Okaloosa County BOCC — January 7, 2014 — Policy Communications Mobile Device Revisions 1-14

CHAPTER XXIX – COMMUNICATIONS POLICY Section A – Purpose The purpose of this policy is to establish the Information Systems Department as the responsible authority for directing technology and data management for the Okaloosa County Board of County Commissioners. This policy specifies or outlines the responsibilities of the Information Systems Department and of authorized users. The purpose of the Information Systems Department is to provide and maintain an organized, shared information infrastructure that enables our County to share data, services and reduce duplication of effort. The management of technology and data in a coherent, organized county- wide effort is necessary to ensure limited money, resources, and time are wisely allocated and efficiently utilized to provide effective, efficient government in Okaloosa County. A centralized Information Systems Department ensures users the maximum benefit of technology without having to acquire the expertise to setup, configure and maintain networks, operating systems, application software and databases. Therefore, employees are allowed to use computer equipment to do their jobs in the most efficient manner possible. Section B – Scope and Applicability All County employees, contract employees, contingent workers, volunteers, interns and vendors using County computer equipment shall use the equipment for authorized business purposes and in accordance with this policy. This policy does not cover the use of office automation equipment such as calculators, typewriters, radios or televisions unless these devices are attached to County computer equipment or the County network. All employees using computer equipment are required to read and comply with this policy. By using any item of computer equipment, County employees consent to all provisions of this policy. Section C – Policy The Information Systems Department is responsible for directing the management of all technology and data for the County. This policy defines the responsibilities of Information Systems Department personnel and of authorized users. Just as Information Systems Department personnel are not required to perform authorized users’ jobs, authorized users are not required to perform Information Systems Department personnel jobs. Therefore, all employees can use computer equipment to do their jobs in the most efficient manner possible. The Okaloosa County Board of County Commissioners’ networks will be protected by one (1) or more firewalls which are controlled exclusively by the Information Systems Director. There will be no access to the County networks except through these firewalls without the expressed, written approval of the Information Systems Director. Conversely, there will be no access from within the County networks to resources outside the networks except through these firewalls or with the expressed, written approval of the Information Systems Director. The objective is to ensure that the Information Systems Department controls all access that exists either into or out of the network and to ensure that the Information Systems Department has the opportunity to enact acceptable solutions that are consistent with security objectives of the County. Any network equipment utilized on County’s networks must be configured by Information Systems Department personnel. County employees will not access another network, (e.g. Public Patron Internet or wireless networks) with County equipment or on County time. Computer equipment, networks and data must be protected from internal sources as well as external sources. It is the responsibility of the Information Systems Director and each department director to ensure that each individual is given the access to the computer equipment and data that he/she needs to do his/her job. Department director approval is required, with the documented need for “at home” or off-site use. A current list of equipment at employees’ residences must be kept by the respective department directors and submitted to the Information Systems Director. Conversely, it is the Information Systems Director and each department director’s responsibility to allow employees access to only the computer equipment, networks and data that he/she needs to do his/her job. Therefore, only authorized computer equipment and peripherals purchased and/or supported by the County and approved by the Information Systems Department will be allowed to connect to County networks. For example, but not limited to, no Universal Serial Bus (USB) thumb drives, portable drives, cameras, video, telephones or wireless devices of any type are to be purchased or connected by any means without the Information Systems Department’s approval. County users with “Aircards” or access to other wireless devices of this type (including when traveling) must be used for official County business only. Non-County devices must follow the guidelines and procedures established by the Information Systems Department. It is the policy of the County that the use of the Internet by County employees is permitted and encouraged where such use is suitable for business purposes and supports the goals and objectives of the County and its departments. Employee access to the Internet must be with a browser installed by the Information Systems Department. The Internet is to be used in a manner that is consistent with the normal execution of an employee’s job responsibilities. Computer networks designed for public use, such as wireless, the Library Cooperative, Conference Center and Airport patron Internets, are not for County employees’ use on County time. Internet traffic must pass through firewall and filtering software. Exceptions are made for County employees travel with prior approval from the Information Systems Department. Section D - Cellular and Mobile Devices 1) An employee may be provided a mobile device or other wireless communication service if it is determined to be necessary under one or more of the following criteria: a) Availability of device and service is integral to the performance of specific duties within the employee's job description. b) A substantial portion of the employee's work is conducted outside of the building or buildings where the employee is assigned to work. c) The employee does not have an assigned office or workspace and needs to be contacted on a regular basis by the department or division for assigned services or to provide needed information. d) It is a job requirement that the employer be able to reach the employee outside of the employee's normal work hours. 