Town of Fairfax[PDF]*

R4

Starting in fiscal year 2020–2021, the county board of supervisors and the city and town councils should request their managers report, at least annually, regarding their cybersecurity profile and any measures being taken to improve it. Response: This recommendation will be implemented in the future.

R5

Starting in fiscal year 2020–2021, the county, cities, and towns should convene periodic discussions, at least annually, in a public forum such as a board or council meeting, regarding the importance of good cybersecurity practices for our government, residents, and other organizations. Response: This recommendation will be implemented in the future. Starting in October 2020, the County of Marin will host an NCSAM event that is open to members of the public to facilitate a discussion on cybersecurity. As a member of the recently formed Marin Information Security Collaboration (MISC), Fairfax will help promote this event to our residents and organizations.

R6

The county and each city and town should adopt a policy to report to federal law enforcement any cybersecurity intrusion that results in financial fraud or unauthorized disclosure of information and make that intrusion public. Response: This recommendation will be implemented in the future. The Town of Fairfax has not had any recent cybersecurity breaches, financial fraud, or unauthorized disclosure of information that have required the reporting to federal law enforcement. If the Town were to become victim to any of the above attacks staff would work closely with all law enforcement personnel, including federal law enforcement, as required to properly respond to the threat. The County of Marin has access to existing security policy templates that have been developed in collaboration with the California Counties Information Services Director's Association (CCISDA) Information Security Council (ISC). These templates will be shared with the members of the recently formed Marin Information Security Collaboration (MISC) and will be considered for updates to the Town's own security policies.

R7

of the date of this report, cities and towns should implement the first four practices described in the Best Practices section of this report, regarding mandatory user training, email flagging and filtering, password management, and backup. Response: These recommendations have been implemented: daily backup, some password management practices, and filtering. These recommendations to be implemented in the future: Email flagging, additional password management, and employee training. Staff agrees that implementation of the first four practices listed are measures that would strengthen security, and the Town has conducted daily backups with regular testing and filtering for years. Also, some aspects of the best practices for password management has been implemented for years such as requiring passwords to be changed every 90 days. For the other recommendations to be implemented, staff will determine the time and cost to do so. However, given our limited resources, it is likely the Town will need more than 180 days to implement all these best practices.

R8

In fiscal year 2020–2021, cities and towns should complete an analysis of the feasibility of implementing the remainder of the practices described in the Best Practices section of this report. These recommendations have been implemented: Automated malware detection and removal, monitoring systems. These recommendations have been partially implemented: Use of expert resources, firewalls, hardware and patching. These recommendations require further analysis: Management of mobile devices, documentation, vulnerability assessments. Staff will need to further study this recommendation to determine if resources can be allocated to complete these tasks in Fiscal Year 2020-21.

R9

In fiscal year 2020–2021, cities and towns should, through the Marin Managers Association, complete an analysis of the feasibility of contracting with a cybersecurity expert to be available to cities and towns on a shared basis, in order to raise the overall level of cybersecurity in Marin's cities and towns. Response: This recommendation has not yet been implemented but will be implemented in the future. The Fairfax Town Manager will work with the Marin Managers Association to add the consideration of hiring a cybersecurity firm to the list of potential shared services that is currently in development.