09/20/2018 MINUTES
WEST MEMPHIS CITY COUNCIL
SEPTEMBER 20, 2018
A regular meeting of the West Memphis City Council was held on Thursday, September 20, 2018 at
1:30 p.m. in the City Council Chambers at City Hall, 205 S. Redding, West Memphis, Arkansas.
Invocation was given by Reverend John Rech, followed by the Pledge of Allegiance led by Jim Fiveash.
Mayor Johnson called the meeting to order. Senior Deputy City Clerk Cindy Greenwood called the roll.
Those present were: Mayor William H. Johnson, City Attorney Michael Stephenson, Councilmembers:
Wayne Croom, Lorraine Robinson. Tracy Catt, James Pulliaum, Ramona Taylor, Marco McClendon,
and James Holt. Absent: Councilmembers: Melanie Hutchinson, Helen Harris and Willis Mondy.
Quorum being present, Mayor Johnson proceeded with the meeting.
MINUTES
Councilmember Catt made a motion, seconded by Councilmember Taylor to dispense with the reading
of the minutes of September 6, 2018 and accept them as submitted. Upon voice vote, the voting was
unanimous.
OLD BUSINESS
2"d Reading AN ORDINANCE GRANTING A TWELVE (12) MONTH MORATORIUM ON THE
ISSUANCE OF ANY NEW CERTIFICATES OF OCCUPANCY FOR USED AUTOMOBILE RELATED
BUSINESSES INCLUDING AUTO REPAIR GARAGES: AUTOMOBILE/TRUCK SALES, USED:
AUTOMOBILE WRECKING, SALVAGE, OR JUNKYARDS; AUTOMOBILE PAINTING OR BODY
REBUILDING SHOP; AUTO WRECKER SERVICES; BOATS, MARINE RENTAL, REPAIR, OR
SALES, USED; AND MOTORCYCLE SALES AND SERVICE, USED; AND, OTHER LIKE
FACILITIES IN THE CITY OF WEST MEMPHIS; MAKING VARIOUS FINDINGS AND PROVISIONS
RELATED TO THE SUBJECT, AND FOR OTHER PURPOSES
City Attorney Stephenson read the Ordinance for the SECOND time. Councilmember Croom made a
motion, seconded by Councilmember Pulliaum to suspend the rules and the ordinance be placed on
the third reading. Upon voice vote, the voting was unanimous. City Attorney Stephenson read the
Ordinance for the third and final time. Councilmember Pulliaum made a motion, seconded by
Councilmember Croom to approve. Lengthy discussion was held. Paul Luker, Director of Planning &
Development was asked to give a brief explanation of the Planning Commission recommendation and
the recommendation of the staff of Planning & Development. Mr. Luker stated there have been a
number of problems with used car dealerships and their appearance primarily due to wrecked cars and
car parts and them looking more like a salvage yard rather than a used car lot. He said we need
stronger guidelines for these types of businesses. Planning & Development will be working with City
Attorney Stephenson to correct this problem during this moratorium. Upon voice vote, the voting was
unanimous. The Ordinance was adopted and assigned No. 2483.
NEW BUSINESS
Councilmember Pulliaum made a motion, seconded by Councilmember McClendon to suspend the
rules and R-1 and R-2 be read by title only. Upon voice vote, the voting was unanimous.
R-1 A RESOLUTION TO ACKNOWLEDGE THE 2ND SATURDAY OF SEPTEMBER OF EACH
YEAR AS "FEED THE HOMELESS DAY".
City Attorney Stephenson read the Resolution. Councilmember Pulliaum made a motion, seconded by
Councilmember Taylor to approve. Councilmember Taylor recognized that last Saturday an event was
held by Dorothy Enterprises to feed the homeless and will be held the second Saturday in September
next year. Upon voice vote, the voting was unanimous. The Resolution was adopted and assigned
No. 2176.
R-2 A RESOLUTION ADOPTING THE INFORMATION SECURITY POLICY FOR THE CITY OF
WEST MEMPHIS, ARKANSAS
City Attorney Stephenson read the Resolution. Councilmember Taylor made a motion, seconded by
Councilmember Croom to approve. Councilor Catt said this is the initial step to bring the city into
compliance and it will be updated in the future. Upon voice vote, the voting was unanimous. The
Resolution was adopted and assigned No. 2177.
COMMITTEE REPORTS
Keep West Memphis Beautiful — Councilmember Robinson reported the fall clean up day is set for
October 27th, 2018.
Insurance Committee —Councilmember Taylor reported they will be bidding out health and vision
insurance for next year.
ANNOUNCEMENTS
Councilmember Pulliaum announced the City of West Memphis was selected as a finalist for an
Arkansas Digital Government Transformation Award for the Rubicon Smart City Sanitation Platform.
He said Jim Jackson, Nick Coulter and Amanda Hicks attended the awards banquet last Friday. He
asked them to come forward and congratulated them for a job well done. They were also recognized
for the Explore Bike Share Program and the solar powered welcome signs.
CITIZENS REQUESTS
Gene Lashley— 1026 Snowden expressed concerns regarding the street trash pickup. He said the city
needs to go back to the once a week trash pickup. He said his street used to be picked up on
Monday's but now they don't know when to set out trash for curbside pickup. The trash sits there for
two to three weeks and it not only kills your grass but is it very unsightly. He said the Rubicon
Program will not help our city if it is lack of equipment and employees that are causing our problem.
Having no further business to come before the Council, Councilmember Pulliaum made a motion,
seconded by Councilmember Taylor to adjourn. Upon voice vote, the voting was unanimous. The
meeting adjourned at 2:00 p.m.
PASSED and APPROVED this 4th day of October 2018.
,0� G�
WILLIAM H. J HNSON, MAYOR
ATTEST:
HILLIP PARA, CITY CLERK
Minutes prepared by: Cindy Greenwood, CMC, Sr. Deputy City Clerk
August 29, 2018
City of West Memphis Department of Planning and Development
Moratorium on Used Automobile Related Businesses
Staff Report
OVERVIEW
The concentration of used automobile related businesses within the city has recently become an
issue that the City Council has decided to reevaluate. The Mayor, at City Council's request,
directed the planning staff to research whether there were any negative impacts from the
abundance of used automobile related businesses in the city and to recommend what solutions
should be considered to offset any negative impacts. The Department of Planning and
Development has found that there is a possibility that the number of used automobile related
businesses in West Memphis negatively affects the health, safety, and general welfare of the city.
As written, the Zoning Ordinance and Design Review Guidelines are not satisfactory to address
these concerns. The administration is recommending that a moratorium be put in place for up to
(12) twelve months in order to fully evaluate appropriate solutions to protect the public from the
negative impacts of used automobile related businesses. Additionally, during the proposed
moratorium, solutions would be developed in conjunction with GROW West Memphis 2040 to
ensure that they are guided by the public's vision of the future growth and development of the
City of West Memphis.
