TACS.pdf

Technical Architectural, Compatibility and Supportability Requirements Document (TACS)

Contents Introduction

Purpose:

Instructions:

Our Environment:

1. Non-Technical Requirements

2. General Applications and Services Technical Questions

3. Applications and Services Hosted internally onto the BCC Network Technical Questions

4. Cloud Based Applications and Services Technical Questions

5. Sensitive Data Collection

6. Compliance & Approval

Appendix 1 - CMA 5401 - Information Systems Lifecycle Management

Appendix 2 – Vendor Remote Access Packet

Collier County TACS - Version 7.2025 Page 1 of 11

Introduction

Purpose:

The Technical, Architectural, Compatibility, and Supportability (TACS) document is designed to assess software applications under consideration for purchase by our organization. The TACS document serves as a standardized questionnaire submitted to vendors to gather detailed technical information. The responses help determine whether a solution aligns with our internal infrastructure, security standards, and support capabilities.

Instructions:

Please complete the sections of this document that are relevant to the deployment model of your solution.

• All vendors must complete the General Applications and Services Technical Questions section first. These questions apply to all solutions, regardless of whether they are hosted internally or cloud based.

• If your software is to be hosted internally (on our organization's servers or workstations), complete the Hosted Internally section. This includes applications installed on Windows Servers, PCs, or those that require direct access to local infrastructure such as a SQL database.

• If your solution is cloud-based and accessed via a web browser over the internet, complete the Cloud- Based section. This includes SaaS or web-hosted platforms that do not require local installation or infrastructure.

• If your solution offers both deployment options, please complete both sections accordingly.

Our Environment:

At Collier County, we have made significant investments in a core set of technologies to support and standardize our IT infrastructure. These key platforms include, but are not limited to:

• Microsoft o Windows Desktop and Server operating systems, Microsoft SQL Server, Office 365, SharePoint, System Center Configuration Manager (SCCM), Active Directory (AD), and Microsoft Entra.

• Apple o iPhone and iPad mobile devices.

• Cisco o Cisco enterprise network infrastructure, WebEx for communication and collaboration, and Cisco-based telephony systems.

• VMware o VMware ESX for server virtualization and resource optimization.

• ESRI

o ArcGIS Server and ArcGIS Online for GIS and geospatial data services.

• SAP

o SAP S/4Hana

Collier County TACS - Version 7.2025 Page 2 of 11

1. Non-Technical Requirements

1. Vendors must read and understand the Information Systems Procurement And Lifecycle Management Policy

(Appendix 1 – CMA 5401) o ☐ Acknowledged

2. The vendor must submit any applicable license agreements for any proposed elements including a description of the licensing model, and list prices for all license types and whether custom licensing arrangements are available.

o ☐ Acknowledged

3. The vendor must submit any applicable maintenance agreements for any proposed elements including a description of the maintenance plan, software upgrade policies and exclusions, and list prices for all maintenance agreement types and whether custom maintenance agreements are available.

o ☐ Acknowledged

4. Vendors who require onsite access to Collier County facilities or remote access to the County’s network without direct supervision must comply with all current County ordinances and policies, including fingerprinting, a background check, and signing any vendor agreements necessary to access the BCC computer network. A vendor packet outlining all these requirements is included in Appendix 2.

o ☐ Acknowledged

Collier County TACS - Version 7.2025 Page 3 of 11

2. General Applications and Services Technical Questions

1. All desktop software applications must utilize the current Microsoft Operating

System, The current Collier Production Version release with current patches and service packs, Windows 11 (64-bit).

Yes No

2. All software upgrades or changes required by the selected vendor must be fully tested before being moved into the production environment. Therefore, vendors must include in their proposal the costs for licensing, professional services, and annual maintenance to set up and maintain test and development environments.

Yes No

3. The candidate software application proposal must include a complete hardware topology diagram and recommended hardware configurations. Vendor Deliverables:

Architectural Diagram Recommended hardware requirements (workstation and server) Network bandwidth requirements

Yes No

4. Web-based solutions must utilize either Microsoft Edge or Google Chrome for both PC’s and iOS Devices

Yes No

5. All applications are required to utilize TLS version 1.2 or higher. Yes No

6. SAP is Collier's financial application and is governed by the Collier County Clerk of

Courts MIS department. The following provisions must be met:

a. Applications are limited from directly interfacing with SAP.

b. Applications that have a point of sales component must be able to produce a batch file daily containing all financial transactions for that day for import into

SAP.

c. The batch file will use the format supplied by the Collier County Clerk of Courts.

Yes No

7. If US-CERT publishes a vulnerability (CVE) with a CVSS score of 7.0 or higher for an application, the software vendor must mitigate it within 30 days. Vulnerabilities rated

7.0 or above are classified as high to critical severity and require immediate action.

Yes No

8. Software vendors must provide written acknowledgment, prior to selection, that all data and databases are the property of Collier County Government.

