2177 RESOLUTION NO. at] �
A RESOLUTION ADOPTING THE INFORMATION SECURITY POLICY FOR
THE CITY OF WEST MEMPHIS,ARKANSAS.
WHEREAS,the City of West Memphis has considered the Information Security Policy
for all departments for the City of West Memphis; and
WHEREAS,it is necessary to submit the Information Security Policy for all departments
to safeguard the City's data in order to provide staff with clear guidance on the appropriate, safe
and legal way in which they can make use of information and IT equipment and show the City's
commitment to comply with the Information Security Program and the Arkansas Legislative
Audit requirement.
NOW,THEREFORE, BE IT RESOLVED BY THE CITY COUNCIL OF THE
CITY OF WEST MEMPHIS, ARKANSAS,THAT the Information Security Policy for the
City of West Memphis is approved.
ADOPTED this day of�� ,,,,(�e r , 2018.
WILLIAM H. JO SON, Mayor��
ATTEST:
Phillip P a, City Clerk
RECEIVED
D8t ity Clerk's 0 ice -
City of West Memphis Information Security Policy
604 E. Cooper Avenue
' West Memphis,AR 72301
Policy Owner �naluon Assur& �rnittc(,
Policy Approver(s) niUrmation Assurancf,�-umrnittee
Related Policies Information Security Charter; Information Acceptable Use Policy
Related Procedures N/A
Storage location Describe physical or digital location of copies of this policy.
Effective Date 28, 2018
Next Review Date I 'f'?"
City of West Memphis, Arkansas
Information Security Policy
City of West Memphis—Information Acceptable Use Policy
Page 1
City of West Memphis Information Security Policy
604 E. Cooper Avenue
�•,.-�,� West Memphis, AR 72301
Contents
Purpose........................................................................................................................................................................................3
Scope...........................................................................................................................................................................................3
Definitions...................................................................................................................................................................................3
GoverningLaws & Regulations....................................................................................................................................................3
Section1—Security Governance.................................................................................................................................................4
1.1 Organization of Information Security....................................................................................................................................4
1.2 Human Resources Security....................................................................................................................................................4
Section2—Security Operations ..................................................................................................................................................6
2.1 Asset Management................................................................................................................................................................6
2.2 Access Control .......................................................................................................................................................................7
2.3 Cryptography.........................................................................................................................................................................8
2.4 Physical and Environmental Security.....................................................................................................................................9
2.5 Operations Security.............................................................................................................................................................10
2.6 Communications Security....................................................................................................................................................11
2.7 System Acquisition, Development, and Maintenance Security...........................................................................................11
2.8 Security in Supplier Relationships .......................................................................................................................................12
Section3—Security Management.............................................................................................................................................14
3.1 Information Security Incident Management.......................................................................................................................14
3.2 Information Security Aspects of Business Continuity Planning...........................................................................................14
3.3 Compliance..........................................................................................................................................................................15
3.4 IT Security Risk Strategy......................................................................................................................................................16
RevisionHistory.........................................................................................................................................................................18
City of West Memphis—Information Acceptable Use Policy
Page 2
City of West Memphis Information Security Policy
604 E. Cooper Avenue
West Memphis,AR 72301
Purpose
The purpose of this policy is to provide staff with clear guidance on the appropriate,safe, and legal way in which they can
make use of information and IT equipment at The City of West Memphis.Staff need to be aware of the compliance required
with this policy and The City of West Memphis's commitment to comply with the Information Security program and
Arkansas Legislative Audit requirements that all reasonable organizational and technical measures are taken to safeguard
its data.
Scope
This Acceptable Use Policy(AUP)applies to the use of all information and IT equipment by The City of West Memphis staff
(including temporary workers, locums, and staff seconded or contracted from other organizations).All staff should be
aware of their legal obligations and internal policy in respect of information handling.
This policy will change as information use changes in the organization.
All employees are expected to have knowledge of at least the portions of this document that are directly related to their
role within the organization.
Definitions
1. Low Risk Information.This is defined as information that does not require special protective measures.
2. High Risk Information.This is defined as information,the loss or breach of which would substantially impair the
organization.
Governing Laws & Regulations
Selection and maintenance of security controls are derived from the requirements outlined in the Arkansas Legislative Audit
-Information Systems Best Practices documentation and are measured annually.
City of West Memphis—Information Acceptable Use Policy
Page 3
City of West Memphis Information Security Policy
" 604 E.Cooper Avenue
West Memphis,AR 72301
Section 1 — Security Governance
1.1 Organization of Information Security
The purpose of this policy is to ensure a framework is in place to include information security within internal and remote
operations.
