AMENDED (MARK UPS KAREN HARTMAN-TELLEZ 20210701) A2236 2021.DOCX

MARICOPA COUNTY INTERNAL POLICY
Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY
Current Adoption Date: MM-DD-2021
SECURITY
Current Implementation Date: MM-DD-2021
Approved by: Board Agenda Number: C-49-15-026-6-01
BOARD OF SUPERVISORS
Original Adoption Date: 12-10-2014
I. PURPOSE
To protect the confidentiality, integrity, and availability of data generated, accessed, modified, stored,
transmitted, used, or processed by Maricopa County Technology Resources (CTR).
The elements in this policy address factors that impact information security and Maricopa County's legal
obligations to adhere to various information security standards. They are intended to maximize the value of
CTR to securely enable business goals and improve efficiency in Maricopa County's mission delivery. This
policy will help preserve the public trust, protect the County from legal liability, ensure compliance with all
applicable laws, and provide clear communication with Authorized Users regarding the use of CTR.
This document refers to several IT standards and common definitions that will contain detailed information
on a variety of topics that fall under Information Security. The Office of Enterprise Technology (OET) will
regularly update these standards to stay current with rapidly changing technology, trends, and cybersecurity
threats that impact Maricopa County.
II. APPLICATION
This Policy applies to all Maricopa County appointed departments as well as the Flood Control District of
Maricopa County, the Maricopa County Library District, and the Maricopa County Stadium District (Special
Districts). The Board of Supervisors is authorized to jointly adopt policies applying to the Special Districts
under the Intergovernmental Agreement, C-06-18-393-6-00, approved on April 11, 2018.
This policy also applies to employees of County elected offices unless the elected official has implemented
a similar policy specific to his or her office
III. DEFINITIONS
A. Appointing Authority: An elected official, the single administrative or executive head of a
Department/Special District, or the designated representative authorized to act in this capacity.
B. Authorized User: An individual approved by the Appointing Authority to use County Technology
Resources (CTRs). This includes County employees, temporary employees, and non-employees
providing products or services to the County and/or who are given access to County Data such as
suppliers on contract or outside organizations with Intergovernmental Agreements (IGAs).
C. Business Associate Agreement: A formal, contractual agreement between two entities doing business
involving (Protected Health Information (PHI).
D. Breach: Impermissible acquisition, access, use, or disclosure of Protected Health Information (PHI) that
compromises the security or privacy of the PHI. A breach is presumed unless the Covered Component
or Business Associate (defined in County Policy A2241 HIPAA Business Associates), as applicable,
demonstrates that there is a low probability that the PHI has been compromised based on a risk
assessment of the factors set forth in 45 C.F.R. § 164.402(2).Chief Information Security Officer (CISO)

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY
SECURITY Current Adoption Date: MM-DD-2021
(or Information Security Officer): The individual appointed by the Chief Information Officer to serve as
the Security Officer as required by HIPAA regulations (see 45 C.F.R. §164.308(a) (2)).
E. Chief Information Security Officer (CISO): The individual appointed by the Chief Information Officer
to Serve as the Security Officer as required by HIPAA regulations (see 45 C.F.R. §164.308(a) (2)).
F. Confidential Data (CD): Confidential Data is protected from unauthorized use and/or disclosure by law,
regulation or standard, and requires the highest level of security measures. CD is protected from
unauthorized use, disclosure, alteration, or destruction, which could cause a significant level of risk to
the County. Storage is in accordance with standards set by the Chief Information Security Officer (CISO)
and prohibited on unauthorized Systems unless otherwise approved by the CISO. Backup and recovery
procedures for CD and associated data systems are documented. CD is subject to the retention
schedules set by the State under A.R.S. §§ 41-151.12(A), -151.15, and -151.19.
G. Confidential System: Any information System, application, function, and/or dataset that contains,
creates, accesses, transmits, or receives Confidential Data (CD). All Systems containing the following
types of CD, are considered Confidential Systems: personally identifiable information (PII) regulated by
federal, state (e.g., A.R.S. § 18-552), or local law; substance use disorder records regulated by 42 C.F.R.
Part 2; Protected Health Information (PHI) regulated by HIPAA; criminal justice information (CJI)
regulated by federal, state, or local Law; online account information; business/financial data regulated
by federal, state, or local law.
H. County Data: Electronically Stored Information (ESI) owned by, contracted with, or controlled by the
County, or used to conduct County business, whether located on premise or in the cloud. The County
may be a steward of the information; it does not need to originate within the County.
I. County Technology Resource (CTR): Any computing account, device (e.g., mobile device,
smartphone, tablet, computer, communications equipment, video conference, facsimile, or telephone);
peripheral, software, local, wireless and wide area networks (i.e., LAN, Wi-Fi and WAN), Electronically
Stored Information (ESI), website, cloud-based or internally-hosted System, or related consumable (e.g.,
disk space, processor time, network bandwidth) owned by, contracted with, or controlled by the County,
whether physical or virtual in nature.
J. Covered Component: A Department or division of a Department that is (1) a health plan or (2) a health
care provider who electronically transmits any Protected Health Information (PHI).
K. Electronically Stored Information (ESI): Information that is created, manipulated, communicated, and
stored in digital form, requiring the use of computer hardware and software. Such information includes,
but is not limited to, emails, databases, logs (phone, voice, access, etc.), scanned or digitally created
documents, spreadsheets, recordings, photographs, or any other information as identified under the
Federal Rules of Civil Procedure Rule 34(a)(1).
L. Encryption: The process of making information unreadable without the necessary decryption key to
prevent unauthorized access.
M. Official Use Only (OUO) Data: OUO Data is information that must be guarded due to legal, proprietary,
ethical, or privacy considerations and must be protected from unauthorized access, modification,
transmission, storage, or other use.
Page 2 of 8

