A1601 REDLINE FINAL VERSION 03.05.2024.DOCX
Extracted text (via pymupdf)
30867 characters
MARICOPA COUNTY INTERNAL POLICY Policy Number: A1601 Current Adoption Date: MM-DD-2024 Policy Title: INFORMATION TECHNOLOGY GOVERNANCE Current Implementation Date: 05/01MM-DD-2024 Board Agenda Number: C-##-##-###-#-## Approved by: COUNTY MANAGERBOARD OF SUPERVISORS Original Adoption Date: 08-1999 I. PURPOSE To implement a Governance structure for Information Technology (IT) that 1) focuses decision making at the optimal business level, 2) consistently promotes systems synergy and integration, and 3) maximizes efficiency of resource utilization. The highest purpose of technology deployment is to enable efficient horizontal business processes, effective decision making, information sharing, and collaboration. II. APPLICATION This policy applies to all Maricopa County appointed departments, the Flood Control District of Maricopa County, and the Maricopa County Library District, (Special Districts). The Board of Supervisors is authorized to jointly adopt policies applying to the Special Districts under the Intergovernmental Agreement, C-06-18- 393-6-00, approved on April 11, 2018. This policy also applies to employees of County elected offices unless the elected official has implemented a similar policy specific to his or her office. The Judicial Branch (Superior Court, Adult Probation, Juvenile Probation and Justice Courts) has agreed that the Judicial Branch will adhere to County information technology policies unless the Judicial Branch has an equivalent or more restricted policy and provided County policies do not interfere or otherwise impede their ability to carry-out their required Constitutional and Statutory responsibilities nor restrict their ability to function as a separate and independent government entity. The Judicial Branch and Maricopa County elected offices have collaborated in the development of this policy and agree to be governed by its provisions provided such provisions do not interfere or otherwise impede their ability to carry-out their required Constitutional and Statutory responsibilities nor restrict their ability to function as a separate and independent government entity. III. DEFINITIONS A. Department Head is the Elected Official, Presiding Judge, or appointed department director serving as the responsible party for conducting business on behalf of the County. Appointing Authority: An elected official, the single administrative or executive head of a Department/Special District, or the designated representative authorized to act in this capacity. B. Chief Information Officer (CIO) is the lead technology officer for the County appointed by the CAO. C. Electronic Community may be defined in two ways: • Organizational - Defined by processes or information that formally tie a group of departments together, making them interdependent. • Functional - Defined by an interest in a common issue (e.g., public information or the sale of data) or a subject database (e.g. GIS). Policy Number: A1601 Policy Title: INFORMATION TECHNOLOGY GOVERNANCE Current Adoption Date: MM-DD-2024 Page 2 of 10 B. Chief Information Officer (CIO) Council: The IT governing body of the County, composed of the highest- level technology leadership for entities, e.g., Maricopa County CIO and CIOs for elected offices and the Judicial Branch. C. Core Business Systems are those technology systems that centrally support Enterprise administrative level operational functions. These systems represent horizontally integrated systems, as opposed to vertically integrated systems found at the business unit level. Core Business Systems: Technology systems that centrally support Countywide functions. D. County Electronic Community: may be characterized as either: 1. Organizational - Defined by processes or information that formally tie a group of entities together, making them interdependent, e.g., Criminal Justice Agencies; or 2. Functional - Defined by an interest in a common issue, e.g., public information or the sale of data; or a subject, e.g., GIS. E. County Technology Resource (CTR): Any computing account; device (e.g., mobile device, smartphone, tablet, computer, communications equipment, video conference, facsimile, or telephone); peripheral; software; local, wireless and wide area networks (LAN, Wi-Fi and WAN); ESI; website; cloud-based or internally-hosted system; or related consumable (disk space, processor time, network bandwidth) owned by, contracted with, or controlled by the County (Elected or Appointed Department) or by the Judicial Branch. F. Department is a collection of one or more teams working in a common business unit or process. They may have a very sophisticated suite of network, desktop and mini or mainframe computer technology, woven together to support their business and their customers. Department: A separate County entity defined by the County organizational chart. For purposes of this policy, County Districts are considered a department. A department may have a sophisticated suite of network, desktop, server, and cloud technology