CITY INFORMATION MANAGEMENT COMMITTEE

200 E. Wells Street City of Milwaukee Milwaukee, Wisconsin 53202 Meeting Minutes CITY INFORMATION MANAGEMENT COMMITTEE ALD. NIK KOVAC, CHAIR Nancy Olson, Vice-Chair Jane Islo, David Kaminski, James Klajbor, Jennifer Meyer, James Owczarski, Jeffrey Madison, Judy Pinger, Aycha Sawa, Richard Watt, and Jeffrey Point. Staff Assistant, Chris Lee, 286-2232, Fax:286-3456, clee@milwaukee.gov Thursday, September 19, 2019 10:00 AM Room 303, Third Floor, City Hall 1. Call to order. Meeting called to order at 10:10 a.m. 2. Roll call. Present 11 - Wilichowski, Watt, Sawa, Pinger, Madison, Owczarski, Meyer, Klajbor, Islo, Olson, Kovac Also present: Brad Houston, City Records Center Atty. Peter Block, City Attorney's Office 3. Review and approval of the previous meeting minutes. Meeting minutes from June 13, 2019 were approved without objection. 4. Records retention. a. Proposed department record schedules for review and approval i. RDA #19-0065 Mr. Houston commented. There were 10 new schedules with 5 being global schedules. Schedules of note included title search forms, special project files, RDA 19-0037 with clarification on historical significance, RDA 19-0036, and RDA 19-0065 on non-public safety monitoring and surveillance video recordings. For RDA 19-0065 the 120-day retention period is the standard used by the State, and a memo from his office was shared to the committee regarding cost implications. Atty. Block commented. The idea with RDA 19-0065 was to create a timeline for non-public safety departments to destroy their surveillance videos, not hold the videos permanently, and not overwrite existing videos. The Milwaukee Police Department acquired adequate storage capability for its body cameras and may be of assistance City of Milwaukee Page 1 CITY INFORMATION MANAGEMENT Meeting Minutes September 19, 2019 COMMITTEE to provide insight to other departments on acquiring ample storage capability. Member Meyer-Stearns said that there would be major cost implications to make 8 of the Milwaukee Public Library’s 13 locations meet the 120-day retention period. Member Klajbor said that the City Treasurer’s video surveillance is managed by the Department of Public Works and based on storage space rather than by time. Chair Kovac said that RDA 19-0065 would produce undesirable costs, potentially shut off surveillance videos for departments, and there should be further analysis by departments on their ability to meet the requirement. Member Klajbor moved to hold to the call of the chair RDA 19-0065. Seconded by member Meyer-Stearns. There was no objection. ii. Remaining schedules Member Owczarski said that there was no corporate way to capture website and social media for RDA 18-0037 presently. Member Owczarski moved to amend RDA 18-0037 by striking “unique information posted to websites and social media pages”. Seconded by member Klajbor. There was no objection. Member Klajbor moved approval of the proposed record retention schedules, as amended. There was no objection. b. State Records Board approval of previous schedules Mr. Houston commented. There were 43 schedules sent to the state board most recently, and some resulted in minor changes. The state board did not approve RDA 19-0057 with “events reviewed” being too vague in their decision, and the schedule will have to be resubmitted. RDA 19-0059 was accepted with the correction that RITS tickets would have to be summarized in reports. RDA 19-0065 regarding external recording devices would be withdrawn per request by the board. The retention period for RDA 19-0004 regarding inspection plans was found to be confusing, and the retention period will be set to creation plus 50 years with an option to extend. Other minor changes included a change in legal citation for confidential information and clarification on end of election for the election series. 5. Communication on an addition to the City Information Management Committee membership. Vice-chair Olson said that there is anticipated pending approval from the Common Council to add Water Works as a member to the committee due to the Water Works having its own IT. Mr. David Kaminski would be the anticipated new member designee. 6. Review and approval of the IT Security Plan. Member Watt commented. The IT Security Plan was brought to the committee for introduction only, and the committee would review and approve the plan at the next meeting. The plan is a major update of the existing plan, uses federal and state City of Milwaukee Page 2 CITY INFORMATION MANAGEMENT Meeting Minutes September 19, 2019 COMMITTEE standards, removes parts of the old plan that discloses sensitive information, lists standards and step-by-step procedures, and serves as a minimum standard for departments to use and build upon as a policy. Judy Siettmann, IT Security and Audit Compliance Analyst, appeared and commented. Some takeaways from the plan are NIST standards and cyber security framework, use of the State’s plan as a template, listing of controls on page 4, access control policy standards and objectives on page 8, configuration management on page 17, change control standards, and disaster recovering plan. The plan is broadly based, sets policy only, and provides overview, compliance, rules, and responsibilities. The plan would be a guideline for departments to use and develop their own plans. Members should provide feedback. Not everything in the plan has been implemented yet. 7. Update on IT Security. Vice-chair Olson gave an update. IT update would be an ongoing agenda item due to the ongoing threat of IT security breaches and issues. A goal is to develop security controls, such as locking idle desktops not being used after a certain time. Security control ideas would be welcomed. Members discussed the City being an attractive cyber security target due to the DNC, email vulnerability, phishing emails, dormant viruses, email hacking, attacks from overseas, and geo-filtering. Vice-chair Olson added remarks. ITMD has done and can provide trainings and presentations for departments on IT security, especially to coincide with cyber security month in October. Geo-filtering can be explored but emails outside of the country cannot be entirely blocked. Employees should cautiously look at actual email addresses and locations in their emails. 8. Agenda items for the next meeting. One item is the penetration audit. Remaining agenda items to be determined. 9. Next meeting date and time. a. Thursday, December 12, 2019 at 10 a.m. 10. Adjournment. Meeting adjourned at 11:04 a.m. Chris Lee, Staff Assistant Council Records Section City Clerk's Office Meeting materials for this meeting can be found within the following file: 190710 Communication relating to the matters to be considered by the City Information Management Committee at its September 19, 2019 meeting. City of Milwaukee Page 3 CITY INFORMATION MANAGEMENT Meeting Minutes September 19, 2019 COMMITTEE Sponsors: THE CHAIR City of Milwaukee Page 4