This Organization of Information Security Policy applies to all business processes and data, information systems and
components, personnel, and physical areas of City of West Memphis.
1.1.1 Management Commitment to Information Security:
1. Management shall actively support security within the organization through clear direction, demonstrated
commitment, explicit assignment, and acknowledgment of information security responsibilities.
2. Top management should ensure that the responsibilities and authorities for roles relevant to information security
are assigned and communicated.
3. Top management should also assign responsibilities and authorities for reporting performance of the information
security management system within the organization.
1.1.2 Internal Organization:
1. All responsibilities and behaviors relating to information security must be clearly defined.
a. A clear and appropriate security organizational structure should be documented and communicated
within the organization and to other interested parties.
b. An information security officer will be determined and the role will be assigned appropriately.
c. Segregation of duties will be implemented to ensure minimal crossover.
2. Contacts with the appropriate authorities will be identified and maintained.
3. Appropriate contacts with special interest groups or specialist security forums will be maintained.
4. Project management will include information security as a crucial consideration regardless of the type of project.
5. City of West Memphis should:
a. Determine the necessary competence of person(s)doing work under its control that affects its
information security performance.
b. Ensure that these persons are competent on the basis of appropriate education,training,or experience.
c. Where applicable,take actions to acquire the necessary competence and evaluate the effectiveness of
the actions taken.
d. Retain appropriate documented information as evidence of competence.
1.2 Human Resources Security
The purpose of this policy is to ensure personnel, including contractors, are aware of and understand their responsibilities
in regards to security.
This Human Resource Security Policy applies to all business processes and data, information systems,as well as
components, personnel,and physical areas of City of West Memphis.
1.2.1 Prior to Employment:
1. All candidates for employment, including contractors and third-party users, must undergo background verification
checks in accordance with the appropriate laws.
2. Contractual agreements with all employees and contractors will clearly outline the responsibility of the
individual/contractor to information security.
a. Responsibilities will be reviewed and updated regularly.
1.2.2 During Employment:
1. Management must require and ensure all employees and contractors adhere to applicable information policies
and procedures within the organization.
City of West Memphis—Information Acceptable Use Policy
Page 4
City of West Memphis Information Security Policy
604 E. Cooper Avenue
West Memphis,AR 72301
a. This includes access agreements which must be signed by personnel prior to being granted access.
i. Access agreements will be reviewed and updated regularly.
2. All employees and contractors must undergo awareness training based on their roles, as well as relevant updates
in policies and procedures applicable to their jobs.
a. City of West Memphis management should require employees, contractors, and third-party users to apply
security in accordance with established policies and procedures of the organization.
b. Training must be accompanied by an assessment procedure based on the cyber security training content
presented in order to determine comprehension of key cyber security concepts and procedures.
3. If there is a failure to comply with these security requirements,there will be a formal, communicated process to
take action against said employee(s)or contractor(s).
1.2.3 Termination and Change of Employment:
1. In the event of an employee's termination or transfer of employment,formal and communicated disciplinary
actions must be taken.
a. This process include exit interviews nd removal of documents(and all copies thereof)and other City of
West Memphis property and,materials in their possession or control.
City of West Memphis—Information Acceptable Use Policy
Page 5
City of West Memphis Information Security Policy
604 E.Cooper Avenue
West Memphis,AR 72301
Section 2 — Security Operations
2.1 Asset Management
The purpose of this policy is to ensure assets are identified appropriately and the proper protection controls for those
assets are in place.
This Asset Management Policy applies to all business processes and data, information systems and components, personnel,
and physical areas of City of West Memphis.
2.1.1 Responsibility for Assets:
1. Information or information processing facility assets must be inventoried and documented and that record must
be kept up to date.
a. Inventory categorization must be approved by the appropriate parties or authorizing authority.
b. Organization will employ use of automated mechanisms to identify unauthorized systems including
hardware or software.
c. Inventory must also include information system updates or removals.
2. This process must be assigned to an owner to maintain the process.
a. Individuals requiring access to the information systems must follow proper procedure to receive such
access,such as signed acknowledgement of standards and consequences.
3. The following assets should be considered in the inventory process:
a. Authorized assets
b. Unauthorized assets
c. Software
d. Databases
e. Information stores
f. Physical assets
g. Services
h. People
i. Tangibles
4. Processes around configuration management will be established as well.
5. All assets must be returned upon termination of employment or contract.
2.1.2 Information Classification:
1. All assets must be classified in terms of legal requirements,value to the organization,their criticality to the
organization, and sensitivity if they were to be disclosed by an unauthorized party.
