|
| | | | This will be a virtual meeting conducted via GoToMeeting. Should you wish to join this meeting from your phone, tablet, or computer you may go to https://meet.goto.com/281974229. You can also dial in using your phone United States: +1 (408) 650-3123 and Access Code: 281-974-229. | | | |
|
Not available
|
|
| | 1. | | Call to order.
Minutes note: The meeting was called to order at 10:07 a.m. | | | |
|
Not available
|
|
| | 2. | | Roll call.
Minutes note: Present (11) - Borkowski, Henke, Richter, Zimmer, Klajbor, Meyer-Stearns, Owczarski, Madison, Jaeger, Klein, Watt
Excused (1) - Larson | | | |
|
Not available
|
|
| | | | Also present:
Minutes note: Brad Houston, City Records Center
Atty. Peter Block, City Attorney's Office
Robert Surita, ITMD
Judy Siettmann, ITMD | | | |
|
Not available
|
|
| | 3. | | Introduction of new membership.
Minutes note: Members welcomed Ald. Mark Borkowski as a new member and chair of the committee, and chair Borkowski said he was eager to learn more about records management and IT matters for the City. | | | |
|
Not available
|
|
| | 4. | | Review and approval of the previous meeting minutes from March 17, 2022.
Minutes note: The meeting minutes from March 17, 2022 were approved without objection. | | | |
|
Not available
|
|
| | 5. | | Records Retention.
Minutes note: A. Proposed departmental record schedules for approval
Mr. Houston presented. Schedules consisted of 16 new and 35 supercedes. DCD schedules pertained to the consolidation of individual schedules for individual programs. City Archives would review City property records and real estate transaction files prior to destroying them. Records for cancelled property acquisition BIDs did not need lengthy retention. Client loan administration records of 15 different programs would have one schedule. There was a cleanup of personal health information records for the Health Department, and more related schedules (consolidating electronic health records) would come at the next meeting.
Mr. Houston said that amended schedules for the City Treasurer's Office were submitted to correct the consolidation of incorrect schedules and to prolong the retention period from one month or when administrative no longer useful to 4 or 7-year retention period for those schedules.
Member Klajbor said that his office (City Treasurer) supported the amended schedules.
Member Klajbor moved approval, seconded by member Meyer-Stearns, of the amended proposed departmental record schedules, as proposed. There was no objection.
Vice-chair Henke said that his office would work with Mr. Houston on the Health Department consolidation of electronic health records.
B. State Records Board approval of previous schedules
Mr. Houston commented. The State Records Board approved the previous schedules with some having administrative corrections. Most corrections were related to typos. There was a correction to add all appeals expanded to RDA 210040 concerning use of force incidents and internal investigation record schedules. The State Records Board was planning to revise their global schedule of facilities relative to surveillance camera footage by the end of August. The retention period for footage without identification of incidents would be changed from 120 days to 72 hours. He would be submitting a global schedule for the City to match the State's.
Members discussed that a new global records schedule on surveillance camera footage retention would be taken up at the next meeting or earlier via a special meeting, as necessary. | | | |
|
Not available
|
|
| | 6. | | Communications from the Information and Technology Management Division.
Minutes note: A. Text Message Archiving
Vice-chair Henke gave an update. The text message archiving trial project via Smarsh was planned for full deployment, had produced mixed results, and would be stopped. The intent was to make text message records of City employees who were conducting city business on city-issued or personal phones archivable, searchable and retrievable similar to that of emails. There were practical limitations. Archiving could not be done for personal devices. The app solution for phones was not user-friendly. Apps with encryption, such as iMessage, would not allow texts to be captured. The value of text message archiving should be reconsidered to see if it would be worthwhile to do. It would cost $100,000 to implement archiving for all city-issued cell phones. Having employees retain their text messages could be a consideration. ITMD stopped archiving in April but still maintained those that were archived prior to.
Atty. Block added that the text archiving pilot project was set up to assist with public records requests, text messages were subject to the open records law, the program was found to be expensive, there was not a legal requirement to use archiving software, there had been very few open records request for text messages, the app solution was not viable, there were other options to consider versus an archiving program, smaller communities were able to implement their archiving programs due to their smaller workforce, such a program would not be feasible due to the size of the City's workforce, and the decision was made to discontinue the pilot program.