Yes No

Collier County TACS - Version 7.2025 Page 4 of 11

3. Applications and Services Hosted internally onto the BCC Network Technical Questions

1. The Information Technology Division requires the following Cyber Security software as part of its standard suite of tools essential for monitoring, threat detection, system protection, and maintaining the overall security posture of the organization. Does your software have any known issues with the following:

a. Change Auditor

b. Windows Firewall

c. System Center Endpoint Management

d. Cisco AnyConnect VPN / Zscaler Private Access

Yes No

2. Does your application require any third-party plugins or software as part of your software solution? Are there any embedded applications in your solution?

If so please list and explain:

Yes No

3. To optimize resource utilization and maintain operational efficiency, the Information Technology Division leverages virtual servers. All software application servers will be deployed on the latest supported version of VMware ESX.

Yes No

4. The proposed solution must be compatible with the latest version of Veritas NetBackup as used in the Collier Production environment.

Yes No

5. Server software applications must be deployed on a Microsoft Windows Server operating system, adhering to the Collier production standard. The system must be updated with the latest patches and service packs. The currently approved version is Windows Server 2025

Yes No

6. Solutions requiring a back-end database must utilize Microsoft SQL Server Standard or Enterprise Edition. The solution must be deployed on Microsoft SQL Server 2022 (64-bit) or a newer version. Additionally, the database compatibility mode must align with the installed version of Microsoft SQL Server.

Yes No

7. For solutions utilizing SQL Server, the use of the default 'SA' account is strictly prohibited. Additionally, assigning the 'SA' role for daily operational activities is not permitted. All solutions must adhere to the principle of least privilege, ensuring users and processes operate with only the minimum access necessary.

Yes No

8. The proposed solutions must be compatible with Volume Shadow Copy Service (VSS) Yes No

Collier County TACS - Version 7.2025 Page 5 of 11

4. Cloud Based Applications and Services Technical Questions

1. Does your application support Microsoft Entra for Single Sign On (SSO)? Yes No

2. Does the application require the installation of supporting software, including browser plug-ins on an end user's computer, if Yes please list all the plug-ins or software and version number:

Yes No

3. Provide a detailed architectural diagram of the application that includes links to all servers, services, ports, and IP addresses.

Yes No

4. Collier County uses an Agency-wide web filtering service. Vendors must confirm compatibility and provide all required IP addresses and or URL’s for whitelisting:

Yes No

5. Describe your data backup and recovery process.

Will a copy of the database be available if requested and what format will it be in?

Yes No

6. Identify the colocation data centers where your application is hosted. Include details on redundancy measures and/or disaster recovery plans to ensure service continuity in case of failure or natural disaster.

Yes No

7. What is the anticipated number of users and the estimated minimum bandwidth required?

Yes No

8. Does your cloud-based software support DKIM configuration for sending emails? Yes No

Collier County TACS - Version 7.2025 Page 6 of 11

5. Sensitive Data Collection

• Software must comply with all Federal, State and Local regulations, Especially the Florida Information

Protection Act (FIPA) Fla. Stat. 501.171. Vendors and consultants must be able to show that their applications either:

o Do not store the type of sensitive data mentioned in FIPA in their application's database.

o Be prepared to demonstrate how they secure the type of sensitive data mentioned in FIPA in their application's database.

• HIPAA compliance is required for any applications that contain an individual’s electronic personal information if it is created, received, used, or maintained in the software.

• All applications that include point of sales systems or accept any type of payment using credit cards must be PCI (Payment Card Industry Data Security Standard) compliant and recertify every year. All credit card processing devices must be encrypted at the device for secure transmission on an isolated network.

Must be reviewed and approved by our PCI Compliance Officer.

1. Does your application collect or store social security numbers for any reason? Yes No

2. Does your application accept credit cards for any transactions? Yes No

3. Does your application store any HIPAA or FIPA protected personal information? Yes No

Collier County TACS - Version 7.2025 Page 7 of 11

6. Compliance & Approval The IT Management Team provides approval, which is necessary before the device can be implemented and connected to the network. Network devices that do not meet security standards will require additional risk assessment and mitigation strategies before approval.

By submitting this form, the vendor acknowledges that the information provided is accurate and complete. Any undisclosed risks may result in the revocation of network access.

Vendor Representative Name:

Vendor Contact Email:

Vendor Contact Phone:

☐ I certify that the above information is accurate to the best of my knowledge.

Signature: _____________________________________ Date: ________________________

Collier County TACS - Version 7.2025 Page 8 of 11

CMA 5401

INFORMATION SYSTEMS PROCUREMENT AND LIFECYCLE MANAGEMENT

§ 5401-1. Purpose.

§ 5401-2. Procurement and Deployment.

§ 5401-3. Ongoing Support and Maintenance.

§ 5401-4. Application Retirement.

§ 5401-5. Waivers, Mitigation and Remediation.

§ 5401-6. Currency.

[Effective Date: April 18, 1997 (Revised: October 1, 2001; Revised: October 1, 2003; Revised:

January 21, 2016)]

§ 5401-1. Purpose.

