Department: Universal Services
Department Head/Elected Official: Sindhu Menon, Executive Director & CIO
Regular or Supplemental RCA: Regular RCA
Type of Request: Policy
Project ID (if applicable): N/A
Vendor/Entity Legal Name (if applicable): N/A
MWDBE Contracted Goal (if applicable): N/A
MWDBE Current Participation (if applicable): N/A
Justification for 0% MWDBE Participation Goal: N/A - Goal not applicable to request
Request Summary (Agenda Caption):
title
Request for approval of eight Harris County Information Technology Policies.
end
Background and Discussion:
SUMMARY: Harris County Universal Services (HCUS) follows the National Institute of Standards and Technology (NIST) in the development and implementation of information security policies. The three types of policies defined by NIST Special Publication 800-12 include program, issue-specific, and system-specific policies. In October 2023, Commissioners Court passed the Harris County Information Security Policy, a program policy that provides high-level strategy for the information security program. To operationalize the Information Security Policy, HCUS recommends approval of eight issue-specific policies providing guidance for specific components of the information security program. Each of these policies includes policy purpose, scope, provisions and compliance. The recommended policies include: 1. Cybersecurity Education and Awareness Training (update to the 2020 Commissioners Court Order) 2. Information Technology Acceptable Use Policy 3. Information Technology Access Control Policy (update to the 2015 policy) 4. Information Technology Asset Management 5. Information Technology Change Management Policy 6. Information Technology Network Security Policy 7. Information Technology Remote Access Policy 8. Third-Party Risk Management Policy SCOPE: The policies apply to elected and appointed officials, department heads, managers, employees, and service providers, such as vendors, contractors, consultants, and commercial entities, that supply, develop, implement, administer, or use County information systems to the extent permitted by state and federal law as well as any other statutory obligation. COMPLIANCE: Each policy has a risk-mitigation mechanism based on Universal Services’ determination that a department violated a policy that poses high risk to the County's network. In this situation, the department may be temporarily disconnected from the central network until the risk is mitigated. IMPLEMENTATION: If passed, HCUS recommends a minimum six-month implementation period to October 1st, 2024. This timeframe allows adequate time for departments to receive the necessary awareness, training and guidance to ensure implementation, operating effectiveness, and compliance.
Expected Impact:
Information technology policies provide protections to Harris County at a time when security threats are on the rise. The expected impact of the implementation of these policies is enhanced cybersecurity, auditability, and compliance by increasing user training and awareness, and building in requirements that mitigate risks of cyberattacks, unauthorized access, disclosure of confidential and/or sensitive information, and non-compliance with regulatory requirements.
Alternative Options:
Alignment with Goal(s):
_ Justice and Safety
_ Economic Opportunity
_ Housing
_ Public Health
_ Transportation
_ Flooding
_ Environment
X Governance and Customer Service
Prior Court Action (if any):
|
Date |
Agenda Item # |
Action Taken |
|
02/24/2015 |
15.04, 4.c. |
Approved - Access Control Policy |
|
02/25/2020 |
20.04, 7.a. |
Approved - Order for Compliance with Cybersecurity Training Legislation H.B. 3834. |
|
10/31/2023 |
23.19, 169. |
Approved - Information Security Policy |
Location:
Address (if applicable):
Precinct(s): Countywide
|
Fiscal and Personnel Summary |
|
Service Name |
|
|
|
|
Current Fiscal Year Cost |
Annual Fiscal Cost |
|
|
Labor |
Non-Labor |
Total |
Recurring Expenses |
|
Funding Sources |
|
|
Existing Budget |
|
|
|
|
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Total Current Budget |
$ |
$ |
$ |
$ |
|
Additional Budget Request (Requires Fiscal Review Request Form) |
|
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Total Additional Budget Request |
$ |
$ |
$ |
$ |
|
Total Funding Request |
$ |
$ |
$ |
$ |
|
Personnel (Fill out section only if requesting new PCNs) |
|
|
Current Position Count for Service |
- |
- |
- |
- |
|
Additional Positions Request |
- |
- |
- |
- |
|
Total Personnel |
- |
- |
- |
- |
Anticipated Court Date: March 26, 2024
Anticipated Implementation Date (if different from Court date): October 01, 2024
Emergency/Disaster Recovery Note: Not an emergency, disaster, or COVID-19 related item
Contact(s) name, title, department: Nicole Broyles, Senior Manager, Policy, Universal Services
Attachments (if applicable): Eight Harris County Information Technology Policies