ACG Computing Policy

Approved by ACG County Attorney 03·2011
Approved by ACG BoCC on 04105/2011
Purpose:
This policy defines Arapahoe County's computing policy regarding the usage of
County computer-related hardware, software, network, Internet, e-mail,
telephones, remote access and other computing services.
Scope:
This policy applies to anyone using ACG computing services or equipment, such
as all full-time, part-time and temporary employees, volunteers, vendors and
contractors.
Definitions:
• Emplovee - Any person that works for Arapahoe County, either on a part­
time, full-time or temporary basis, whether as a County employee, a State or
other employee, vendor, contractor or volunteer using ACG computing
services or equipment.
• Contractor - Any person that contracts services or goods with Arapahoe
County
• County· Arapahoe County Government
• County Computing Equipment - All Electronic Media, Hardware, Mobile
Devices and other equipment and systems provided by or on behalf of
Arapahoe County to its elected and apPointed officials, employees,
contractors and agents, whether owned or leased directly by Arapahoe
County or otherwise, for the purpose of Electronic Communications and/or for
data storage or manipulation.
• Electronic Communications - Use of electronic mail ("e-mail"), Internet, text
or instant messaging, electronic FAX, bulletin boards, television access
channels, voice services, electronic subscription services, or any other
electronic communications forums.
4/6/2011
1
• Electronic Media - Electronic storage devices including, but not limited to,
hard drives, CD-ROMs, servers, memory sticks or other external drive
devices,
• Mobile Devices - Laptops, tablet computers, Smart phones, and Personal
Digital Assistants, such as (but not limited to) a "Blackberry" device or any
other of a class of handheld electronic devices that can provide County
computing functionality and/or can be used wirelessly on or off premise,
• Hardware - Devices, including, but not limited to, computers, laptops,
printers, scanners, telephones, handheld or other mobile or wireless devices,
network equipment, modems, storage or input devices,
General Policy:
All information or data contained or stored in any County Computing Equipment
(as defined above) is the property of the County, Any information or data
contained or stored in any County Computing Equipment is available at all times
to the County and its authorized elected and appointed officials, employees,
agents or other representatives.
The County's records are subject to the Colorado Open Records Act ("CORA").
1
Any party requesting records under CORA may be responsible for any and all
costs incurred in the retrieval and review of electronic media, Availability of
information is subject to County policies and procedures for retention of data,
The County Attomey or his/her designee must be notified of all open records
requests and shall review all records before they are released, including
documents produced pursuant to subpoenas, to ensure personal or privileged
information is not published. Should questions arise concerning what mayor
may not be exempt from disclosure under CORA, employees should contact the
County Attorney's office for clarification, All employees should be aware that
their correspondence in the form of e-mail may be a public record under the
public records law and may be subject to public inspection under Section 24-72­
203 of CORA 2
1 Colorado Open Records Act begins at Section 24-72-201, et seq., of the Colorado Revised Statutes. Pursuant to
section at seq.. C.R.S., certain records k.ept by Arapahoe County, Colorado in the normal course of
business are open to inspection by the public at reasonable times. However, the County makes no representation as
to the accuracy or content of the information contained in these records. Some of the information contained in the
Arapahoe County records is derived from other sources. and that information should be verified by consulting said
sources, (Source: Colorado Attorney General's Office at http://www.ago.state.co.us)
2 REQUESTS FOR MESSAGES: The Arapahoe County Information Technology Director is the official
custodian of the County's e-mail messages, All requests for copies of whether for elected officials' or
employees' e-mail, will be handled by the Information TeCtlnology Director, in conjunction with the County Attomey's
Office.
41612011
2
Employees are expected and have the obligation to use good judgment at all
times when using the Internet and other electronic communications tools.
Employees should be professional and courteous when sending electronic
messages. Electronic media is made available to employees for the purpose of
providing an effective method to communicate, increase productivity, perform
research and obtain information that will assist in performing job-related tasks.
County Computing Equipment may be used for incidental personal
communications or transactions provided that such use does not interfere with
the conduct of Arapahoe County Business, incur additional system costs,
interfere with the employee's duties, or violate any other County policy or
procedure. However, all personal and business use of County Computing
Equipment is subject to access, monitoring, review and disclosure at all times by
the County, and its authorized elected and appOinted officials, employees, agents
and other representatives. Therefore, County elected and appOinted officials,
employees and agents have no expectation of privacy with respect to use of
County Computing Equipment.
Further, the County may choose to block or ban certain hardware, software,
computing functions, applications or services at any time due to security risks or
for other reasons.
