Loading...
155City of Anaheim Administrative Regulation CHAPTER 1 - ADMINISTRATIVE Subject: Information Services Technology A.R. 155 Use Policy Issue Date: September 17, 2003 Revised: March 25, 2009 September 7, 2011 January 11, 2024 Page (1) of (9) Purpose: The purpose of this Administrative Regulation is to: 1) Establish policies and procedures regarding the proper and authorized use of City resources, including but not limited to computers, mobile devices, services, printers, copiers, fax machines, scanners, software, Internet, phone systems, electronic communication systems (including the E-Mail System), and all other technology devices where data is stored ("City Technology"); and 2) Set forth policies for the ownership, retention and destruction of electronic data stored and managed by the City's Technology system, including the electronic mail system. This Regulation is intended to supplement Administrative Regulation 410 (Use of Office Communication), Anaheim Municipal Code Sections 1.10.070 and 1.10.080, relating to Electronic Communications and Computer Data Retention, other City personnel policies and regulations that govern rules of conduct and performance in the workplace, as well as regulations pertaining to public records requests, subpoenas and all other related and applicable City codes, policies, and regulations. Scope: This Regulation applies to all users authorized to use the City's Technology while conducting official City business as regular or temporary users, including, but not limited to, City employees, City officials, consultants, contractors and temporary agency employees (hereinafter referred to as "Technology Users"). Procedures: 1. General Provisions: a. All data and information stored within computer systems, network equipment, hardware, software, temporary or permanent files, electronic mail and electronic documents, and any related technology or devices, described herein, that are stored on any type of media provided by the City are the City's property and shall not be deemed the property of, or confidential, private or proprietary information of any City officer or employee. These further include, but are not limited to, City of Anaheim Administrative Regulation 155 Page (2) of (9) printers, phone systems, electronic communication systems and all other City Technology. b. The City has provided City Technology to allow for efficient communication in the conduct of official City business. All resources provided are to be used for official business functions. It is strictly prohibited to use City Technology for personal use if such use interferes with employee performance; interferes with city business; is illegal, unethical, sexual, or prejudicial in nature; disseminates confidential information to unauthorized third parties; is intended for personal monetary gain or personal political purposes. c. The City has the right to monitor all network traffic on the City network and to modify/or restrict access if necessary. City Technology resources and the contents thereof are subject to inspection, without notice to technology users, to insure that City Technology is being used in a manner that the City deems appropriate. Users cannot expect any degree of privacy in the use of City Technology and any and all information accessed from, stored on, or created by users, is City property. Violation of any portion of this Regulation by any user of the City's Technology system could result in loss of access privileges and disciplinary action, up to and including termination of employment. 2. Computers and Network Use: a. The Information Services Division will coordinate all technology, computer service, equipment, additions, changes, moves, and repairs. Computer accounts will be generated and maintained by the Information Services Division. Department Heads and Division Managers (or equivalent) have the authority to request creation, modification, and deletion of their subordinates' accounts. A Network Access form must be completed and signed for all additions, modifications, and deletions of user accounts. b. Unauthorized access, alteration, deletion, damage, infection, or destruction of any City Technology is prohibited. c. The Information Services Division has established a standard configuration for computer hardware and software. Deviation by users from this standard configuration is prohibited. Changes to the system configuration must be requested from the Information Services Division. d. Games used for services such as in the children's area of the library or for a Recreation and Community Services Department program are permitted. No other games will be allowed on systems. Any material found on City Technology that does not directly relate to the job duties of the employee and/or the employee's department will be deleted and the employee's manager notified. e. Technology users are responsible for all activity generated by their accounts. All users are responsible for exercising good judgment regarding appropriate use of technology systems and tools in accordance with City policies and standards, and only to the extent authorized and necessary to fulfill assigned job duties. Users should log off or lock their computers / when left unattended. City of Anaheim Administrative Regulation 155 Page (3) of (9) f. Any software, including databases, custom reports, graphics, or other work product developed while using a City Technology or developed for use on the City network shall be deemed the property of the City of Anaheim. 3. Network Hard Drive: a. Storing files — The City provides technology users access to networked computer hard drives to store electronic files, including email files. City networked drives may include a drive accessible by all users for sharing files city-wide, a drive for shared departmental use, and a drive for individual access and use. Technology users shall save their electronic files to these network drives for inclusion in nightly backups performed by the Information Services Division (see Section 7(a) for purging schedule). Any files stored on any non -network local drive (i.e. C: drive etc.) and any portable drive (i.e. thumb drive, USB drive etc.) is not backed up by the Information Services Division and will not be able to be restored if the local hard drive or portable device malfunctions. b. To maximize the efficiency of storage capacity, Technology Users have been allocated a specified amount of disk space based on position function and duties.. The Information Services Division may increase space on the City's primary file server based on a user's need and/or system disk space availability, with Department Head approval. 