Grand Jury Revised Board of Supervisors Response to 2022-2023 Grand Jury Report Caitlin Smith Tue, Oct 3, 2023 at

Santa Cruz County does not have a Cybersecurity Plan, and the absence of a current plan that defines security policies, procedures, and controls required to protect its networks and devices increases the risk of vulnerabilities. _x_ AGREE __ PARTIALLY DISAGREE __ DISAGREE Response explanation (required for a response other than Agree): In 2019, the County developed an Incident Response Plan for Cyber events and is working on establishing a more formal Cybersecurity Plan that addresses emerging threats and responses. The County has reached out to the four cities and Santa Cruz Regional 911 (SCR911) to convene a regional Cybersecurity Consortium to take a regional approach to developing Cybersecurity and incident response plans that can be leveraged for the individual needs and requirements of each participating agency. The plans will be completed before or by December 31, 2023 Required Response from the Santa Cruz County Board of Supervisors Cyber Threat Preparedness Due by August 16, 2023

Santa Cruz County does not have a sufficiently detailed Incident Response Plan, indicating they would not be prepared to respond rapidly and effectively in the event of a cyber incident. _x_ AGREE __ PARTIALLY DISAGREE __ DISAGREE Response explanation (required for a response other than Agree): In 2019, the County developed an Incident Response Plan for Cyber events and is working on establishing a more formal Cybersecurity Plan that addresses emerging threats and responses. The County is coordinating with the four cities and SCR911 to develop a regional plan that can be modified for the individual needs and requirements of each entity. The plans will be completed before or by December 31, 2023 Required Response from the Santa Cruz County Board of Supervisors Cyber Threat Preparedness Due by August 16, 2023

Santa Cruz County participates in multiple information sharing groups at regional and state levels, although it has only minimal interaction with the cities across Santa Cruz County, degrading their ability to fully understand regional vulnerabilities. __ AGREE _x_ PARTIALLY DISAGREE __ DISAGREE Response explanation (required for a response other than Agree): The County has reached out in the past to inform cities of Cybersecurity resources, such as the Northern California Regional Intelligence Center and Urban Areas Security Initiative Program. A more formal information sharing has been established through a regional Cybersecurity Consortium to promote and encourage communication and resources. The Consortium began meeting on June 12, 2023. Required Response from the Santa Cruz County Board of Supervisors Cyber Threat Preparedness Due by August 16, 2023