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY
SECURITY Current Adoption Date: MM-DD-2021
N. Protected Health Information (PHI): Individually Identifiable Health Information (IIHI) is any information,
whether oral or recorded in any form or medium, that is created or received by a health care provider,
health plan, public health authority, employer, life insurer, school or university, or health care
clearinghouse, which identifies an individual or with respect to which there is a reasonable basis to
believe the information can be used to identify the individual, and that: 1) relates to the past, present, or
future physical or mental health or condition of an individual; 2) the provision of health care to an
individual; or 3) the past, present, or future payment for the provision of health care to an individual. PHI
refers to IIHI that is transmitted by electronic media, maintained in electronic media, or transmitted or
maintained in any other form or medium. However, PHI excludes education records covered by the
Family Educational Rights and Privacy Act, records described in 20 U.S.C. §1232g(a)(4)(B)(iv), as well
as employment records held by a covered entity in its role as employer.
O. Risk Analysis: The process of identifying and analyzing potential issues that could negatively impact
County Data or County Technology Resources (CTR).
P. System: Any electronic computing or communications device or the applications running thereon which
can create, access, transmit, or receive data. Systems are typically connected to digital networks.
Q. System Administrator: The technical custodian of a Confidential System. This individual provides the
technology and processes to implement the decisions of the System Owner. In some circumstances,
e.g., small systems, the System Administrator and the System Owner may be the same person. System
Administrators are responsible for the technical operation, maintenance, and monitoring of the
Confidential System. These duties include implementation of technical, physical, and administrative
safeguards.
R. System Owner: The individual or Appointing Authority who has final responsibility for Confidential
Systems. In some complex Confidential Systems, the functional responsibility for the Confidential System
and the responsibility for one or more applications or database may lie with more than one individual.
The System Owner usually delegates responsibility for the technical management of a Confidential
System to a System Administrator for implementation of technical, physical, and administrative
safeguards.
IV. POLICY
It is the policy of Maricopa County to have a security posture that uses a layered approach of overlapping
controls, authentication, monitoring, scanning, and auditing to maintain a high level of Information
Technology Security and Privacy among the various CTR. Access to County information Systems and data
will be granted using the principle of least privilege (need to know). Passwords and credentials used for
access to County Data and Systems will be individually owned, conform to a high security level, changed
regularly, and always transmitted and stored Encrypted, protected, and never disclosed to anyone. OET will
conduct risk reviews and assessments to identify threats and vulnerabilities and will address them according
to best practices. This policy extends to the use of the cloud to provide County services.
A. General Use
1. County Staff Accountability
a. Chief Information Security Officer
The CISO is responsible for the development and implementation of the policies and procedures
related to security safeguards for CD and OUO data.
b. Appointing Authority or Elected Official Accountability
Page 3 of 8