woven together to support their business and their customers. G. Enterprise Architecture (EA): At the direction of the CIO Council, EA is the process of standardizing and organizing IT infrastructure so that County-funded entities achieve business objectives. H. Enterprise Level (the highest level within the County) consists of those functions which maintain and coordinate the technology infrastructure of the County. Enterprise Level: Those functions which maintain and coordinate the IT Infrastructure of the County. I. Governance refers to the method of managing information technology in which policy and standards are defined centrally with the participation of all levels of the organization, while information technology operations in support of business functions are implemented and supported at the closest level appropriate to the business function. Governance: The processes that ensure the effective and efficient use of IT in enabling the County to achieve its business objectives. Policy and standards are defined centrally with the participation of all levels, while IT operations in support of business functions are implemented and supported at the closest level appropriate to the business function. J. Information Technology (IT): Any information system or other technology used to support the primary business function of any County operation. May also be referred to as information system or application. K. IT Capital Acquisitions: Investments made in the equipment base that operates for a reasonable period known as the life cycle. The replacement of that capital must be part of an overall investment strategy. L. IT Infrastructure: embraces Includes multiple components consisting of 1) the Countywide data centers, data, voice, video, wireless network, and public safety wireless radio, 2) enterprise-wide core administrative systems, 3) core collaboration services including the County Internet home page, the Policy Number: A1601 Policy Title: INFORMATION TECHNOLOGY GOVERNANCE Current Adoption Date: MM-DD-2024 Page 3 of 10 County Intranet, and County Groupware complexMicrosoft Office 365 environment, and 4) enterprise- wide information security resources. M. Judicial Branch: Includes the Superior Court, Adult Probation and Juvenile Probation functioning within Maricopa County. The Presiding Judge, as appointed by the Arizona Supreme Court, is the sole local authority to administer and govern all Judicial Branch operations. N. Life-Cycle Costing: An identification of expenditures, both initial and ongoing equipment, maintenance, and human resource allocations for an IT Capital Acquisition, from project initiation tothrough full implementation, to obsolescence or replacement (part of the investment strategy), projected on an annualized basis. O. Maricopa County Board of Supervisors (BOS): Five-member board that is comprised of a qualified elector from each of the five supervisorial districts within Maricopa County. P. Maricopa County Chief Information Officer (CIO): The lead Technology Officer appointed by the County Manager. Q. Technology Officer is the person designated by a Department Head to manage IT operations at the business unit level. The Technology Officer’s position may be one of the following, depending upon the size of the IT operation, size of IT support staff, and latitude regarding budgetary control and strategic planning: • Chief Technology Officer: Manages, at the direction of the Chief Information Officer or the Executive Business Leader, the overall information systems function for several agencies. They will have more than one Information Systems Director reporting directly to them. The Chief Technology Officer is responsible for strategic planning, oversight of the IT architecture, and IT budgetary control for all IT organizations under their control. Educational background usually consists of a BS or BA in Computer Information Systems, a Master’s Degree and a minimum of 15 years of IT experience, including 3-5 years in senior IT management. • Information Systems Director: Manages a major technology organization which typically includes: 1) a large installation site (+400 workstations); 2) a large staff with middle managers responsible for tactical operations; 3) a very broad range of systems, applications and technology domains; and 4) substantial technology budget authority. Educational background usually consists of a BS or BA in Computer Information Systems, a Master’s Degree and a minimum of 15 years of IT experience, including 3-5 years in senior IT management. • Information Center Manager: Manages a technology support group which typically includes: 1) a installation site of less than 400 workstations; 2) a small to medium size support staff, possibly with 1-2 additional supervisors or project leaders; 3) a moderate range of applications, systems and technology domains; and 4) modest budget authority. Educational background usually consists of a BS or BA in Computer Science, Business Administration or related field, and a minimum of 7 years of IT experience, including 2-3 years in IT