Santa Barbara, Ca*

R1

That each public entity within Santa Barbara County designate an individual to be accountable and responsible to oversee cyber security. City of Santa Barbara Response Agree: this recommendation has been implemented. Since 2014, the City’s Infrastructure Supervisor has been the primary individual responsible to oversee cyber security.

R2

That each public entity within Santa Barbara County complete a full inventory of their data, electronic and communication systems and determine the related security risks. City of Santa Barbara Response Disagree Wholly (that this finding applies to the City of Santa Barbara): this recommendation has been partially implemented. State law mandates that all public agencies publish and annually update an Enterprise Systems Catalog on the agency's Please consider the environment before printing this letter. Santa Barbara County Grand Jury and Judge Michael J. Carrozzo City of Santa Barbara Response to Grand Jury Report Titled, Cyber-Attacks Threaten Santa Barbara County June 17, 2020 website. By complying with this mandate, the City does maintain an inventory of its electronic and communication systems pursuant to State law. The City does not however maintain a separate inventory of its data.

R3

That each public entity within Santa Barbara County establish a written cyber security plan. City of Santa Barbara Response Disagree Wholly (that this finding applies to the City of Santa Barbara): this recommendation has been implemented. The City has in place, written Standard Operating Procedures for handling cyber security incidents.

R4

That each public entity within Santa Barbara County take substantial steps to protect data from internal and external attacks or threats. City of Santa Barbara Response Disagree Wholly (that this finding applies to the City of Santa Barbara): this recommendation has been implemented. The City has maintained a robust cybersecurity program for many years through the use of industry-standard firewall(s), and monitoring of the firewall by staff and third parties, staff training on cyber threats, and third-party penetration testing to identify and mitigate potential weaknesses.

R5a

That each public entity within Santa Barbara County install and maintain current antivirus software to detect malware and other threats. City of Santa Barbara Response Agree: this recommendation has been implemented. The City has installed and maintained industry-standard anti-virus/malware software for approximately twenty-five (25) years. Updates and patches are installed regularly. Santa Barbara County Grand Jury and Judge Michael J. Carrozzo City of Santa Barbara Response to Grand Jury Report Titled, Cyber-Attacks Threaten Santa Barbara County June 17, 2020 <b>Recommendation 5b</b> That each public entity within Santa Barbara County install and update all operating software regularly. City of Santa Barbara Response Agree: this recommendation has been implemented. For at least fifteen (15) years, Information Technology staff routinely update and patch all operating system software on a routine basis, generally monthly or quarterly.

R5b

That each public entity within Santa Barbara County install and update all operating software regularly. City of Santa Barbara Response Agree: this recommendation has been implemented. For at least fifteen (15) years, Information Technology staff routinely update and patch all operating system software on a routine basis, generally monthly or quarterly.

R5c

That each public entity within Santa Barbara County periodically train employees and then test their cyber security awareness. City of Santa Barbara Response Agree: this recommendation has been implemented. The City has fully followed this recommendation since 2018 with the implementation of a cybersecurity training program for City staff. Beyond formal training, the City also tests employee knowledge of common cybersecurity threats, such as email phishing schemes and sends the results of these tests to employees to further reinforce best practices.

R5d

That each public entity within Santa Barbara County periodically ensure electronic system-related contractors have been trained for cyber security awareness. City of Santa Barbara Response Agree: This recommendation will be implemented by having vendors certify that they have completed a cyber security awareness program with relevant contractors as part of the vendor account renewal process.

R6a

That each public entity within Santa Barbara County create and implement a full backup and recovery plan. City of Santa Barbara Response Agree: this recommendation has been implemented. The City has followed this recommendation for many years through the use and maintenance of a robust, redundant backup system. Santa Barbara County Grand Jury and Judge Michael J. Carrozzo City of Santa Barbara Response to Grand Jury Report Titled, Cyber-Attacks Threaten Santa Barbara County June 17, 2020

R6b

That each public entity within Santa Barbara County regularly update and test their backup and recovery plan. City of Santa Barbara Response Agree: this recommendation has been implemented. The City routinely evaluates and updates its backup and recovery systems. Moreover, the City employs a multi-layer backup system that essentially provides "back up of backups."

R7

That each public entity within Santa Barbara County secure adequate cyber insurance. City of Santa Barbara Response Disagree Wholly (that this finding applies to the City of Santa Barbara): this recommendation has been implemented. The City has maintained cyber insurance since 2010.

R8

That each public entity within Santa Barbara County that is unable to allocate adequate funds for cyber security develop a cybersecurity working group to establish best practices and share costs for education, expertise, and insurance. City of Santa Barbara Response Disagree Wholly (that this finding applies to the City of Santa Barbara): this recommendation has been implemented. The City allocates funding for cybersecurity infrastructure, monitoring, testing, and employee training in its annual budget. Moreover, the City is a member of the Multi-State Information Sharing and Analysis Center (MS- ISAC) consortium offered to all state, local, and tribal territories by the Cybersecurity and Infrastructure Security Agency (CISA) division of Homeland Security since 2017. Thank you for the opportunity to respond to the Grand Jury report and for your consideration of this response. Santa Barbara County Grand Jury and Judge Michael J. Carrozzo City of Santa Barbara Response to Grand Jury Report Titled, Cyber-Attacks Threaten Santa Barbara County June 17, 2020