2. City of West Memphis data shall be classified into one of the following categories:
a. Confidential:Critical information whose existence or content is only known to a small group of
individuals. Disclosure of this information would harm the organization or impede ability to achieve
objectives.
b. Sensitive:Sensitive information requires an elevated level of protection (e.g. encryption)to satisfy
regulatory requirements or prevent its unintended disclosure. Information is disclosed only to authorized
individuals on a need-to-know basis.
c. Business Confidential: Business confidential information/data is used to conduct normal business
operations of City of West Memphis. Normal levels of confidentiality(per the Employee Code of Conduct)
are applied.The intention is to minimize the impact upon business operations.
d. Internal Use: Internal use data/information is used to support the business operations of a department.
The information is intended for internal use only.
e. Public: Public information is such that City of West Memphis has published for general or public
consumption, or publicly known information that City of Wet Memphis has received from other
organizations.
City of West Memphis—Information Acceptable Use Policy
Page 6
City of West Memphis Information Security Policy
604 E. Cooper Avenue
' West Memphis,AR 72301
3. Assets will be labeled and handled based on appropriate information classification procedures used by the
organization.
2.1.3 Media Handling:
1. Removable media must also be managed by the same asset classification procedure used by the organization.
2. Removable media must be protected against unauthorized access and misuse while in use and in transit, and must
be disposed of securely, using appropriate procedures.
3. Media containing information shall be protected against unauthorized access, misuse, or corruption during
transportation.
2.1.4 Acceptable Use:
1. Standards or guidelines for the acceptable usage of assets should be documented to indicate what information
system users are and are not allowed to do.
2. The following items should be covered in acceptable usage guidelines:
a. Computer and information system usage
b. Software and data usage
c. Internet and email usage
d. Telephone usage
e. Office equipment& materials usage
3. As a requirement of information system access, and as a component of security awareness training, all information
system users,whether employees or third parties,will be required to provide signed acceptance of the acceptable
usage guidelines.
2.2 Access Control
The purpose of this policy is to ensure users have the appropriate access levels specifically authorized to them to access
information on systems and applications.
This Access Control Policy applies to all business processes and data, information systems and components, personnel, and
physical areas of City of West Memphis.
2.2.1 Business Requirements of Access Control:
1. This access control policy must be developed and reviewed regularly(i.e. annually) based on City of West Memphis
security requirements.
a. City of West Memphis will employ a role-based access method.
2. Users will only receive access to networks and network systems specifically authorized to them.
a. City of West Memphis will follow the principle of least privilege.
2.2.2 User Access Management:
1. A formal user registration and de-registration process must be developed and initiated to allow assignment of
rights.
a. City of West Memphis will employ use of automated mechanisms to enhance this process.
b. A formal user provisioning process must be in place.This process will allow for the assignment or
revocation of access rights for all users to all systems and services.
c. Privileged access rights will be allocated in a highly controlled and restricted process.Their usage will also
be controlled.
i. Inactivity logout will be enabled after a pre-determined time period.
d. Secret authentication information allocation will be managed through a formal process.
e. Asset owners must conduct regular reviews of users' access rights and use of accounts.
f. Upon termination of employment, an employee's or external party's user access rights will be revoked.
i. If there is a change to a contract or agreement,then the access will be adjusted appropriately.
ii. City of West Memphis will employ automated processes to remove temporary and emergency
accounts after a determined amount of time.A similar automated process will exist for disabling
inactive accounts.
City of West Memphis—Information Acceptable Use Policy
Page 7
City of West Memphis Information Security Policy
604 E.Cooper Avenue
West Memphis,AR 72301
1. City of West Memphis will also terminate any access for(and accounts of) high-risk
users.
2.2.3 User Responsibilities:
1. Users must follow City of West Memphis's procedures surrounding secret authentication information usage.
2.2.4 System and Application Access Control:
1. User access to all information and application systems will be restricted based on City of West Memphis's access
control standards.
a. According to the access control policy, access to systems and applications will be restricted with a secure
log-on process.
i. A limit of successive incorrect logons(e.g.six times)will be enforced and an automatic account
lock will be enabled.
ii. Time and date of logons and account changes will be appropriately recorded and monitored.
b. Network and information systems sessions should remain locked for a predetermined time or until the
user reestablishes access through an established authentication procedure.
c. City of West Memphis will establish appropriate restrictions around remote access,wireless access, and
mobile devices.
