Title
Information Technologies Department recommending the Board approve revisions to Board Policy A-17 - Data Center and Network Systems Physical Security, including the title change to Board Policy M-3 Physical Security.
FUNDING: N/A
Body
DISCUSSION / BACKGROUND
Information Technologies (IT) Department is recommending that the Board of Supervisors approve revisions to Board Policy A-17 - Data Center and Network Systems Physical Security, including the title change to Board Policy M-3 Physical Security.
This policy establishes physical access controls that ensure County information technology resources are protected by physical security measures that prevent physical tampering, damage, theft, or unauthorized access, and to develop, document, and implement comprehensive physical and environmental protection controls aligned with the National Institute of Standards and Technology (NIST) Security and Privacy Controls for Information Systems and Organizations Publication 800-53, Revision 5.
The proposed revisions update the Policy for Countywide Physical Access Control Systems, Monitoring, and Determinations. The proposed revisions also update provisions for Visitors, the Data Center, Non-Digital Media, and Video Surveillance Systems. The revisions also remove the detailed Procedures from the Policy and establishes the IT Department maintained technology-specific Physical Security and Access Controls Procedures document and change management process. Moving forward, all IT-related policies will be transitioned into the "M" policy category.
ALTERNATIVES
The Board could choose not to approve the changes or could request further edits to the Policy.
PRIOR BOARD ACTION
Legistar file 17-1345 - January 9, 2018 - The Board made changes to Board Policy A-17 - Data Center and Network Systems Physical Security.
Legistar file 22-1485 - September 13, 2022 - The Board made changes to Board Policy A-17 - Data Center and Network Systems Physical Security.
OTHER DEPARTMENT / AGENCY INVOLVEMENT
All Departments had the opportunity to review the proposed changes.
CAO RECOMMENDATION / COMMENTS
Approve as recommended.
FINANCIAL IMPACT
There is no direct financial impact to updating this Policy. Indirectly, the proposed Policy should assist in minimizing the County's Liability.
CLERK OF THE BOARD FOLLOW UP ACTIONS
Update the Board Policy Manual with the revised M-3 policy document.
STRATEGIC PLAN COMPONENT
N/A
CONTACT
Amanda Earnshaw, Chief Information Officer