9-2 Information Technology Use and Security Policy Manual - Chapter II: Roles and Responsibilities

Return to IT Use and Security Policy Manual Table of Contents

Approved by: Board of Supervisors of the County of Sonoma (“County”), and the Boards of Directors of the Northern Sonoma County Air Pollution Control District, the Russian River County Sanitation District, Sonoma Valley County Sanitation District, Occidental County Sanitation District, South Park County Sanitation District, and the Board of Directors of the Sonoma County Agricultural Preservation and Open Space District (collectively referred to hereinafter as “Special Districts”), and the Sonoma County Water Agency (“Agency”), and the Board of Commissioners of the Sonoma County Community Development Commission (“Commission”). The County, Special Districts, Agency and Commission are collectively referred to herein as “Local Agencies” or singularly as “Local Agency.”

Read next: III. Information Technology and Security Governance Policy

What's on this Page

1. Users
2. Local Agency Department Head/General Manager
3. Information Security Representative
4. Local Information Services Providers
5. Chief Information Security Officer 
6. Information Security Steering Committee
7. HIPAA County Privacy Officer
8. Data Owner
9. Data Steward
10. Data Custodian

Users are all workforce members (employees or any other individual performing work on behalf of, or with approval of Local Agencies) authorized to access Local Agency IT resources and are responsible for:

1. Users are all workforce members (employees or any other individual performing work on behalf of, or with approval of Local Agencies) authorized to access Local Agency IT resources and are responsible for:
2. Complying with County Information Technology and Security policies;
3. Maintaining the security of Local Agency IT resources and data associated with their role(s) as defined in this Policy manual;
4. Storing original Local Agency data on the Local Agency network to ensure compliance with County or Local Agency records retention policy, 
5. Protecting Sensitive information against loss, unauthorized use, access, or disclosure, by the following:
   1. Using Sensitive information only for the stated legal and/or business purpose.
   2. Disclosing Sensitive information as permitted by law or with the express consent of the Data Owner.
   3. Not making copies of Sensitive information except as required in the performance of assigned duties.
   4. Keeping Sensitive information out of plain sight.
6. Not sharing User accounts and passwords;
7. Creating, changing and storing passwords in accordance with established policies and standards;
8. Locking or logging off unattended workstations.
9. Using only assigned Local Agency electronic messaging accounts, i.e., e-mail, to conduct Local Agency business communication, and refraining from conducting Local Agency business with personal electronic messaging accounts (e.g., Yahoo, Gmail).  Law enforcement and/or other Local Agency workforce may be exempted from these restrictions during the performance of legitimate job responsibilities;
10. Not violating copyright law, and conforming to software licensing restrictions by:
11. Only using software that has been installed by their Local Information Service Provider or other authorized individual.
12. Not engaging in any use of Local Agency IT resources that violates federal, state, local laws, Local Agency or County policy;
13. Reporting any known or suspected information security incident to their manager/supervisor, Information Security Representative or Local Information Service Provider;
14. Compliance with VII. Mobile Computing Policy if using a mobile device to work on or access Local Agency IT resources or data.

Back to top

Local Agency Department Head/General Manager and/or Designee are responsible for:

1. Enforcing this Policy manual within their Local Agency;
2. Ensuring all Users of Local Agency IT resources and data are made aware of County information technology and security policies and that compliance is mandatory;
3. Ensuring all Users receive education regarding their security responsibilities before accessing Local Agency IT resources and data;
4. Establishing supplemental information technology and security policies, standards, procedures, or guidelines as needed for their business purposes, provided they are not less restrictive than County policies. Prior to final approval Local Agency Department Head/General Manager and/or Designee are responsible for:
   1. Providing supplements to Human Resources for review.
   2. Providing notice to employee organizations regarding any proposed supplements; and
   3. Providing supplements to Local Agency’s Local Information Service Provider to review for consistency with County/Local Agency IT security policies.
5. Provide training in support of established procedures and guidelines
6. Obtaining a signed acknowledgment from Users that they have had an opportunity to read and will comply with this Policy manual before accessing Local Agency IT resources and data; 
7. Designating or serving as an information security representative; and
8. Submitting to the ISSC any needed requests for exceptions to this Policy manual. 

