AMENDED (MARK UPS) A2236 2021.DOCX

MARICOPA COUNTY INTERNAL POLICY
Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY SECURITY Current Adoption
12-10-2014MM-DD-
Date: 2021
Board Agenda
Approved by: Number: C-49-15-026-6-010
BOARD OF SUPERVISORS Original Adoption 12-10-2014
Date:
I. PURPOSE
To protect the security of Confidential Information from Breach, unauthorized alteration
or access.
To establish Maricopa County's Information Technology Security policyTo protect the Commented [M(1]: @Shallana Edwards (OET) Would it
confidentiality, integrity, and availability of data generated, accessed, modified, stored, be ok to delete this phrase? It is redundant and unnecessary.
transmitted, used, or processed by Maricopa County Technology Resources (CTR). Purpose of this policy?..."to establish a policy to". If your
team wants to keep it, that is fine though.
Commented [N(2R2]: Changed
The elements in this policy address factors that impact information security and
Maricopa County's legal obligations to adhere to various information security standards.
They are intended to maximize the value of CTR to securely enable business goals and
improve efficiency in Maricopa County's mission delivery. This policy will help preserve
the public trust, protect the County from legal liability, ensure compliance with all
applicable laws, and provide clear communication with Authorized Users regarding the
use of CTR.
This document refers to several IT standards and common definitions that will contain
detailed information on a variety of topics that fall under Information Security. The Office
of Enterprise Technology (OET) will regularly update these standards to stay current
with rapidly changing technology, trends and cybersecurity threats that impact Maricopa
County.
II. SCOPE & APPLICATION APPLICATION Commented [M(3]: @Shallana Edwards (OET) I'd prefer
to keep it as just Application to be consistent with all other
This Policy applies to County Covered Components as defined in Policy A2233. This policy County policies, but if your team prefers this, that's fine.
applies to all Maricopa County appointed departments as well as the Flood Control Commented [N(4R4]: That works for us.
District of Maricopa County, the Maricopa County Library District, and the Maricopa
County Stadium District (Special Districts). The Board of Supervisors is authorized to
jointly adopt policies applying to the Special Districts under the Intergovernmental
Agreement (IGA), C-06-18-393-6-00, approved on April 11, 2018.
Page 1 of 15

This policy also applies to employees of County elected offices unless the elected
official has implemented a similar policy specific to his or her office.
III. DEFINITIONS
A. Appointing Authority: An elected official, the single administrative or
executive head of a Department/Special District, or the designated
representative authorized to act in this capacity.
A.B. Authorized User: An individual approved by the Appointing Authority to use
County Technology Resources (CTRs). This includes County employees,
temporary employees, and non-employees providing products or services to the
County and/or who are given access to County Data such as suppliers on contract
or outside organizations with Intergovernmental Agreements (IGAs). Commented [MR(5]: New, should be redlined
B.C. Business Associate Agreement: A formal, contractual agreement between two Commented [N(6R6]: changed
entities doing business involving (Protected Health Information (PHI).
C. Breach: Impermissible acquisition, access, use, or disclosure of Protected
Health Information (PHI) that compromises the security or privacy of the PHI.
A breach is presumed unless the Covered Component or Business Associate
(defined in County Policy A2241 HIPAA Business Associates), as applicable,
demonstrates that there is a low probability that the PHI has been
compromised based on a risk assessment of the factors set forth in 45 C.F.R.
§ 164.402(2).
D. Chief Information Security Officer (CISO) (or Information Security Officer):
The individual appointed by the Chief Information Officer to serve as the
Security Officer as required by HIPAA regulations (see 45 C.F.R. §164.308(a)
(2)). Commented [MR(7]: Changed slightly from original
version. Please add redlined parts (delete “or Information
D. Security Officer” and add “(CISO)”.
E. Confidential Information Data (CDI): Confidential and sensitive data that Commented [N(8R8]: changed
are protected by federal and/or state legislation (e.g., credit card numbers,
social security numbers, PHI (defined below), username and password
combinations, etc.). Confidential Data is information protected by statutes,
regulations, County policies, contractual language, or that is otherwise
exempt from disclosure under Federal statutes and Arizona Public Records
Law. County Officers and Managers may also designate data as confidential
subject to and consistent with Arizona Public Records Law. Confidential
Data may be disclosed to individuals on a need-to-know basis only. Commented [MR(9]: Which City? Should this be
County?
Disclosure to parties outside the City shall be authorized by executive
Commented [SE(10R10]: @Natalie Beever (OET) please
management and/or the County Attorney’s office. Confidential Data is clarify this. See Michele’s note above
protected from unauthorized use and/or disclosure by law, regulation or Commented [NB(11R10]: We have changed this
standard, and requires the highest level of security measures. CD is definition to be in parallel with other policy. “City” (or
protected from unauthorized use, disclosure, alteration, or destruction, which County) is no longer used. We have also updated the next
definition “Confidential System” for the same reason.
Page 2 of 15