Mr. Houston said that 95% of texts were transitory and not relevant, archiving all texts would be an over-retention, employees should not be depended upon to retain their texts, and departments had previously objected in a response to a survey on text archiving.
Vice-chair Henke said that he would work with City Records Center and City Attorney's Office to draft instructions and guidance on maintaining non-transitory texts, and he inquired about having a communication file on the matter before the Common Council.
Member Klajbor said that there should be advocacy to instruct employees to conduct city business via email rather than through text.
Chair Borkowski said that he was surprised to learn the issue of text message archiving and that he did not oppose to a communication file before the Common Council.
Members and participants discussed whether or not such a communication file before the Common Council should occur, whether the communication would spark open records requests, that a system or plan should be in place prior to doing the communication, that such a communication should be focused on best practices as opposed to citywide archiving, and that there should not be reliance on cell phone companies to retain texts since their retention periods were questionable.
B. Multi-Factor Authentication and Password Policy updates
Vice-chair Henke said that MFA required employees to do secondary verification via a text or phone call when logging into their city accounts.
Mr. Surita gave an update. The goal was to have 100% MFA participation by the end of the year. There has only been 10% participation thus far. The purpose of MFA was to protect accounts against hacks and unauthorized access. MFA would occur when users would change their passwords or log into their accounts outside of the city network. MFA was an audit finding, and the desire was to satisfy the audit finding.
Mr. Houston inquired about revisiting or eliminating the policy to update passwords every 60 days.
Vice-chair Henke said that the intent was to do away with updating passwords based on a calendar date should MFA have full implementation.
Atty. Block said that MFA was becoming more standard.
C. Deployment of ManageEngine ServiceDesk Plus
Mr. Surita said that Manage Engine ServiceDesk products were being used, the Plus product would be purchased to replace RITS, Plus was a better enterprise management software for ITMD to deliver better service, and it would allow for asset inventory and software inventory for ITMD and other departments.
D. Phishing Test Campaign
Ms. Siettmann and vice-chair Henke gave an update. The campaign resulted in an 8% fail rate for 2022, which was lower than the rate of 25% for 2021. The decreased rate would be attributable to training and an easier template. Those who failed lacked training. Reports of phishing were forwarded to management. The City was getting better. The campaign would continue. A next step was to require mandatory training once a year for those who failed. There would be follow-up with department heads on phishing issues. Training would be 20 minutes long. Security training was also ongoing. Dashboards can be made for departments.
Some members said that they were interested in a dashboard for their respective departments and that the phishing test results should be shared with the respective department heads so that proper follow-up with employees could be done.
E. CISA Cyber-Response Table Top Exercise for Q3 2022
Vice-chair Henke and Ms. Siettmann gave an update. CISA was a federal cyber security agency that provided a wealth of resources. There was an audit finding for the City to do a cyber-response table top exercise. CISA would be able to do an exercise with the City in quarter 3 of this year. The exercise would take 2 hours and go over scenarios and response. Participation from many departments was needed. Further information would be forthcoming. | | | |
|
Not available
|
|
| | 7. | | Agenda items for the next meeting.
Minutes note: To be determined. | | | |
|
Not available
|
|
| | 8. | | Next meeting date and time (Thursday, September 15, 2022 at 10 a.m.).
Minutes note: Chair Borkowski said that he learned much from his first meeting and thanked vice-chair Henke and clerk staff for their assistance with the meeting. | | | |
|
Not available
|
|
| | 9. | | Adjournment.
Minutes note: The meeting adjourned at 11:28 a.m.
Chris Lee, Staff Assistant
Council Records Section
City Clerk's Office | | | |
|
Not available
|
|
| | | | Meeting materials from this meeting can be found within the following file: | | | |
|
Not available
|
|
220189
| 0 | | Communication | Communication relating to the matters to be considered by the City Information Management Committee at its June 16, 2022 meeting. | | | |
Action details
|
Not available
|
|