ross[PDF]
August 19, 2024
•
4 pages
• 8 responses
•
Score: +2
(+2, 6, 0)
View Details ▾
8 responses to findings and recommendations
F1
Contracts for Information Technology, Information Systems, and Cybersecurity services between third-party providers and Marin County governmental agencies should contain a Business Continuity clause, or other language, protecting that agency from a sudden cessation of services provided by the third-party provider.
Response: Disagree Partially
Score: 0
Agree with the findings numbered: _ F1-F5 = Disagree partially with the findings numbered: F6 *_ Disagree wholly with the findings numbered: __ _ --- - - S000 © oo (Attach a statement specifying any portions of the findings that are disputed; include an explanation of the reasons therefor.
R1
Marin agencies should require a current (executed within the last five years), competitively-bid, written contract which includes business continuity language for any third-party Information Technology services they use.
Response: Will Implement
Score: +1
This recommendation has already been implemented in the Town of Ross. R6. All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year. Response: This recommendation has not yet been fully implemented. It will be implemented by the start of the 2025-2026 Fiscal Year.
F2
Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers’ services without a current contract.
Response: Disagree Partially
Score: 0
We agree with the finding. F4. Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security. Response: We agree with the finding. FS. Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin. Response: We agree with the finding. F6. The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiatin...
F3
Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement.
Response: Disagree Partially
Score: 0
We agree with the finding. F4. Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security. Response: We agree with the finding. FS. Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin. Response: We agree with the finding. F6. The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiatin...
F4
Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security.
Response: Disagree Partially
Score: 0
We agree with the finding. FS. Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin. Response: We agree with the finding. F6. The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties). Response: We partially disagree with this finding. It is not within the Town of Ross's realm of responsibility to agree or disagree with this finding. The County's collective bargaining...
F5
Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin.
Response: Disagree Partially
Score: 0
Agree with the findings numbered: _ F1-F5 = Disagree partially with the findings numbered: F6 *_ Disagree wholly with the findings numbered: __ _ --- - - S000 © oo (Attach a statement specifying any portions of the findings that are disputed; include an explanation of the reasons therefor.
F6
The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties).
Response: Disagree Partially
Score: 0
Agree with the findings numbered: _ F1-F5 = Disagree partially with the findings numbered: F6 *_ Disagree wholly with the findings numbered: __ _ --- - - S000 © oo (Attach a statement specifying any portions of the findings that are disputed; include an explanation of the reasons therefor.
R6
All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year.
Response: Will Implement
Score: +1
R6 have not yet been implemented, but will be implemented in the future.
▶
Town of San Anselmo[PDF]
August 05, 2024
•
4 pages
• 8 responses
•
Score: +2
(+2, 6, 0)
View Details ▾
8 responses to findings and recommendations
F1
Contracts for Information Technology, Information Systems, and Cybersecurity services between third-party providers and Marin County governmental agencies should contain a Business Continuity clause, or other language, protecting that agency from a sudden cessation of services provided by the third-party provider.
Response: Disagree Partially
Score: 0
Agree. F2. Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers' services without a current contract. Response: Agree. F3. Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement. Response: Agree. F4. Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a governm...
R1
Marin agencies should require a current (executed within the last five years), competitively-bid, written contract which includes business continuity language for any third-party Information Technology services they use.
Response: Will Implement
Score: +1
This recommendation has not yet been implemented, but will be implemented by the start of the 2025-2026 fiscal year. R6. All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year. Response: This recommendation has not yet been implemented, but will be implemented by the start of the 2025-2026 fiscal year.
F2
Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers’ services without a current contract.
Response: Disagree Partially
Score: 0
Agree. F3. Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement. Response: Agree. F4. Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security. Response: Agree. F5. Joint Powers Authorities in Marin County exist to provide more efficient and costeffective services to the people of Marin. Response: Agree. F6. The current C...
F3
Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement.
Response: Disagree Partially
Score: 0
Agree. F4. Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security. Response: Agree. F5. Joint Powers Authorities in Marin County exist to provide more efficient and costeffective services to the people of Marin. Response: Agree. F6. The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parti...
F4
Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security.
Response: Disagree Partially
Score: 0
Agree. F5. Joint Powers Authorities in Marin County exist to provide more efficient and costeffective services to the people of Marin. Response: Agree. F6. The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties). Response: Partially Disagree The Town is not informed regarding the Marin County Bargaining Agreements' implications on the Department of Information Systems and Technology and there refrains from endorsing this finding. We di...
F5
Joint Powers Authorities in Marin County exist to provide more efficient and cost-effective services to the people of Marin.
Response: Disagree Partially
Score: 0
Agree with the findings numbered: _Fl-F5 Disagree partially with the findings numbered: F6 Disagree wholly with the findings numbered: (Attach a statement specifying any portions of the findings that are disputed; include an explanation of the reasons therefor.
F6
The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties).
Response: Disagree Partially
Score: 0
Agree with the findings numbered: _Fl-F5 Disagree partially with the findings numbered: F6 Disagree wholly with the findings numbered: (Attach a statement specifying any portions of the findings that are disputed; include an explanation of the reasons therefor.
R6
All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year.
Response: Will Implement
Score: +1
R6(a) & (b) have not yet been implemented, but will be implemented in the future.