7-2025 Information Technology Policies.pdf

Information Management Services Division

Department of Administrative Services

Title: Administrative Directive on Acceptable Use Issue Date: 04/15/2020 Approval: Chief Information Officer Supersedes: 08/24/2018

Contact IMSD Service Desk: Information Management Services Division Contact the Service Desk regarding requests, incidents, and approvals.

Email: helpIMSD@milwaukeecountywi.gov Phone: 414-278-7888

Definitions 1) County: Milwaukee County Government

2) Directive: This Administrative Directive on Acceptable Use.

3) IMSD: Department of Administrative Services – Information Management

Services Division

4) Information System: Hardware, Software, Data, Networks, Portable

Devices and any other County data processing infrastructure, equipment, technology, components, information or material of any sort, on premises and in hosted services over the Internet (a.k.a. “in the Cloud”).

o Hardware: Physical data processing components, goods or equipment of any sort owned or controlled by the County.

Hardware includes Portable Devices.

o Software: Data processing programs on or associated with Hardware, irrespective of where software resides or executes.

o Data: Information, communication, material or graphics of any sort stored or transmitted electronically via the Information System.

o Networks – Connecting systems that allow the Information System to communicate. This includes wireless networks.

o Portable Devices – County portable Hardware, including cellphones, tablets and laptops.

5) User: Any person using Information System, including a County employee, vendor, consultant, contractor, vendor, and agent who is authorized to use County Information System.

Purpose This Directive sets out acceptable uses of the County’s Information System.

IMSD Principles Everything on the Information System, whether job-related or personal, belongs to the County. The County is the sole owner of the Information System and all Data.

The Information System is owned and controlled by the County and is provided to further the efficient operation of the County’s business. The Information System is not provided for inappropriate uses or for the personal convenience of Users.

Users have no expectation of privacy when using the County Information System. The County Information System is subject to search at any time by the County or its agents, without notice to or permission of Users.

All Data, whether or not “personal,” is subject to the County’s monitoring, review, deletion or collection at any time, without notice or permission, to mailto:helpIMSD@milwaukeecountywi.gov ensure compliance with this Directive, to comply with law enforcement requests, to complete an investigation, to defend the County in legal proceedings, to comply with open records requests or for any other reason consistent with the law. This includes documents, emails, texts, instant messages, graphics, photos or any other items.

Any Data or Software created by a User in the scope of or related to the User’s work for the County becomes the property of the County upon creation, and must not be copied or shared except to assist the User in the performance of her or his County work.

Accountability and Enforcement

County employees, contract workers or other non-employee Users (including vendors) will be required to acknowledge and sign this Directive.

Failure to comply with this Directive will constitute action outside the scope of the User’s County employment or obligations and may result in discipline up to and including termination of the User’s employment or engagement.

Failure to comply may also result in denial of access to the Information System.

Federal law may also apply when the crime is committed on a computer or communications device that communicates to another device outside of the state.

User Procedures and Conduct

1) The Information System

a) Access

i) Only authorized Users may use the County Information System, and only through their own usernames, passwords and other means made available by the County.

ii) Users must not knowingly share or allow the use of usernames and passwords with anyone, whether or not another User.

iii) Users may access, use or share Data only to the extent authorized and necessary to fulfill assigned job duties.

iv) Users are accountable for all work, transactions and communications under their usernames and passwords.

v) Users are expressly prohibited from pursuing unauthorized access to restricted areas of the Information System and from accessing or trying to access, copy, alter or delete the Data of any other User without authorization.

vi) Users requiring job access to material or sites otherwise prohibited under this Directive may submit a specific written request, approved by management, to IMSD for consideration.

b) Inappropriate Activity

i) Users are expressly prohibited from accessing, displaying, downloading or distributing any Data or material of any sort that could be deemed pornographic, racist, sexist, defamatory, discriminatory, harassing or otherwise offensive or in violation of County policies, resolutions or ordinances, state or federal law, or any other applicable law.

ii) Users are expressly prohibited from using the County Information System to attempt to probe, scan, disable, overload or breach the security or authentication measures of any system or Network, either internally or externally.

iii) Users are expressly prohibited from knowingly introducing or propagating any computer virus or other harmful feature in the Information System.

