Cyber Preparedness: Are We There Yet?*

Contracts for Information Technology, Information Systems, and Cybersecurity services between third-party providers and Marin County governmental agencies should contain a Business Continuity clause, or other language, protecting that agency from a sudden cessation of services provided by the third-party provider. Response: Agree. The City of Novato does not utilize a third-party managed service provider for maintenance and support of critical services. Consulting is utilized where applicable, however consultants are not responsible for maintaining required City of Novato services. The City does maintain a contract and service level agreements for additional Cybersecurity assistance where applicable.

Marin County municipalities should have current, written contracts with third- party providers of Information Technology, Information Systems, and Cybersecurity services, and should not continue to use those providers' services without a current 13 contract. Response: Agree. The City relies upon IT services to maintain daily operation and business continuity throughout the City. Contracts are critical to minimize risks and liabilities in utilities and service providers. As noted in Finding 1, the City maintains the critical infrastructure in- house and does not utilize third party managed services. Where consultants are needed, contracts are in place.

Membership in insurance risk pools provides the benefits of cybersecurity assessments and audits, which highlight cybersecurity deficiencies and make suggestions for improvement. Response: Agree. A potential cybersecurity attack could cost a municipality millions of dollars to remediate. Insurance risk pools help to mitigate the overall potential cost impact on a City to recover from an attack. The City participates in California Joint Powers Risk Management Association (CJPRMA) and cyber insurance coverage is a part of this membership.

Having a completed, adopted and regularly updated cybersecurity plan helps ensure that all staff within a government agency are working together to optimize that organization's cyber preparedness and security. Response: Agree. Cybersecurity is part of the core service managed by the City's staff who monitors and responds to threats, provides network backups, and manages cybersecurity training. Staff is required to participate in annual security training including email updates on current threats, phishing simulations, and regular password changes. The City conducts an internal annual audit to ensure industry best practices have been implemented, and continues to add additional-layers of security as they are available

Joint Powers Authorities in Marin County exist to provide more efficient and cost- effective services to the people of Marin. Response: Agree. When available, JPA's may be a good way to provide more efficient and cost-effective services to the people of Marin.

The current County Collective Bargaining Agreements prevent the Marin County Department of Information Systems & Technology from unilaterally negotiating managed service agreements (outsourcing work to third parties). Response: Disagree wholly with the finding. It is not within the City of Novato's realm of responsibility to make a determination about the County's practices and limitations related to this finding. The County's collective bargaining agreements are the responsibility of the County of Marin. RECOMENDATIONS The Grand Jury requested that the City respond to report recommendations R1, R6 (a), and