In the text that follows the reader is provided with definitions of used automobile related
businesses, applicable local and state regulations, findings of relevant court cases, and staff's
analysis and recommendations.
DEFINITIONS
Automobile Junk or Salvage Yard: (See "Junkyard").
Automobile Painting or Body Rebuilding Shop: A facility for restoring auto bodies,
painting, or refinishing.
Auto Repair Garage: A facility for major motor vehicle repair, excluding body
rebuilding.
Garage, Public or Repair: A building in which are provided facilities for the care,
servicing, repair, or equipping of automobiles.
Junkyard: A place where waste, discarded, or salvaged materials are bought, sold,
exchanged, baled, packed, disassembled, or handled, including auto wrecking yards,
house wrecking yards, used lumber yards, and places for storage of salvaged house
wrecking and structural steel materials and equipment; but not including such places
where such uses are conducted entirely within a completely enclosed building,
and not including pawn shops and establishments for the sale, purchase, or storage of
used furniture and household equipment when conducted entirely within a completely
1
Source documents are available upon request.
August 29, 2018
enclosed building, or sale of used cars in operating condition.
CURRENT ZONING REGULATIONS
C-2 Open Display Commercial District allows for outside display and storage. All servicing of
vehicles and assembly of equipment carried on as an incidental part of the sales operation shall
be conducted within a completely enclosed building.
BW-2, Open Display Broadway District allows retail sales with outside display such as
automobile dealerships. All servicing of vehicles and assembly of equipment carried on as an
incidental part of the sales operation shall be conducted within a completely enclosed building.
I-1, Limited Industrial District allows service uses, conducted by operations which are primarily
carried on within enclosed buildings having adequate land area for parking and landscaping.
I-2, General Industrial allows for heavier or more intense industrial uses than permitted in the I-
1, Limited Industrial District.
C-2, BW-2, I-1 and I-213istricts
Every use, or any part thereof, that is not conducted within a building completely enclosed on all
sides shall be screened by a permanent opaque screening fence or wall so that it cannot be seen
from an adjoining lot. Automobile storage areas are not required to screen fully assembled
merchandise which is ready for sale.
Automobile Wrecking and Salvage Yards, Junkyards, and similar uses shall not be permitted
closer than 500 feet to any established residential district. All outdoor storage of salvage and
wrecking operations shall be conducted entirely within an enclosed opaque fence or wall.
Automobile Wrecker Services shall screen all temporary storage of said wrecked automobiles
entirely within enclosed opaque fence or wall. Any premises on which there remains for more
than a 30-day period an inoperable, wrecked, or otherwise disabled vehicle, shall be deemed for
the purpose of this Ordinance, an automobile wrecking, salvage, or junkyard.
2
Source documents are available upon request.
August 29, 2018
STATE LEGISLATION
Arkansas Code Annotated
27-74-402. Definitions.
As used in this subchapter:
(1) "Automobile graveyard" means any establishment or place of business that is maintained,
used, or operated for the storing, keeping, buying, or selling of five (5) or more wrecked,
scrapped, ruined, or dismantled motor vehicles;
(2) "Junk" means old or scrap copper,brass, rope, rags,batteries, paper, trash, rubber debris, and
waste or junked, dismantled, or wrecked automobiles, or parts thereof, or iron, steel, and other
old or scrap ferrous or nonferrous materials; and
(3)
(A) "Junkyard" means an establishment or place of business that is maintained, used, or
operated for storing, keeping,buying, or selling junk or for the maintenance or operation of an
automobile graveyard.
(B) The term "junkyard" shall also include garbage dumps and sanitary fills.
27-74-405. Screening requirement.
(a) Except as otherwise herein provided, no junkyards shall be established, operated, or
maintained after June 29, 1967, any portion of which is within one thousand feet (1000') of
the nearest edge of the right-of-way of any interstate, primary, or other state highway
designated by the State Highway Commission in the State of Arkansas unless the junkyards
shall be screened by natural objects, plantings, fences, or other appropriate means so as not
to be visible from the main-traveled way of the highway, or shall be removed from sight.
COURT CASES
The following is a list of related court cases:
United States Supreme Court Cases
Berman V. Parker, 348 U.S. 26(1954).
Validated that the aesthetics of a community is part of the public welfare and therefore validated
aesthetic regulations as part of the police powers. Since Berman aesthetics has become an
appropriate subject for police power regulation. Aesthetic considerations have emerged as
essential elements in the preservation of an individual's and a community's "quality of life."
3
Source documents are available upon request.
August 29, 2018
Tahoe-Sierra Preservation Council, Inc. v. Tahoe Regional Planning Association, 535 US 302
(2002).
The Court upheld a 32-month moratorium on development in an area while a comprehensive
plan was being developed, preventing landowners from rushing to develop causing inefficient
and ill-conceived growth before the plan could be adopted. The ruling substantiated that
moratoria are an essential tool of successful development when the character of the regulation
and public interests to be achieved outweigh the interference with property owners' investment
backed expectations.
State Court Cases
Parkersburg Builders Material Co. v. Barrack, 118 W. Va. 608, 191 S.E. 368 (1937).
Eyesores, the storage of old automobiles in this case, can be declared aesthetic nuisances and
therefore legal action can be taken to enjoin the owner from using their property in such a way.
The Court ruled that eyesores can be prohibited if their location makes them unduly offensive to
neighbors or the public. Barrack lends strong legal support to the principle that unsightliness is
actionable.
Foley v. Harris, 223 Va. 20, 286 S.E.2d 186 (1982).
The Supreme Court of Virginia affirmed a chancellor's decree enjoining the defendants from
keeping wrecked automobiles on their lot. The chancellor's finding that the "old, battered,
abandoned automobiles on the lot...definitely 'obstruct[ed] the reasonable and comfortable use of
property' of neighbors," and thereby constituted a nuisance.
Allison v. Smith, 695 P.2d 791 (Colo. App. 1984).
A Colorado Court held that a legitimate but unsightly activity may constitute a private nuisance if
it is unreasonably operated so as to be unduly offensive to its neighbors.In this case,the defendants
had placed a number of inoperable automobiles, scrap material,pipe, and other"obnoxious debris'
on their property. The plaintiffs sued for damages and injunctive relief claiming that the sight of
the defendant's land substantially interfered with the use and enjoyment of their property.
4
Source documents are available upon request.