Users must use extreme caution when opening e-mail attachments received from unknown senders, which may contain malicious content. A User who becomes aware of a virus or other harmful feature must immediately disconnect from all Networks, cease using the Information System and immediately report the discovery to the IMSD Service Desk (see Contact section).

c) Software

i) Only Software owned, licensed or authorized by the County may be installed or used on the Information System. Users are expressly prohibited from installing or attempting to install unauthorized Software.

ii) Users must not download Software from the Internet unless specifically authorized to do so by IMSD. Users must not download or distribute pirated Software or Data.

d) Data and Physical Security

i) Users must store all County-related Data in County designated storage locations where it can be backed up. No personal, non- County Data is to be stored on the Information System nor should the Information System be used to collect, store, transmit or transfer any type of personal data and information.

ii) Any theft, loss or unauthorized disclosure of Data must be reported immediately to the IMSD Service Desk (see Contact section).

iii) Any Data or material, including personal material, that is stored on the Information System is not private and is subject to County access and disclosure at any time, including to comply with law enforcement requests, to complete an investigation, or to defend the County in legal proceedings.

iv) Users must take adequate steps to protect the physical security of the Information System by ensuring Portable Devices are securely stored when not in use and workstations are locked when left unattended. Any theft or loss of Hardware must be reported immediately to the IMSD Service Desk (see Contact section).

v) Users must preserve all Data required to be retained under applicable law, resolution or policy. This includes emails, texts and, where possible, instant messaging where applicable.

vi) Users who maintain “isolated” Data such as safe combinations, alarm codes, domain name registry passwords, administrative passwords, off-site storage access codes, etc., must contact the IMSD Service Desk (see Contact section) to ensure that duplicate copies of the information are securely maintained.

e) Portable or Mobile Hardware

i) Users who have been issued County Portable Hardware (such as smartphones, tablets, or network access devices) or access the County Information System remotely through any other personally owned Hardware that is approved by IMSD must ensure they are protected with a password or a passcode, and must secure the equipment when left unattended.

ii) The theft or loss of any County- or personally owned portable or mobile Hardware (such as smartphones or tablets) that accesses the County Information System remotely must be reported immediately to IMSD Service Desk (see Contact section).

iii) Users accessing County Information Systems through County-owned or personally owned mobile devices must comply with data protection laws and regulations.

iv) Any mobile device that is used to conduct Milwaukee County business must be used appropriately, responsibly, and ethically in compliance with this Directive.

v) Users using Portable or Mobile Hardware must comply with applicable laws and ordinances restricting mobile device usage while driving.

vi) Under this Directive, users are not allowed to use mobile devices while operating a vehicle even where it is legal to do so.

2) Email and Texting, Instant Messaging, Social Media and Internet

a) General

i) Users must not send sensitive or confidential Data over the Internet or via email without adequate protection securing the Data. Examples include credit card numbers, telephone calling card numbers, fixed passwords, health information or customer account numbers which relate to personal identification information or personal health information.

ii) The Information System, including email, texting, etc., is not to be used to convey non-work-related information other than described in the section on Incidental Personal Use.

b) Email and Texting

i) Users must take care when using email or texting as a means of communication because, although often informal in nature, email communications may be subject to production in a legal action or Public Records request.

ii) Users must not knowingly distribute or forward hoax virus warnings, chain letters, jokes, political commentaries, or similar unsolicited email or texts of any kind.

iii) Users must not access any other User’s email or texts without explicit authorization from that User (e.g. through Outlook delegates) or proper management permission.

iv) Users must not send any email or text purporting to come from another User without explicit authorization from that User (e.g., through Outlook delegates).

v) Users must not use personal email accounts to conduct ANY type of official County business.

vi) Due to their disruptive effect, system-wide or “all user” messages or blasts are prohibited, except as part of the County’s authorized emergency response efforts. Please note the County intranet may provide a suitable location for information of interest to all employees.

c) Instant Messaging

i) Users may access approved instant messaging services only for informal business communication like a quick phone call or quick in-person verbal communication, unless the content of the messages is subject to an instruction to preserve records and electronically stored information.

ii) Users must communicate only with known and trusted correspondents via instant messaging

iii) Instant messages should not be used to transfer or record any substantive government information, because instant messages are not normally stored or saved.