2. Password management systems will be interactive and mandate strong passwords.
3. Any use of utility programs capable of overriding system and application controls will be highly controlled and
restricted, if necessary.
4. Any access to program source code will be strictly prohibited.
5. City of West Memphis will control the flow of information between interconnected systems to ensure secure
transfers through measures like encrypted tunnels.
a. When an automated flow control decision is not possible or available,City of West Memphis will initiate a
human review.
6. The City of West Memphis will enact separation of duties to decrease abuse of privileges.
7. Access by external information systems will be regulated.
8. The City of West Memphis will ensure information sharing process follows appropriate access levels of sharing
partners.
a. City of West Memphis will designate individuals allowed to post information on publicly available systems.
9. The City of West Memphis will implement appropriate data mining prevention controls.
2.3 Cryptography
The purpose of this policy is to ensure correct use of cryptography to protect the confidentiality,authenticity,and integrity
of the organization's information.
This Cryptography Policy applies to all business processes and data, information systems and components, personnel, and
physical areas of City of West Memphis.
2.3.1 Cryptographic Controls:
1. The City of West Memphis will develop a policy surrounding the proper procedures needed around the use of
cryptographic controls.The following items should be considered:
a. Based on a risk assessment,the required level of protection should be identified taking into account the
type, strength, and quality of the encryption algorithm required.
b. The use of encryption for protection of information transported by mobile or removable media devices or
across communication lines.
c. The standards to be adopted for effective implementation throughout the organization.
d. The impact of using encrypted information on controls that rely upon content inspection.
2.3.2 Key Management:
1. Cryptographic keys should be protected through their whole lifecycle.
2. Cryptographic algorithms, key lengths, and usage practices should be selected according to best practice.
City of West Memphis—Information Acceptable Use Policy
Page 8
City of West Memphis Information Security Policy
604 E. Cooper Avenue
�! West Memphis,AR 72301
3. All cryptographic keys should be protected against modification and loss. In addition,secret and private keys need
protection against unauthorized use as well as disclosure.
4. Equipment used to generate, store,and archive keys should be physically protected.
5. A key management system should be based on an agreed set of standards, procedures, and secure methods for:
a. Generating keys for different cryptographic systems and different applications.
b. Issuing and obtaining public key certificates.
c. Distributing keys to intended entities, including how keys should be activated when received.
d. Storing keys, including how authorized users obtain access to keys.
e. Changing or updating keys, including rules on when keys should be changed and how this will be done.
f. Dealing with compromised keys.
g. Revoking keys, including how keys should be withdrawn or deactivated.
h. Recovering keys that are lost or corrupted.
i. Backing up or archiving keys.
j. Destroying keys.
k. Logging and auditing of key management related activities.
2.4 Physical and Environmental Security
The purpose of this policy is to ensure proper measures are in place to prevent unauthorized physical access or damage to
the organization's information and facilities.
This Physical and Environmental Security Policy applies to all business processes and data, information systems and
components, personnel, and physical areas of City of West Memphis.
2.4.1 Physical Access and Security:
1. Physical security perimeters will be identified and will protect mission critical information or facilities.
2. Appropriate entry controls will be implemented at secure access points to ensure only individuals with appropriate
access levels are allowed access.These access points will be monitored.
a. City of West Memphis should develop, approve, and maintain a list of personnel with authorized access to
the facility where information systems are physically located.
b. City of West Memphis should establish a process to review, approve, and issue credentials for facility
access.
c. [Agency] shall remove individuals from the facility access list when access is no longer required.
d. City of West Memphis should maintain physical access audit logs for data center(s)and/or sensitive
facilities'entry/exit points.
3. Security measures will be implemented for working in various identified safe spaces and delivery and loading
spaces.
2.4.2 Environmental Security:
1. Protection against natural disasters or other malicious attacks,as well as accidental incidents,will be determined
and implemented.
2. The City of West Memphis should place power equipment and cabling in safe locations to prevent environmental
and/or man-made damage and destruction.
3. Applicable security measures will be implemented for offices, boardrooms,etc., including considerations for
temperature, protection against water damage, and emergency lighting.
2.4.3 Equipment Security:
1. Equipment will be handled and protected to ensure risks are reduced, preventing potential environmental threats
and hazards.
2. Redundancies and other supporting procedures will be put in place to protect from power failures and other
disruptions, including ensuring power and telecommunications cabling carrying data will be properly protected.