could cause a significant level of risk to the County. Storage is in
accordance with standards set by the Chief Information Security Officer
(CISO) and prohibited on unauthorized sSystems unless otherwise
approved by the CISO. Backup and recovery procedures for Confidential
DataCD and associated data systems are documented. Confidential DataCD
is subject to the retention schedules set by the State under A.R.S. §§ 41-
151.12(A), -151.15, and -151.19.
F. Confidential System: Any information sSystem, application, function, and/or
dataset that contains, creates, accesses, transmits, or receives
CIConfidential Data (CD). All sSystems containing the following types of CD,
are considered Confidential Systems: personally identifiable information (PII)
Rregulated by federal, state (e.g., A.R.S. § 18-552), or local law; substance
use disorder records regulated by 42 C.F.R. Part 2; Protected Health
Information (PHI) Rregulated by HIPAA; criminal justice information (CJI)
Rregulated by federal, state, or local Law; online account information; Commented [M(12]: @Shallana Edwards (OET) Does
business/financial data Rregulated by federal, state, or local law.All PHI- Online Account Information and Business/Financial Data
containing systems are considered Confidential Systems. need to be capitalized? They aren't defined terms. Are they
proper nouns?
G. Covered Component: A Department or division of a Department that is (1) a Commented [M(13R13]: same thing for all the uses of
health plan or (2) a health care provider who electronically transmits any "Federal, State, or Local Law". These traditionally wouldn't
Protected Health Information (PHI). be capitalized.
Commented [M(14R13]: same question for Personally
H. Identifiable Information. I checked several websites and it is
usually lowercase even when paired with the capitalized
F. County Data: Electronically Stored Information (ESI) owned by, contracted with, (PII).
or controlled by the County, or used to conduct County business, whether located Commented [N(15R13]: Made changes; left PHI
on premise or in the cloud. The County may be a steward of the information; it capitalized as it appears as a definition
does not need to originate within the County.
I.G. County Technology Resource (CTR): Any computing account, device (e.g.,
mobile device, smartphone, tablet, computer, communications equipment, video
conference, facsimile, or telephone); peripheral, software, local, wireless and wide
area networks (i.e., LAN, Wi-Fi and WAN), eElectronically sStored iInformation
(ESI), website, cloud-based or internally-hosted sSystem, or related consumable
(e.g., disk space, processor time, network bandwidth) owned by, contracted with,
or controlled by the County, whether physical or virtual in nature.
J.H.Covered Component: A Department or division of a Department that is (1) a
health plan or (2) a health care provider who electronically transmits any
Protected Health Information (PHI).
K.
L.I. Electronically Stored Information (ESI): Information that is created,
manipulated, communicated, and stored in digital form, requiring the use of
computer hardware and software. Such information includes, but is not
limited to, emails, databases, logs (phone, voice, access, etc.), scanned or
digitally created documents, spreadsheets, recordings, photographs, or any
other information as identified under the Federal Rules of Civil Procedure
Rule 34(a)(1).
Page 3 of 15

