Grand Jury Attn: Civil Grand Jury Response (Cyber Threat Preparedness) Emeline Nguyen Tue, Aug 15, 2023 at 5:08 Pm

The City of Santa Cruz seems to have an adequate IT Department structure; however, in late 2022, 40 percent of its positions remained vacant, leaving them inadequately staffed to mitigate and respond to cyber attacks. X AGREE __ PARTIALLY DISAGREE __ DISAGREE Response explanation (required for a response other than Agree):

Inadequate staffing and high attrition has led to overworked staff and raises the risk of cyber vulnerabilities across its networks. X AGREE __ PARTIALLY DISAGREE __ DISAGREE Response explanation (required for a response other than Agree):

The City does not have an individual dedicated as the lead for cyber security, which could lead to inadequate preparation for and response to a cyber attack. X AGREE __ PARTIALLY DISAGREE __ DISAGREE Response explanation (required for a response other than Agree):

The City of Santa Cruz does not have a Cybersecurity Policy, suggesting that preparations to mitigate a cyber attack are inadequate and not widely shared. X AGREE __ PARTIALLY DISAGREE __ DISAGREE Response explanation (required for a response other than Agree):

The City of Santa Cruz does not have an Incident Response Plan, and this absence indicates that the City will be challenged in responding to a cyber attack, especially a ransomware attack. X AGREE __ PARTIALLY DISAGREE __ DISAGREE Response explanation (required for a response other than Agree):

Santa Cruz participates in some information sharing organizations such as the California Municipal Information Services Association (MISAC), yet it has minimal collaboration within the county and the other cities, forfeiting opportunities to share best practices and understand threats. X AGREE __ PARTIALLY DISAGREE __ DISAGREE Response explanation (required for a response other than Agree):