The purpose of this Instruction is to define a standard, efficient, and effective method for procurement and lifecycle management of information systems and services that are compatible with the agency’s information architecture, supportable, interoperable, secure and comply with the County Information Technology Division (IT) standards and practices. All purchases must comply with the requirements of the County procurement ordinance and policy.

§ 5401-2. Procurement and Deployment.

A. A completed Technical Architectural Compatibility Standards (TACS) signed by the IT

Director and the procuring Operating Division Director is required prior to procurement.

The current TACS form is available on the IT Division’s Intranet website. All requirements must be met. Exceptions may be granted with sufficient mitigation or a waiver see § 5401-5. Waivers, Mitigation and Remediation.

B. Operating Division Director must determine permissible service levels including the maximum number of failures on an annual basis, the maximum downtime per incident and the acceptable data loss per incident in minutes.

C. Information systems must comply with all local, state and federal laws. Health Insurance

Portability and Accountability Act (HIPAA), Personally Identifiable Information (PII) and Payment Card Industry Data Security Standard (PCI DSS) requirements must be identified and addressed if applicable. PCI DSS certifications must submitted on an annual basis by the Operating Division Director.

D. An architectural diagram must be prepared and review conducted in compliance with IT policy. Approval by the IT Division Director is required prior to procurement and deployment.

§ 5401-3. Ongoing Support and Maintenance.

A. Systems must have an active vendor maintenance agreement that includes patches and upgrades.

B. Systems must support platform patches within 30 days of release. If patches cannot be installed appropriate mitigations must be identified and deployed within that timeframe

Collier County TACS - Version 7.2025 Page 9 of 11 by the Operating Division Director (see § 5401-5. Waivers, Mitigation and

Remediation).

C. Vulnerabilities identified and published by the Department of Homeland Security’s

United States Computer Emergency Readiness Team (US-CERT) must be mitigated by the Operating Division Director within 30 days of notice by IT (see § 5401-5. Waivers, Mitigation and Remediation).

D. The Operating Division Director is responsible for submitting a completed Technical

Architectural Compatibility Standards (TACS) to IT on an annual basis. All requirements must be met Exceptions may be granted with sufficient mitigation or a waiver see § 5401-5. Waivers, Mitigation and Remediation.

§ 5401-4. Application Retirement.

A. All system components must be shut down and decommissioned when systems are retired. This includes servers, databases, storage and uninstalling associated applications on PCs.

B. Budget inventory changes must be made at system retirement.

C. The Operating Division Director is responsible for public records compliance for all retired system data and contacting the agency’s Records Manager to determine the appropriate retention period. The operating Division Director is responsible for maintaining the systems to read the backup media including any required hardware and software and all associated costs.

D. Operating Division Director will review retirement plan with IT to ensure compliance with this CMA.

§ 5401-5. Waivers, Mitigation and Remediation.

A. Mitigation is required for systems that are not TACS compliant or require the use of older version of/or insecure components. Viable mitigation options include the use of technical controls, replacement or upgrade of the system and retiring the system.

a. The Operating Division Director is responsible for working with IT to develop an acceptable mitigation strategy. Scenarios involving technical controls are subject to the same review process as new systems.

b. The Operating Division Director is responsible for all costs, including support staff, associated with mitigation. These costs may include, but are not limited to:

i. Support for

1. Non-standard databases

2. Operating Systems

3. System components

4. Web servers

ii. Creation and maintaining development environments

iii. Initial and ongoing support for Firewalls and Intrusion

Detection/Prevention systems and monitoring

B. Waivers may be granted under extenuating circumstances.

Collier County TACS - Version 7.2025 Page 10 of 11

a. All waivers must be reviewed by the IT Director.

b. The Operating Division Director may grant a waiver where the impact is limited to their division.

c. Department Heads may grant waivers where the impact is limited to their department.

d. The Information Technology Executive Committee (ITEC) will make a recommendation to grant a waiver where the impact is at the agency level with final approval by the County Manager or his designee.

C. Remediation costs associated with a breach or system failure as the result of a waiver must be fully funded by the Operating Division Director.

§ 5401-6. Currency.

The Information Technology Division is responsible for maintaining the currency of this

Instruction.

Collier County TACS - Version 7.2025 Page 11 of 11

Request for Vendor Access to Collier County IT Systems

Vendors who need remote network access to the BCC network will need to do the following:

• Read CMA 5402

• Read CMA 5403 and completed the Third-Party Access Policy form

• Read CMA 5405

• Complete the Elevated Systems Privileges Agreement form (if required)

• Complete the Finger Printing Process

CMA # 5402

REMOTE ACCESS INSTRUCTION

§ 5402-1. Purpose. § 5402-4. Enforcement.

§ 5402-2. Background. § 5402-5. Definitions.

§ 5402-3. Policy. § 5402-6. Currency.

[Effective Date: January 1, 2005; Revised July 5, 2018]

§ 5402-1. Purpose.

The purpose of this Instruction is to define standards for remotely connecting to Collier

County's network. This Instruction will also ensure Collier County's compliance with applicable license, copyright, local, state and federal laws and regulations.