3. Equipment will be regularly maintained.
4. Any removal of assets must be done with prior authorization from the right party.
City of West Memphis—Information Acceptable Use Policy
Page 9
City of West Memphis Information Security Policy
604 E.Cooper Avenue
West Memphis,AR 72301
5. Any offsite assets will be treated with the same security measures,with special consideration to risks of being off-
premise.
6. Disposal or re-use of equipment must be done after the removal of sensitive or critical data has been completed.
7. Any unattended equipment must have applicable protection.
8. Personnel are responsible for maintaining their personal workspaces and ensuring media or literature containing
sensitive or critical information is properly stored and not in the open.
2.5 Operations Security
The purpose of this policy is to ensure the secure operations of information processing facilities within and related to City of
West Memphis.
This Operations Security Policy applies to all business processes and data, information systems and components, personnel,
and physical areas of City of West Memphis.
2.5.1 Operational Procedures and Responsibilities:
1. A standardized configuration, or baseline,will be established and maintained for all information systems.These
baselines will indicate the specifications of information system components(hardware,firmware, and software),
their relationship, and their ownership.
a. Changes to an information system must be fully documented and authorized, and must be performed in a
controlled manner.
2. Operational procedures will be made available to all applicable users.
3. A change management request should be created for all information system maintenance.
4. Capacity management to ensure appropriate usage of resources will be implemented.
5. Any testing environments will be made separate from the main operational network and facilities.
2.5.2 Protection from Malware:
1. Protection against malware should be based on malware detection and repair software, information security
awareness,and appropriate system access and change management controls.
2. Anti-virus software should be deployed on all systems commonly affected by malicious software(particularly,
personal computers and servers).
3. Ensure that all anti-virus mechanisms are current, actively running,and generating audit logs.
4. Where the use of mobile code is authorized,the configuration shall ensure that the authorized mobile code
operates according to a clearly defined security policy and unauthorized mobile code shall be prevented from
executing.
2.5.3 Backup:
1. A backup policy must be agreed upon to collect backup copies of necessary data, software,etc.and test them in a
timely manner.
2.5.4 Logging and Monitoring:
1. Information systems should be configured to record all critical systems activities such as login/logout and
administrative changes into a log file.
2. Event logs recording user activities, exceptions,faults, and information security events shall be produced, kept,
and regularly reviewed.
3. In addition,the information systems should be configured to notify administrative staff via a Security Information
Event Management(STEM)solution in the event that inappropriate, unusual,and/or suspicious activity is noted.
4. These logging processes and facilities will be protected accordingly.
5. All clocks of the logging and information processing systems will be appropriately synchronized.
2.5.5 Control of Operational Software:
1. City of West Memphis will implement controls for the implementation of software and to prevent or detect the
use of unauthorized software(e.g. application whitelisting).
2.5.6 Mobile Devices and Teleworking:
1. Security measures will be developed and adhered to in order to manage risks introduced by the use of mobile
devices.
City of West Memphis—Information Acceptable Use Policy
Page 10
City of West Memphis Information Security Policy
604 E. Cooper Avenue
West Memphis,AR 72301
2. Security measures will be implemented to protected information accessed, processed, or stored at
teleworking/remote sites.
2.5.7 Technical Vulnerability Management:
1. City of West Memphis will implement controls and processes to properly scan and address vulnerabilities in
information systems at least quarterly, and when new vulnerabilities appear.
2. Appropriate measures should be taken to address associated risks.
2.5.8 Information Systems Audit Considerations:
1. Security audits will be conducted [insert frequency—suggested annually]to ensure information system security
controls have been implemented correctly, are operating effectively, and are producing the desired level of
security.
2.6 Communications Security
The purpose of this policy is to ensure security is a key consideration in network management and in the transfer of
information in and out of the organization.
This Communications Security Policy applies to all business processes and data, information systems and components,
personnel, and physical areas of City of West Memphis.
2.6.1 Network Security Management:
1. Network segregation must be implemented. Groups of information services, users, and information systems must
be separated from one another.
2. City of West Memphis should implement limitation and controls of network ports, protocols, and services.
3. Controls should be implemented to ensure the security of information in networks and the protection of
connected services from unauthorized access. In particular,the following items should be considered:
a. Responsibilities and procedures for the management of networking equipment should be established.
b. Special controls should be established to safeguard the confidentiality and integrity of data passing over
public networks or over wireless networks.
c. Appropriate logging and monitoring should be applied to enable recording and detection of actions that
may affect, or are relevant to, information security.
d. Management activities should be closely coordinated both to optimize the service to City of West
Memphis and to ensure that controls are consistently applied across the information processing
infrastructure.