August 29, 2018
Arkansas Court Case
Craft v. City of Fort Smith 335 Ark. 417, 984 S.W.2d 22 (1998)
The Arkansas Supreme Court held that an ordinance does not have to treat all people or activities
similarly. Phillips v. Town of Oak Grove, 333 Ark. 183, 968 S.W.2d 600 (1998). The ordinance
may include classifications that cause people or activities to be treated differently so long as
there is a rational basis for the distinction. See, e.g, Phillips v. Town of Oak Grove, supra
(upholding an ordinance that allowed birds to be raised for personal but not for commercial
uses); Johnson v.Sunray Serv., Inc., 306 Ark. 497, 816 S.W.2d 582 (1991) (upholding an
ordinance that allowed solid waste disposal facilities to be constructed two miles from
designated waterways); City of Little Rock v. Reinman-Wolfort Automobile Livery Co., 107
Ark. 174, 155 S.W. 105 (1913), affd, 237 U.S. 171, 35 S.Ct. 511, 59 L.Ed. 900 (1915)
(upholding an ordinance that prohibited livery, but not sale, stables from only certain portions of
the city).
In this case, the appellant was an affected property owner who challenged the zoning ordinance
on the grounds that the new landscaping requirements for his property were a financial burden
and would decrease the resale value of his land. The court ruled that there was a rational basis for
applying landscaping and signage regulations to the new portions of the road and not to other
streets in the city because the new portion consisted of mostly undeveloped land and the City
wanted to ensure that the area was developed in a manner that promotes traffic safety and
aesthetics.
STAFF ANALYSIS
Used automobile related businesses have been allowed in various commercial and industrial
districts, depending on intensity and nature of the specific use, for nearly 30 years. During that
time many code enforcement violations have occurred regarding the zoning of the subject
properties and the uses that are permitted. Historically, used automobile related businesses
originate as low intensity, generally compatible land uses in commercial and industrial districts.
Over time, however, the uses intensify and used car lots, for example, turn into automobile
junkyards, which are not permitted by right in any zoning district. While used automobile
related businesses are a necessity to diverse communities like West Memphis, they can become
nuisances when they are operated in a manner inconsistent with the adopted rules and regulations
to protect the health, safety, and general welfare of the public.
The health and safety of residents are jeopardized by used automobile related businesses due to
pollutants that are released from automobiles. One of the most known pollutants is Benzene. It
is present in gasoline, vehicle exhaust, and is used to make plastics, lubricants, and rubbers. It
has also been linked to childhood leukemia. Various studies have found that there is an
association between the location of a child's home next to a repair garage or petrol station and
childhood leukemia.
Environmental pollutants have also been linked to asthma. Neighborhoods frequently associated
with asthma are typically disproportionately burdened by pollution and are low income,minority
5
Source documents are available upon request.
w
Y
August 29, 2018
occupied. These asthma hotspots also tend to have clusters of polluting facilities, like repair
garages, nearby. This clustering is important to note because these facilities are generally small
and do not emit enough pollutants to be monitored by a regulatory agency. Taken together,
however, they represent significant hazardous exposure for residents.
In addition to pollutants, automobile repair garages produce the following hazardous waste:
- Antifreeze,
- Cleaning Solutions & Sludges
- Floor Cleaning Materials
- Lead Acid Batteries
- Paint, Paint Solvents and Paint Filters
- Pressurized Spray Cans
- Shop Rags/Towels
- Used Oil Filters
- Used Oil
Used automobile related businesses can also cause harm to the physical, aesthetic, and monetary
realms of the general welfare. When automobile related land uses dominate the physical
landscape, areas are changed from vibrant places with human interaction and activities to baron
corridors where people feel unsafe to travel on foot due to long distances between origins and
destinations. There are long stretches of sidewalk where pedestrians have to walk within arms-
length from high-speed traffic. Once the destination is reached, there is still a vast parking lot to
cross. Instead of running into a neighbor, a pedestrian has to constantly be aware of their
surroundings so that they do not collide with cars. This sense of human isolation gives rise to
new issues of fear, crime, neglected properties, and the impression of the loss of social control.
These perceptions remain even though a disproportionate amount of tax dollars is spent policing
blighted areas over code compliant ones.
Not only is this development pattern dangerous but it is also unpleasing to the eye. Many used
car related businesses store inoperable vehicles in view of the public,pile tires in sections of their
lots,and park operable vehicles in an unorganized,unnavigable manner.This creates an unsightly
image of the city for residents and outsiders alike. One way to lighten the harsh effects of car-
centric corridors is to add pedestrian friendly aesthetic amenities such as street furniture,
landscape strips between the sidewalk and nearest lane of traffic, and vegetation to screen the
parking lots from passersby. None of these currently exist in areas with a concentration of used
automobile related businesses, however. The absence of these amenities creates an environment
that is uninviting, bland, and lacking character. Aesthetics is one tool that can help transform
these spaces into places. People relate their visual surroundings to experiences which allows them
to attach an emotional meaning to spaces. This new-found link turns spaces in to places and as a
result, the character of a neighborhood is developed. Currently, due to the high concentration of
used automobile related businesses, there is an abundance of space waiting to be designated as
special places to the residents of West Memphis.
As stated above, the areas with a concentration of used automobile related businesses requires
more policing, therefore more tax dollars are spent on them than other areas of the city. There
are also other monetary effects that are the result of this concentration. Because used automobile
related businesses are not the highest and best use for commercial or industrial property, they
decrease the tax base, reduce tax revenues, and substantially inhibit growth of the adjacent area.
6
Source documents are available upon request.
w
1
August 29, 2018
These uses, especially auto salvage yards, decrease property values for all property types in the
surrounding area. The lower property values are a contributing factor of the high number of low
income households who reside nearby, which in turn, can be linked back to the high level of
pollutants low income households are subject to by neighboring land uses.
RECOMMENDATION
Based on the above stated research and analysis,staff proposes enacting a(12)month moratorium
suspending the issuance of any new Certificate of Occupancy for used automobile related
businesses.During this time,staff will work closely with the Planning Commission,City Council,
and other city departments to develop a holistic approach to regulating used automobile related
businesses. The regulations will be developed in conjunction with GROW West Memphis 2040,
the city's comprehensive growth and development plan,to ensure that they will be an instrument
in helping West Memphis reach its development goals. Staff notes that the public and all affected
landowners will be mutually benefited by the proposed moratorium because it will protect
everyone's interest against immediate development that might be inconsistent with the provisions
of the plan that is ultimately adopted.
7
Source documents are available upon request.