4. Software License Agreements and Installation: a. Only those software programs where license agreements exist by which manufacturers permit the use of their programs and where the City has valid City owned licenses, shall be installed. b. All software installations will be performed by Information Systems staff. c. All licensed City software media will be stored in the Information Systems Division. d. All City software and all purchases of software to be installed on City computers must be approved by the Information Services Manager. e. Employees may not install City licensed software on any computer not owned by the City. Exceptions to this guideline may apply if allowed by the software license agreement and approved in advance by the Information Systems Manager and Department Head. S. E-Mail Policy: a. Use of the City e-mail system is a privilege, not a right, and can be revoked at any time for unacceptable use as described in this policy. Users are prohibited from using the e-mail system to interfere with or disrupt other network users, services, or equipment or for direct personal gain. Prohibited disruptions include, but are not limited to, distribution of unsolicited advertising, the propagation of computer viruses, submission of large volumes of messages to other users or networks, and unauthorized entry to any other computer system. City of Anaheim Administrative Regulation 155 Page (4) of (9) b. All electronic data placed on the City's information systems are the property of the City. Accordingly, employees should have no expectations of privacy in their email messages (or any data files residing on City -owned technology), whether sent or received. This includes files that may be designated as "private" or "personal". c. To limit the excessive use of broadcasting email messages across the entire organization and multiple departments, broadcasting email messages are limited to only pre -approved accounts, such as Human Resources, Communications, or Information Services; the City Intranet (Insider: http:HInsider) may be used for other communications and announcements. d. General interest work -related messages and announcements shall be sent to smaller, rather than larger audiences where appropriate. The City's Intranet bulletin board may be used for certain broadcast purposes. e. Creation of archived folders within Outlook is prohibited and use of the automatic archive feature in Outlook is prohibited. The Information Services Division will conduct scans of Outlook records and will notify respective Department Heads of violations. Exceptions to this prohibition may be granted on a case by case basis by the respective Department head where there is a strong business reason to retain certain records in Outlook [see Section 6(c)]. 6. Maintenance and Retention of Electronic Records, including E-Mail, Text Messages and Social Media content: a. Electronic records, email, text messages and social media content (including attachments), are considered public records and the retention and disposition of public records are governed by State law and the City's Municipal Code and are managed according to the Department's Record Retention Schedule. Users shall be aware that messages sent or received via email, text message and content posted on Social Media Websites may be public records and must meet the same standards as if they were paper documents. Users shall manage their email, text messages and social media content in accordance with their department's record retention schedule and the City's Code. b. Electronic mail, text messages and content posted on Social Media websites are methods of communication. E-mail messages, text messages, Social Media content, and any attachments, intended to be retained for long-term storage shall be placed in the appropriate subject file, either in a specifically labeled electronic file folder or in hard copy, prior to system backup [see Section 7(a) for purging schedule]. Social Media websites are not controlled by the Information Services Division and thus are not an acceptable method for saving electronic records of any type. c. In the event that it is in the best interest of the City exempt certain users from the default email retention policy, requestors must establish the business reason for maintaining records in Outlook. Requestors must obtain Department Head approval for such an exception. The Exception Form can be located on the on the City Intranet under Information Services Forms http:HInsider (See attachment B) City of Anaheim Administrative Regulation 155 Page (5) of (9) i. All approved records that are stored in Outlook archives must be listed in the City's Record Retention Schedule. ii. The City reserves the right to audit any archive file to ensure those files are correctly listed in the City's Record Retention Schedule. d. The normal operation and maintenance of the City's resources require the backup and caching of data and communications, the logging of activity, the monitoring of general usage patterns and other such activities that are necessary for the rendition of service. The Information Services Division maintains a backup of all files located on City servers. Backups are not performed on individual computers unless specified by the Information Services Division, in rare cases when a user runs applications locally. e. Backups of the City's network and e-mail system are for the purpose of system recovery only and not for the purpose of preserving the informational content of e-mail messages and records for future business use. 7. Data storage, retention, and