3) Internet and Intranet

a) Business Internet Access

i) When visiting an Internet site, information identifying a User's PC may be logged (i.e. cookies, temp files). Therefore, Users must assume they are identified as County employee or contractor or vendor and act appropriately at all times.

ii) Users must not access websites, blogs, discussion forums, chat rooms or other locations that are inappropriate or have any content that could be construed as defamatory, harassing or otherwise offensive (e.g.

pornography, bullying) or in violation of County policies.

iii) Users must always exercise caution when using a County e-mail address to join networking sites. While such use may be appropriate as part of job duties for some (e.g. LinkedIn), for others this may not be the case.

iv) Users accessing a web site must comply with its terms and conditions.

Users may not infringe copyrights or other protections.

v) Users may not use the Information System to download, play or store personal photographs, music or video files (e.g. MP3, MP4) due to capacity, copyright and legal issues. Personal photographs, music and video files will be deleted from County servers when found. Users may not stream video or audio (e.g., Internet radio, Pandora, sports video) whose content is not directly related to the business of Milwaukee County Government.

vi) The County routinely blocks access to Internet sites that are deemed to be inappropriate or to pose an information security threat to the County.

Access is prohibited. Any attempts to access blocked Internet sites are monitored and recorded. Persistent attempts to access blocked sites may result in discipline or termination.

vii) The County may monitor and disclose User’s Internet activity to ensure compliance with this Directive or for any other purpose permitted or required by law.

b) Social Media or Networking Sites

i) Users must be mindful of, and clear about, the capacity in which they are participating. Only authorized County spokespersons should make statements on social media sites on behalf of the County.

ii) Social media or networking sites may be accessed only as needed for the User’s job. Personal use of social media on the Information System is prohibited.

iii) Interactions on social media or networking sites must comply with all County policies.

4) Incidental Personal Use

i) Incidental Personal Use of the Information System consists of occasional, brief use of the Information System (including email or Internet) for short, routine, non-sensitive, non-confidential communications. For illustration, this might include: an email to check on a child’s arrival home from school, an email to meet someone for lunch, a quick check of the Internet for weather or news.

ii) Incidental Personal Use is permitted. This use is at the absolute discretion of the County and no User may expect or claim such personal use as a right or expect such use to be private. Excessive use or other abuse may result in discipline or termination.

iii) Incidental Personal Use is not allowed if it interferes with the performance of the User’s duties, exposes the County to expense or liability, or is unlawful for the County.

5) Prohibited Uses

In addition to prohibited activity set out elsewhere, the following are also expressly prohibited:

i) Users are prohibited from using the Information System for solicitations for outside organizations, political or religious causes, or with the operation or management of any business other than that of the County.

ii) Users are prohibited from using the Information System for personal online shopping, personal online sales, or other online transactions.

Users may use the Information System for occasional, brief access of online services such as online banking, using the User’s personal email and account information.

iii) Users are strictly prohibited from using County email addresses for non- County business. For example, a County email address may not be used for personal online shopping or financial transactions, personal blog or bulletin board memberships, personal email alerts from merchants or teams, etc., or as part of a payment such as PayPal.

iv) A County email address may not be used as a User’s personal address for: Facebook, social media, Twitter or similar services, online subscriptions, game systems, online gaming or gambling, couponing, or contests and sweepstakes.

v) Use of the Information System for gambling of any sort (including “social” gambling or office pools), games of chance or games of skill, online video games, lotteries, or sweepstakes is strictly prohibited.

vi) Personal, offensive or inappropriate use of webcams, video conferencing equipment, recording devices or microphones is prohibited.

vii) Child pornography is illegal. The use of County technology resources or privately-owned devices that are attached to the County network to store, display, or disseminate pornographic or other sexually explicit content is strictly prohibited. Any such use must be and will be reported immediately to the Milwaukee County Sheriff's Office and/or the Milwaukee County District Attorney Office.