management. • Manager, Microcomputer Technology: Supervises a support team which typically includes: 1) a small support staff with technicians, programmer/analysts, and/or LAN administrator(s); 2) a limited range of technology domains and applications; and 3) little or no independent budget authority. An educational background with a BS or BA in a Computer Science related field is preferred or a corresponding number of years experience in IT with 1-2 years in IT management. Technology Officer: The most senior IT leadership position within a County-funded entity, e.g., Chief Information Officer or Information Services Director. IV. POLICY A. Governance Model Framework To ensure that IT resources deliver maximum business value, the County will employ a federated structure to manage IT. Reflecting the overall business model of decentralized County management, the federated Policy Number: A1601 Policy Title: INFORMATION TECHNOLOGY GOVERNANCE Current Adoption Date: MM-DD-2024 Page 4 of 10 approach balances the benefits of local autonomy with the advantages of Countywide IT coordination and management. It simultaneously allows responsiveness to business issues and accountability to local management, while establishing a convergent IT direction and optimized infrastructure. The federated structure recognizes the following three levels: Enterprise Policy, standards, infrastructure, core systems, security, and telecommunications County Electronic Community Processes, systems, and data shared between departmentsCounty- funded entities Department Systems internal to a specific department or functional area Each of these three tiers represents varying blends of integration and autonomy. At each level, an IT function is autonomous except as it relates to the tiers above, where it must follow the prevailing policies, standards, conventions, and practices for purposes of business process and system integration. B. Guiding Principles The following principles form the foundation of this Governance model: 1. Business unitsDepartments are fully responsible for the benefits and costs of information technologyIT deployed in their operations. They will assume accountability for delivering productivity gains derived from technology implementation according to their business strategies and plans. OperationsDepartments will employ solutions that provide the lowest overall business cost to the County. To optimize technology and business alignment, Department HeadsAppointing Authorities should establish a directdirect reporting relationship with their Technology Officer. In the case of Elected Officials, a Chief Deputy may be appropriate. 2. Significant investment in new technology will not be made until processes have been firstfirst re- engineered or enhanced by eliminating redundant tasks and duplicate data. Data should be entered into the information system only once at the point of origin. Business unitsDepartments will build horizontal business processes around citizens, business partners, and internal customers. Technology must measurably enhance the productivity or quality of work based upon full Life-Cycle Costing. Common systems will be used for all similar business functions unless verifiable proof exists that some functions must remain different or unique. Shared systems resources and common data repositories will be exploitedleveraged wherever possible. 3. Technology investments will be made in compliance with the Procurement Code. 4. Whenever the need arises for additional technology capability, consideration will be given to enhancing existing systems before opting for entirely new systems. Small, timely, incremental improvements must be considered prior to any investment in large and comprehensive programs. Large, new initiatives will be funded and executed in incremental phases of two years or lessas feasible to 1) demonstrate proof of concept, 2) minimize risk, and 3) track achievement of business goals. 5. The preferred approach to new systems will be to integrate purchased applications that are based upon recognized industry standards and common user interfaces. Custom development will be considered only as a last resortif more cost-effective and if capable of meeting any deadlines. New systems will be validated in pilot implementationsthrough extensive user acceptance testing and other best practices prior to full scale deployment. Policy Number: A1601 Policy Title: INFORMATION TECHNOLOGY GOVERNANCE Current Adoption Date: MM-DD-2024 Page 5 of 10 6. The oversightstrategic alignment of major programs, as defined by the CIO Council, will be assigned to one of the three Governance tiers: Enterprise(Electronic Government Council or Office of the CIO);, County Electronic Community (Leadership Team);, or County-funded entity/Department (Business Leadership). Business and technology oversight will be maintained throughout the program life cycle. Independent reviews by either Internal Audit or external service providers may be requested by senior managementCounty Leadership and/or Board of Supervisors as appropriate. 