Response to Grand Jury Report Form Report Title: Cyberattacks: a Growing Threat to Marin Government Report Date: May

Transparency is lacking regarding cybersecurity because past breaches have not been publicly disclosed, and city and town councils have not facilitated public discussion of cybersecurity issues. Response: Disagree The Sausalito City Council has and continues to support, through its annual budget and managed IT services that address cybersecurity measures. In particular and as referenced in the Report on , in January 2018, when Sausalito was the victim of a phishing attack in which a fake emails, purporting to be from the City Manager, was sent to a city employee, the city employee provided confidential tax filing information of all city employees and councilmembers. The City began to initiate procedures to notify both the FBI and the victims of the breach. As also referenced in the Report on , Sausalito informed the persons whose information was compromised, provided identity theft protection resources to all employees, held a City Council discussion on cybersecurity on November 27, 2018 whereby the City’s cybersecurity consultant, Maze and Associates, provided a presentation to the public (refer to Agenda Item 1.A of that can be found at the following link: https://docs.google.com/gview?url=https%3A%2F%2Fgranicus_production_attachments.s3.amazonaws .com%2Fsausalito%2Fca54136fa4c860d8348f5eaeff9f882a0.pdf&embedded=tru), and implemented a number of measures to strengthen its security, including mandatory training, technology for flagging external emails, and on-going monitoring of its system by a cybersecurity consultant.

Most elected officials in Marin’s cities and towns are not sufficiently engaged in ensuring robust cybersecurity policies and procedures are in place. Response: Disagree As referenced in the Report, Sausalito has regularly made the maintenance and upgrade of cybersecurity practices a part of the City’s annual goals and objectives. Over the past several years, the City Council and City Staff have receive periodic updates on the status of the City’s cybersecurity programs.

County and municipal officials and managers have been generally unaware of breaches that have occurred outside their own agencies in Marin and therefore have not felt the need to collaborate on measures to improve cybersecurity. Response: Disagree partially 2 DocuSign Envelope ID: 24093189-E009-4432-9A71-13D2E6FA4E7E The City of Sausalito has not consistently been made aware of breaches outside of our agency, however issues of cybersecurity have been discussed by the Marin Managers Association.

Municipalities have been lax in following FBI guidance that cybersecurity breaches be reported to federal law enforcement. Response: Disagree The City of Sausalito maintains Department of Justice compliant network connectivity to serve our Police Department and have a process for reporting breaches to federal authorities.

Marin’s cities and towns have not made a concerted effort to standardize around a common set of best practices with respect to cybersecurity. Response: Agree The City of Sausalito agrees that more can be done to share cybersecurity best practices. While the strategy and approach to cybersecurity in Marin cities and towns have not been standardized amongst all jurisdictions, most of the cities and towns utilizing the MIDAS network share the network security protocols in place for MIDAS and a number of cities and towns have relied on a common service provider to implement local network security solutions through Marin IT.

The Marin County Council of Mayors & Councilmembers has not made cybersecurity a priority, which has minimized the awareness and engagement of elected officials in cybersecurity matters. Response: Disagree partially While the Marin County Council of Mayors & Councilmembers have not made cybersecurity a focus over other pressing regional issues, the Sausalito City Council has made cybersecurity a priority. Since Sausalito’s phishing breach, the City Manager and councilmembers have been briefed on the status of our security program, long-term projects, and actions-to-date related to the security of the City’s network.

The Marin Managers Association has not done enough to facilitate the sharing of cybersecurity information and resources among its members. Response: Disagree 3 DocuSign Envelope ID: 24093189-E009-4432-9A71-13D2E6FA4E7E In 2019, the City of San Rafael made a presentation to the Marin Managers Association about a recent overhaul of our IT service delivery model (including cybersecurity). The San Rafael presentation included a consultant that was hired to conduct an assessment of San Rafael’s service model and the president of the company who manages our cybersecurity.

Various low-cost best practices exist that could, if implemented, significantly improve the cybersecurity posture of Marin’s cities and towns. Agree.