Reporting Violations Users or any other County employees are required to report violations, or suspected violations of the Acceptable Use directives. Violations may expose the County to a host of legal and information security risks. Activities that should immediately be reported to a manager or supervisor include, but are not limited to:

1) attempts to circumvent established computer security systems

2) use or suspected use of virus, Trojan horse hacker programs or any other intrusive program

3) obtaining or trying to obtain another User's password

4) using the computer to make harassing or defamatory comments or to violate Milwaukee County's Harassment Policy or Milwaukee County Civil Service Rules

5) illegal conduct of any kind.

Reported violations will be investigated. Failure to adhere to this reporting policy may result in discipline, up to and including termination of user’s employment or engagement.

Users or employees who, in good faith, report violations or suspected violations will be protected from retaliation. However, Users or employees who falsely accuse another of violations without a good faith basis for such accusation are also subject to discipline, up to and including termination of employment or engagement.

Reporting Lost or Stolen Devices

All lost, or stolen devices, or devices that have gone missing, must be reported as soon as possible to the IMSD Service Desk (see Contact section) and to your manager or supervisor.

MILWAUKEE COUNTY

ADMINISTRATIVE DIRECTIVE ON ACCEPTABLE USE OF INFORMATION TECHNOLOGY

STATEMENT

I acknowledge that I am in receipt of Milwaukee County's Administrative Directive on Acceptable Use of Information Technology and that violations of my obligation to adhere to this directive may result in corrective action, including termination from Milwaukee County service or immediate termination of vendor contract with Milwaukee County. I also understand that violations of this directive on my part may result in Milwaukee County taking action that will deny me access or rights to any of Milwaukee County's technology resources.

I acknowledge that I have read and will comply with this administrative directive.

Signature Print Name

Date

Title: Administrative Directive on Remote Network Access Issue Date: 04/15/2020

Approval: Chief Information Officer Supersedes: 9/17/2015

Definitions: • County: Milwaukee County Government

• Directive: This Administrative Directive on Remote Network Access

• IMSD: Department of Administrative Services – Information Management

Services Division

• Information System: Hardware, Software, Data, Networks, Portable

Devices and any other County data processing infrastructure, equipment, technology, components, information or material of any sort, on premises and in hosted services over the Internet (a.k.a. “in the Cloud”).

• Hardware: Physical data processing components, goods or equipment of any sort owned or controlled by the County. Hardware includes Portable Devices.

• Software: Data processing programs on or associated with Hardware, irrespective of where software resides or executes.

• Data: Information, communication, material or graphics of any sort stored or transmitted electronically via the Information System.

• Networks: Connecting systems that allow the Information System to communicate. This includes wireless networks.

• Portable Devices: County portable Hardware, including cellphones, tablets and laptops.

• Remote Access: A secure connection to the County network in order to access resources that are not otherwise publicly available, from a computer that is not directly connected to the Milwaukee County network.

• User: Any person using Information System, including a County employee, consultant, contractor, Vendor, and agent who is authorized to use County Information System.

• Vendor: A party in the supply chain that provides goods and services to the County; a third party or independent business partner.

Purpose: This directive defines the requirements for remote access to County networks and systems from outside networks, computers, and agencies.

Access to publicly available web services is not considered “remote access” for the purposes of this directive.

Requesting Remote Access:

All remote access must be justified by a business need. Requests that do not clearly specify the business need will be rejected. Remote access is granted on a least-privilege basis. That means that a valid request must also include the exact County resources to which the requestor needs remote access.

Access will be granted to these resources only, and all requests for additional remote access must go through the same procedure.

Remote access for County employees and contractors will be provided using

County-owned computers with IMSD-approved remote access software. Any exceptions to this directive must have an approved business need (see “Approved Business Need” section below.)