2) To be approved for a mobile device and associated service plan, the following procedures are applicable:  a) The supervisor of an employee requesting the device and/or plan must determine if the employee meets the eligibility requirements. b) Documentation to support the decision to issue the device and plan must be provided on an Okaloosa County Mobile Device Request Form, approved by the department director and forwarded to the Human Resources Department. c) All procurement of mobile devices and approval of designated rate plans are made by Purchasing with input from department directors. d) Usage of mobile devices must be in accordance with the county’s current personal use policy. 3) Personal use of mobile devices is permitted if it: a) Does not interfere with existing departmental rules, policies or protocols. b) Does not disrupt or distract the conduct of Okaloosa County business due to the volume or frequency of calls; or involve or support illegal activities. c) Is compliant with county policy. d) Is authorized by the department director on an Okaloosa County Mobile Device Request Form with a payroll deduction to offset the cost of personal use. e) All mobile devices used for county business are subject to monitoring. 4) Restrictions: a) Access to Board of County Commissioners’ network data is prohibited. b) The county is not supporting or authorizing the use of any personal devices for business purposes. c) Access and use of MiFi hotspots are allowed only if approved by the Information Systems Director. d) Employees driving county vehicles are required to comply with all laws regarding the use of mobile devices while driving. Texting and email use while driving are prohibited. e) Commercial drivers covered by the Department of Transportation (DOT) regulations are prohibited from using hand-held mobile devices while driving. Employees operating non-commercial vehicles should keep mobile device use to a minimum while driving and use hands free if possible. f) Motor vehicle operators on Eglin and Hurlburt Air Force Bases are prohibited from using cell phones while operating a vehicle on base (unless there is imminent danger or to report an accident). 5) Operational and administrative procedures:  a) Department directors will provide a copy of the communications policy to all employees who are assigned a mobile device. b) Employees must read and abide by the communications policy. c) Department directors are responsible for enforcing the communications policy and monitoring the usage of all electronic equipment used in the department to include usage of minutes and personal use. d) Mobile device group leaders may be designated by department directors to manage electronic equipment within departments and divisions. e) Employees must return mobile device equipment to their supervisors upon termination of employment, transfer to a position that does not require a mobile device, or upon request. f) Employees must report to their supervisors, lost, stolen or damaged devices as soon as possible. Section D – E Text Messaging All Okaloosa County electronic business communication should be completed primarily through County e-mail. Due to the County’s obligation to comply with Florida’s Public Records law and its technology limitations, County employees may only communicate by text message when the message being sent and/or received is considered transitory in nature and has no archival value as defined by the Department of State, Division of Archives, Bureau of Records Management. “Transitory” refers to short-term value based upon the content and purpose of the message, not the format or technology used to transmit it. Examples of transitory messages include, but are not limited to, reminders to employees about scheduled meetings or appointments; most telephone messages (whether in paper, voice mail, or other electronic form); announcements of office events such as holiday parties or group lunches; and recipient copies of announcements of agency-sponsored events such as exhibits, lectures, workshops, etc. Transitory messages are not intended to formalize or perpetuate knowledge and do not set policy, establish guidelines or procedures, certify a transaction, or become a receipt. Using a wireless communication device to text while driving presents an unsafe condition and employees shall not compose, read or send text or e-mail messages while driving. Furthermore, County employees should have no reasonable expectation of privacy when texting from a County issued wireless device. Section E F– Use of Equipment Telephones, cellular phones, voicemail systems, fax machines, and computers, including electronic mail systems (e-mail) and Internet are provided for county business use and personal use of these devices is generally prohibited except as expressly authorized. (See “Personal Use Defined” below). Also prohibited is the use of any of these systems to transmit or receive inappropriate messages, to access inappropriate information, or to harass or annoy another party. Inappropriate messages and information include, but are not limited to, those that are for personal benefit and those involving discriminatory, hostile, suggestive, obscene, or otherwise unsuitable language and content. Violations of this policy will be considered grounds for disciplinary action, up to and including dismissal of employment. Employees are prohibited from e-mailing the entire County directory. Only the County Administrator and approved personnel may e-mail the entire Okaloosa County directory. Section F G – Monitoring Communications