City of west Memphis Information Security Policy
604 E. Cooper Avenue
West Memphis,AR 72301
Policy Owner
Policy Approver(s)
Related Policies
Related Procedures
Storage Location
Effective Date
Next Review Date
City of West Memphis, Arkansas
Information Security Policy
City of West Memphis—Information Acceptable Use Policy
Page 1
City of West Memphis Information Security Policy
t-1- 604 E. Cooper Avenue
- West Memphis, AR 72301
Contents
Purpose........................................................................................................................................................................................3
Scope...........................................................................................................................................................................................3
Definitions...................................................................................................................................................................................3
GoverningLaws & Regulations....................................................................................................................................................3
Section1—Security Governance.................................................................................................................................................4
1.1 Organization of Information Security....................................................................................................................................4
1.2 Human Resources Security....................................................................................................................................................4
Section2—Security Operations ..................................................................................................................................................6
2.1 Asset Management................................................................................................................................................................6
2.2 Access Control.......................................................................................................................................................................7
2.3 Cryptography.........................................................................................................................................................................8
2.4 Physical and Environmental Security.....................................................................................................................................9
2.5 Operations Security.............................................................................................................................................................10
2.6 Communications Security....................................................................................................................................................11
2.7 System Acquisition, Development, and Maintenance Security...........................................................................................11
2.8 Security in Supplier Relationships.......................................................................................................................................12
Section3—Security Management.............................................................................................................................................14
3.1 Information Security Incident Management.......................................................................................................................14
3.2 Information Security Aspects of Business Continuity Planning...........................................................................................14
3.3 Compliance..........................................................................................................................................................................15
3.4 IT Security Risk Strategy ......................................................................................................................................................16
RevisionHistory.........................................................................................................................................................................18
City of West Memphis—Information Acceptable Use Policy
Page 2
City of west Memphis Information Security Policy
d 604 E. Cooper Avenue
West Memphis,AR 72301
Purpose
The purpose of this policy is to provide staff with clear guidance on the appropriate, safe, and legal way in which they can
make use of information and IT equipment at The City of West Memphis. Staff need to be aware of the compliance required
with this policy and The City of West Memphis's commitment to comply with the Information Security program and
Arkansas Legislative Audit requirements that all reasonable organizational and technical measures are taken to safeguard
its data.
Scope
This Acceptable Use Policy(AUP) applies to the use of all information and IT equipment by The City of West Memphis staff
(including temporary workers, locums, and staff seconded or contracted from other organizations).All staff should be
aware of their legal obligations and internal policy in respect of information handling.
This policy will change as information use changes in the organization.
All employees are expected to have knowledge of at least the portions of this document that are directly related to their
role within the organization.
Definitions
1. Low Risk Information.This is defined as information that does not require special protective measures.
2. High Risk Information.This is defined as information,the loss or breach of which would substantially impair the
organization.
Governing Laws & Regulations
Selection and maintenance of security controls are derived from the requirements outlined in the Arkansas Legislative Audit
-Information Systems Best Practices documentation and are measured annually.
City of West Memphis—Information Acceptable Use Policy
Page 3
r..
City of West Memphis Information Security Policy
Ey 604 E.Cooper Avenue
West Memphis,AR 72301
Section 1 — Security Governance
1.1 Organization of Information Security
The purpose of this policy is to ensure a framework is in place to include information security within internal and remote
operations.
This Organization of Information Security Policy applies to all business processes and data, information systems and
components, personnel, and physical areas of City of West Memphis.
1.1.1 Management Commitment to Information Security:
1. Management shall actively support security within the organization through clear direction, demonstrated
commitment,explicit assignment, and acknowledgment of information security responsibilities.
2. Top management should ensure that the responsibilities and authorities for roles relevant to information security
are assigned and communicated.
3. Top management should also assign responsibilities and authorities for reporting performance of the information
security management system within the organization.
1.1.2 Internal Organization:
1. All responsibilities and behaviors relating to information security must be clearly defined.
a. A clear and appropriate security organizational structure should be documented and communicated
within the organization and to other interested parties.
b. An information security officer will be determined and the role will be assigned appropriately.
c. Segregation of duties will be implemented to ensure minimal crossover.
2. Contacts with the appropriate authorities will be identified and maintained.
3. Appropriate contacts with special interest groups or specialist security forums will be maintained.
4. Project management will include information security as a crucial consideration regardless of the type of project.
5. City of West Memphis should:
a. Determine the necessary competence of person(s) doing work under its control that affects its
information security performance.
b. Ensure that these persons are competent on the basis of appropriate education,training,or experience.
c. Where applicable,take actions to acquire the necessary competence and evaluate the effectiveness of
the actions taken.
d. Retain appropriate documented information as evidence of competence.
1.2 Human Resources Security
The purpose of this policy is to ensure personnel, including contractors, are aware of and understand their responsibilities
in regards to security.
This Human Resource Security Policy applies to all business processes and data, information systems, as well as
components, personnel, and physical areas of City of West Memphis.
1.2.1 Prior to Employment:
1. All candidates for employment, including contractors and third-party users, must undergo background verification
checks in accordance with the appropriate laws.
2. Contractual agreements with all employees and contractors will clearly outline the responsibility of the
individual/contractor to information security.
a. Responsibilities will be reviewed and updated regularly.
1.2.2 During Employment:
1. Management must require and ensure all employees and contractors adhere to applicable information policies
and procedures within the organization.
City of West Memphis—Information Acceptable Use Policy
Page 4
City of West Memphis
��Y 604 E. Cooper Avenue Information Security Policy
West Memphis,AR 72301
a. This includes access agreements which must be signed by personnel prior to being granted access.
i. Access agreements will be reviewed and updated regularly.
2. All employees and contractors must undergo awareness training based on their roles, as well as relevant updates
in policies and procedures applicable to their jobs.
a. City of West Memphis management should require employees, contractors, and third-party users to apply
security in accordance with established policies and procedures of the organization.
b. Training must be accompanied by an assessment procedure based on the cyber security training content
presented in order to determine comprehension of key cyber security concepts and procedures.
3. If there is a failure to comply with these security requirements,there will be a formal, communicated process to
take action against said employee(s)or contractor(s).
1.2.3 Termination and Change of Employment:
1. In the event of an employee's termination or transfer of employment,formal and communicated disciplinary
actions must be taken.
a. This process include exit interviews nd removal of documents(and all copies thereof) and other City of
West Memphis property an�materials in their possession or control.
City of West Memphis—Information Acceptable Use Policy
Page 5
City of West Memphis Information Security Policy
604 E.Cooper Avenue
West Memphis,AR 72301
Section 2 — Security Operations
2.1 Asset Management
The purpose of this policy is to ensure assets are identified appropriately and the proper protection controls for those
assets are in place.
This Asset Management Policy applies to all business processes and data, information systems and components, personnel,
and physical areas of City of West Memphis.
2.1.1 Responsibility for Assets:
1. Information or information processing facility assets must be inventoried and documented and that record must
be kept up to date.
a. Inventory categorization must be approved by the appropriate parties or authorizing authority.
b. Organization will employ use of automated mechanisms to identify unauthorized systems including
hardware or software.
c. Inventory must also include information system updates or removals.
2. This process must be assigned to an owner to maintain the process.
a. Individuals requiring access to the information systems must follow proper procedure to receive such
access, such as signed acknowledgement of standards and consequences.