If an employee desires the use of a remote connection to access the County
network, they must abide by the provisions of the County Teleworking Policy,
including following of established inventory control and licensing procedures.
Information Technology provides telephone support during normal business
support hours and will perform maintenance and repair of County-owned
equipment that is in use at an employee's home. The employee, however, is
responsible for transporting the device(s) to the Information Technology
Department, or other approved County facility. Employees are not allowed to
access the Arapahoe County network via remote communications devices
(modems, DSL, ISDN, etc.) without the express consent of their supervisor or
manager. No one may connect to the County wired or wireless network with non­
County printers, routers, switches or any electronic device not approved in the
published Technology Standards without the expressed permission of their
sponsoring Office or Department and the Information Technology Department
Director. See the published Technology Standards for a list of currently
approved electronic devices.
It is permissible for employees to used personally owned WiFi enabled mobile
devices that are approved in the Technology Standards with the County wireless
network for Internet only access. Such usage must be reasonable, approved and
managed by the employee's supervisor, manager or Department Director/Elected
Official or designee.
41812011
3
To secure County data, employees shall always make a reasonable attempt to
logoff of their computer when finished with a session.
Employees shall only use e-mail and Internet security software provided or
approved by Arapahoe County's IT Department. Employees shall not use their
own security software, including but not limited to encryption and virus scanning,
without express prior written authorization from the Information Technology
Department, nor shall they de-activate or bypass County security in any way,
except where specifically authorized by the Director of the Information
Technology Department.
County employees shall not use County Computing Equipment to publish
material (e-mail or web publishing, wikis, blogs or the like) about sensitive County
issues (this does not apply to the publication of material that is protected by the
First Amendment). All media releases shall go through the appropriate County
representatives.
Department Directors and Elected Officials are responsible for enforcement of all
County policies and for taking prudent steps to ensure the safety of County
assets.
Passwords and Password Management
It is the responsibility of each employee to select, protect and manage their own
network passwords (and application passwords, if appropriate) according to
current County security requirements. In the event that an employee needs to
have their password reset through the IT Service Desk, (due to error, expiration
or inability to remember it), the IT Service Desk will use approved County
procedures to verify the requestor's identity in order to ensure that the password
reset is valid and appropriate.
E-mail Standards
Employees shall adhere to the standards set forth by the Arapahoe County
Information Technology Department. Electronic Communications should be
monitored by each employee and proper etiquette used at all times. Please see
the sections titled "Examples of Permissible Uses of the Arapahoe County
Computing Resources" and "Examples of Prohibited Uses of the Arapahoe
County Computing Resources" for specific standards.
Electronic Communications and Internet content shall not be used in any way
that violates any federal, and/or state law, Arapahoe County standard, policy,
procedure, or ordinance or resolution.
4/612011 4
Employees are responsible for business related subscription services and should
unsubscribe to lists or newsgroups when they are no longer needed.
Opinions contained in e-mail messages, whether expressed or implied, are the
opinions of the author and are not necessarily the official pOSitions of Arapahoe
County
The County may filter or block certain file attachments or organization's
addresses to protect the County from computer viruses or other threats.
Any type of text or instant messaging through County Computing Equipment
should also adhere to appropriate email standards. In addition, since text and
instant messaging content is generally non-permanent in nature, these
communication means should not be used for anything that requires
documentation or recoverability.
Email Retention and Archiving
In order to meet all legislative, judicial and County business requirements, and to
provide for the effective and efficient use of County resources, all email is now
subject to retention and archiving periods established by the County.
All email items (sent and received) are archived for 18 months to preserve their
authenticity, reliability and integrity, and are recoverable in their original form.
This archiving process will supersede any end user deletion activity within an
employee's own email account. After the 18 month archive period has expired,
email items will be purged from the archive system and will not be recoverable
from that system. Calendar items are archived for 1 year and then purged.
To better manage County resources and expenses, all email items (sent and
received) older than 45 days will be purged from the email servers. Any items
older than 45 days which need to be accessed will be available during the 18
month archive period on the archive system. E-mail items may be moved to
other externally managed storage (Including but not limited to CD, desktop,
networked or other electronic personal storage media) in order to be retained
outside of the archive system only when necessary for legitimate business
reasons and only with the permission of a Director or Elected Official. Any
deliberate activity to circumvent the County email retention and archiving pOlicies
may be cause for disciplinary action up to and including termination.
An exception to this retention and archive policy is for any email subject to a
litigation hold. If the County Attorney's office determines that a litigation hold is
applicable, affected employees will be notified and provided with any needed
instructions pertaining to the litigation hold, as determined by the County
4/6/2011
5
Attorney's office and in compliance with the County's Litigation Hold Policy and
Procedures.