§ 5402-2. Background.

This Instruction is required to minimize the risk that any individual device could be configured or used in a manner which could compromise the confidentiality, integrity and availability of the network and associated resources. Damages include the loss of productivity due to downtime, damage to public image, and damage to critical Collier

County internal systems, and access to non-public data, which could result in possible violations of law concerning privacy (HIPAA, etc.). This Instruction applies to anyone that remotely connects to the Collier County network.

§ 5402-3. Instruction.

A. Requirements:

(1) All requests for remote access will be submitted to the Information Technology (IT)

Division. The request must 1st be approved by the requestor’s Division Director or direct supervisor.

(2) All trusted network connections and devices must be configured to meet the authentication and configuration requirements of the Collier County network.

(3) Only computers owned and supported by Collier County will be permitted to connect to the Collier County network, this includes both local network access as well as remote access via VPN.

(4) Vendors requesting access to the Collier County network will be provided a copy of all applicable instructions governing remote access and will demonstrate acceptance of those policies by signing a Third-Party Access Agreement,1 of which a copy will be retained by the IT Division.

OFFICE OF COUNTY MANAGER ADMINISTRATIVE

§ 5402-3 PROCEDURE § 5402-5

(5) Anyone with remote access privileges must ensure the computer or workstation that is remotely connected to Collier County's corporate network is not connected to any other private network at the same time using a 2nd network interface. Only the network interface being used in conjunction with VPN access is permitted to be connected.

(6) All remote access clients for VPN access will be configured by IT personnel according to IT Division procedures.

(7) It is the responsibility of the County employee, vendor or contractor who have been granted remote access to ensure that the computers used for remote access be connected to the network at least once in a thirty-day period so that it can receive the proper security patches and updates. Computers requiring security updates will be prevented from accessing the network until the required updates are completed.

§ 5402-4. Enforcement.

A. It is the responsibility of remote access users to comply with all applicable Collier County computer usage instructions.

B. Any employee found to have violated this Instruction may be subject to disciplinary action, up to and including termination of employment.

§ 5402-5. Definitions.

As used in this Instruction, the following terms shall have the meanings indicated:

HOST — Computer or another device connected to a network.

PRIVATE NETWORK — A network secured from external access from other networks and the Internet.

REMOTE ACCESS — All present and future methods by which hosts connect to the Collier

County Board of County Commissioners private network, such as dial-up, VPN, PC

Anywhere, etc.

TRUSTED NETWORK — A system that has the necessary controls to ensure that security policies will not be compromised

UN-TRUSTED NETWORK — A system with no verifiable security controls that would present a security risk to the Collier County Board of County Commissioners network.

1. Editor's Note: See CMA 5300, Third Party Access Instruction, and its accompanying attachments.

§ 5402-5 REMOTE ACCESS POLICY § 5402-6

VPN — Virtual Private Network. An encrypted connection to the Collier County Board of

County Commissioners network via the Internet.

§ 5402-6. Currency.

The Information Technology Department is responsible for maintaining the currency of this Instruction

CMA # 5403

THIRD PARTY ACCESS

INSTRUCTION

§ 5403-1. Purpose. § 5403-6. Currency.

§ 5403-2. Concept.

§ 5403-3. Instruction.

§ 5403-4. Enforcement.

§ 5403-5. Definitions.

[Effective Date: January 1, 2005; July 5, 2018]

§ 5403-1. Purpose.

The purpose of this Instruction is to define standards for vendors, contractors, consultants, and others who connect to Collier County's network from any host. These standards are designed to minimize the potential exposure to Collier County from damages that may result from unauthorized use of Collier County resources. Damages are defined to include, but not limited to:

the loss of productivity due to downtime, loss of sensitive or confidential data, loss of intellectual property, damage to public image, damage to critical Collier County internal systems, etc.

§ 5403-2. Concept.

A. This Instruction applies to all non-county staff using a Collier County owned computer or workstation used to connect to Collier County’s network. This Instruction applies to direct and remote access connections used to perform work on behalf of Collier County including reading or sending e-mail and viewing intranet web resources.

B. Access implementations covered by this Instruction include all methods of direct and remote access to the Collier County network.

§ 5403-3. Instruction.

A. General.

(1) It is the responsibility of Collier County that vendors, contractors, consultants, and others having access privileges to Collier County's network ensure their access connection is given the same consideration as the user's on-site connection to the

Collier County network.1

(2) The following Instructions must be reviewed by vendors, contractors, consultants, and other parties for details of protecting information when accessing the Collier

1. Editor's Note: See the Third-Party Network Access Agreement at the end of this CMA.

OFFICE OF COUNTY MANAGER ADMINISTRATIVE

§ 5403-3 PROCEDURE § 5403-4

County network via remote access methods and the acceptable use of Collier

County's network:

(a) Computer Technology Use (CMA 5405).2

(b) Remote Access Instruction (CMA 5402).3

B. Requirements.

(1) Secure access must be strictly controlled. Control will be enforced via one-time password authentication or public/private keys with strong pass-phrases. For information on creating a strong pass-phrase see the End User Computing Instruction.