3. The following assets should be considered in the inventory process:
a. Authorized assets
b. Unauthorized assets
c. Software
d. Databases
e. Information stores
f. Physical assets
g. Services
h. People
i. Tangibles
4. Processes around configuration management will be established as well.
5. All assets must be returned upon termination of employment or contract.
2.1.2 Information Classification:
1. All assets must be classified in terms of legal requirements, value to the organization, their criticality to the
organization, and sensitivity if they were to be disclosed by an unauthorized party.
2. City of West Memphis data shall be classified into one of the following categories:
a. Confidential:Critical information whose existence or content is only known to a small group of
individuals. Disclosure of this information would harm the organization or impede ability to achieve
objectives.
b. Sensitive: Sensitive information requires an elevated level of protection (e.g. encryption)to satisfy
regulatory requirements or prevent its unintended disclosure. Information is disclosed only to authorized
individuals on a need-to-know basis.
c. Business Confidential: Business confidential information/data is used to conduct normal business
operations of City of West Memphis. Normal levels of confidentiality(per the Employee Code of Conduct)
are applied.The intention is to minimize the impact upon business operations.
d. Internal Use: Internal use data/information is used to support the business operations of a department.
The information is intended for internal use only.
e. Public: Public information is such that City of West Memphis has published for general or public
consumption, or publicly known information that City of Wet Memphis has received from other
organizations.
City of West Memphis—Information Acceptable Use Policy
Page 6
City of West Memphis Information Security Policy
604 E. Cooper Avenue
ILEF
' West Memphis,AR 72301
3. Assets will be labeled and handled based on appropriate information classification procedures used by the
organization.
2.1.3 Media Handling:
1. Removable media must also be managed by the same asset classification procedure used by the organization.
2. Removable media must be protected against unauthorized access and misuse while in use and in transit, and must
be disposed of securely, using appropriate procedures.
3. Media containing information shall be protected against unauthorized access, misuse, or corruption during
transportation.
2.1.4 Acceptable Use:
1. Standards or guidelines for the acceptable usage of assets should be documented to indicate what information
system users are and are not allowed to do.
2. The following items should be covered in acceptable usage guidelines:
a. Computer and information system usage
b. Software and data usage
c. Internet and email usage
d. Telephone usage
e. Office equipment&materials usage
3. As a requirement of information system access, and as a component of security awareness training, all information
system users, whether employees or third parties, will be required to provide signed acceptance of the acceptable
usage guidelines.
2.2 Access Control
The purpose of this policy is to ensure users have the appropriate access levels specifically authorized to them to access
information on systems and applications.
This Access Control Policy applies to all business processes and data, information systems and components, personnel, and
physical areas of City of West Memphis.
2.2.1 Business Requirements of Access Control:
1. This access control policy must be developed and reviewed regularly(i.e. annually) based on City of West Memphis
security requirements.
a. City of West Memphis will employ a role-based access method.
2. Users will only receive access to networks and network systems specifically authorized to them.
a. City of West Memphis will follow the principle of least privilege.
2.2.2 User Access Management:
1. A formal user registration and de-registration process must be developed and initiated to allow assignment of
rights.
a. City of West Memphis will employ use of automated mechanisms to enhance this process.
b. A formal user provisioning process must be in place.This process will allow for the assignment or
revocation of access rights for all users to all systems and services.
c. Privileged access rights will be allocated in a highly controlled and restricted process.Their usage will also
be controlled.
i. Inactivity logout will be enabled after a pre-determined time period.
d. Secret authentication information allocation will be managed through a formal process.
e. Asset owners must conduct regular reviews of users' access rights and use of accounts.
f. Upon termination of employment, an employee's or external party's user access rights will be revoked.
i. If there is a change to a contract or agreement,then the access will be adjusted appropriately.
ii. City of West Memphis will employ automated processes to remove temporary and emergency
accounts after a determined amount of time.A similar automated process will exist for disabling
inactive accounts.
City of West Memphis—Information Acceptable Use Policy
Page 7
~• City of West Memphis Information Security Policy
604 E.Cooper Avenue
' West Memphis,AR 72301
1. City of West Memphis will also terminate any access for(and accounts of) high-risk
users.
2.2.3 User Responsibilities:
1. Users must follow City of West Memphis's procedures surrounding secret authentication information usage.
2.2.4 System and Application Access Control:
1. User access to all information and application systems will be restricted based on City of West Memphis's access
control standards.
a. According to the access control policy, access to systems and applications will be restricted with a secure
log-on process.
i. A limit of successive incorrect logons(e.g. six times)will be enforced and an automatic account
lock will be enabled.
ii. Time and date of logons and account changes will be appropriately recorded and monitored.
b. Network and information systems sessions should remain locked for a predetermined time or until the
user reestablishes access through an established authentication procedure.
c. City of West Memphis will establish appropriate restrictions around remote access,wireless access, and
mobile devices.
2. Password management systems will be interactive and mandate strong passwords.
3. Any use of utility programs capable of overriding system and application controls will be highly controlled and
restricted, if necessary.
4. Any access to program source code will be strictly prohibited.
5. City of West Memphis will control the flow of information between interconnected systems to ensure secure
transfers through measures like encrypted tunnels.
a. When an automated flow control decision is not possible or available, City of West Memphis will initiate a
human review.
6. The City of West Memphis will enact separation of duties to decrease abuse of privileges.
7. Access by external information systems will be regulated.
8. The City of West Memphis will ensure information sharing process follows appropriate access levels of sharing
partners.
a. City of West Memphis will designate individuals allowed to post information on publicly available systems.
9. The City of West Memphis will implement appropriate data mining prevention controls.
2.3 Cryptography
The purpose of this policy is to ensure correct use of cryptography to protect the confidentiality, authenticity, and integrity
of the organization's information.
This Cryptography Policy applies to all business processes and data, information systems and components, personnel, and
physical areas of City of West Memphis.
2.3.1 Cryptographic Controls:
1. The City of West Memphis will develop a policy surrounding the proper procedures needed around the use of
cryptographic controls. The following items should be considered:
a. Based on a risk assessment,the required level of protection should be identified taking into account the
type,strength, and quality of the encryption algorithm required.
b. The use of encryption for protection of information transported by mobile or removable media devices or
across communication lines.
c. The standards to be adopted for effective implementation throughout the organization.
d. The impact of using encrypted information on controls that rely upon content inspection.
2.3.2 Key Management:
1. Cryptographic keys should be protected through their whole lifecycle.
2. Cryptographic algorithms, key lengths, and usage practices should be selected according to best practice.
City of West Memphis—Information Acceptable Use Policy
Page 8
City of West Memphis Information Security Policy
604 E. Cooper Avenue
+ West Memphis,AR 72301
3. All cryptographic keys should be protected against modification and loss. In addition, secret and private keys need
protection against unauthorized use as well as disclosure.
