Extracted text (via pymupdf)
2713 characters
Item Number: H.10. CITY COUNCIL REPORT SUBJECT: Employee Handbook Amendment - Section 400: Technology Regulations MEETING DATE: July 8, 2025 TO: Mayor and Council FROM: Steve Holliday, Chief Technical Officer Wendy Jackson, Deputy City Manager/Employee Resources Director REVIEWED: Reyes Medrano Jr., City Manager PURPOSE: To seek Council approval for the addition of a new policy section permitting the use of physical two-factor authentication (2FA) devices, such as YubiKeys, to enhance information security and employee privacy in accessing City-managed systems. BACKGROUND: The current technology regulations address general security standards but do not specify protocols for physical 2FA devices. Two-factor authentication provides critical protection against unauthorized system access, and the introduction of physical security keys such as YubiKeys reduces dependency on employees’ personal mobile devices for authentication while enhancing cybersecurity posture. DISCUSSION: The proposed Section 400.12 formally allows employees to request and utilize YubiKeys as an alternative to mobile-based authentication for City-managed systems. This policy outlines the approval process, responsibilities, compliance requirements, and replacement fees related to YubiKey use. It includes: • Required written approval from Department Directors and the Chief Technology Officer (CTO) or designee, based on operational need, system compatibility, and security standards. • Compliance with all City IT policies, including proper handling, safekeeping, and data confidentiality protocols. • Assessment of replacement fees for loss or damage due to negligence. • Strict prohibition of unauthorized use or sharing of YubiKeys, with potential disciplinary action for violations. • Requirement for immediate reporting of lost or malfunctioning devices to the Information Technology Department. • Maintenance of an operating procedure by the IT Department detailing issuance, registration, usage, and return processes for YubiKeys. This addition aligns with best practices for municipal cybersecurity, supports employees in safeguarding sensitive City data, and ensures consistency in 2FA implementation across the organization. BUDGET IMPACT: Minimal fiscal impact related to procurement of YubiKeys and recovery of replacement costs through employee fees if devices are lost or damaged due to negligence. RECOMMENDATION: It is recommended that Council approve the amendment to Section 400 of the Employee Handbook to include Section 400.12 Use of Physical Two-Factor Authentication, as outlined. ATTACHMENTS: 1. Information_Technology_Regulations