9-2 Information Technology Use and Security Policy Manual - Chapter IV: Use of Local Agency IT Resources and Data Policy

Return to IT Use and Security Policy Manual Table of Contents

Approved by: Board of Supervisors of the County of Sonoma (“County”), and the Boards of Directors of the Northern Sonoma County Air Pollution Control District, the Russian River County Sanitation District, Sonoma Valley County Sanitation District, Occidental County Sanitation District, South Park County Sanitation District, and the Board of Directors of the Sonoma County Agricultural Preservation and Open Space District (collectively referred to hereinafter as “Special Districts”), and the Sonoma County Water Agency (“Agency”), and the Board of Commissioners of the Sonoma County Community Development Commission (“Commission”). The County, Special Districts, Agency and Commission are collectively referred to herein as “Local Agencies” or singularly as “Local Agency.”

Read next: V. Data Classification Policy

What's on this Page

This Policy establishes acceptable use of Local Agency Information Technology (IT) resources and data.

1. General Use and Ownership
2. IT Resource Monitoring
3. User Access Monitoring
4. No Expectation of Privacy
5. Public Records Act Compliance and Records Retention
6. Use of Sensitive Information
7. User Accounts and Passwords
8. Use of Electronic Messaging
9. Use of the Internet
10. Personal Use/Union Use
11. Use of Authorized Software
12. Use of Authorized Devices
13. Unacceptable Use

A. General Use and Ownership

1. Access to Local Agency IT resources may be provided for conducting Local Agency business. Access may be wholly or partially restricted without prior notice or consent of the User.
2. The Data Owner retains the rights of ownership to all data created on IT resources, unless the legal ownership is otherwise defined by law.
3. Local Agency IT resources and data are to be used for conducting business authorized by and related to Local Agency operations.
4. Local Agency data must only be used for authorized purposes and must not be disclosed to anyone not authorized to receive such data.
5. All Users of Local Agency IT resources and data must sign an acknowledgment of this Policy manual prior to being granted access.

Back to top

B. IT Resource Monitoring

1. Data Owners and/or Data Stewards with express consent of the Data Owner may monitor any and all aspects of Local Agency data access and use.
2. Local Information Services Providers may monitor and log all activities on the IT resources they own, control or manage for security, network maintenance, and/or policy compliance.

Back to top

C. User Access Monitoring

1. Monitoring or investigating User access to Local Agency IT resources and data must be approved by the Data Owner, Data Steward or designee.
2. County Counsel approval with the express consent of the Data Owner is required for monitoring of User’s work generated data files, Internet access logs, or electronic messaging (e.g., e-mail, and instant messaging).
3. Upon request by the Data Owner, Data Steward or designee, Local Information Service Providers may monitor or investigate User access to Local Agency IT resources and data, without advance notice to the User.

Back to top

No Expectation of Privacy

Users have no expectation of privacy when using Local Agency IT resources, or in any data they access, create, store, send or receive on any Local Agency IT resources.

Back to top

E. Public Records Act Compliance and Records Retention

1. Any records created while conducting Local Agency business using Local Agency IT resources, including personal and county provided mobile devices, may be subject to disclosure.
2. To ensure compliance with County or Local Agency records retention policy, original Local Agency data must be stored on the Local Agency network.

Back to top

F. Use of Sensitive Information

Sensitive information as defined in this Policy manual is information classified as either:

• Confidential - Information protected from use and/or disclosure by law, regulation or standard, and for which the highest level of security measures, or
• Restricted - Information that requires special precautions to protect from unauthorized use, access, or disclosure.

To protect Sensitive information against loss, unauthorized use, access, or disclosure the following must be adhered to:

1. Sensitive information must only be used or disclosed as permitted by law and/or policy.
2. Sensitive information that is not controlled by law or policy can only be disclosed with express consent of the Data Owner.
3. Copies of Sensitive information must not be made except as required in the performance of assigned duties.
4. Sensitive information must be kept out of plain sight and must not be displayed in any form when it is not being used.
5. Unattended workstations must be locked or have password protected screen savers enabled in accordance with Local Information Service Provider standards.

Back to top

G. User Accounts and Passwords

1. User accounts and User passwords must not be shared.
2. User passwords only be created, changed and stored in accordance with established policies and standards.

Back to top

H. Use of Electronic Messaging

1. Users must only use assigned Local Agency electronic messaging accounts conduct Local Agency business, and are prohibited from conducting Local Agency business using personal electronic messaging services, social media accounts or email accounts (e.g., texting, Twitter, Facebook Messenger, Yahoo, Gmail). Law enforcement and/or other Local Agency workforce may be exempted from these restrictions during the performance of legitimate job responsibilities. 

Back to top

I. Use of the Internet

1. Local Agency IT resources that allow access to the Internet are provided to facilitate the effective and efficient use of Local Agency business. With Local Agency approval, Users are permitted access to the Internet to assist in the performance of their assigned duties, and must comply with all acceptable use described in this Policy and any other Local Agency or County Policy.

Back to top

J. Personal Use/Union Use

Except as otherwise stated, reasonable and limited personal use of Local Agency IT resources or use of Local Agency e-mail between recognized County unions and Local Agency workforce is allowed under the following circumstances:

1. Does not involve unacceptable use as defined in section IV.N of this Policy or in any other County Policy;
2. Does not interfere with Local Agency IT resources and;
3. Does not interfere with the User’s job performance and/or obligations as a public employee.

Back to top

K. Use of Authorized Software

All software installation and use must conform to licensing restrictions. These products include those that are not appropriately licensed for use by the Local Agency or those that violate the rights of any person or organization protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of “pirated” or other software is prohibited.

1. Only software that has been installed by the Local Information Services Provider or other authorized individuals may be used.
2. Software purchased by the Local Agency must not be loaded on a personally owned device, unless specifically authorized by the Local Agency Department Head/General Manager and/or Designee and the manufacturers licensing agreement.

Back to top

L. Use of Authorized Devices

1. To maintain the security of the Local Agency network, only devices authorized by the Local Information Service Provider may be connected. Any device found to be in violation of this Policy is subject to immediate disconnection from the Local Agency network.

Back to top

M. Unacceptable Use

Any use which violates federal, state, local laws, Local Agency or County policies is prohibited. Law enforcement and/or other Local Agency workforce may be exempted from these restrictions during the performance of legitimate job responsibilities. 

The following activities are prohibited on Local Agency IT resources; examples include, but are not limited to:

1. Representing yourself as someone else, real or fictional, or sending information anonymously;
2. Sending messages or accessing data with content that violates any county policies, rules or other applicable laws;
3. Sending messages or accessing data that contain inappropriate, defamatory, obscene, harassing or illegal material;
4. Sending information that violates or unlawfully infringes on the rights of any other person (including but not limited to copyrights and software licenses);
5. Engaging in activity that may harass, threaten or abuse others;
6. Conducting political activity, business for fraudulent activity, personal profit or gain, or other improper activities as defined in Local Agencies Incompatible Activities Policy;
7. Downloading, installing or running security programs or utilities such as password cracking programs, packet sniffer, or port scanners that reveal or exploit weaknesses in the security of Local Agency IT resources;
8. Engaging in activity that may degrade the performance of Local Agency IT resources;
9. Accessing or attempting to access Local Agency IT resources which have not been authorized;
10. Restricting or denying authorized Users access to Local Agency IT resources; and Circumventing Local Agency security measures.

Back to top