through the above-mentioned county devices is subject to monitoring by the county for business purposes. Section G H- Personal Use Defined While communications equipment is generally provided for county business only, the County recognizes there may be occasional situations in which an employee needs to use such equipment for brief periods of time for personal reasons. Employees are required to obtain their department directors’ permission before they engage in personal use of any communications equipment. In addition, employees must reimburse the County for any cost of personal use upon department receipt of itemized billing. In an effort to reduce staff time in reconciling monthly itemized cell phone bills to identify personal calls, employees may authorize a bi-weekly payroll deduction amount determined by the County Administrator to cover personal calls. The bi-weekly deduction will continue until such time the employee and department initiates an action to discontinue personal use. Section H I– Public Records Information generated on e-mail and by computer is a public record subject to public inspection and is not confidential, unless specifically cited by statute. Users are responsible for assuring that any public records that are confidential by statute are safeguarded in a manner consistent with the practices normally provided for public records in a paper format. To ensure full compliance with the Public Records Law, Chapter 119 Florida Statutes, and the governing public’s right to access public records, all employees and elected officials with current or existing County e-mail accounts are required to use County e-mail accounts for all County business. No other e-mail accounts may be used to conduct County business. Employees or officials who receive business related e-mail at another account must forward that e-mail to their County e-mail accounts with a response to senders to please use the employee’s or the official’s County e-mail account for further business purposes. Logins and passwords are issued solely for the use of employees in conducting official county business. All employees are prohibited from: 1) Disclosing or transferring logins or passwords to unauthorized persons or entities; and 2) Sharing logins or passwords with other county employees without prior authorization from their department director. Section I J– Retention of Electronic Mail The State of Florida requires the retention of “all documents, papers, letters, maps, books, tapes, photographs, films, sound recordings, data processing software, or other material, regardless of the physical form, characteristics, or means of transmission, made or received pursuant to law or ordinance or in connection with the transaction of official business by any agency” [F.S. 119.011(1)]. As it is for all documents, requirements for retention of e-mail are determined by content. It is each department’s responsibility to evaluate e-mail for content to determine the length of time and how the message must be retained, just as it does with paper documentation. Methods of retaining e-mail documents include saving messages to files on floppy disk, hard drive, or printing messages and filing in a paper file. The Information Systems Department is available to advise users in the specifics of different methods. Retention schedules must be followed in accordance with the State Library and Archives of Florida. Section J K– Software, ITunes, and Domain Registration Okaloosa County purchases and licenses the use of computer software. Employees shall use that software only in accordance with the license agreement for that software. All software developed in-house or by vendors for Okaloosa County is the sole property of Okaloosa County. “Shareware”, “Freeware”, and all other similar software, unless pre-approved by the Information Systems Director, are not permitted on the network. Applications software, such as ITunes, must be approved by the county Information Systems Department in the same manner as software on a personal computer. An ITunes Gift Card must be purchased for application software transactions unless otherwise authorized by Information Systems. No domain name can be registered on behalf of Okaloosa County Board of County Commissioners or their reporting departments without the approval and inclusion of the Information Systems Department. The Information Systems Department shall manage domain name services (DNS) and shall be listed as at least one of the administrative and technical contacts. Section KL – Information Technology Project Management 1) Lack of planning is a primary cause of schedule slippage, cost overruns, poor quality, and high maintenance costs. An information technology project becomes better understood as it progresses through the following processes: problem definition; system justification; analysis and conceptual design; implementation planning; implementation and testing; and operations and maintenance. 2) In order to ensure a well planned and designed approach to information technology projects, the problem definition must be submitted to the Information Systems Director for review and approval. Approved projects will follow the process established by the Information Systems Department. a) The Information Systems Department responsibilities include, but are not limited to, the following:  i) Directing and coordinating all information technology related activities for the County; ii) Directing and managing all computer equipment and networks; iii) Directing and managing enterprise-wide projects such as e-mail services, security systems, the County imaging system and enterprise licensing agreements; iv) Directing and managing all departmental level applications and departmental licensing agreements that involve technology; v) Initiating and implementing all contract negotiations and grants involving an information technology component; vi) Specifying the appropriate operating environment for all computer equipment; vii) Coordinating development, maintaining and managing web-based solutions; viii) Reviewing and approving all new computer