J. Encryption: The process of making information unreadable without the
necessary decryption key to prevent unauthorized access.
M.K. Official Use Only (OUO) Data: OUOfficial Use Only Data is information
that must be guarded due to legal, proprietary, ethical, or privacy
considerations, and must be protected from unauthorized access,
modification, transmission, storage, or other use. Commented [MR(16]: Added, should be redlined
L. Protected Health Information (PHI): Individually Identifiable Health
Information (IIHI) is any information, whether oral or recorded in any form or
medium, that is created or received by a health care provider, health plan,
public health authority, employer, life insurer, school or university, or health
care clearinghouse, which identifies an individual or with respect to which Commented [M(17]: @Shallana Edwards (OET) can this
there is a reasonable basis to believe the information can be used to identify phrase be deleted? It makes it hard to understand.
the individual, and that: 1) relates to the past, present, or future physical or Commented [N(18R18]: This is taken from other policies
mental health or condition of an individual; 2) the provision of health care to with this phrasing. Are we making changes across the
board?
an individual; or 3) the past, present, or future payment for the provision of
health care to an individual. Protected Health InformationPHI refers to IIHI
that is transmitted by electronic media, maintained in electronic media, or
transmitted or maintained in any other form or medium. However, PHI
excludes education records covered by the Family Educational Rights and
Privacy Act, records described in 20 U.S.C. §1232g(a)(4)(B)(iv), as well as
employment records held by a covered entity in its role as employer.
M. Risk Analysis: Risk Analysis is tThe process of identifying and analyzing
potential issues that could negatively impact County Data or County
Technology Resources (CTR).
N. Security Incident: A security incident is the act of violating an explicit or
implied security policy or control. These include but are not limited to:
1. The attempted or successful unauthorized access, use, disclosure,
modification or destruction of Confidential Information or interference with a
Confidential System or its data
2. Unwanted disruption or denial of service to a Confidential System
3. Changes to Confidential System hardware, firmware, or software
characteristics without the owner's knowledge, instruction, or consent.
Security Compliance Assessment: An evaluation of the compliance
posture of a department with regards to applicable external laws, rules, and
regulations or internal guidelines, such as standards, policies, and Commented [M(19]: @Shallana Edwards (OET) This
procedures pertaining to information security. term is not used anywhere. Does it need to be included in
Definitions? If so, should it be referenced somewhere in the
N. Security Incident: Any event that impacts the confidentiality, integrity, policy section?
and/or availability in data or data System that causes appreciable financial or Commented [MR(20]: Redline changes from original
reputational harm to the County. Commented [M(21]: @Shallana Edwards (OET) This
term is not used anywhere else. Should it be deleted from
O. definitions or included in policy section?
Commented [N(22R22]: removed
Page 4 of 15

P.O. System: Any electronic computing or communications device or the
applications running thereon which can create, access, transmit, or receive
data. Systems are typically connected to digital networks.
Q.P. System Administrator: The technical custodian of a Confidential System.
This individual provides the technology and processes to implement the
decisions of the System Owner. In some circumstances, e.g., small systems,
the System Administrator and the System Owner may be the same person.
System Administrators are responsible for the technical operation,
maintenance, and monitoring of the Confidential System. These duties
include implementation of technical, physical, and administrative safeguards.
R.Q. System Owner: The individual or Appointing Authority who has final
responsibility for Confidential Systems. In some complex Confidential
Systems, the functional responsibility for the Confidential System and the
responsibility for one or more applications or database may lie with more
than one individual. The System Owner usually delegates responsibility for
the technical management of a Confidential System to a System
Administrator for implementation of technical, physical, and administrative
safeguards.
I. POLICY
A. Risk Analysis
1. Each department will conduct a Risk Analysis to document the potential
risks and vulnerabilities to the confidentiality, integrity and availability of
CI held by the department as well as an estimation of the security
measures sufficient to reduce the risks and vulnerabilities to a reasonable
and appropriate level. Risk Analysis involves determining what requires
protection, what it should be protected from and how to protect it. Each
department will conduct a HIPAA Risk Analysis specific to the potential
risks and vulnerabilities of PHI.
a. This Risk Analysis will take place annually and whenever there are
significant changes to Confidential Systems, business operations, or
locations of operations.
b. Each department will create, execute and maintain a Risk Analysis
procedure.
c. Decisions regarding access to Confidential Systems and responsibility
for Risk Analysis rest with the System Owner and the Appointing
Authority.
B. Risk Management
1. System Identification
Page 5 of 15