(2) At no time should any third party (as described above) provide their login, password, or e-mail their password to anyone.

(3) Those with access privileges must ensure that a Collier County owned computer or workstation which is connected to Collier County's network is not connected to any other network at the same time.

(4) Vendors, consultants and other third parties will be permitted to access the Collier

County network only during normal business hours (8:00 a.m. to 5:00 p.m. Eastern

Standard Time), unless otherwise agreed to.

(5) Anyone making changes to any information system (including but not limited to servers, network infrastructure equipment, databases, and applications) must follow the Information Technology Division’s Change Management Instructions and

Procedures. Vendors, consultants and others will notify the IT Division immediately if passwords are lost, accounts are no longer required or if any attempts of intrusion are detected.

(6) Vendors, consultants and others will notify their sponsor and the IT Division immediately when one of their staff members (who has access to the County’s network) is no longer employed to ensure any access is terminated immediately.

§ 5403-4. Enforcement.

Any third party found to have violated this Instruction may be subject to loss of Collier County network access privileges or other penalties as prescribed in the vendor's contract with Collier

County or by applicable laws.

2. Editor's Note: See CMA 5405.

3. Editor's Note: See CMA 5402.

§ 5403-5 THIRD PARTY ACCESS INSTRUCTION § 5403-6

§ 5403-5. Definitions.

As used in this CMA, the following terms shall have the meanings indicated:

HOST — Computer or another device connected to a network.

PRIVATE NETWORK — A network secured from external access from other networks and the Internet.

REMOTE ACCESS — All present and future methods by which hosts connect to Collier

County’s private network, such as dial-up, VPN, PC Anywhere, etc.

TRUSTED NETWORK — A system that has the necessary controls to ensure that security instructions will not be compromised.

UN-TRUSTED NETWORK — A system with no verifiable security controls that would present a security risk to Collier County’s network.

VPN (Virtual Private Network) — An encrypted connection to Collier County’s network via the

Internet.

§ 5403-6. Currency.

The Information Technology Division is responsible for maintaining the currency of this

Instruction.

CMA 5405

COMPUTER/TECHNOLOGY USE

Effective Date: June 10, 1999 (Revised: December 1, 2000; Revised: February 12, 2001; Revised: October 1, 2001; Revised: October 1, 2003; Revised: May 30, 2004; Revised: June 11, 2004; Revised: January 1, 2005;

Revised: April 1, 2006; Revised: July 1, 2009; Revised: December 16, 2009; Revised: March 18, 2011;

Revised July 11, 2018; Revised June 7, 2019; Revised: June 7, 2024)

§ 5405-1. Purpose.

A. The goal of this instruction is to ensure the integrity, proper operation and security of the County’s technology resources by setting rules of conduct for use by all County employees, contract employees, and business partners.

B. This instruction applies to the Collier County Board of Commissioners Agency’s internal business network and associated systems and resources. This instruction does not apply to the, the

Transportation Signalization Network, the Public Utilities Plant Control and SCADA Networks, Emergency Management non-IP two-way communication systems and their associated systems and resources, except where they interface with the Agency’s internal business network.

C. This instruction sets forth the Agency’s practices and procedures governing the utilization of technology resources and disciplinary recourse for violations. This instruction also sets forth guidance for compliance with applicable laws governing the handling of specific kinds of data created with or transmitted by network resources.

§ 5405-2. Definitions.

A. AUTHORIZED ADMINISTRATIVE STAFF – IT staff and other staff authorized by the

Director, Information Technology Division who have elevated privileges and access rights for maintaining network resources and services.

B. BUSINESS PARTNERS – any person not directly employed by the Board of County

Commissioners who is authorized to utilize County technology resources. Examples of business partners would include, but not be limited to: vendors, contractors, and advisory board members.

C. DATA – Information stored by technology assets or transmitted from or through the network.

D. DATA CUSTODIANS - Staff with the authority for acquiring, creating, and maintaining data within their assigned area of control.

E. INAPPROPRIATE CONTENT - Content that is fraudulent, harassing, embarrassing, sexually explicit, profane, obscene, intimidating, defamatory, or contains sexual comments, obscenities, nudity, pornography, abusive or degrading language, antisocial behavior, or inappropriate comments concerning race, color, religion, sex, national origin, marital status, or disability or is otherwise unlawful is inappropriate for the workplace and may not be sent by e-mail or other form of electronic communication or displayed on County computers or stored in the County's systems.

F. LIMITED NON-BUSINESS USE – Use of the County’s technology assets that does not impact employee productivity and complies with all other aspects of this instruction.

G. NETWORK – The data, voice, and multimedia communication system made up of devices

(switches / routers / firewalls and the like), wires, fiber optics, jacks, access points (physical and wireless), software and services.

