CITY INFORMATION MANAGEMENT COMMITTEE

200 E. Wells Street City of Milwaukee Milwaukee, Wisconsin 53202 Meeting Minutes CITY INFORMATION MANAGEMENT COMMITTEE ALD. MARK BORKOWSKI, CHAIR David Henke, Vice-Chair Timothy Richter, Robert Jaeger, James Klajbor, Jennifer Meyer, James Owczarski, Jeffrey Madison, James Zimmer, David Klein, Richard Watt, and Jeffrey Larson. Staff Assistant, Chris Lee, 414-286-2232, Fax:286-3456, clee@milwaukee.gov Thursday, June 16, 2022 10:00 AM Virtual Meeting This will be a virtual meeting conducted via GoToMeeting. Should you wish to join this meeting from your phone, tablet, or computer you may go to https://meet.goto.com/281974229. You can also dial in using your phone United States: +1 (408) 650-3123 and Access Code: 281-974-229. 1. Call to order. The meeting was called to order at 10:07 a.m. 2. Roll call. Present (11) - Borkowski, Henke, Richter, Zimmer, Klajbor, Meyer-Stearns, Owczarski, Madison, Jaeger, Klein, Watt Excused (1) - Larson Also present: Brad Houston, City Records Center Atty. Peter Block, City Attorney's Office Robert Surita, ITMD Judy Siettmann, ITMD 3. Introduction of new membership. Members welcomed Ald. Mark Borkowski as a new member and chair of the committee, and chair Borkowski said he was eager to learn more about records management and IT matters for the City. 4. Review and approval of the previous meeting minutes from March 17, 2022. The meeting minutes from March 17, 2022 were approved without objection. City of Milwaukee Page 1 CITY INFORMATION MANAGEMENT Meeting Minutes June 16, 2022 COMMITTEE 5. Records Retention. A. Proposed departmental record schedules for approval Mr. Houston presented. Schedules consisted of 16 new and 35 supercedes. DCD schedules pertained to the consolidation of individual schedules for individual programs. City Archives would review City property records and real estate transaction files prior to destroying them. Records for cancelled property acquisition BIDs did not need lengthy retention. Client loan administration records of 15 different programs would have one schedule. There was a cleanup of personal health information records for the Health Department, and more related schedules (consolidating electronic health records) would come at the next meeting. Mr. Houston said that amended schedules for the City Treasurer's Office were submitted to correct the consolidation of incorrect schedules and to prolong the retention period from one month or when administrative no longer useful to 4 or 7-year retention period for those schedules. Member Klajbor said that his office (City Treasurer) supported the amended schedules. Member Klajbor moved approval, seconded by member Meyer-Stearns, of the amended proposed departmental record schedules, as proposed. There was no objection. Vice-chair Henke said that his office would work with Mr. Houston on the Health Department consolidation of electronic health records. B. State Records Board approval of previous schedules Mr. Houston commented. The State Records Board approved the previous schedules with some having administrative corrections. Most corrections were related to typos. There was a correction to add all appeals expanded to RDA 210040 concerning use of force incidents and internal investigation record schedules. The State Records Board was planning to revise their global schedule of facilities relative to surveillance camera footage by the end of August. The retention period for footage without identification of incidents would be changed from 120 days to 72 hours. He would be submitting a global schedule for the City to match the State's. Members discussed that a new global records schedule on surveillance camera footage retention would be taken up at the next meeting or earlier via a special meeting, as necessary. 6. Communications from the Information and Technology Management Division. A. Text Message Archiving Vice-chair Henke gave an update. The text message archiving trial project via Smarsh was planned for full deployment, had produced mixed results, and would be stopped. The intent was to make text message records of City employees who were conducting city business on city-issued or personal phones archivable, searchable and retrievable similar to that of emails. There were practical limitations. Archiving could not be done City of Milwaukee Page 2 CITY INFORMATION MANAGEMENT Meeting Minutes June 16, 2022 COMMITTEE for personal devices. The app solution for phones was not user-friendly. Apps with encryption, such as iMessage, would not allow texts to be captured. The value of text message archiving should be reconsidered to see if it would be worthwhile to do. It would cost $100,000 to implement archiving for all city-issued cell phones. Having employees retain their text messages could be a consideration. ITMD stopped archiving in April but still maintained those that were archived prior to. Atty. Block added that the text archiving pilot project was set up to assist with public records requests, text messages were subject to the open records law, the program was found to be expensive, there was not a legal requirement to use archiving software, there