Records Management is currently decentralized at the County. Appropriate
retention and archiving of official records is the responsibility of each Office and
Department. Therefore, it is the responsibility of the end user to make necessary
arrangements and receive appropriate approval from a Department Director or
Elected Official for long term storage of email whose content may constitute an
official record.
Internet Standards
Employees shall adhere to the County approved computing standards set forth
by the Information Technology Department. Please see the sections entitled
"Examples of Permissible Uses of the Arapahoe County Computing Resources"
and "Examples of Prohibited Uses of the Arapahoe County Computing
Resources" for specific guidelines.
The County may block certain web sites to protect County data, to protect from
infrastructure damage or other threats and to prevent inappropriate Internet use.
Hardware Standards
All Hardware shall be used for Arapahoe County Government business
purposes, except that minimal personal use is allowed as long as it does not
interfere with the conduct of Arapahoe County Business, incur additional system
costs (such as affecting the performance of the hardware), interfere with the
employee's duties, or violate any other County policy or procedure. However, all
personal use of Hardware is subject to access, monitoring, review and disclosure
by the County and its representatives.
Employees shall adhere to the standards as stated in the ACG Financial Policy,
and set forth by the Arapahoe County Information Technology Department
regarding Hardware acquisitions and the Information Technology Department
approval process. Information Technology Department approval shall be
obtained prior to purchases of any non-standard hardware. Please see the
sections entitled "Examples of Permissible Uses of the Arapahoe County
Computing Resources" and "Examples of Prohibited Uses of the Arapahoe
County Computing Resources" for specific standards.
All employees who use handheld wireless mobile devices, whether owned by the
County or by the employee, shall follow the hardware guidelines herewith and
published Technology Standards when used to interact with County computing
4/6/2011
6
equipment or systems. Employees shall take prudent steps to ensure the safety
of County assets and protect them from damage or loss.
Any handheld wireless Mobile Devices shall adhere to County standards and
shall not be configured for use on non·ACG computers. Handheld wireless
mobile devices and laptop computers shall have password protection on the
device to protect from data loss or theft. All handheld wireless Mobile Devices
that access the County network or data may be subjected to remote wiping by
the County in the event of loss or theft. Further, the County may determine that
these devices also require approved encryption software. Computers shall have
a screen saver set with password protection that initiates after a set period of
inactivity, generally about 15 minutes.
Employees shall not make Hardware changes to County devices. All
maintenance and repairs will be performed by the Information Technology
Department or designated representative.
All Hardware remains the property of the County and shall be returned upon
termination of employment. The employee is responsible for protecting both data
and hardware from loss, theft, and damage.
Software Standards
Employees shall not copy software, nor should software be given to any outside
third party. Employees shall use software only in accordance with applicable
license agreements. This includes "Freeware" or "Shareware". "Shareware"
shall be registered to the Arapahoe County Information Technology Department
and license fees shall be paid in accordance with the software vendor's policy.
All software acquired through Department Director or Elected Official approval
shall also first be approved by the Information Technology Department, in
accordance with the County Financial Policy. The Finance Department shall be
included in the selection, development, modification, upgrade and
implementation of all financial software, including all software that interfaces with
the County's financial system or that is routinely used to record, collect,
summarize or report financial data, including but not limited to inventory tracking,
grants and project accounting, payroll and benefits, revenue collections,
accounts receivable and disbursements, for the purpose of ensuring the integrity
of the financial data and financial reporting and the adequacy of the internal
controls imbedded in the financial business processes accompanying the
software. Employees shall not install, modify or remove any software, without
approval by the Information Technology Department.
3
An exception can be
made for employee supplied license compliant desktop wallpaper or license
:) The custOdlan, and the immediate decision maker for computer related Issues at Arapahoe County, is the Information
Technology Director.
4/612011
7
compliant screen savers. However, these are subject to removal by the
Information Technology Department should they interfere with County business
operations, operation of the hardware or problem trouble-shooting. All software
licenses acquired by Arapahoe County will be stored and monitored by the
Information Technology Department.
Storage/Media Devices:
The County provides network based storage (file servers) for employees to
manage County data to do their jobs. The Information Technology Department
will provide data backup and restore services for all ACG County file servers.
Information Technology does not backup data on County desktops, laptops or
personal home PC's. Backing up any data on desktop PC's is the responsibility
of the employee. The Arapahoe County IT Service Desk can provide
recommended procedures to use for backing up desktop PC's. However, it is
strongly encouraged to store critical information in server based files for
maximum security and file management.