4. The following will be identified and listed within network services' agreements—both in-house and outsourced
agreements:
a. Security mechanisms.
b. Service levels.
c. Management requirements.
2.6.2 Information Transfer:
1. Appropriate policies, procedures, and controls must be established around the protection of information being
transferred through various types of facilities.
2. External parties must agree to the secure transfer of business data with City of West Memphis.
3. All information transferred in electronic messaging must be properly protected.
4. Any confidentiality or non-disclosure agreements of the organization must be acknowledged, reviewed often,and
documented.
2.7 System Acquisition, Development, and Maintenance Security
The purpose of this policy is to ensure information is a forefront consideration throughout the lifecycle of information
systems in the organization.
City of West Memphis—Information Acceptable Use Policy
Page 11
City of west Memphis Information Security Policy
` 604 E.Cooper Avenue
' West Memphis,AR 72301
This System Acquisition, Development, and Maintenance Security Policy applies to all business processes and data,
information systems and components, personnel, and physical areas of City of West Memphis.
2.7.1 Security Requirements of Information Systems:
1. Information security requirements must be considered in the acquisition of new information systems or
enhancements to existing ones.
2. Identification and management of information security requirements and associated processes should be
integrated in the early stages of information systems projects.
3. Information security requirements and controls should reflect the business value of the information involved and
the potential negative business impact which might result from lack of adequate security.
4. Application services:
a. Public networks:Any information passing over public networks must be protected from malicious activity.
b. Transactions: Information in application services transactions must be protected to prevent incomplete
transactions, unauthorized access, or other undesirable activity.
2.7.2 Security in Development and Support Processes:
1. Ensure information security is included within the policies applying to software development and systems.
2. Appropriate change control processes for systems are in place throughout the development lifecycle, coupled with
technical reviews of applications for any changes made after operating platform changes.
3. Any changes to software packages should be minimized to only necessary changes, and those changes must be
controlled.
4. Secure system engineering principles and development environment must be established.
5. Any outsourced development must be strictly controlled and monitored.
6. Testing:
a. System security testing must be executed regularly during development cycles.
b. System acceptance testing must be developed for new systems, upgrades, and system versions.
2.7.3 Test Data:
1. Test data should be carefully selected, protected, and controlled.
2. The use of operational data containing personally identifiable information or any other confidential information
for testing purposes should be avoided. If personally identifiable information or otherwise confidential information
is used for testing purposes, all sensitive details and content should be protected by removal or modification.
2.8 Security in Supplier Relationships
The purpose of this policy is to ensure proper protection of City of West Memhis's assets that are accessed by suppliers.
This Security in Supplier Relationships Policy applies to all business processes and data, information systems and
components, personnel, and physical areas of City of West Memphis.
2.8.1 Information Security in Supplier Relationships:
1. Procedures surrounding risk mitigation of a supplier's access to City of West Memphis's assets must be
documented, reviewed, and agreed upon by City of West Memphis and the specific supplier.
2. All suppliers that access, process,store, or provide various IT components must be in agreement withCity of West
Memphis's security requirements around suppliers' relationships with the assets.
a. Types of information access should be defined that different types of suppliers will be allowed, as well as
monitoring and controlling the access.
b. Types of obligations applicable to suppliers should be defined to protect the organization's information.
3. Security requirement agreements for suppliers must also include details on addressing risks surrounding the
handling, processing,and communicating of assets or services.
a. The risks to the organization's information and information processing facilities from business processes
involving external parties shall be identified and appropriate controls implemented before granting
access.
City of West Memphis—Information Acceptable Use Policy
Page 12
City of West Memphis Information Security Policy
604 E.Cooper Avenue
West Memphis,AR 72301
b. Legal and regulatory requirements, including data protection, intellectual property rights, and copyright,
etc.should be clearly identified and addressed.
2.8.2 Supplier Service Delivery Management:
1. A process must be developed to monitor and assess the service delivery of a supplier to ensure it is meeting
appropriate business and security requirements, as well as meeting any contract or SLA requirements.
2. A change management process must be in place to address any alterations to an existing policy, including
documentation of said change and ensuring it is in alignment with business processes and follows appropriate re-
assessment of risk involved, if necessary.
City of West Memphis—Information Acceptable Use Policy
Page 13
City of West Memphis Information Security Policy
604 E. Cooper Avenue
West Memphis,AR 72301
Section 3 — Security Management
3.1 Information Security Incident Management
The purpose of this policy is to ensure proper recognition, management, and communication of security events and
weaknesses through a formal process.