a. Confidential Systems, including databases, spreadsheets, and other
data storage applications, will be tracked and documented in a
countywide database.
b. Systems will be identified as having CI and PHI specifically.
c. Records containing CI must be stored securely. For example, CI may
be stored on a server or on a shared network storage device in an
access controlled area.
d. Systems will be prioritized for data backup, disaster recovery and/or
emergency operations plans (See §IV.C.7 of Policy A2237, Security
and Privacy Breaches, Incidents and Emergencies).
C. HIPAA Controls Evaluation
Policies and procedures related to the security of CI will undergo evaluations
for HIPAA compliance regularly and in response to environmental or
operational changes that could affect the security of CI.
D. Non-Compliance Sanctions
1. Employees who fail to comply with County security policies and
department procedures may face discipline up to and including
termination. Appointing Authorities are responsible for determining and
enforcing appropriate discipline for security violations.
a. In addition to internal disciplinary measures, individuals found in
violation of this Policy may be subject to criminal prosecution, civil
liability, or both.
b. Non-employees (Business Associates, contractors, volunteers, interns,
etc.) may be subject to discipline and/or remedial steps, as determined
by the Appointing Authority, to address failures to comply with County
security policies and procedures and/or terms of applicable
agreements (e.g., Business Associate Agreements).
2. Investigation:
a. Reported violators will be referred to Human Resources who will
request an investigation by the Chief Information Security Office. The
Chief Information Security Office is also authorized to investigate
security concerns identified through means other than a reported
violation, including routine and targeted monitoring activities.
b. The Chief Information Security Office and/or the appropriate
Page 6 of 15

Appointing Authority may authorize investigations of violations of
security policies and procedures as appropriate.
E. System Activity Review Procedures
Each department will create procedures to regularly review Confidential
Systems; determine who has access to these systems; determine who
gained access in the period under review and determine who used
temporary, guest, or “break-glass”/emergency access, etc. (See Policy
A2238, Granting and Terminating Access to Protected Confidential
Information)
F. Chief Information Security Officer
The Chief Information Officer will designate a Chief Information Security
Officer who will be responsible for the development and implementation of
the policies and procedures related to security safeguards for CI.
G. Encryption and Decryption
Encryption may be appropriate, or not, depending on the context in which the
information is managed. When appropriate, based on risk assessment
findings, the County will encrypt files, documents, or other folders that
contain CI before transmitting them.
H. Audit Controls
1. Hardware and/or software mechanisms will be used to record and
examine activity in Confidential Systems.
2. Each Appointing Authority will assign an individual to monitor the activity
of their department’s Confidential System and who will look for unusual
access patterns and take appropriate steps according to department
procedures to report this activity.
3. Departments will use their Risk Analysis and appropriate organizational
factors such as current technical infrastructures to determine what data
must be gathered through audit controls and to determine how often the
audit reports should be reviewed.
I. CI Integrity
a. Each system that contains CI will provide a mechanism to authenticate
that CI has not been breached or accessed or altered without
authorization.
Page 7 of 15

J. Person or Entity Authentication
1. Each department will create a procedure to authenticate users of CI that
meets one or more of the following standards (See Policy A2238
Granting Access to Confidential Information):
a. Require something known only to that individual, such as a password
or PIN
b. Require something that individual possesses, such as a smart card, a
token or a key
c. Require something unique to the individual such as a biometric
identifier including fingerprints, voice patterns, facial patterns or iris
patterns
K. Transmission Security
1. CI will only be electronically transmitted if it is properly protected with the
appropriate controls given the type of CI or encrypted. Each department
will document appropriate methods of transmission, including email, that
protect against unauthorized access to CI.
2. Transmission will include the minimum necessary information for the
appropriate business duty.
3. Departments will document their procedures and implement security
measures to ensure that CI is not improperly modified without detection
until it is disposed of.
IV. POLICY
It is the policy of Maricopa County to have a security posture that uses a layered
approach of overlapping controls, authentication, monitoring, scanning, and auditing
to maintain a high level of Information Technology Security and Privacy among the
various CTR. Access to County information sSystems and data will be granted using
the principle of least privilege (need to know). Passwords and credentials used for
access to County dData and sSystems will be individually owned, conform to a high
security level, changed regularly, and always transmitted and stored Eencrypted,
protected, and never disclosed to anyone. OET will conduct risk reviews and
assessments to identify threats and vulnerabilities and will address them according to
best practices. This policy extends to the use of the cloud to provide cCounty
services.
A. General Use
Page 8 of 15