e-Discovery: a. Data backups are taken at varying intervals depending on the defined server data type and are for purposes of system restoration only, in the event of server failure. Data backups are not itemized for individual file recovery. b. Data types include the City's Email system and File Systems (1. City's databases; and 2. Operating systems). All data backups are stored to tape in a non -categorical order as follows: i. All electronic communication, whether read or not, is electronically deleted from the users email system as dictated by the applicable retention policy assigned to the user. The default retention period for emails is 24 months, with the exception of emails placed in the Deleted folder, which are only subject to a retention period of at least 90 days ii. Email records for Members of the City Council, support staff or contractors of the Mayor or City Council, the Executive Team of the City, Chief Communications Officer, or any other as designated by the City Manager or Executive Team are also subject to eDiccovery controls and will be established such that records may be electronically searched through the use of a system tool or utility. iii. Once the retention period is exceeded, based on the original date of receipt/sent, the email record will be automatically purged/erased without any notice to users. iv. File system records stored on the City's network are backed up and are retained for 2 years, from the date of the backup. v. All file system records created and deleted, on the same date, from the City's network system prior to the nightly back-up, by or around 6:00 p.m., are not recoverable as they are permanently deleted from the system, thus not backed -up. City Of Anaheim Administrative Regulation 155 Page (6) of (9) 8. On -Line Services Policy: a. Web resources are made available to Technology Users to improve communication and information exchange, as well as a tool to assist in gathering research needed to conduct official City business. The Internet is a global electronic infrastructure of networks and therefore it is necessary to place certain restrictions to avoid improprieties and ensure established standards are met. b. The City reserves the right to restrict access to any data source if the City determines such a source to be problematic. Technology Users can be granted temporary override of certain privileges to blocked sites with Department Head approval, provided such is necessary for official city business. c. The City restricts access to the Internet. The City has the right and ability to view, access and disclose all such internet activity by a Technology User for any purpose. City Supervisors are responsible for monitoring use of the Internet by Technology Users. d. Knowingly generating, sending, requesting, receiving, or archiving any material which contains any comment or image that is discriminatory, offensive, defamatory, or harassing in nature is prohibited. e. Streaming media (online radio, music, video, podcasts etc.) is only allowed for business purpose without constant and extended hours of streaming. f. The occasional personal use of the Internet on the employee's own time (i.e. lunch break) is permitted as long as it does not interfere with regular City business, is not excessive, does not cause an adverse impact (i.e. congestion) on the City's network, and does not violate any established City or Department policies or procedures, including this Regulation. g. The City Manager's office shall determine appropriateness of materials posted to the City's Internet and Intranet web site. Links from the City Internet website is permitted, but shall be in conformance with this regulation. h. The City of Anaheim logo is a trademark of the City. Any use of the materials stored on the City's website is prohibited without the written permission of the City of Anaheim. The City of Anaheim retains all intellectual property rights including copyrights on all text, graphic images, and other content. Unauthorized modification, distribution, mirroring, or use of images or other web content is prohibited. i. The materials and information contained on, or obtained from, the City website are distributed and transmitted "as is" without warranties of any kind, either express or implied, including without limitation, warranties of title or implied warranties of merchantability or fitness for a particular purpose. Information contained on the City website, including information from external links thereon, is provided without any representation of any kind as to accuracy or content and should be verified by the user. The City of Anaheim is not responsible for any special, indirect, incidental or consequential damages that may arise from the use of, or the inability to use, the website and/or material contained on the site whether the material contained on the website is provided by the City or a third party. City of Anaheim Administrative Regulation 155 Page (7) of (9) 9. Remote Access: a. The City offers employees the ability to access their Microsoft 365 account from remote locations using non -City computers, personal devices, and Internet service. Access is limited to Microsoft 365 functions and does not include access to files or applications stored on the network. Employees who use this service must adhere to the guidelines of this Regulation, as well as the following: i. The City offers this service as a convenience to employees and does not require employees to use this service. As such, employees shall not be compensated for time spent accessing their City Microsoft 365 through this service. As with all overtime, authorization for overtime compensation must be approved in advance in accordance with the appropriate section in the various bargaining groups' MOU and Human Resources policies and procedures. ii. Employees who use this optional service do so at their own risk and the City will not be held liable for damage to employees' personal computers or devices. iii. Use of this service shall be for work -related purposes only. iv. Employees using this optional service should take reasonable