H. NETWORK RESOURCES – Any services which may be accessed through the Collier County network. Examples include, but are not limited to: software applications, e-mail, data, telecommunications, the Public Safety Radio System, and Internet resources accessed from or through the network.

I. REGULATED DATA – data that requires special handling due to statutes, regulations or agency policies. At this time, regulated data includes, but not limited to: Protected Health Information

(PHI) protected under HIPAA rules and statutes, Payment Card Industry (PCI) and other personal financial information (PFI) (e.g. credit card and bank account numbers) and personal identifying information (PII) (e.g. social security numbers), PII protected by the Florida Information Protection

Act (FIPA), addresses and names of judges and law enforcement officials, and other data exempted from the State of Florida’s Public Records Laws by statute.

J. SLATE – a form factor for a computing device that meets the following criteria:

1. Does not run Windows operating system as its base operating system, and

2. Uses “touch” as its primary mode of user interface.

K. TECHNOLOGY ASSETS – any devices owned by Collier County that are part of or used for data or voice communications. Examples include, but are not limited to: computers, network switches and routers, servers, databases, smart phones, cellular air cards, printers, telephones, public safety radios, and associated software and accessories.

L. TECHNOLOGY RESOURCES – includes all of the following: TECHNOLOGY ASSETS, information/data stored or in transit, the County’s private data network, NETWORK

RESOURCES, and all resources and services associated with other networks accessed from or through the County network, including the Internet, Internet Services, and other agencies’ or corporate networks and services.

M. USER – Inclusively, staff, elected / appointed officials, and/or business partners authorized to use

County technology resources.

§ 5405-3. Concept.

A. Compliance:

1) This instruction applies to all users of Collier County technology assets, network and/or network resources including authorized administrative staff except when utilizing properly authorized elevated privileges or access rights in the discharge of their duties.

a. Authorized administrative staff’s use of elevated privileges is governed by IT

Division instructions.

b. Employee violations will be assessed, and disciplinary actions will be governed by

CMA 5351 – Discipline, and CMA 5311.1 - Standards of Conduct.

c. Business partner violations will be subject to loss of the use of technology assets, network and/or network resources and contractual sanctions.

2) Because of the interdependent nature of network and communications systems, interruptions of service can have a broad impact with the potential for large adverse financial consequences or impact to health and safety. Loss of technology resources and/or misuse of network resources can cause financial damage to the County, the taxpayers of Collier County, and those who depend on County services, therefore, these resources must be protected. As such, violations of this instruction may unduly expose the network to intended or unintended risks, which may or may not result in actual losses.

a. The Director, Information Technology may disable network access for violations of this instruction.

b. The severity of infractions will be assessed by the Director, Information Technology who will forward a risk / threat assessment to the supervising Division Director for use in making recommendations for disciplinary actions in accordance with CMA 5351 -

Discipline.

c. The Human Resources Division will advise Division Directors in order to ensure consistency in the handling of employee violations of this instruction.

3) Collier County, at its discretion, reserves the right to monitor any use of network resources, to monitor computer and internet usage, including, but not limited to: sites visited, searches conducted, information uploaded or downloaded and to access, retrieve and delete any data stored in, created, received, or sent over the network or using network resources for any reason and without the permission or prior knowledge of any user. Collier County may monitor the use of technology assets, content of electronic communications and the usage of network resources to support operational, maintenance, auditing, security, disciplinary, and investigative activities.

4) County employees and authorized business partners using County owned technology or network resources have no right or expectation of personal privacy for any voice communications, e-mails, internet searches, internet sites visited, or data stored in, created by, received with, or transmitted using technology resources. Use of passwords or other security measures, whether mandatory or voluntary, does not in any way diminish Collier County's rights or create any privacy rights of users. Collier County has administrative tools that permit it to monitor all activities on the network and access all data stored within technology resources.

5) All Collier County employees and business partners who have access to technology assets and/or network resources must affirm that they have read and understood all applicable policies annually.

B. User Responsibility:

1) Authorized network users are responsible to ensure that network resources are used only for their intended purposes.

a. Except for services intended for use by the public (kiosks, terminals and public wireless services) technology assets, technology resources, network resources, the network and data are intended exclusively for the use of authorized employees and business partners only.

b. Technology assets, technology resources, network resources, the network and data are the property of Collier County Government. Collier County provides these systems to be used for County business purposes, although limited non-business use is permitted.

All communications and data transmitted by, received from, passed through, or stored in these systems are the exclusive property of Collier County. At all times, employees and authorized business partners have the responsibility to use these resources in a professional, ethical, and lawful manner.

c. Use of technology and network resources is a privilege that may be monitored, restricted or revoked at any time. Collier County reserves the right to revoke the privileges of any user at any time.

d. Conduct that interferes with the normal and proper operation of Collier County's network or network resources, which adversely affects the performance of the network or the ability of others to use the network or network resources or, which is harmful or offensive to others will not be permitted. Such actions may subject employees to disciplinary action in accordance with CMA 5351 - Discipline. Such actions by business partners may result in the loss of network privileges and/or contractual sanctions.

e. The Director, Information Technology can authorize actions to remediate network or application performance problems during an incident where network or application performance has been adversely affected.

f. A user may not use the County network or technology assets to connect to or make use of other computer systems unless specifically authorized to do so by the operators of those systems.

g. Because network and data security are dependent upon physical security, all Collier

County employees have a responsibility to ensure that only authorized employees and/or business partners or properly escorted visitors have access to areas where network access is available and that only authorized employees have access to secure spaces where network resources are located.