1. County Staff Accountability
a. Chief Information Security Officer
The Chief Information Security Officer CISO is responsible for the
development and implementation of the policies and procedures related to
security safeguards for CICD and OUO data.
b. Appointing Authority or Elected Official Accountability
Each department is responsible for implementing processes and
procedures that conform with and reinforce this Information Security
policy. This includesincluding training, education, risk analyses, and risk
management programs.
c. Authorized Users Accountability
Authorized Users are responsible for:
i. uUnderstanding and complying with this policy
ii. . Authorized Users are also accountable for the securingty of their
own user IDs and passwords
iii. , and for all actions performed by their user accounts. Any activity
performed on a County Technology ResourceCTR under an
Authorized User’s login ID is presumed to be performed by that
member and is the responsibility of that Authorized User.
d. Exception for CISO-Authorized Information Security Personnel
CISO or designee may authorize exceptions to this policy as
needed. Examples may include, but are not limited to:, cybersecurity
investigations, active cyber threats against part or all of Maricopa County,
and identified sSecurity iIncidents affecting the resources identified in the
following policysection. Exception requests are submitted in writing to the
CISO or designee, and aAuthorized uUsers are notified as necessary.
2. Resource Usage
a. CTR usage is governed under County Policy A2611 Use of County
Technology Resources (Policy A2611).
b. Each department will create a procedure to authenticate Authorized
uUsers of CD that meets one or more of the following standards: Commented [M(23]: @Shallana Edwards (OET) Should
this be Authorized User?
i. Require something known only to that individual, such as a password
Commented [N(24R24]: agree.
or PIN
ii. Require something that individual possesses, such as a smart card, a
token, or a key
Page 9 of 15

iii. Require something unique to the individual such as a biometric
identifier including fingerprints, voice patterns, facial patterns, or iris
patterns
B. Network, Applications, and Systems Activities
1. Authorized Hardware
a. Non-County owned devices may be used to access County networks
remotely via the County's remote access sSystems provided that such
devices are regularly updated with the latest security patches and are
secured and compliant with anti-virus, and other available security
protection measures.
b. Wireless Access Points (WAPs) and other technology resources
connected directly to the County network must be approved by OET and
shall comply with all associated security standards.
c. The use of Network sniffers, scanners, or other network/local
machine monitoring devices is restricted to Authorized Users who must
use such tools to perform their job duties. These tools shall not be used to
monitor or track any individual's network activity except under special
authorization approved by the HR Director or an authorized designee.
2. Authorized Software
a. Prior to the installation of any new software product, a security evaluation
must be performed by OET Information Security to ensure compliance with
security standards. In addition, Authorized Users shall obtain department
approval and comply with copyright and licensing requirements. A plan and
process must be agreed upon for any needed patching and updating in
order to ensure adequate ongoing support.
b. Software security compliance audits may be conducted by OET. If any
software is determined by OET to cause concerns with computer or
enterprise performance, the product may be removed by OET and
alternative software sought.
c. Each sSystem that contains CD will provide a mechanism to authenticate
that CD has not been bBreached, or accessed, or altered without
authorization.
3. Security Software
a. Authorized Users shall not disable or circumvent any software or controls
intended to safeguard CTR. Commented [MR(25]: Must vs shall: Must is used to
denote a legal obligation
b. Authorized Users who have inadvertently connected to any web site that Commented [SE(26R26]: @Natalie Beever (OET)
contains inappropriate content must shall immediately disconnect from that calling attention to this change.
site and report the event to their immediate supervisor. If an Authorized Commented [NB(27R26]: Noted
Page 10 of 15