7. The IT Infrastructure shall allow employees, citizens, and business partners to satisfy the majoritymost of their business needs using electronic means. It will be depoloyed so that the location of data or the application that produces data is irrelevant.The IT Infrastructure will integratecommunications, computing and systems support functions automatically by means that do not require personal intervention.provide access to applications and data regardless of where it is located. 8. Technology resourcesCTR will be leveraged effectively and efficiently through the adoption of common standards and shared information. Data, voice, video, image, workflow and GIS information systems shall be standardized and interoperable between all County agencies. 9. The IT infrastructureDepartmental architects will define the interfaces between Enterprise Level systems (standardizing interfaces rather than content). Well-defined interfaces will last longer than the systems they connect and will provide greater flexibility in the choice of systems. 10. Information systems willcan be periodically audited for compliance to relevant County policy by the Internal Auditor Department, special contract, or as requested by the Board of SupervisorsBOS, County Administrative OfficerManager, Deputy County Managers, Chief Officers, or Department HeadsAppointing Authorities. C. Authority and Responsibility 1. Maricopa County Board of Supervisors (BOS) a. The BOS is the approval authority for information systems policy, major programs, and IT Capital Acquisition for the County. County Administrative Officer (CAO) The CAO is responsible for: • Establishing the County-wide vision and resource allocation to leverage IT. • Chairing the Electronic Government Council (outlined below). • Convening ad-hoc committees to consider special issues and unique IT programs. Electronic Government Council The Electronic Government Council is the highest level IT governing body of the County. It is chaired by the CAO and is composed of elected officials, senior management, external representatives and other key leaders. It is responsible for: • Establishing a common strategy and compelling program for e-Government • Developing a planning framework for service transformation • Promoting consistent and convenient delivery channels for County customers • Enabling cross-agency synergy and cultural alignment • Setting major targets and monitoring progress Monitoring departmental e-business strategies • Providing oversight of key Enterprise-level initiatives • Approving Enterprise-level policies, practices, and standards Department Heads Department Heads are responsible for: Policy Number: A1601 Policy Title: INFORMATION TECHNOLOGY GOVERNANCE Current Adoption Date: MM-DD-2024 Page 6 of 10 • Aligning Information Technology programs with business strategy. • Achieving benefits of technology deployment, and producing IT services in a manner that is consistent with best industry practices and benchmarks. • Jointly establishing Electronic Communities that set direction for IT when more than one department must: 1) Share horizontal processes, information and systems; 2) Coordinate one or more projects (which may require appointment of an independent project coordinator). 2. Judicial Branch a. The Presiding Judge is the approval authority for information systems policy, major programs, and IT Capital Acquisition for the Judicial Branch. 3. Technology LeadershipMaricopa County Chief Information Officer (CIO) The CIOreports directly to the County Administrative Officer and is responsible for: a. Providing the strategic vision and resource deployment at the Enterprise Level; acting as a change agent and principal integrator of the County’sInformation Technology IT mission and technical capability. b. Defining the Enterprise-level Aarchitecture and facilitating the flow of information between County departmentsentities, outside organizations, and citizens. • Managing the governance structure including: 1) developing Enterprise IT policy, standards and directions; 2) facilitating standards which provide direction and overall lowest total cost of ownership; 3)establishing security principles and guidelines; 4) developing and facilitating management of Electronic Communities; and 5) resolving issues between Electronic Communities and/or Departments. • Encouraging funding models that facilitate infrastructure development and Electronic Community partnerships; acting as a consultant to senior management of Information Technology program proposals; partnering with the Deputy County Administrator to facilitate a technology budget issue review as part of the annual budget development process. c. Developing and maintaining the IT Infrastructure at the Enterprise Level. d. andManaging network security at the Enterprise Level. e. In conjunction with the Office of Procurement Services, coordinating enterprise vendor relationships and assisting departments in optimizing vendor performance. f. With the support/recommendations of the CIO Council, partnering with Human Resources in conducting IT salary market surveys, developing and publishing