Department: Universal Services
Department Head/Elected Official: Sindhu Menon, Executive Director & CIO
Regular or Supplemental RCA: Regular RCA
Type of Request: Policy
Project ID (if applicable): N/A
Vendor/Entity Legal Name (if applicable): N/A
MWDBE Contracted Goal (if applicable): N/A
MWDBE Current Participation (if applicable): N/A
Justification for 0% MWDBE Participation Goal: N/A - Goal not applicable to request
Request Summary (Agenda Caption):
title
Request for approval of eight Harris County Information Technology Policies.
end
Background and Discussion:
SUMMARY: Harris County Universal Services (HCUS) follows the National Institute of Standards and Technology (NIST) in the development and implementation of information security policies. The three types of policies defined by NIST Special Publication 800-12 include program, issue-specific, and system-specific policies. In October 2023, Commissioners Court passed the Harris County Information Security Policy, a program policy that provides high-level strategy for the information security program. To operationalize the Information Security Policy, HCUS recommends approval of eight issue-specific policies providing guidance for specific components of the information security program. Each of these policies includes policy purpose, scope, provisions and compliance. The recommended policies include: 1. Cybersecurity Education and Awareness Training (update to the 2020 Commissioners Court Order) 2. Information Technology Acceptable Use Policy 3. Information Technology Access Control Policy (update to the 2015 policy) 4. Information Technology Asset Management 5. Information Technology Change Management Policy 6. Information Technology Network Security Policy 7. Information Technology Remote Access Policy 8. Third-Party Risk Management Policy SCOPE: The policies apply to elected and appointed officials, department heads, managers, employees, and service providers, such as vendors, contractors,...
Click here for full text