equipment acquisitions; ix) Installing and configuring all computer equipment for all departments; x) Delegating software administration responsibilities to departmental software administrators for each departmental level as needed; xi) Directing and coordinating computer equipment training; xii) Directing and coordinating all Geographic Information System (GIS) related activities for the County; xiii) Managing the County Aerial Photography and Digital Mapping projects; xiv) Managing the County Geodetic Control Network. b) Department responsibilities include the following: i) Coordinating with the Information Systems Department during the budgetary process for any new computer equipment, information technology projects, data acquisitions, applications and upgrades; ii) Channeling all communication agreements, contracts and grants through the Information Systems Department prior to and for negotiation; iii) Ensuring the use of all computer equipment and data in accordance with this policy; iv) Providing the specified environment for computer equipment; v) Reporting computer equipment and data problems; vi) Logging out at the end of the day;  vii) Protecting all logins and passwords to ensure security; viii) Maintaining an inventory of all licensed software for each PC and the associated disc or CD containing the software for backup purposes (this is not applicable to enterprise-wide software); ix) Providing at least one (1) departmental software administrator for each departmental level application, when applicable; x) Designating at least one (1) liaison between the user department and the Information Systems Department; xi) Providing access or an appropriate contact that can allow access to network communication equipment at any time; xii) Coordinate the need for application software with the Information Systems Department. Section LM – Compliance Computer equipment is provided to fulfill the mission of the County. All computer equipment is owned by Okaloosa County. Any modification of computer hardware or software to circumvent this policy is strictly prohibited. Improper use of computer equipment in violation of this policy is grounds for counseling or disciplinary action. The type of action taken will be based on the frequency and/or severity of the incident in question. Actions can include counseling, written reprimand, loss of the privilege of using computer equipment, employee suspension and dismissal from employment. Section MN– Definitions 1) Computer Equipment – Any hardware or software device under purview of the County that exchanges data with or connects to any County computer, device or network. 2) Information Systems Department Personnel – Any person who works under the direction of the Information Systems Director. 3) Authorized User – Anyone authorized by a department director to use computer equipment to do his/her job. 4) Authorized Administrator – Any person who has been granted administrative access to one (1) or more pieces of computer equipment by the Information Systems Director. Authorized administrators must be appointed by the department director and approved by the Information Systems Director. This will only be done where it is absolutely compelled by the circumstances. The Information Systems Director is the final authority. 5) Departmental Software Administrator – Any person who is designated by his/her department director and approved by the Information Systems Director to assist Information System Department personnel in administering departmental applications. These applications normally run on one (1) or more departmental servers and are department specific software applications. Departmental Software Administrators are provided the access allowed by the Information Systems Director. 6) Liaison – One or more individuals within a department who is designated to act as a liaison between Information Systems Department personnel and the department director for matters involving computer equipment. Liaisons may be appointed at the discretion of the department director. At least one (1) liaison per department must be designated. 7) Data – Information that can be digitally transmitted or process by County computer equipment. 8) County Networks – Components or circuitry owned or leased by the County that inter- connects computer equipment. 9) Information Technology Project – Any work effort or plan that requires computer equipment and Information Systems Department personnel resources. 10) Information Systems Component – Any hardware or software item that would fall under the Information Systems Department’s support, whether related to Geographic Information Systems (GIS), Systems and Networks or Applications divisions. This is to include wireless and Voice Over Internet Protocol (VOIP) peripherals. 11) Contingent Workers – Individuals hired through temporary staffing agencies. 12) Network Equipment – Any switch, hub, router, sniffer or copper-based device. 13) Mobile Device - a cell phone, push to talk (PTT) radio, tablet, 3G or 4G iPad, or internet/email capable equipment. This device is characterized by the fact that a service plan cost generally is determined by the amount of use and/or capabilities. BYOD (Bring Your Own Device) is not supported on the Okaloosa County network. 14) Department Mobile Device - A mobile device purchased and maintained by an Okaloosa County department or division for use by more than one employee or other authorized user while engaged in their assigned duties. 15) Mobile Device Group Leader – Designated by each department director, an employee assigned responsibility for authorizing and managing all mobile devices and applications for the department. This person will also evaluate usage and device types and advise Purchasing if any new devices are needed and/or if adjustment is needed to plans. 16) Reasonable Secondary Personal use – mobile devices are intended for County purposes. Personal use is authorized if employees select to reimburse the county for usage on the Okaloosa County Mobile Device Request form. 17) Mifi Hotspot - A device that provides Internet access via Wi-Fi.