The quality and integrity of City of West Memphis's incident response capabilities are used to monitor for security
incidents,determine the magnitude of the threat presented by these incidents, and respond to these incidents. Without an
incident response capability,the potential exists that in the event that a security incident occurs, it will go unnoticed and
the magnitude of harm associated with the incident will be significantly greater than if the incident were noted and
corrected.
This Information Security Incident Management Policy applies to all business processes and data, information systems and
components, personnel, and physical areas of City of West Memphis.
3.1.1 Management of Information Security Incidents and Improvements:
1. Incident management responsibilities and procedures must be established to ensure timely response procedures
to incidents.
2. The incident response capability should include a defined plan and must address the seven stages of incident
response:
a. Preparation
b. Detection
c. Analysis
d. Containment
e. Eradication
f. Recovery
g. Post-incident activity
3. Information security events will be assessed, and determinations will be made about whether they can be
identified as information security incidents.
4. Information security incidents should be identified and classified into different severity levels to make incident
response process more effective.
5. Incidents will be responded to with the appropriate procedures based on documented organizational processes.
a. Incident response procedures will be reviewed on an annual basis, and any required updates will be
communicated to the appropriate parties.
6. Information gained from responding to and resolving incidents will be used to reduce potential future incidents.
7. City of West Memphis will establish definitions and procedures around the identification,collection, acquisition,
and preservation of information.
a. This data will be used in analysis of these incidents and as evidence.
b. The records of this data will be audited regularly and timestamped.
8. Reporting:
a. Information security events must be reported through proper channels. Incidents will be tracked as they
occur.
b. Any weaknesses,suspected or verified, in systems and services must be reported by employees or third-
party contractors using those systems and services.
3.2 Information Security Aspects of Business Continuity Planning
The purpose of this policy is to ensure that information security is properly addressed within the organization's Business
Continuity Planning(BCP) strategy.
City of West Memphis—Information Acceptable Use Policy
Page 14
CitEf WestCoopAvenuhis e AnSecurity Policy
West Memphis,AR 72301
This Information Security Aspects of Business Continuity Planning Policy applies to all business processes and data,
information systems and components, personnel, and physical areas of City of West Memphis.
3.2.1 Information Security Continuity Management:
1. The organization will determine its requirements for information security and how it fits into the overall continuity
of information security management in crises.
a. Including aspects like purpose, roles, and responsibilities.
2. The organization will create, document, and implement any processes and controls related to the continuity for
information security during crisis situations.
a. Contingency plans will go through testing to ensure comprehensiveness and effectiveness.
3. These information security processes and controls will be reviewed and validated regularly to ensure their
continued effectiveness.
3.2.2 Security Contingency Planning within the context of enterprise BCP:
1. City of West Memphis should conduct a Business Impact Analysis(BIA)to identify security functions, processes,
and applications that are critical to the city and determine a point in time(i.e. recovery time objective(RTO))when
the impact of an interruption or disruption becomes unacceptable to City of West Memphis.
2. City of West Memphis should utilize the BIA results to determine potential impacts resulting from the interruption
or disruption of critical security functions, processes, and applications.
3. City of West Memphis should assign contingency roles and responsibilities to key individuals from all security
functions.
4. City of West Memphis should establish procedures to maintain continuity of critical security functions despite
critical information system disruption, breach, or failure.
5. City of West Memphis should document a Business Continuity Plan (BCP)that addresses documented recovery
strategies designed to enable The City of West Memphis to respond to potential disruptions and recover its critical
security functions within a predetermined RTO following a disruption.
6. City of West Memphis should establish a process to ensure that the BCP is reviewed and approved by senior
management.
7. City of West Memphis should distribute copies of the BCP to key personnel responsible for the recovery of the
critical security functions and other relevant personnel and partners with contingency roles, as determined by The
City of West Memphis.
8. Sufficient redundancies will be implemented to ensure availability requirements are met.
3.2.3 Data Backups:
1. City of West Memphis should develop, maintain,and document data backup and storage procedures to ensure the
recovery of electronic information in the event of failure.
2. City of West Memphis should identify and apply security requirements for protecting data backups based on the
different types of data (sensitive,confidential, public) handled by the entity.
3. City of West Memphis should establish a process to perform data backups of user-level and system-level
information at a defined frequency consistent with the established RTOs and RPOs.
3.3 Compliance
The purpose of this policy is to ensure proper measures are in place to avoid non-adherence to information security
compliance requirements—legal,contractual, regulatory,or otherwise.