4. Equipment used to generate, store, and archive keys should be physically protected.
5. A key management system should be based on an agreed set of standards, procedures, and secure methods for:
a. Generating keys for different cryptographic systems and different applications.
b. Issuing and obtaining public key certificates.
c. Distributing keys to intended entities, including how keys should be activated when received.
d. Storing keys, including how authorized users obtain access to keys.
e. Changing or updating keys, including rules on when keys should be changed and how this will be done.
f. Dealing with compromised keys.
g. Revoking keys, including how keys should be withdrawn or deactivated.
h. Recovering keys that are lost or corrupted.
i. Backing up or archiving keys.
j. Destroying keys.
k. logging and auditing of key management related activities.
2.4 Physical and Environmental Security
The purpose of this policy is to ensure proper measures are in place to prevent unauthorized physical access or damage to
the organization's information and facilities.
This Physical and Environmental Security Policy applies to all business processes and data, information systems and
components, personnel, and physical areas of City of West Memphis.
2.4.1 Physical Access and Security:
1. Physical security perimeters will be identified and will protect mission critical information or facilities.
2. Appropriate entry controls will be implemented at secure access points to ensure only individuals with appropriate
access levels are allowed access. These access points will be monitored.
a. City of West Memphis should develop, approve, and maintain a list of personnel with authorized access to
the facility where information systems are physically located.
b. City of West Memphis should establish a process to review, approve, and issue credentials for facility
access.
c. [Agency] shall remove individuals from the facility access list when access is no longer required.
d. City of West Memphis should maintain physical access audit logs for data center(s)and/or sensitive
facilities' entry/exit points.
3. Security measures will be implemented for working in various identified safe spaces and delivery and loading
spaces.
2.4.2 Environmental Security:
1. Protection against natural disasters or other malicious attacks, as well as accidental incidents,will be determined
and implemented.
2. The City of West Memphis should place power equipment and cabling in safe locations to prevent environmental
and/or man-made damage and destruction.
3. Applicable security measures will be implemented for offices, boardrooms, etc., including considerations for
temperature, protection against water damage, and emergency lighting.
2.4.3 Equipment Security:
1. Equipment will be handled and protected to ensure risks are reduced, preventing potential environmental threats
and hazards.
2. Redundancies and other supporting procedures will be put in place to protect from power failures and other
disruptions, including ensuring power and telecommunications cabling carrying data will be properly protected.
3. Equipment will be regularly maintained.
4. Any removal of assets must be done with prior authorization from the right party.
City of West Memphis—Information Acceptable Use Policy
Page 9
City of West Memphis Information Security Policy
604 E. Cooper Avenue
West Memphis,AR 72301
5. Any offsite assets will be treated with the same security measures,with special consideration to risks of being off-
premise.
6. Disposal or re-use of equipment must be done after the removal of sensitive or critical data has been completed.
7. Any unattended equipment must have applicable protection.
8. Personnel are responsible for maintaining their personal workspaces and ensuring media or literature containing
sensitive or critical information is properly stored and not in the open.
2.5 Operations Security
The purpose of this policy is to ensure the secure operations of information processing facilities within and related to City of
West Memphis.
This Operations Security Policy applies to all business processes and data, information systems and components, personnel,
and physical areas of City of West Memphis.
2.5.1 Operational Procedures and Responsibilities:
1. A standardized configuration, or baseline,will be established and maintained for all information systems. These
baselines will indicate the specifications of information system components(hardware,firmware, and software),
their relationship, and their ownership.
a. Changes to an information system must be fully documented and authorized, and must be performed in a
controlled manner.
2. Operational procedures will be made available to all applicable users.
3. A change management request should be created for all information system maintenance.
4. Capacity management to ensure appropriate usage of resources will be implemented.
5. Any testing environments will be made separate from the main operational network and facilities.
2.5.2 Protection from Malware:
1. Protection against malware should be based on malware detection and repair software, information security
awareness, and appropriate system access and change management controls.
2. Anti-virus software should be deployed on all systems commonly affected by malicious software(particularly,
personal computers and servers).
3. Ensure that all anti-virus mechanisms are current, actively running, and generating audit logs.
4. Where the use of mobile code is authorized,the configuration shall ensure that the authorized mobile code
operates according to a clearly defined security policy and unauthorized mobile code shall be prevented from
executing.
2.5.3 Backup:
1. A backup policy must be agreed upon to collect backup copies of necessary data, software, etc. and test them in a
timely manner.
2.5.4 logging and Monitoring:
1. Information systems should be configured to record all critical systems activities such as login/logout and
administrative changes into a log file.
2. Event logs recording user activities, exceptions, faults, and information security events shall be produced, kept,
and regularly reviewed.
3. In addition,the information systems should be configured to notify administrative staff via a Security Information
Event Management (STEM)solution in the event that inappropriate, unusual,and/or suspicious activity is noted.
4. These logging processes and facilities will be protected accordingly.
5. All clocks of the logging and information processing systems will be appropriately synchronized.
2.5.5 Control of Operational Software:
1. City of West Memphis will implement controls for the implementation of software and to prevent or detect the
use of unauthorized software(e.g.application whitelisting).
2.5.6 Mobile Devices and Teleworking:
1. Security measures will be developed and adhered to in order to manage risks introduced by the use of mobile
devices.
City of West Memphis—Information Acceptable Use Policy
Page 10
City of west Memphis Information Security Policy
604 E.Cooper Avenue
West Memphis,AR 72301
2. Security measures will be implemented to protected information accessed, processed, or stored at
teleworking/remote sites.
2.5.7 Technical Vulnerability Management:
1. City of West Memphis will implement controls and processes to properly scan and address vulnerabilities in
information systems at least quarterly, and when new vulnerabilities appear.
2. Appropriate measures should be taken to address associated risks.
2.5.8 Information Systems Audit Considerations:
1. Security audits will be conducted [insert frequency—suggested annually]to ensure information system security
controls have been implemented correctly, are operating effectively, and are producing the desired level of
security.
2.6 Communications Security
The purpose of this policy is to ensure security is a key consideration in network management and in the transfer of
information in and out of the organization.
This Communications Security Policy applies to all business processes and data, information systems and components,
personnel, and physical areas of City of West Memphis.
2.6.1 Network Security Management:
1. Network segregation must be implemented. Groups of information services, users, and information systems must
be separated from one another.
2. City of West Memphis should implement limitation and controls of network ports, protocols, and services.
3. Controls should be implemented to ensure the security of information in networks and the protection of
connected services from unauthorized access. In particular,the following items should be considered:
a. Responsibilities and procedures for the management of networking equipment should be established.
b. Special controls should be established to safeguard the confidentiality and integrity of data passing over
public networks or over wireless networks.
c. Appropriate logging and monitoring should be applied to enable recording and detection of actions that
may affect, or are relevant to, information security.
d. Management activities should be closely coordinated both to optimize the service to City of West
Memphis and to ensure that controls are consistently applied across the information processing
infrastructure.