While it may be appropriate for business reasons to copy or move data to
removable media (such as external drive, CD or memory stiCk), it is the obligation
of the employee to ensure that this is approved by their Office or Department. In
all cases, it is recommended that files on any removable media be password
protected for READ so that it is not accessible by anyone else in the event that
the mini-media is lost or stolen. In some cases, it may be appropriate to only use
an external storage device which enforces the use of encryption and password,
such as for sensitive or personal information. Again, this may be a requirement
in your own Office or Department.
Conference Calls:
No employee shall listen to a conference call unless the employee was invited to
participate or was the organizer/originator of the conference call. All employees
are required to identify themselves to the other participants when first joining in
on a conference call.
Privacy/Monitoring:
The County, through its Authorized Employees, has the right to access, review
and monitor all telephone calls sent or received by any person on or through the
County telephone lines and/or County telephones. Such telephone lines may be
monitored periodically at any time by the County's Authorized Employees without
4/612011
8
notice or cause for the purposes of ensuring the quality of customer service
provided to callers and/or for training purposes,
Employees have no expectation of privacy for their usage of County telephone
lines and/or County telephones, Employees who use County telephone lines,
and/or use any County telephone, have no expectation of privacy for any such
usage, including any personal usage,
The County, through its authorized elected and appointed officials, employees,
agents and other representatives, reserves the right to access, review, monitor,
delete and disclose all infonmation and data sent, received or stored using
County Computing Equipment, including, but not limited to, all e-mails, on a
random basis or otherwise, with or without prior notice, and with or without
cause,4 Therefore, County elected and appointed officials, employees and
agents do not have any expectation of privacy with respect to use of County
Computing Equipment or any communications or other data or information sent,
received or stored using County Computing Equipment In addition, and not in
limitation of the foregoing, County Internet usage is traceable, and persons using
the County-provided Internet access should not expect that they have any
degree of anonymity and/or privacy, Access to Web sites and message
authorship can be easily traced to a specific user and may be done with or
without cause or notice,
Remote or Wireless Access:
Some job responsibilities, special circumstances or desire for convenience may
result in employees accessing County IT services from locations outside of a
County facility, Such usage will fall into 3 categories: wireless, nominal remote
access use and teleworking,
Wireless usage is defined as performing your normal job duties or reasonable
personal usage using County owned or approved personal equipment through a
wireless network connection, For this type of access all computing policies apply
the same as for a hard wired connection, regardless of work location,
Nominal remote access use is defined as occasional usage of County IT
services, generally for convenience, Examples would be someone who utilizes
Outlook Web Access (OWA) from a home PC to catch up on email, or someone
who may have authorization for a more robust County provided remote access
service such as Citrix or VPN, but again uses it only occasionally and generally
for convenience or productivity, This type of usage may be performed from an
approved County device that the employee is authorized to remove from County
premises (such as a PDA, smart phone, laptop computer, tablet computer or
, This section is not intended to violate, or confer authority to any County to violate, state or
federal law with respect to eavesdropping and wiretapping,
4/6/2Q11
9
other wireless mobile device) or may be from a non-County device such as a
kiosk PC at a conference or a personally owned approved PDA, smart phone,
laptop computer, tablet computer or other wireless mobile device on or off
County premises, In these cases, the individual should be authorized by
management for this type of access and should continue to adhere to all County
computing policies for County related activity. In addition, the nominal remote
access user is responsible for ensuring the security of County information
regardless of the environment from which he or she is remotely accessing any
County information or service. In addition, the nominal remote access user
should understand that at no time should any County data be stored on a non­
County device, including a home PC, regardless of how short a period of time.
Any non-County device that has had County data stored on it can become
subject to CORA
Teleworking is defined as participating in a County sponsored program that
permits an employee to work a regularly scheduled portion of their job from a
remote access site, generally home. A separate Teleworking agreement must be
signed and on file for each employee who is Teleworking, This agreement can
be obtained through Human Resources. In all Teleworking situations, Arapahoe
County computing policies will apply.
All remote access is subject to the privacy and monitoring policies contained
herein,
Violations:
Violations of this policy may result in disciplinary or legal action up to, and
including termination of employment, criminal/civil penalties, or other legal action
against the employee.
Complaint Procedures:
To report a violation, employees should contact their supervisor and/or manager
who should report it to the appropriate official. The responsible department
director/Elected Official shall then take appropriate action. Alternative avenues
for reporting include Human Resources and the "Ethics Hotline",
Examples of Permissible Uses of Arapahoe County Computing Resources:
• Day-to-day functions as outlined by the employee's written job
descriptions, his/her supervisor/manager, or by the governing body that
oversees the employee's department.