This Compliance Policy applies to all business processes and data, information systems and components, personnel, and
physical areas of City of West Memphis.
3.3.1 Compliance with legal and contractual requirements:
1. All applicable compliance requirements should be identified,documented,and well-maintained.
2. Any intellectual property rights requirements should be implemented and adhered to as necessary.
3. Records will be properly managed to avoid any destruction from natural disasters, unauthorized use,or loss.
4. Personally identifiable information will be properly protected.
City of West Memphis—Information Acceptable Use Policy
Page 15
City of West Memphis Information Security Policy
604 E. Cooper Avenue
' West Memphis,AR 72301
5. Any cryptographic controls will be used appropriately according to relevant compliance requirements.
3.3.2 Compliance with security policies and standards:
1. At least annually, City of West Memphis should perform reviews or audits of users' and systems' compliance with
security policies,standards, and procedures, and initiate corrective actions where necessary.
2. Results from compliance reviews or audits shall be documented and reported by City of West Memphis'
leadership.
3.3.3 Information system audit considerations:
1. City of West Memphis should implement audit procedures to help ensure that activities involving reviews or audits
of operational systems are carefully planned to minimize the risk of disruptions to business processes.
2. [Agency]shall implement security controls to help prevent unauthorized access and/or access abuse of audit tools.
3. City of West Memphis information systems should be enabled to generate audit records containing details to help
establish what type of event occurred, when and where the event occurred,the source and outcome of the event,
and the identity of any individuals or subjects associated with the event.
4. City of West Memphis should report findings of audit records reviews to information security personnel and
[Agency] leadership.
3.3.4 Information security reviews and continuous improvements:
1. City of West Memphis will conduct an independent review of its information security practices, controls, policies,
etc.
2. Management team is responsible for regular reviews of their compliance with information security policies and
procedures.
3. A technical review of information systems will be conducted regularly.
4. City of West Memphis should develop a plan of action and milestones to document planned remedial actions to
correct weaknesses or deficiencies identified as a result of internal/external risk assessments,security reviews,
and/or audits.
3.4 IT Security Risk Strategy
The purpose of this policy is to ensure adequate processes and controls are in place to mitigate risks and measure progress
related to security performance.
This IT Security Risk Strategy Policy applies to all business processes and data, information systems and components,
personnel, and physical areas of City of West Memphis.
3.4.1 Risk Assessment and Mitigation:
1. Security risk tolerance level should be defined, documented, and communicated across City of West Memphis.
2. Security risk assessment criteria should be defined in order to produce consistent assessment results.
3. Risk assessments will be performed on all information systems that house or access City of West Memphis
controlled information.These assessments will address unauthorized access, use,disclosure, disruption,
modification,and/or destruction of information or the information system itself. Further,the assessments shall
identify known potential threats,the likelihood of their occurrence, and the magnitude of the impact of those
threats should they occur.
4. Risk assessments shall be performed upon initial acquisition of an information system (in the event that the
information system is owned/operated by City of West Memphis)or prior to initial establishment of service
agreements(in the event that the information system is owned/operated by a third party on behalf of City of West
Memphis). Further,the risk assessment shall be reviewed and,where required, updated three years or whenever a
significant change is made to the information system, whichever comes first.
5. Results of risk assessments will be disseminated to appropriate parties.
3.4.2 Third-Party Risk Management:
1. Prior to choosing a third party, a proper risk assessment must be conducted on the third party to ensure
reputation,security practices, etc. are clearly made evident and work within City of West Memphis's risk
tolerance.
City of West Memphis—Information Acceptable Use Policy
Page 16
City of west Memphis Information Security Policy
604 E.Cooper Avenue
' West Memphis,AR 72301
2. Third parties must provide documentation around their own risk management procedures,staffing requirements,
recordkeeping, and security processes.
3. While both security and vulnerability assessments are to be performed by internal staff on an on-going basis,third
parties will be retained every third assessment to ensure appropriate levels of coverage and oversight.
3.4.3 Security Performance and Metrics:
1. City of West Memphis will determine what needs to be monitored and measured to demonstrate effectiveness of
security and overall risk management processes(e.g. incident reporting, and decrease in overall incidents).
City of West Memphis—Information Acceptable Use Policy
Page 17
Y of West Memphis" Cit
"'-
P Information Security Policy
604 E. Cooper Avenue
' West Memphis,AR 72301
Revision History
Version Date of Change Author Rationale
ID
1.0 January 31, 2018 Shane Adams Document Created
City of West Memphis—Information Acceptable Use Policy
Page 18