the County Information Technology Position Reference Guide; consulting with technology officers and Huuman Resources on IT staff retention, recruitment, and compensation proposals. g. Representing the technology interests of the County to parties external to the County. (The Presiding Judge or designee represents such technology interests for the Judicial Branch.) h. Providing the County Administrative OfficerManager and Board of SupervisorsBOS with annual goals describing the infrastructure and operational plans for Enterprise Level information systems and technology. Policy Number: A1601 Policy Title: INFORMATION TECHNOLOGY GOVERNANCE Current Adoption Date: MM-DD-2024 Page 7 of 10 i. Providing technical advice and support to the County Administrative OfficerManager and Board of SupervisorsBOS; providing technology consulting services to agencies,departments or individuals on an as requested basis. j. Encouraging andMaking recommendations to County Administrative OfficerManagement for shared services and consolidated operations, (e.g., GIS, data warehouses, data centers, etc.) k. Reviewing technology related items at the request of the Board of SupervisorsBOS. l. The CIO may also convene, as necessary,Convening select committees or oversight bodies to address Enterprise Level issues impacting project or fiscal technology gGovernance. 4. CIO Electronic GovernmentCouncil The Electronic Government Council is the highest level IT governing body of the County. It is chaired by the CAO and is composed of elected officials, senior management, external representatives and other key leaders. ItThe CIO Council is responsible for: a. Establishing a common strategy and complelling program for e-Governmentfacilitating Department rotation and meeting cadence. b. Developing a planning framework for service transformationEstablishing the Countywide vision to leverage IT. c. Promoting consistent and convenient delivery channels for County customersConvening ad hoc committees to consider special issues and unique IT programs. d. Contributing to the County’s strategic vision. e. Setting major targets and monitoring progressEnabling the Governance structure including: 1) developing approvingEnterprise-level IT policies policy, practicesstandards, and directions, 2) Providing oversight of key Enterpirse-level initiativesfacilitating standards which provide direction and overall lowest total cost of ownership, 3) promoting security principles and guidelines as established by the Chief Information Security Officer (CISO), and 4) Monitoring departmental e-business strategiesdeveloping and facilitating management of technology within the County Electronic Community tier. f. Encouraging funding models that facilitate infrastructure development and County Electronic Community partnerships. g. Facilitating: 1) policies, standards, and guidelines, 2) risk management, 3) evaluation and adoption of technologies, and 4) cross agency communications. h. When requested by Human Resources, collaborating on IT salary market surveys on positions to ensure that all appropriate positions are evaluated uniformly across Departments. Policy Number: A1601 Policy Title: INFORMATION TECHNOLOGY GOVERNANCE Current Adoption Date: MM-DD-2024 Page 8 of 10 i. Collaborating on new technology products and services that may be leveraged for service transformation. j. Sharing partner assessments. k. Sharing departmental strategies and establishing common strategies. l. Promoting consistent and convenient delivery channels. m. Enabling cross department synergy andculturalservice alignment. n. Identifying, developing, and recommending Enterprise Level policies, practices, and standards. 5. Department HeadsAppointing Authorities Department HeadsAppointing Authorities are responsible for: a. Aligning Information Technology programs with business strategyCollaborating with their Technology Officer. b. Achieving benefits of technology deployment and producing IT services in a manner that is consistent with best industry practices and benchmarks. c. Jointly establishing County Electronic Communities that set direction for IT when more than one department must: 1) share horizontal processes, information, and systems, 2) coordinate one or more projects (which may require appointment of an independent project coordinator). d. Ensuring departmental participation in CIO Council. 