Marin County Grand Jury
• 2024-2025
• Agency Response
Response to:
Cyberattacks: A Growing Threat to Marin Government
ITY of Ausalito July 30th, 2024 The Honorable Judge Mark Talamantes Marin County Superior Court
⚠️ Translation Notice: This content has been automatically translated. The original English text is the official version. Translation may contain errors.
⚠️ Este contenido ha sido traducido automáticamente. El texto original en inglés es la versión oficial. La traducción puede contener errores.
Findings and Recommendations 6 findings
F1
Contracts for Information Technology, Information Systems, and Cybersecurity services between third-party providers and Marin County governmental agencies should contain a Business Continuity clause, or other language, protecting that agency from a sudden cessation of services provided by the third-party provider. Response: Agree
Related Recommendations (1)
R1
Marin agencies should require a current (executed within the last five years), competitively-bid, written contract which includes business continuity language for any third-party Information Technology services they use. This recommendation will be implemented. Following the expiration of the previous contract on June 30, 2024, the City of Sausalito contracted a third-party IT service that was competitively bid and included business continuity language in the contract.
F2
Marin County municipalities should have current, written contracts with third-party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers’ services without a current contract. Response: Agree
No recommendations for this finding
F3
Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement. Response: Agree
No recommendations for this finding
F4
Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security. Response: Agree
No recommendations for this finding
F5
Joint Powers Authorities in Marin County exist to provide more efficient and cost- effective services to the people of Marin. Response: Disagree Per California Government Code 6502, joint powers authorities are formed for a variety of purposes and can be formed to exercise any power common to the contracting governmental entities.
No recommendations for this finding
F6
The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties). Response: Disagree. The City of Sausalito has no authority over the County of Marin and has no role in the review and negotiation of the County’s Collective Bargaining Agreements, and such agreements would not affect the City of Sausalito. RESPONSE TO GRAND JURY RECOMMENDATIONS The Marin County Civil Grand Jury recommends the following:
Related Recommendations (1)
R6
All Marin municipalities should: a) take all steps necessary to acquire an appropriate .gov or .ca.gov domain; b) formulate and adopt a plan for rolling out a .gov or .ca.gov website and emails by the start of the 2025-2026 Fiscal Year The recommendation has already been implemented as of July 2017. The City of Sausalito has already implemented the .gov domain and implemented a comprehensive plan to transition its website and email systems to the new domain. The transition enhanced the security and credibility of the City’s online presence.