4. The following will be identified and listed within network services' agreements—both in-house and outsourced
agreements:
a. Security mechanisms.
b. Service levels.
c. Management requirements.
2.6.2 Information Transfer:
1. Appropriate policies, procedures, and controls must be established around the protection of information being
transferred through various types of facilities.
2. External parties must agree to the secure transfer of business data with City of West Memphis.
3. All information transferred in electronic messaging must be properly protected.
4. Any confidentiality or non-disclosure agreements of the organization must be acknowledged, reviewed often, and
documented.
2.7 System Acquisition, Development, and Maintenance Security
The purpose of this policy is to ensure information is a forefront consideration throughout the lifecycle of information
systems in the organization.
City of West Memphis—Information Acceptable Use Policy
Page 11
City of West Memphis Information Security Policy
/ 604 E.Cooper Avenue
�•J West Memphis,AR 72301
This System Acquisition, Development, and Maintenance Security Policy applies to all business processes and data,
information systems and components, personnel, and physical areas of City of West Memphis.
2.7.1 Security Requirements of Information Systems:
1. Information security requirements must be considered in the acquisition of new information systems or
enhancements to existing ones.
2. Identification and management of information security requirements and associated processes should be
integrated in the early stages of information systems projects.
3. Information security requirements and controls should reflect the business value of the information involved and
the potential negative business impact which might result from lack of adequate security.
4. Application services:
a. Public networks:Any information passing over public networks must be protected from malicious activity.
b. Transactions: Information in application services transactions must be protected to prevent incomplete
transactions, unauthorized access, or other undesirable activity.
2.7.2 Security in Development and Support Processes:
1. Ensure information security is included within the policies applying to software development and systems.
2. Appropriate change control processes for systems are in place throughout the development lifecycle, coupled with
technical reviews of applications for any changes made after operating platform changes.
3. Any changes to software packages should be minimized to only necessary changes, and those changes must be
controlled.
4. Secure system engineering principles and development environment must be established.
5. Any outsourced development must be strictly controlled and monitored.
6. Testing:
a. System security testing must be executed regularly during development cycles.
b. System acceptance testing must be developed for new systems, upgrades, and system versions.
2.7.3 Test Data:
1. Test data should be carefully selected, protected, and controlled.
2. The use of operational data containing personally identifiable information or any other confidential information
for testing purposes should be avoided. If personally identifiable information or otherwise confidential information
is used for testing purposes, all sensitive details and content should be protected by removal or modification.
2.8 Security in Supplier Relationships
The purpose of this policy is to ensure proper protection of City of West Memhis's assets that are accessed by suppliers.
This Security in Supplier Relationships Policy applies to all business processes and data, information systems and
components, personnel, and physical areas of City of West Memphis.
2.8.1 Information Security in Supplier Relationships:
1. Procedures surrounding risk mitigation of a supplier's access to City of West Memphis's assets must be
documented, reviewed, and agreed upon by City of West Memphis and the specific supplier.
2. All suppliers that access, process,store, or provide various IT components must be in agreement withCity of West
Memphis's security requirements around suppliers' relationships with the assets.
a. Types of information access should be defined that different types of suppliers will be allowed, as well as
monitoring and controlling the access.
b. Types of obligations applicable to suppliers should be defined to protect the organization's information.
3. Security requirement agreements for suppliers must also include details on addressing risks surrounding the
handling, processing, and communicating of assets or services.
a. The risks to the organization's information and information processing facilities from business processes
involving external parties shall be identified and appropriate controls implemented before granting
access.
City of West Memphis—Information Acceptable Use Policy
Page 12
City of west Memphis Information Security Policy
604 E. Cooper Avenue
West Memphis,AR 72301
b. Legal and regulatory requirements, including data protection, intellectual property rights, and copyright,
etc. should be clearly identified and addressed.
2.8.2 Supplier Service Delivery Management:
1. A process must be developed to monitor and assess the service delivery of a supplier to ensure it is meeting
appropriate business and security requirements, as well as meeting any contract or SLA requirements.
2. A change management process must be in place to address any alterations to an existing policy, including
documentation of said change and ensuring it is in alignment with business processes and follows appropriate re-
assessment of risk involved, if necessary.
City of West Memphis—Information Acceptable Use Policy
Page 13
City of west Memphis Information Security Policy
604 E.Cooper Avenue
West Memphis,AR 72301
Section 3 — Security Management
3.1 Information Security Incident Management
The purpose of this policy is to ensure proper recognition, management, and communication of security events and
weaknesses through a formal process.
The quality and integrity of City of West Memphis's incident response capabilities are used to monitor for security
incidents, determine the magnitude of the threat presented by these incidents, and respond to these incidents. Without an
incident response capability,the potential exists that in the event that a security incident occurs, it will go unnoticed and
the magnitude of harm associated with the incident will be significantly greater than if the incident were noted and
corrected.
This Information Security Incident Management Policy applies to all business processes and data, information systems and
components, personnel, and physical areas of City of West Memphis.
3.1.1 Management of Information Security Incidents and Improvements:
1. Incident management responsibilities and procedures must be established to ensure timely response procedures
to incidents.
2. The incident response capability should include a defined plan and must address the seven stages of incident
response:
a. Preparation
b. Detection
c. Analysis
d. Containment
e. Eradication
f. Recovery
g. Post-incident activity
3. Information security events will be assessed, and determinations will be made about whether they can be
identified as information security incidents.
4. Information security incidents should be identified and classified into different severity levels to make incident
response process more effective.
5. Incidents will be responded to with the appropriate procedures based on documented organizational processes.
a. Incident response procedures will be reviewed on an annual basis, and any required updates will be
communicated to the appropriate parties.
6. Information gained from responding to and resolving incidents will be used to reduce potential future incidents.
7. City of West Memphis will establish definitions and procedures around the identification, collection,acquisition,
and preservation of information.
a. This data will be used in analysis of these incidents and as evidence.
b. The records of this data will be audited regularly and timestamped.
8. Reporting:
a. Information security events must be reported through proper channels. Incidents will be tracked as they
occur.
b. Any weaknesses,suspected or verified, in systems and services must be reported by employees or third-
party contractors using those systems and services.
3.2 Information Security Aspects of Business Continuity Planning
The purpose of this policy is to ensure that information security is properly addressed within the organization's Business
Continuity Planning(BCP)strategy.
City of West Memphis—Information Acceptable Use Policy
Page 14
City of west Memphis Information Security Policy
604 E. Cooper Avenue
ILLIP
West Memphis,AR 72301
This Information Security Aspects of Business Continuity Planning Policy applies to all business processes and data,
information systems and components, personnel, and physical areas of City of West Memphis.