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY
SECURITY Current Adoption Date: MM-DD-2021
Each department is responsible for implementing processes and procedures that conform with
and reinforce this information Security policy including training, education, risk analyses, and risk
management programs.
c. Authorized Users Accountability
Authorized Users are responsible for:
i. Understanding and complying with this policy
ii. Securing their own user IDs and passwords
iii. All actions performed by their user accounts - any activity performed on a CTR under an
Authorized User’s login ID is presumed to be performed by that member and is the
responsibility of that Authorized User
d. Exception for CISO-Authorized Information Security Personnel
CISO or designee may authorize exceptions to this policy as needed. Examples may include,
but are not limited to, cybersecurity investigations, active cyber threats against part or all of
Maricopa County, and identified Security Incidents affecting the resources identified in the
following section. Exception requests are submitted in writing to the CISO or designee, and
Authorized Users are notified as necessary.
2. Resource Usage
a. CTR usage is governed under County Policy A2611 Use of County Technology Resources.
b. Each department will create a procedure to authenticate Authorized Users of CD that meets one
or more of the following standards:
i. Require something known only to that individual, such as a password or PIN
ii. Require something that individual possesses, such as a smart card, a token, or a key
iii. Require something unique to the individual such as a biometric identifier including
fingerprints, voice patterns, facial patterns, or iris patterns
B. Network, Applications, and Systems Activities
1. Authorized Hardware
a. Non-County owned devices may be used to access County networks remotely via the County's
remote access Systems provided that such devices are regularly updated with the latest security
patches and are secured and compliant with anti-virus and other available security protection
measures.
b. Wireless Access Points (WAPs) and other technology resources connected directly to the
County network must be approved by OET and shall comply with all associated security
standards.
c. The use of Network sniffers, scanners, or other network/local machine monitoring devices is
restricted to Authorized Users who must use such tools to perform their job duties. These tools
shall not be used to monitor or track any individual's network activity except under special
authorization approved by the HR Director or an authorized designee.
Page 4 of 8

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY
SECURITY Current Adoption Date: MM-DD-2021
2. Authorized Software
a. Prior to the installation of any new software product, a security evaluation must be performed by
OET Information Security to ensure compliance with security standards. In addition, Authorized
Users shall obtain department approval and comply with copyright and licensing requirements.
A plan and process must be agreed upon for any needed patching and updating to ensure
adequate ongoing support.
b. Software security compliance audits may be conducted by OET. If any software is determined
by OET to cause concerns with computer or enterprise performance, the product may be
removed by OET and alternative software sought.
c. Each System that contains CD will provide a mechanism to authenticate that CD has not been
Breached, accessed, or altered without authorization.
3. Security Software
a. Authorized Users shall not disable or circumvent any software or controls intended to safeguard
CTR.
b. Authorized Users who have inadvertently connected to any web site that contains inappropriate
content shall immediately disconnect from that site and report the event to their immediate
supervisor. If an Authorized User unintentionally receives inappropriate material, they shall
report it to their immediate supervisor and OET Information Security to investigate the source of
the material. The inappropriate material shall not be forwarded to other individuals except as
instructed by the OET Support staff.
c. The County recognizes that certain departments have a business need to access internet sites
that may be considered inappropriate for others. Authorized Users who have a business need
to access these internet sites shall obtain written authorization from their Department Director
who will submit the request to OET Information Security so that exceptions can be made within
any filtering tools. All monitoring of access will be done in accordance with County Policies,
personnel rules, state, and other applicable laws.
4. Unattended Devices
Authorized Users shall appropriately protect all unattended CTR. In the event of the loss or theft of
any CTR containing County Data, as well as any suspicious activity that may affect information
security, Authorized Users shall promptly report it to their immediate supervisor and OET Support
staff. Authorized Users shall follow standard procedures related to passwords (or pattern matching)
for protecting their devices when given access to CTR. The County reserves the right to block usage
or application access to CTR in the event of the loss or theft of County or personally purchased
mobile devices.
5. Lost Devices
Lost devices pose a significant security and legal risk to the County. For device definitions,
procedures for reporting lost devices, and more information about various devices, see County Policy
A2611 Use of County Technology Resources.
6. Personal Use
Page 5 of 8

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY
SECURITY Current Adoption Date: MM-DD-2021
a. Incidental, infrequent personal use of CTR is permissible if it does not interfere with the
performance of Authorized User responsibilities and duties defined under County Policy A2611
Use of County Technology Resources and is authorized by the Department Appointed
Authority.
b. “Incidental personal use” is defined as any personal use of CTR that:
i. Is infrequent and brief
ii. Has no negative impact on overall staff productivity or does not interfere with an Authorized
User's department
iii. Does not result in any additional expenses to the County
iv. Does not negatively affect any CTR, such as disk space availability or bandwidth
v. Does not compromise or embarrass the County or any Authorized User
vi. Complies with all other Maricopa County and department policies and procedures
vii. Serves the County's interests by allowing Authorized Users the flexibility to address
important personal matters that cannot be addressed outside of work hours or without
leaving the workplace
7. Inappropriate Use
There are many activities that are expressly prohibited unless an exception is requested by a
Department Director and approved by the CIO and a County Attorney. For more information and
a non-exhaustive list of prohibited activities, see County Policy A2611 Use of County Technology
Resources.
a. Investigation:
i. Reported violators will be referred to Human Resources who will request an
investigation by the Information Security Office. The Information Security Office is
also authorized to investigate security concerns identified through means other than
a reported violation, including routine and targeted monitoring activities.
ii. The CISO and/or the appropriate Appointing Authority may authorize investigations
of violations of security policies and procedures as appropriate.
b. Audit Controls
i. Hardware and/or software mechanisms will be used to record and examine activity
in Confidential Systems.
ii. Each Appointing Authority will assign an individual to monitor the activity of their
department’s Confidential System and who will look for unusual access patterns and
take appropriate steps according to department procedures to report this activity.
iii. Departments will use their Risk Analysis and appropriate organizational factors such
as current technical infrastructures to determine what data must be gathered
Page 6 of 8