Remote access for vendor users must use a computer that meets IMSD security requirements and uses the IMSD-approved remote access software.

A request for remote access must be sent to the IMSD Service Desk and must include the following information for each individual person who will need access: Name, email address, contact phone number, department or company/agency, County resources to be accessed remotely, contract expiration date if this need is based on a support or other contract with a defined end date.

Each request will be reviewed by IMSD business analysts to validate the business need and ensure that the collected information is complete and accurate. After this review is complete, and the business analyst approves the request, the IMSD Service Desk will send the County remote access agreement to be signed by all requestors. This will be placed on file prior to user accounts being created.

Security Requirements:

All User accounts for non-County Users requesting remote access will be configured to be disabled at all times, unless an approved business need exists.

When a User requires remote access for any purpose, they will need to contact the IMSD Service Desk and provide the reason they are accessing the network.

This will be reviewed, and if valid the User account will be enabled for the appropriate amount of time based on the need.

In cases where an approved business need exists for the account to be kept enabled, an expiration date will still be applied for no more than a one-year duration. After each year the account shall be reviewed to ensure that the business need is still valid, and contact information is still accurate.

A malware protection product must be installed on all remote devices running Microsoft Windows as the operating system. This product is preferably a behavioral analysis malware prevention solution or minimally must be receiving virus definition updates at an interval no longer than every day.

Split tunneling (allowing access to the County network and to the remote user’s local network simultaneously) will be disabled for all remote Users unless an approved business need exists. Convenience in more efficiently accessing documents or data on the remote network is not an approved business need for the purposes of this section.

Remote Users are not permitted to share their login credentials, nor write them down or keep them in an electronic file in any unencrypted form.

Remote Users (including the vendor company representative) are required to notify the IMSD Service Desk immediately when a User is leaving their company or agency, changing roles that no longer requires remote access, contract expiration, loss or theft of a device that has been configured for remote access to the County network, or suspected loss or theft of user credentials and passwords.

Web or Client Based Remote Access Tools:

Web or client based remote access tools (examples: LogMeIn, TeamViewer, GoToMyPC) are not allowed to be used on the Milwaukee County network without express written permission from IMSD. Permission will generally be granted for isolated, vendor supported systems. Permission may be denied for remote access to Milwaukee County PCs. To apply for permission to use a web or client based remote access tool please submit your request and business need to the IMSD Service Desk.

Change Management:

Milwaukee County enforces a change management process for all IMSD managed systems. Any change to production environments requires approval by this process prior to proceeding. You are responsible for following this process when connecting to Milwaukee County systems. If you are unfamiliar with this process, please work with the IMSD business analyst for the department you are working for prior to making any changes to systems. If you do not know who this is, please contact the IMSD Service Desk.

All exceptions made to the User account disabled rule will require the remote access requestor to read, understand, and sign off on the Milwaukee County change management policy.

Approved Business Need:

All exceptions to this directive, or any subsections that require an “approved business need”, will be approved by the following process: exception submitted to IMSD business analyst for the requesting department/division, if business analyst agrees, request will then be submitted to Connectivity manager and reviewed, if manager agrees, request will be submitted to County’s Chief Technology Officer for final approval.

Contact: IMSD Service Desk at imsdhelp@milwaukeecountywi.gov or call 414-278-7888.

Urgent requests or security incidents should be reported via phone call for the fastest response.

mailto:imsdhelp@milwaukeecountywi.gov

MILWAUKEE COUNTY

ADMINISTRATIVE DIRECTIVE ON REMOTE NETWORK ACCESS

STATEMENT

I acknowledge that I am in receipt of Milwaukee County's Administrative Directive on Remote Network Access and that violations of my obligation to adhere to this directive may result in corrective action, including termination from Milwaukee County service or immediate termination of the vendor contract with Milwaukee County. I also understand that violations of this directive on my part may result in Milwaukee County taking action that will deny me remote network access to Milwaukee County's technology systems.

I acknowledge that I have read and will comply with this administrative directive.

Signature Print Name

Date