3.2.1 Information Security Continuity Management:
1. The organization will determine its requirements for information security and how it fits into the overall continuity
of information security management in crises.
a. Including aspects like purpose, roles, and responsibilities.
2. The organization will create, document, and implement any processes and controls related to the continuity for
information security during crisis situations.
a. Contingency plans will go through testing to ensure comprehensiveness and effectiveness.
3. These information security processes and controls will be reviewed and validated regularly to ensure their
continued effectiveness.
3.2.2 Security Contingency Planning within the context of enterprise BCP:
1. City of West Memphis should conduct a Business Impact Analysis(BIA)to identify security functions, processes,
and applications that are critical to the city and determine a point in time(i.e. recovery time objective (RTO)) when
the impact of an interruption or disruption becomes unacceptable to City of West Memphis.
2. City of West Memphis should utilize the BIA results to determine potential impacts resulting from the interruption
or disruption of critical security functions, processes, and applications.
3. City of West Memphis should assign contingency roles and responsibilities to key individuals from all security
functions.
4. City of West Memphis should establish procedures to maintain continuity of critical security functions despite
critical information system disruption, breach, or failure.
5. City of West Memphis should document a Business Continuity Plan (BCP)that addresses documented recovery
strategies designed to enable The City of West Memphis to respond to potential disruptions and recover its critical
security functions within a predetermined RTO following a disruption.
6. City of West Memphis should establish a process to ensure that the BCP is reviewed and approved by senior
management.
7. City of West Memphis should distribute copies of the BCP to key personnel responsible for the recovery of the
critical security functions and other relevant personnel and partners with contingency roles, as determined by The
City of West Memphis.
8. Sufficient redundancies will be implemented to ensure availability requirements are met.
3.2.3 Data Backups:
1. City of West Memphis should develop, maintain, and document data backup and storage procedures to ensure the
recovery of electronic information in the event of failure.
2. City of West Memphis should identify and apply security requirements for protecting data backups based on the
different types of data (sensitive, confidential, public) handled by the entity.
3. City of West Memphis should establish a process to perform data backups of user-level and system-level
information at a defined frequency consistent with the established RTOs and RPOs.
3.3 Compliance
The purpose of this policy is to ensure proper measures are in place to avoid non-adherence to information security
compliance requirements—legal, contractual, regulatory, or otherwise.
This Compliance Policy applies to all business processes and data, information systems and components, personnel, and
physical areas of City of West Memphis.
3.3.1 Compliance with legal and contractual requirements:
1. All applicable compliance requirements should be identified, documented, and well-maintained.
2. Any intellectual property rights requirements should be implemented and adhered to as necessary.
3. Records will be properly managed to avoid any destruction from natural disasters, unauthorized use, or loss.
4. Personally identifiable information will be properly protected.
City of West Memphis—Information Acceptable Use Policy
Page 15
City of West Memphis Information Security Policy
604 E.Cooper Avenue
' West Memphis,AR 72301
5. Any cryptographic controls will be used appropriately according to relevant compliance requirements.
3.3.2 Compliance with security policies and standards:
1. At least annually, City of West Memphis should perform reviews or audits of users' and systems' compliance with
security policies, standards, and procedures, and initiate corrective actions where necessary.
2. Results from compliance reviews or audits shall be documented and reported by City of West Memphis'
leadership.
3.3.3 Information system audit considerations:
1. City of West Memphis should implement audit procedures to help ensure that activities involving reviews or audits
of operational systems are carefully planned to minimize the risk of disruptions to business processes.
2. [Agency] shall implement security controls to help prevent unauthorized access and/or access abuse of audit tools.
3. City of West Memphis information systems should be enabled to generate audit records containing details to help
establish what type of event occurred, when and where the event occurred,the source and outcome of the event,
and the identity of any individuals or subjects associated with the event.
4. City of West Memphis should report findings of audit records reviews to information security personnel and
[Agency] leadership.
3.3.4 Information security reviews and continuous improvements:
1. City of West Memphis will conduct an independent review of its information security practices, controls, policies,
etc.
2. Management team is responsible for regular reviews of their compliance with information security policies and
procedures.
3. A technical review of information systems will be conducted regularly.
4. City of West Memphis should develop a plan of action and milestones to document planned remedial actions to
correct weaknesses or deficiencies identified as a result of internal/external risk assessments, security reviews,
and/or audits.
3.4 IT Security Risk Strategy
The purpose of this policy is to ensure adequate processes and controls are in place to mitigate risks and measure progress
related to security performance.
This IT Security Risk Strategy Policy applies to all business processes and data, information systems and components,
personnel, and physical areas of City of West Memphis.
3.4.1 Risk Assessment and Mitigation:
1. Security risk tolerance level should be defined, documented, and communicated across City of West Memphis.
2. Security risk assessment criteria should be defined in order to produce consistent assessment results.
3. Risk assessments will be performed on all information systems that house or access City of West Memphis
controlled information.These assessments will address unauthorized access, use, disclosure, disruption,
modification, and/or destruction of information or the information system itself. Further, the assessments shall
identify known potential threats,the likelihood of their occurrence, and the magnitude of the impact of those
threats should they occur.
4. Risk assessments shall be performed upon initial acquisition of an information system (in the event that the
information system is owned/operated by City of West Memphis)or prior to initial establishment of service
agreements(in the event that the information system is owned/operated by a third party on behalf of City of West
Memphis). Further, the risk assessment shall be reviewed and,where required, updated three years or whenever a
significant change is made to the information system, whichever comes first.
5. Results of risk assessments will be disseminated to appropriate parties.
3.4.2 Third-Party Risk Management:
1. Prior to choosing a third party, a proper risk assessment must be conducted on the third party to ensure
reputation,security practices, etc. are clearly made evident and work within City of West Memphis's risk
tolerance.
City of West Memphis—Information Acceptable Use Policy
Page 16
City of west Memphis Information Security Policy
604 E. Cooper Avenue
West Memphis,AR 72301
2. Third parties must provide documentation around their own risk management procedures, staffing requirements,
recordkeeping, and security processes.
3. While both security and vulnerability assessments are to be performed by internal staff on an on-going basis,third
parties will be retained every third assessment to ensure appropriate levels of coverage and oversight.
3.4.3 Security Performance and Metrics:
1. City of West Memphis will determine what needs to be monitored and measured to demonstrate effectiveness of
security and overall risk management processes(e.g. incident reporting, and decrease in overall incidents).
City of West Memphis—Information Acceptable Use Policy
Page 17
City of west Memphis Information Security Policy
604 E.Cooper Avenue
West Memphis,AR 72301
Revision History
Version Date of Change Author Rationale
ID
1.0 January 31, 2018 Shane Adams Document Created
City of West Memphis—Information Acceptable Use Policy
Page 18