User unintentionally receives inappropriate material, they should shall
report that factit to their immediate supervisor and OET Information
Security in order to investigate the source of the material. The
inappropriate material shall not be forwarded to other individuals except as
instructed by the OET Support staff.
c. The County recognizes that certain departments have a business need to
access Iinternet sites that may be considered inappropriate for
others. Authorized Users who have a business need to access these
Iinternet sites shall obtain written authorization from their Department
Director who will submit the request to OET Information Security so that
exceptions can be made within any filtering tools. All monitoring of access
will be done in accordance with County Policies, personnel rules, state,
and other applicable laws.
4. Unattended Devices
Authorized Users must shall appropriately protect all unattended CTR. In the event
of the loss or theft of any CTR containing County dData, as well as any suspicious
activity that may affect information security, Authorized Users shall promptly report it
to their immediate supervisor and OET Support staff. Authorized Users shall follow
standard procedures related to passwords (or pattern matching) that arefor
protecting their devices when given access to CTR is provided t. The County
reserves the right to block usage or application access to CTR in the event of the
loss or theft of County or personally purchased mobile devices.
5. Lost Devices
Lost devices pose a significant security and legal risk to the County. For device
definitions, procedures for reporting lost devices, and more information about
various devices, see County Ppolicy A2611 Use of County Technology Resources.
6. Personal Use
a. Incidental, infrequent personal use of CTR is permissible if it does not
interfere with the performance of Authorized User responsibilities and
duties defined under County Ppolicy A2611 Use of County Technology
Resources and is authorized by the Department Appointed Authority.
b. “Incidental personal use” is defined as any personal use of CTR that:
i. Is infrequent and brief
ii. Has no negative impact on overall staff productivity or does not
interferees with an Authorized User's department
iii. Does not result in any additional expenses to the County
iv. Does not negatively affect any CTR, such as disk space availability
or bandwidth
Page 11 of 15

v. Does not compromise or embarrass the County or any Authorized
User
vi. Complies with all other Maricopa County and department policies
and procedures
vii. Serves the County's interests by allowing Authorized Users the
flexibility to address important personal matters that cannot be
addressed outside of work hours or without leaving the workplace
c. Any personal usage shall not be considered private and is subject to
monitoring, recording, logging, duplication, and potential investigation.
7. Inappropriate Use
There are many activities that are expressly prohibited unless an exception is
requested by a Department Director and approved by the CIO and a County
Attorney. For more information and a non-exhaustive list of prohibited activities,
see County Ppolicy A2611 Use of County Technology Resources.
a. Investigation:
i. Reported violators will be referred to Human Resources who will
request an investigation by the Chief Information Security Office. The
Chief Information Security Office is also authorized to investigate Commented [M(28]: @Natalie Beever (OET) @Shallana
security concerns identified through means other than a reported Edwards (OET) Should these be CISO?
violation, including routine and targeted monitoring activities. Commented [N(29R29]: No. This refers to the people in
the office. Not the CISO.
ii. The Chief Information Security OfficeCISO and/or the appropriate
Appointing Authority may authorize investigations of violations of Commented [N(30R29]: It can read "Information
Security Office." Remove "Chief"
security policies and procedures as appropriate.
Commented [M(31R29]: thank you
b. Audit Controls
i. Hardware and/or software mechanisms will be used to record and
examine activity in Confidential Systems.
ii. Each Appointing Authority will assign an individual to monitor the
activity of their department’s Confidential System and who will look for
unusual access patterns and take appropriate steps according to
department procedures to report this activity.
iii. Departments will use their Risk Analysis and appropriate
organizational factors such as current technical infrastructures to
determine what data must be gathered through audit controls and to
determine how often the audit reports should be reviewed.
C. Data
1. Managing County critical data assets is a responsibility for all Departments.
Confidential Systems, including databases, spreadsheets, and other data
storage applications, will be tracked and documented in a countywide database.
Page 12 of 15