had been very few open records request for text messages, the app solution was not viable, there were other options to consider versus an archiving program, smaller communities were able to implement their archiving programs due to their smaller workforce, such a program would not be feasible due to the size of the City's workforce, and the decision was made to discontinue the pilot program. Mr. Houston said that 95% of texts were transitory and not relevant, archiving all texts would be an over-retention, employees should not be depended upon to retain their texts, and departments had previously objected in a response to a survey on text archiving. Vice-chair Henke said that he would work with City Records Center and City Attorney's Office to draft instructions and guidance on maintaining non-transitory texts, and he inquired about having a communication file on the matter before the Common Council. Member Klajbor said that there should be advocacy to instruct employees to conduct city business via email rather than through text. Chair Borkowski said that he was surprised to learn the issue of text message archiving and that he did not oppose to a communication file before the Common Council. Members and participants discussed whether or not such a communication file before the Common Council should occur, whether the communication would spark open records requests, that a system or plan should be in place prior to doing the communication, that such a communication should be focused on best practices as opposed to citywide archiving, and that there should not be reliance on cell phone companies to retain texts since their retention periods were questionable. B. Multi-Factor Authentication and Password Policy updates Vice-chair Henke said that MFA required employees to do secondary verification via a text or phone call when logging into their city accounts. Mr. Surita gave an update. The goal was to have 100% MFA participation by the end of the year. There has only been 10% participation thus far. The purpose of MFA was to protect accounts against hacks and unauthorized access. MFA would occur when users would change their passwords or log into their accounts outside of the city network. MFA was an audit finding, and the desire was to satisfy the audit finding. Mr. Houston inquired about revisiting or eliminating the policy to update passwords every 60 days. City of Milwaukee Page 3 CITY INFORMATION MANAGEMENT Meeting Minutes June 16, 2022 COMMITTEE Vice-chair Henke said that the intent was to do away with updating passwords based on a calendar date should MFA have full implementation. Atty. Block said that MFA was becoming more standard. C. Deployment of ManageEngine ServiceDesk Plus Mr. Surita said that Manage Engine ServiceDesk products were being used, the Plus product would be purchased to replace RITS, Plus was a better enterprise management software for ITMD to deliver better service, and it would allow for asset inventory and software inventory for ITMD and other departments. D. Phishing Test Campaign Ms. Siettmann and vice-chair Henke gave an update. The campaign resulted in an 8% fail rate for 2022, which was lower than the rate of 25% for 2021. The decreased rate would be attributable to training and an easier template. Those who failed lacked training. Reports of phishing were forwarded to management. The City was getting better. The campaign would continue. A next step was to require mandatory training once a year for those who failed. There would be follow-up with department heads on phishing issues. Training would be 20 minutes long. Security training was also ongoing. Dashboards can be made for departments. Some members said that they were interested in a dashboard for their respective departments and that the phishing test results should be shared with the respective department heads so that proper follow-up with employees could be done. E. CISA Cyber-Response Table Top Exercise for Q3 2022 Vice-chair Henke and Ms. Siettmann gave an update. CISA was a federal cyber security agency that provided a wealth of resources. There was an audit finding for the City to do a cyber-response table top exercise. CISA would be able to do an exercise with the City in quarter 3 of this year. The exercise would take 2 hours and go over scenarios and response. Participation from many departments was needed. Further information would be forthcoming. 7. Agenda items for the next meeting. To be determined. 8. Next meeting date and time (Thursday, September 15, 2022 at 10 a.m.). Chair Borkowski said that he learned much from his first meeting and thanked vice-chair Henke and clerk staff for their assistance with the meeting. 9. Adjournment. The meeting adjourned at 11:28 a.m. Chris Lee, Staff Assistant Council Records Section City Clerk's Office City of Milwaukee Page 4 CITY INFORMATION MANAGEMENT Meeting Minutes June 16, 2022 COMMITTEE Meeting materials from this meeting can be found within the following file: 220189 Communication relating to the matters to be considered by the City Information Management Committee at its June 16, 2022 meeting. Sponsors: THE CHAIR City of Milwaukee Page 5