Back to top

The Information Security Representative is designated by the Local Agency Department Head/General Manager to coordinate information security within their Local Agency and is responsible for:

1. Assisting in the development of any Local Agency information technology and security policy;
2. Reviewing Local Agency information technology and security policies for compliance with County policies;
3. Representing the Local Agency’s information security concerns countywide.

Back to top

The County Information Systems Department, the Human Services Department Information Integration Division, the Sonoma County Sheriff's Office Technical Services Bureau, and the County Water Agency Computer Application and Instrumentation Support Section serve as Local Information Service Providers and are responsible for:

1. Providing network infrastructure, network access, data storage and e-mail services to Local Agencies;
2. Maintaining an inventory of Local Agency IT resources;
3. Configuring Local Agency IT resources in accordance with County information technology and security policies and standards;
4. Implementing and maintaining technology-based services that adhere to the intent and purpose of information technology and security policies, standards and guidelines; 
5. Investigation, remediation, and documentation of information security incidents; and
6. Establishing and implementing standards, procedures and guidelines as needed for this Policy manual.

Back to top

The County Information Systems Director serves as the Chief Information Security Officer and is responsible for:

1. Overseeing and managing the County Information Technology and Security Program, this includes;
   1. Developing and maintaining the County information security strategy;
   2. Providing information security related technical, regulatory and policy leadership;
   3. Facilitating the implementation of County information technology and security policies; and
   4. Approving or denying policy waivers.

Back to top

The Information Security Steering Committee (ISSC) is the coordinating body for all County information security-related activities and is composed of the County Privacy Officer, Information Security Officer, and individuals designated by the IT Governance Council. The Information Security Steering Committee is responsible for:

1. Developing and proposing County information technology and security policies, standards, and guidelines;
2. Reviewing County information technology security policies annually and policy waivers.
3. Reviewing Local Agency policy exception requests and making recommendations for CISO approval or denial;
4. Maintaining documentation of policy waivers;
5. As requested, reviewing Local Agency information technology and security policies for compliance with County policies; and 
6. Identifying and recommending industry best practices for information security.

Back to top

The HIPAA County Privacy Officer is responsible for:

1. Making required publication, consumer notice and regulatory filing, in response to data breaches involving Electronic Protected Health Information (ePHI) and/or personal information.

Back to top

The Data Owner is the Local Agency Department Head/General Manager or other individual authorized by law, regulation or policy to collect and manage the data that supports their business operations and is responsible for:

1. Identifying applicable law, regulations, or standards that contain information security requirements for the data they own;
2. Classification of Local Agency data and IT resources they own based upon law, regulation, common business practice, liability or reputational factors;
3. Establishing as needed, Local Agency policies and procedures for the data and IT resources they own;
4. Responsible for ensuring mitigation of known or suspected information security incidents, and notification to individuals or agencies in the event of a data breach involving unencrypted personal information; and
5. Designating or serving as the Data Steward.

Back to top

The Data Steward is designated by the Data Owner to protect the confidentiality, integrity, and availability of the data that supports their business operations and is responsible for:

1. Assisting the Data Owner in the classification of Local Agency data;
2. Implementing protection requirements for the data and IT resources entrusted to their stewardship; and
3. Authorizing access to Local Agency data in accordance with the classification of the data.

Back to top

The Local Information Service Provider serves as the Data Custodian and is responsible for:

1. Implementing the necessary safeguards to protect Local Agency data and IT resources at the level classified by the Data Owner or the Data Steward;
2. Granting access privileges as authorized by the Data Owner or Data Steward;
3. Complying with any additional security policies and procedures established by the Data Owner and/or Data Steward;
4. Advising the Data Owner and/or Data Steward of vulnerabilities that may present a threat to their Local Agency data and of specific means of protecting that data; and
5. Notifying the Data Owner of any known or suspected information security incident.

Back to top