Response to Grand Jury Report Form Report Title: Cyberattacks: a Growing Threat to Marin Government Report Date: May*

R4

town councils should request their managers report, at least annually, regarding their cybersecurity profile and any measures being taken to improve it. Response: This recommendation has been implemented. Historically, the City of San Rafael's Information Technology Division, now the Digital Service and Open Government Department, has provided periodic reports to the City Manager and the Mayor on current cybersecurity risk and threat assessments and actions underway by City staff to combat these threats. City staff will continue to provide these reports at the request of the Mayor and City Manager on a periodic basis.

R5

Starting in fiscal year 2020–2021, the county, cities, and towns should convene periodic discussions, at least annually, in a public forum such as a board or council meeting, regarding the importance of good cybersecurity practices for our government, residents, and other organizations. Response: This recommendation has not yet been implemented, but will be implemented in the future. City of San Rafael employees, elected officials, and anyone with access to the City network are required to participate in regular cybersecurity training and receive email updates to current and trending security threats. The City periodically sends out public communications about known scams and prevention measures. The City will continue to explore additional means for educating the public about cybersecurity and work with the County of Marin to promote countywide public awareness campaigns. The county and each city and town should adopt a policy to report to federal law

R6

enforcement any cybersecurity intrusion that results in financial fraud or unauthorized disclosure of information and make that intrusion public. Response: This recommendation has not yet been implemented, but will be implemented in the future. The City of San Rafael has not had any recent cybersecurity breaches, financial fraud, or unauthorized disclosure of information that have required the reporting to federal law enforcement. If the City of San Rafael were to become victim to any of the above attacks staff would work closely with all law enforcement personnel, including federal law enforcement, as required to properly respond to the threat. While we have a process for reporting breaches, we will develop a policy consistent with the above recommendation. The County of Marin has access to existing security policy templates that have been developed in collaboration with the California Counties Information Services Director's Association (CCISDA) Information Security Council (ISC). These templates will be shared with the members of the recently formed Marin Information Security Collaboration (MISC) and will be considered for updates to the City of San Rafael's own security policies.

R7

of the date of this report, cities and towns should implement the first four practices described in the Best Practices section of this report, regarding mandatory user training, email flagging and filtering, password management, and backup. Response: This recommendation has been implemented. The City of San Rafael currently follows the first four practices described in this report. Network security is currently managed by the City's managed service provider, Xantrion Inc., who monitors and responds to threats, provides network backups, and manages cybersecurity training. Staff is required to participate in annual security training including email updates on current threats, phishing simulations, regular password changes. We also have measures in place for email flagging, spam filtering, and regular backups of City files and servers. Mobile device management has been implemented in our Police Department and we are currently working to expand mobile device security and management throughout the organization. We have started requiring multi-factor authentication for City staff who have access to City networks and documents, and plan to have this rolled out to all users by the end of the summer.

R8

In fiscal year 2020–2021, cities and towns should complete an analysis of the feasibility of implementing the remainder of the practices described in the Best Practices section of this report. Response: This recommendation has been implemented. The City of San Rafael is committed to protecting information and data from external threats. We have conducted a security analysis of the City of San Rafael network and systems and our Managed Service Provider Xantrion is working to implement recommendations on an ongoing basis. Some measures require more funding than is currently available however we are committed to implementing as many of the best practices as is financially feasible.

R9

In fiscal year 2020–2021, cities and towns should, through the Marin Managers Association, complete an analysis of the feasibility of contracting with a cybersecurity expert to be available to cities and towns on a shared basis, in order to raise the overall level of cybersecurity in Marin's cities and towns. Response: This recommendation has not yet been implemented, but will be implemented in the future. The City of San Rafael currently contracts with cybersecurity experts who assist in the management of training, backup, and response. The City Manager will work with the Marin Managers Association to discuss shared resources and recommendations based on the success of our program and the consideration of shared cybersecurity services. 2020 JUL 20 P 4: 02 CONNSERS OFFICE YTNUOO NIRAM