2) After 90 days of account inactivity, the system automatically disables the account as a security measure to mitigate potential breaches. Disabled users will be unable to access their accounts and associated services until they take action to reactivate their accounts.

Should an inactive account need to be reactivated, a Service Desk Request should be requested. After reactivation, users will be prompted to reset their passwords to maintain the integrity of their accounts and safeguard sensitive information. The Password Policy above will govern valid passwords. This policy helps ensure that dormant accounts do not become vulnerable entry points for unauthorized access.

a. Staff and authorized business partners are issued credentials (user name and password) for accessing the network and network resources. Users are responsible for periodically changing their passwords every 90 days and safeguarding their passwords. Additionally, inactive users will be automatically locked out after 90 days of inactivity to enhance security.

b. All users, where applicable, will be required to register a second approved device for

MFA (Multifactor Authentication) to enhance authentication security. There may be exceptions in which a user has a legitimate need to utilize technology resources outside the scope of this policy. The Cybersecurity team may approve, in advance, exception requests based on balancing the benefit versus the risk for IT resources that cannot support MFA.

c. For any staff member that will be taking a Leave of Absence (LOA) (i.e. FMLA, short term disability, extended time off, etc.), accounts will be put into a suspended state until their return to work.

d. Users are responsible for all transactions made using their credentials.

e. Users are responsible for protecting the confidentiality of their credentials and are prohibited from sharing their credentials with anyone.

f. Users shall not leave their computers unattended while their account is logged in without first locking the computer, using the Windows “Lock Computer” functionality.

g. User passwords for County network accounts or passwords for County application

/system access may not be printed or stored online in any file, database or Internet service. It is the user’s responsibility to safeguard their password. If a user suspects for any reason that their password may have been compromised, they must immediately change it. Passwords may be stored electronically in an IT Division encrypted removable USB drive.

h. No user may access the network or network resources with another user’s credentials. If access to another user’s account is required, access can be granted by the IT Service

Desk upon request from the user’s manager.

i. All network access must be accomplished by user specific credentials, and as a normal course of business, generic or “shared” network accounts are not issued. In special cases the

IT Director can authorize the use of shared accounts with proper authorization from the users’ management under circumstances where individual accounts can’t adequately meet business needs and their use will not compromise identity integrity and auditing.

j. Misrepresenting, obscuring, suppressing, or replacing a user’s identity on the network is forbidden. The user name, e-mail address, County affiliation, and related information included with electronic messages or postings shall reflect the actual originator of all messages or postings.

3) Network Security

a. Users shall report any suspicion of violations of any provision of this instruction to their supervisor or the Information Technology Division Service Desk. Users shall notify the

Service Desk of any instances where they observe or have reason to believe that data is inappropriately accessible to employees, the public, or business partners.

b. Users shall promptly report all information security alerts, warnings, suspected system vulnerabilities, etc. to the IT Service Desk.

c. Users shall not exploit inadvertent rights or deficiencies in information systems security to damage systems or data, obtain resources beyond those to which they have been authorized, or to obtain or take resources away from other users or gain access to other systems for which proper authorization has not been granted.

d. Users who receive malware alerts or notice unusual system behavior, such as missing files, frequent system crashes, misrouted messages, etc., should immediately notify the

IT Service Desk. To prevent possible damage to Collier County data, technology assets and network resources, users are not permitted to remove malware on their own. If users believe they may have been the victim of malicious software, they must immediately inform the IT Service Desk.

e. In order to ensure that malware signatures, patches and security software are up to date, any workstations or portable computers that have not been updated within 30 days will be removed from the network. Updates occur upon login. Action by the IT Service

Desk will be required to restore connectivity.

4) Inappropriate Use

a. Internet browsing on websites with inappropriate content is prohibited. Use of the

Internet will be monitored, and corrective actions will be taken by the user’s division, in coordination with Human Resources and Information Technology.

b. Collier County's technology assets, network and network resources may not be used for dissemination or storage of commercial or personal advertisements, solicitations, promotions, political material, inappropriate content or any unauthorized use deemed inappropriate.

c. Users are not permitted to store, download or transmit copyrighted materials with network resources unless written permission has been granted. Examples of copyrighted materials include, but are not limited to: commercial music, video, graphics, or other intellectual property. Collier County will not provide a defense for violators of copyrights. Collier County allows reproduction of copyrighted material only to the extent legally considered "fair use" or with the permission of the author/owner. All doubt about whether software or other material is copyrighted, proprietary, or otherwise inappropriate for duplication should be resolved in favor of not duplicating such information.

d. Users are not permitted to make any defamatory statements using network resources.

e. County Employees are not permitted to subscribe to information services without the approval of their supervisor.

f. Users are not permitted to capture, store or create digitized images of signatures or digital signatures (other than their own) or attach or affix a digitized image of a signature or digital signatures (other than their own) to any document or e-mail or use such image of a signature or digital signatures in any way that could be interpreted as representing information as being originated, approved, or sanctioned by another person without the express permission of the signatory.