6. Technology Officer To support the business,The Technology Officer at each level of the organization is responsible for: a. Engaging in practices to manage their technology environments within the framework of the principles established in Section Bthis policy and other approved County policies and procedures. b. Integrating new applications and systems into the common interfaces of the IT Infrastructure; adopting common data definitions and standards for all data shared with other business unitsDepartments. c. Facilitating and controlling access to information according to the Maricopa County Electronic Information Resource Security Principles document, security standards and in accordance with public records laws. d. Using industry best practices and standard benchmarks to measure IT performance. e. Leveraging shared services at the Enterprise, County Electronic Community, and Department levels whether (insourced or outsourced) technology. f. Utilizing a system development life cycle methodology to plan, implement, and maintain systems at the business unit level. Policy Number: A1601 Policy Title: INFORMATION TECHNOLOGY GOVERNANCE Current Adoption Date: MM-DD-2024 Page 9 of 10 g. Developing, andmaintaining, and testing plans for the recovery of information systems in response to a natural disaster, fire, or other event that would render a business facility or service inoperable. h. Protecting information assets against deliberate attack,or sabotage, and unintentional or unauthorized alteration, destruction, or disclosure. i. Ensuring that their technology platforms meet the criteria of being proven, scalable, low cost, and well supported by the vendor; having a clearly defined short and long-range migration strategy. In addition to supporting their business clients, each Technology Officer is responsible for. j. Participating with their County Electronic Community and the Enterprise to ensure timely and responsive integration of business systems and information based upon approved standards; Departments may be reviewed or audited for Community or Enterprise standards compliance. k. Assigning project coordinators when migrations affect or include more than one Department; the project coordinator will act as a liaison to all involved business and technology leaders and is responsible for the timely communication of impacts and related costs to other areas. l. Establishing appropriate departmental information technologyIT policies for their business operations and iensuring that their systems conform to policies set by their Department, County Electronic Community, or the Enterprise, including approved record retention and disposition schedules. 7. County Electronic Community The County Electronic Community, which may include a formal governing entity, (i.e., IT Program Office) is responsible for: a. Acting upon direction from the CIO Council, Appointing Authorities, and Technology Officers. b. DraftingSetting IT policy, strategy, priorities, plans, and standardsthat are binding upon the entire Community. Resolving IT issues between member departments and bringing unresolved issues to the CIO or CAO. Electronic Communities may establish a formal IT Program Office to facilitate strategic planning and to coordinate technology activities. Appendix A outlines specific program charters. c. Coordinating technology activities with County Electronic Community members as appropriate. GEOGRAPHIC INFORMATION SYSTEM (GIS) PROGRAM OFFICE Purpose Maricopa County has invested heavily in its geographical information systems (GIS). In an effort to enhance the services and products from this GIS investment, the County has established a GIS Program Office to facilitate effective decision making, information sharing, and collaboration in this environment. The GIS Office has oversight of County GIS operations. The GIS Officer (GIO) directly reports to the County CIO. Objectives • To expand the current GIS portfolio of products and services Policy Number: A1601 Policy Title: INFORMATION TECHNOLOGY GOVERNANCE Current Adoption Date: MM-DD-2024 Page 10 of 10 • To promote systems synergy and integration • To maximize efficiency of resource utilization • To enhance communication and coordination within the Maricopa GIS family Key Activities • Manage the Technology Environment • Coordinate the technology team(s) • Promote integrated systems and software • Coordinate IT staff training plan • Communicate the GIS Program Activities • Market the GIS program • Facilitate the GIS Program • Increase awareness of products and services internally, with the Public, and with regional partners • Participate in regional associations and initiatives • Host presentations, technical briefings, and GIS Council meetings • Develop Policies and Practices • Establish GIS policies • Develop standards • Oversee compliance • Establish Board-approved fees for GIS products • Develop Products • Catalog current products and services • Coordinate GIS-related contracts • Facilitate (single point of contact) public record requests for GIS data (commercial & non-commercial) • Develop new product line (annual data sets available on CD’s and/or other venues) • Provide consulting services to other County entities The GIS Office is currently funded by the General Fund. Revenue generated from product sales will be reinvested into the GIS Program for information technology, system maintenance and enhancements. The staffing model consists of the GIS Officer (with management/budgetary authority) and additional staff as approved by the CIO. Revision History Version Revision Date Description of Revision 1 08-1999 Initial version. Approved by County Manager 2 05-2001 Revision. 3 MM-DD-2024 Convert to BOS approved policy, add Application section, and clarify governance model, roles, and responsibilities.