precautions to prevent computer viruses from infecting the City's network. b. Remote access to the City's network is available. Exempt employees shall receive authorization from their Department Head and submit the applicable service form to the Information Services Division. Permission will be granted on a case -by -case basis. Any remote access to the City's network is strictly for business related purposes and is not to be shared with any individuals who are not employed by the City or employees who have not received such authorization. i. Unless authorized by the Department Head, no employee shall use this ability to take the place of their attending work. ii. The City reserves the right to audit any personal computer, laptop, tablet or mobile device of any employee accessing City files from their device. Users who do not wish to be subject to possible audit of their devices may request a City laptop to be provided to access City resources from remote sites. 10. City Equipment: a. Computers, laptops, mobile devices, tablets and smart devices (Smartphones, tablet computers etc.) are assigned on a permanent basis to certain staff by their respective Department Head and are the property of the City. All technology - use rules set forth herein apply to all City Technology. b. Laptops and mobile devices should be used for City related business only. The City recognizes that there may be incidental occasional personal use of laptops and mobile devices, but all data and messages will be treated as a record and City of Anaheim Administrative Regulation 155 Page (8) of (9) the City reserves the right to access, review, audit and disclose, as necessary, all information from a City -owned laptop and cellular phone, without regard to content. c. Laptops issued to staff for use while at the City must be stored in a locked or secured area when not in use. d. The user shall immediately report any lost or stolen equipment to their supervisor so that the equipment can be reported appropriately. e. The user is responsible for properly caring and maintaining the equipment while in their possession. All liquids and food must be kept away from the equipment at all times. f. Reports of any problems with the equipment, software, or other computer related problems are to be made to the Information Services Service Desk staff immediately. Users should not try to resolve any unfamiliar problems without the assistance of the Information Services Service Desk staff. Error messages appearing on the user's computer screen when a problem occurs are not to be answered. When a problem does occur, document the action that was occurring at the time the problem started. This will facilitate Information Services Help Service staff s efforts to correct or repair the problem. Always provide as much detailed information as possible. IL Security Policy: a. All City network users are required to use personalized user IDs and passwords. The user ID will be assigned by the Information Services Division staff and follows the syntax of first name initial and full last name unless otherwise specified. The passwords are chosen by the user and are not known to the Information Services Division staff. Passwords are considered confidential and should not be disclosed to anyone and should not be saved on any computer. b. It is the responsibility of each user to create a strong password and change their password when prompted by the system. Users should avoid using passwords that are easy to guess. The system will reject passwords that have been previously used by the user over the last 12 selections. c. All use of the login accounts to various systems is assumed to be performed by the person assigned to that account. Account owners are held responsible for all activities associated with their accounts. d. If it is required that another City employee access a user's account, access can only be granted by the Department Head or supervisor, in writing, to the Director of the Information Systems Division, or designee. Information that a user obtains through this special privilege is to be treated as confidential. e. Virus protection software is resident on each computer. Users shall not disable this software. Users shall notify Information Services Division Staff of any virus detected on their system. f. Users of the City network must report any known security weaknesses or breaches immediately to the Information Services Division Service Desk. City of Anaheim Administrative Regulation 155 Page (9) of (9) 12. Training: a. The City provides computer -training classes for employees. The courses taken must meet the job description duties of the employee. Information on training registration is available on the City Intranet at http:Hlnsider. Responsibility: This regulation applies to all users authorized to use City Technology and the City of Anaheim's network system. Attachment: A. Network Access Form B. Email Archiving Exception Request ATTACHMENT: B City of Anaheim Information Technology Services and Support EMAIL ARCHIVING EXCEPTION REQUEST FOR SECURITY ADMINISTRATOR USE ONLY REQUEST NO. TO BE COMPLETED BY REQUESTOR REQUESTED BY PHONE EXTENSION DATE REQUESTED SIGNATURE REQUESTING DEPARTMENT DESIRED COMPLETION DATE EMAIL ACCOUNT USER FIRST NAME LAST NAME MI WORK PHONE NUMBER EMAIL ADDRESS / ACCOUNT NETWORK LOGIN ID SUPERVISOR DEPARTMENT DIVISION/GROUP UNIT EMAIL ARCHIVING REQUIREMENTS • Please ensure that your department's record retention schedule includes the type of records listed on this exception form. • On the space below, please specify the requested information and justification for archiving your emails PURPOSE OF EMAIL ARCHIVING and TYPES OF EMAIL TO BE ARCHIVED ARCHIVE DATE or DATE RANGE ARCHIVE DURATION (In Years) Please obtain the required signatures for approval by your department. Approval must be obtained from an Administrative Manager and/or a Department Head, as established by your department. APPROVER PRINTED NAME SIGNATURE DATE DEPARTMENT HEAD FOR EMAIL ADMINISTRATOR USE ONLY ARCHIVED EMAIL ACCOUNT SIZE OF ARCHIVED EMAILS COMPLETED BY AND DATE ARCHIVE PATH OR NETWORK FOLDER LOCATION