C. Business Partners.

1) Employees are responsible to ensure that business partners requiring access to the network or network resources are properly authorized. Business partner accounts will be issued on a monthly basis and will expire each month. Employees are responsible for requesting extension of business partner accounts if required. Generic business partner accounts will not be issued. All business partner accounts must be issued in the name of the user.

2) Any business partner requiring access to the network or network resources must complete the Third-Party Use Agreements, file them with the IT Division and maintain compliance with the terms of that agreement.

3) Once granted access, business partners must comply with this instruction in its entirety.

Business partner violations of this instruction may result in loss of access and purchasing sanctions.

4) Authorized business partners are issued credentials (user name and password) for accessing the network and network resources. Partners are responsible for periodically changing their passwords every 90 days and safeguarding their passwords. Additionally, inactive users will be automatically locked out after 90 days of inactivity to enhance security.

D. E-mail

1) All e-mails entering or leaving the County’s e-mail system are duplicated and retained in an administrative mailbox in addition to each user’s mailbox. As such, users are free to delete e-mails from their mailbox when their usefulness to the user has ended. However, if the user would like future access to such e-mails, they should retain them. At the designated time, all e-mail in Outlook will be archived. At this time, e-mails are never deleted from the archive.

2) BCC staff are required to use the county email system and only the county email system for county business. Use of external email systems compromise the Agency’s ability to execute complete public records requests.

3) Users shall not send unsolicited/non-business e-mail to persons without their consent. Chain letters or other non-business-related use of network resources is prohibited.

4) Mass e-mailing for business purposes must be coordinated with the IT Service Desk. Non-business-related mass e-mailing is prohibited.

5) The use of the “Subscribers” and “BCC-Agency” distribution lists are restricted to department heads, division directors and the County Manager’s office.

6) Tampering, forging, or altering e-mail identity information is prohibited. Sending an e-mail which in any way appears as though it was sent by someone else (who did not send it) is prohibited.

7) Inappropriate content may not be sent by e-mail or other form of electronic communication or displayed on or stored in the County's computers. Any message received that contains intimidating, hostile, offensive or inappropriate content should be reported immediately to management so that appropriate measures can be taken.

8) Users must not originate or forward any e-mails with inappropriate content as defined in section

2(E) and 3(D)6. Reference CMA 5311.1 (Standards of Conduct).

9) Users receiving e-mail messages with inappropriate content as defined in section 2(E) or 3(D)6 must immediately notify their supervisor, manager, or division director. Reference CMA

5311.1 (Standards of Conduct).

a. The following information must be provided: (1) the date and time the e-mail was sent/received; (2) the sender’s e-mail address (or, if unavailable, any identifying information); (3) and the subject line.

b. Do not forward the e-mail. Once the information specified in Section D(9)a is passed on to a supervisor, the e-mail should be deleted.

c. Supervisors, managers or directors receiving such reports from their employees shall provide these reports to the Human Resources Director. Additionally, if the user reports having received repetitive inappropriate or explicit e- mails from the same external sender, these reports and all supporting documentation should be provided to the IT

Service Desk as well as Human Resources.

10) Signatures, tag lines, and background settings should be professional in nature and reflect positively on the County.

a. Signatures may contain some or all of the following: Name, Agency Name, Department/Division, Title, Address, Telephone Number, Fax Number, Cell Phone

Number, e-mail Address. Colors and fonts other than the default settings are acceptable.

b. Tag lines conveying personal, inspirational, or political messages are subject to interpretation and are, therefore, prohibited. Tag lines may contain agency, department or division mottos, mission or vision statements, or logos.

c. To portray a professional image, no backgrounds should be used in e-mail settings.

E. Hardware/Equipment:

1) County technology assets, network and network resources are provided as a tool to enhance productivity and perform job duties. Access to County technology assets is a privilege.

a. Only devices which are managed by the IT Division are permitted on the Agency’s business network. Exceptions may be authorized with written approval from the IT

Director.

b. The processes and procedures for purchasing technology are on the Agency’s Intranet and updated periodically. Improperly purchased technology items may be refused network access.

c. The use of personally owned computing devices is permitted but such devices will be limited to publicly available websites and internet resources. Personal owned computing devices are not managed by the IT Division and are not permitted access to the Agency’s business network.

d. SLATE computers may be approved for purchase by the IT Division. SLATE computers must be configured and managed by the IT Division.

2) Unauthorized Equipment.

a. Users may not connect any device to County technology assets or the network. Only authorized administrative employees are permitted to add devices to the network.