HAS NOT YET Been Implemented but Will BE in the Future –

Funds are focused on improving conditions of well-being for community members experiencing the greatest challenges and barriers in the County.

A hybrid approach is administered to support both broad-based service programs and smaller “Targeted Impact” models.

There is good diversity of eligible applicants: Non-profit 501(c)(3) agencies, federally recognized tribal entities, and public education agencies.

The program is well coordinated, with County and City staff partnering to review and award for all tiers. The City focused their funding on programs serving primarily City residents.

A clear outline of the RFP is available to the applicants, with an understanding of the awards process and the tier level they fall under.

The County and City provides a comprehensive review of the process which allows the applicants an opportunity to ask questions of clarity if needed. Commendations C1. The CORE program is commended for being unbiased. Applicants for Small, Medium, and Large tiers are asked to select an “equity dimension” (i.e., race, ethnicity, age, gender, sexual orientation, etc.) that best describes how equity is defined in the proposed project or program. Since the Targeted Impact tier is focused on racial equity, a question is included in that specific application on any additional equity dimensions the proposal will address. It is not required to focus on an additional dimension, and it will not be scored. This aspect provides a very even playing field for all applicants applying and there is no room for any bias in the process. C2. The CORE program is commended for accommodating applicants of diverse size equitably. All applicants are encouraged to be as specific as possible when articulating their activities, populations served, and program outcomes. Details on activities (strategies) are relevant in the Small tier while higher tier applications are to emphasize outcomes. This allows inclusion no matter what size your organization and focuses on the central objective of helping the broader community with the most impactful services. C3. Since funding is awarded at the same amount for each year of the 3-year grant term, applicants are able to consider how this may impact the services throughout the 3-year term. CORE does a good job of ensuring that the services being funded remain intact and the impacted communities receive the needed support throughout the duration of the funded programs. We could not find any evidence of mishandling of the funds or programs being removed within this 3-year period. CORE published May 18, 2023 2022-2023 Consolidated Final Report with Responses 7 Invited Responses Respond Within/ Respondent Findings Recommendations Respond By Director of Human Services 90 Days

The City of Santa Cruz does not have a Cybersecurity Policy, suggesting that preparations to mitigate a cyber attack are inadequate and not widely shared.

The City of Santa Cruz does not have an Incident Response Plan, and this absence indicates that the City will be challenged in responding to a cyber attack, especially a ransomware attack.

Santa Cruz participates in some information sharing organizations such as the California Municipal Information Services Association (MISAC), yet it has minimal collaboration within the county and the other cities, forfeiting opportunities to share best practices and understand threats.

After recently expanding its IT Department, the City of Watsonville has improved its IT functions although it does not yet allocate sufficient resources to cybersecurity.

The City does not have an individual whose primary responsibility is cybersecurity for the city networks, leaving cybersecurity oversight to the IT Director–along with a multitude of other IT responsibilities–and lowering the priority for cybersecurity measures.

Watsonville does not have a Cybersecurity Plan that defines security policies, procedures, and controls required to protect its networks and devices, a situation that increases the risks of vulnerabilities.

Watsonville does not have an Incident Response Plan that provides detailed information on how to respond to an attack, suggesting the City would not be able to respond rapidly and effectively to a cyber attack.

Watsonville participates in some regional information sharing forums, but it does not have the resources to expand its participation or tap into state-level information sharing, thus forfeiting valuable best practices and cyber threat information.

Although Scotts Valley’s managed service provider is very knowledgeable and capable of providing cybersecurity services, there is no single city official with cybersecurity oversight, potentially leading to a poor understanding of the threats and an inadequate response to a cyber attack.

Scotts Valley does not have a current Cybersecurity Plan that defines security policies, procedures, and controls required to protect its networks and devices, potentially increasing the risks of vulnerabilities.

Scotts Valley does not have a current Incident Response Plan, which could exacerbate the effects of a cyber incident such as increase the time a network is unavailable or raise the potential financial costs of a resolution.

Scotts Valley does not participate in any cybersecurity information sharing groups to enhance best practices, rather they depend on their contractor to stay informed, which makes the City last to know of critical cyber threats.

With one individual responsible for IT services, Capitola does not allocate sufficient resources to cybersecurity, a status that could lead to poor cyber knowledge and unnecessary vulnerabilities.

The City of Capitola does not have a robust cybersecurity training program, nor does it conduct phishing tests or routinely remind employees to adhere to cybersecurity measures during potential periods of increased threats. Cyber Threat Preparedness published May 18, 2023 2022-2023 Consolidated Final Report with Responses 45

The City of Capitola does not have a Cybersecurity Plan to address cybersecurity measures city wide, suggesting the city is not adequately mitigating the potential impact of cyber incidents.

The City of Capitola does not have an Incident Response Plan, which could exacerbate the effects of a cyber incident such as increase the time a network is unavailable or raise the potential financial costs of a resolution.

Capitola does not participate in any cyber-focused information sharing groups, nor does it take advantage of state and federal resources designed to assist small cities with mitigating cyber attacks, thereby forfeiting opportunities to learn best practices and raise their cyber awareness.