4/6/2011
10
• Disseminating appropriate County documents to other individuals or
organizations.
• Communicating with other County employees.
• Obtaining information from job-related vendors on products and services.
• Use in applying for or administering grants or contracts for County
Govemment research or programs.
• Communication with members of professional organizations, collaborating
on articles and other writing, reviewing information on career and
educational opportunities, and participating in reading electronic
discussion groups on professional or career development topics.
• Training to enhance business and/or technical skills, pertaining to the
employee's job function or as assigned by the employer.
• Broadcast messages (messages sent to large distribution lists such as
department lists or building lists) are allowed, but should be restricted to
those instances where there is a clear business need to inform all e-mail
users.
• Subscriptions to job-related Internet mailing lists and newsgroups.
• Reasonable incidental personal communications or transactions, so long
as it does not interfere with the conduct of Arapahoe County Business,
incur additional system costs, interfere with the employee's duties, or
violate any other County policy, procedure or departmental standard.
Examples of Prohibited Uses of Arapahoe County Computing Resources;
• Sending broadcast messages or mass file attachments for personal use.
This includes the sale of any personally owned item or school fundraisers,
etc, It is suggested that the employee instead use the Classified Ads on
the Intranet or in the County Line Newsletter.
• Sending email to 'all employees' either with or without using one or more
distribution lists unless approved by Communication Services. Most
employee information is more appropriately distributed through another
fonm, such as the AC Weekly.
• Subscriptions to non-business related Internet mailing lists.
• Use of the County's e-mail system for any illegal activity including, but not
limited to, gambling, child or other pornography, soliCitation to distribute or
purchase controlled substances, etc,
• Messages or Internet content containing sexual implications, racial slurs,
gender-specific comments, or any comment that offensively addresses
someone's age, religious or political beliefs, national origin, or disability.
• Use of electronic communications to be used to send or receive
copyrighted materials, trade secrets, proprietary financial information,
chain letters or Similar materials.
• Use of non-approved electronic communications such as third party "chat"
software. These or other messaging services may be used only within the
County network and with approved County standard software.
416/2011
11
• Use of electronic communications to solicit, communicate, or recruit for
outside commercial ventures, religious or political causes, matters or
organizations not connected to the County business, or other non-job
related solicitations.
• Knowingly distributing any e-mail message that includes a virus or other
destructive program, or intentionally developing or distributing programs
that are designed to infiltrate computer systems internally or externally.
• Distribution or saving of any non-business related file attachments or
software, such as games, pictures, video or audio clips is prohibited.
• Unauthorized distribution or saving of copyrighted materials, applications
or programs, confidential business materials, non-business related or
confidential financial information or similar materials.
• Playing computer games, either on the local machine or through the
network.
• Accessing non-County networks that could allow access into the County
network.
• Downloading of or unauthorized linking to copyrighted information or
software.
• Accessing or downloading any resource for which there is a fee without
prior appropriate approval.
• Attempting to access any computer system or resource that an employee
is not authorized to access (hacking).
• Representing oneself as another user or employee.
• Disclosing your userid and password to anyone for any purpose.
• Installing any unauthorized software on any computer for any reason,
without prior appropriate consent.
• Copying software, or giving software to any outside third party.
• Altering, in any manner, including but not limited to: decompiling,
disassembling, cross-compiling, reverse engineering, or creating
derivative works without prior written consent of the vendor and as
directed by the County.
• Removing computer equipment, software or documentation without the
prior permission of the department director/Elected Official.
• Careless use of County-owned hardware, including but not limited to,
leaving equipment in unattended vehicles or public areas.
• Altering hardware configurations.
• Use of electronic communications for sensitive personnel or legal
matters may be restricted in certain situations at the direction of
ACG management or legal.
4/6/2011
12
Hardware/Software Standards and Support:
Information Technology shall provide support for all approved computing
platforms including the following:
• Standard software installation on all hardware: the standard desktop
consists of one of several different Microsoft Operating Systems, the
Microsoft Office Suite, and any departmental application that has been
approved by Information Technology.
• Network, server and storage infrastructure and voice communications
• Hardware connections for approved synchronization
• Replacement of County-owned hardware under warranty due to hardware
failure
• Basic training on standard hardware Isoftware for users
• Answers to frequently asked questions about standard hardware and
software
• Reconfiguration of hardware when it is transferred to another employee or
if the current employee's user identification changes.
416/2011 13

Sign up to vote on this title
UsefulNot useful