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY
SECURITY Current Adoption Date: MM-DD-2021
through audit controls and to determine how often the audit reports should be
reviewed.
C. Data
1. Managing County critical data assets is a responsibility for all Departments. Confidential Systems,
including databases, spreadsheets, and other data storage applications will be tracked and
documented in a countywide database.
2. Records containing CD must be stored securely in locations approved by the Department’s
Appointing Authority and Department’s IT service provider. For example, CD may be stored on a
server or on a shared network storage device in an access-controlled area.
3. Each department will create procedures to regularly review Confidential Systems, determine who
has access to these Systems, determine who gained access in the period under review, and
determine who used temporary, guest, or “break-glass”/emergency access, etc.
4. Systems will be prioritized for data backup, disaster recovery, and/or emergency operations plans in
accordance with applicable Maricopa County IT policies and with OET-specific disaster recovery
planning procedures.
D. Transmission Security
1. Electronically transmitted CD shall be either protected or Encrypted. Appropriate controls, such as
application protection methods or network control policies, may be employed OR individual users
shall Encrypt data transmitted outside of appropriate controls. Each department shall document
appropriate methods of transmission, including email, that protect against unauthorized access to
CD.
2. Transmission shall include the minimum necessary information for the appropriate business duty.
3. Departments shall document their procedures and implement security measures to ensure that CD
is not improperly modified without detection until it is disposed.
E. HIPAA, PCI, and Other data Security Compliance
1. The County is required to comply with various industry and legal data security requirements.
2. In addition to internal disciplinary measures, individuals found in violation of this policy may be
subject to criminal prosecution, civil liability, or both.
3. Non-employees (Business Associates, contractors, volunteers, interns, etc.) may be subject to
discipline including loss of access to CTR and/or termination of contract or agreement, as determined
by the Appointing Authority, to address failures to comply with County security policies and
procedures and/or terms of applicable agreements (e.g., Business Associate Agreements).
F. Risk Analysis
1. In conjunction with the County’s Information Security group, each department shall conduct a Risk
Analysis to document the potential risks and vulnerabilities to the confidentiality, integrity, and
availability of CD held by the department as well as an estimation of the security measures sufficient
to reduce the risks and vulnerabilities to a reasonable and appropriate level. Risk Analysis involves
determining what requires protection, what it should be protected from, and how to protect it. Each
department shall conduct a Risk Analysis specific to the potential risks and vulnerabilities of the
Department’s CTR in coordination with Information Security
Page 7 of 8

Policy Title: Policy Number: A2236
INFORMATION TECHNOLOGY
SECURITY Current Adoption Date: MM-DD-2021
a. This Risk Analysis shall take place annually or as otherwise directed by the CISO and whenever
there are significant changes to Confidential Systems, business operations, or locations of
operations.
b. Each department shall create, execute, and maintain a Risk Analysis procedure.
c. Decisions regarding access to Confidential Systems and responsibility for Risk Analysis rest with
the System Owner and the Appointing Authority.
G. Compliance
1. Violation of this policy or any related Information Security Standards may result in disciplinary actions
up to and including termination. All reported violators, including non-employees, shall be referred to
Human Resources and/or the Appointing Authority to address violations of this policy. In addition to
internal disciplinary measures, individuals found in violation of this policy may be subject to criminal
prosecution, civil liability, or both.
2. The CISO or designee is authorized to initiate investigations of violations of this policy and other
Information Technology Security Standards as appropriate.
3. The Maricopa County Internal Audit Department may conduct periodic security audits to evaluate
and ensure compliance with this policy. In some circumstances, outside technology and security
auditors may perform security audits of CTR.
Revision History
Version Revision Date Description of Revision
1 12-10-2014 Initial version. (C-49-15-026-6-00)
2 MM-DD-2021 Expanded the Purpose section and updated Application section; added
appropriate definitions and updated policy to reflect technological advances
and clarify responsibility and accountability. (C-49-15-026-6-01)
Page 8 of 8