2. Records containing CD must be stored securely in locations approved by the
Department’s Appointing Authority and Department’s IT service provider. For
example, CD may be stored on a server or on a shared network storage device
in an access-controlled area.
3. Each department will create procedures to regularly review Confidential
Systems,; determine who has access to these sSystems,; determine who gained
access in the period under review, and determine who used temporary, guest, or
“break-glass”/emergency access, etc.
4. Systems will be prioritized for data backup, disaster recovery, and/or emergency
operations plans in accordance with applicable Maricopa County IT policies and
with OET-specific disaster recovery planning procedures (see: ).
D. Transmission Security
1. Electronically transmitted CD shall will only be either protected or Encrypted.
electronically transmitted if it is properly protected with the aAppropriate controls,
such as application protection methods or network control policies, may be
employed OR individual users shall Encrypt data transmitted outside of
appropriate controls. given the type of CD or encrypted. Each department will Commented [MR(32]: Word choice: “Encryption”?
shall document appropriate methods of transmission, including email, that protect Commented [SE(33R33]: @Natalie Beever (OET) please
against unauthorized access to CD. advise.
2. Transmission will shall include the minimum necessary information for the Commented [NB(34R33]: It is awkwardly written. It is
basically saying electronically transmitted County data will
appropriate business duty. be either protected or encrypted. Appropriate controls may
3. Departments will shall document their procedures and implement security be employed (such as the type of method or network the data
is transmitted on), OR users MUST encrypt data that are
measures to ensure that CD is not improperly modified without detection until it is transmitted outside of the appropriate controls. I made
disposed of. revisions that hopefully clarify.
E. HIPAA, PCI, and Other Data Security Compliance
1. The County is required to comply with various industry and legal data security
requirements.
2. In addition to internal disciplinary measures, individuals found in violation of this
policy may be subject to criminal prosecution, civil liability, or both.
3. Non-employees (Business Associates, contractors, volunteers, interns, etc.) may
be subject to discipline including loss of access to County Technology
ResourcesCTR and/or termination of contract or agreement, as determined by Commented [MR(35]: Abbreviate: “CTR”?
the Appointing Authority, to address failures to comply with County security Commented [SE(36R36]: Done.
policies and procedures and/or terms of applicable agreements (e.g., Business
Associate Agreements).
F. Risk Analysis
Page 13 of 15

1. In conjunction with the County’s Information Security group, each department will
ensure that conduct a Risk Analysis is conducted to document the potential risks
and vulnerabilities to the confidentiality, integrity, and availability of CD held by
the department as well as an estimation of the security measures sufficient to
reduce the risks and vulnerabilities to a reasonable and appropriate level. Risk
Analysis involves determining what requires protection, what it should be
protected from, and how to protect it. Each department will shall conduct a Risk
Analysis specific to the potential risks and vulnerabilities of the Department’s
CTR in coordination with Information Security
a. This Risk Analysis will shall take place annually or as otherwise directed
by the CISO and whenever there are significant changes to Confidential
Systems, business operations, or locations of operations.
b. Each department, in conjunction with the County’s Information Security
group, will shall ensure that a Risk Analysis procedure is created,
executed, and maintained a Risk Analysis procedure.
c. Decisions regarding access to Confidential Systems and responsibility for
Risk Analysis rest with the System Owner and the Appointing Authority.
G. Compliance
1. Violation of this policy or any related Information Security Standards may result
in disciplinary actions up to and including termination. All reported violators,
including non-employees, shall be referred to Human Resources and/or the
Appointing Authority to address violations of this policy. In addition to internal
disciplinary measures, individuals found in violation of this policy may be subject
to criminal prosecution, civil liability, or both.
2. The Chief Information Security OfficerISO, or designee, is authorized to initiate
investigations of violations of this policy and other Information Technology
Security Standards as appropriate.
3. The Maricopa County Internal Audit Department may conduct periodic security
audits to evaluate and ensure compliance with this policy. In some
circumstances, outside technology and security auditors may perform security
audits of CTR.
Revision History
Version Revision Date Description of Revision
1 10 Dec 201412-10-2014 Initial version.
2 27 July 2020MM-DD- Rewrote policy content to Eexpanded the scope and
2021 pPurpose section and, updated Application section;
added appropriate definitions and updated policy to
reflect technological advances and clarify
responsibility and accountability. (C-49-15-026-6-01)
Page 14 of 15

Page 15 of 15