Department Heads and immediate supervisors of all Town employees are responsible for ensuring appropriate enforcement of this policy and related standards on Town IT Resources within their areas of responsibility. The formal Security Policy/Procedure Exception Form must be filed and approved by each employee's immediate supervisor or department head and shall be filed in the employee's personnel file.

Violations of this policy or any other Town policy or regulation may result in the revocation or limitation of IT Resource privileges as well as other disciplinary actions, including, but not limited to termination of employment, and referral of the matter to external authorities.

Controlled access to IT Resources is essential for the Town to ensure that it may provide continued and uninterrupted service to the residents of St. John, and to preserve public records and information. This policy describes a comprehensive approach to Authentication and Authorization that can support current needs for electronic access and accommodate future services and technologies by employing standardized mechanisms for Identification, Authentication, and Authorization.

This policy is guided by the following objectives:

General Mission Statement

The Town strives to provide and maintain access for its employees to local, national and international sources of information and to provide an atmosphere that encourages sharing of knowledge, the creative process and collaborative effort to achieve the Town's public service missions. Access to the information system facilities at the Town is a privilege, not a right, and must be treated as such by all users of these systems. The smooth operation of Town IT Resources requires proper conduct by all users. All users must act honestly and responsibly. All users must respect the rights of other information system users, respect the integrity of the physical facilities and controls, and comply with all pertinent license and contractual agreements related to Town's IT Resources. All users shall act in accordance with these responsibilities, as well as applicable local, state and federal laws and regulations. Failure to conduct oneself in compliance with this Policy may result in denial of access to the Town's IT Resources and/or other appropriate disciplinary action.

Scope:

The Computer and Network Acceptable Use Policy applies to:

Information Classified as Public Records

Information created, maintained or obtained through any Town operated office or by any Town employee is a Public Record. Such records also include the notes and other customary documents prepared by any Town employee in the performance of their position and that position's responsibilities, regardless of the medium in which the record is created and/or stored.

Information communicated through Town electronic equipment, including computers and mobile electronic devices, are also Public Records. No Public Record may be altered, deleted, destroyed or removed from the system in which it is kept, unless in accordance with state law and any department's specific policies and procedures pertaining to same. If an employee seeks to alter, delete, destroy or remove a public record, prior written authorization must be obtained from the employee's immediate supervisor and/or Department Head. If the Public Record pertains to communication between the employee and their immediate supervisor and/or Department Head, written authorization to alter, delete, destroy or remove the communication must be authorized by the Clerk-Treasurer and/or Town Manager.

Definitions

For purposes of this Policy, as presently stated and as may be amended from time to time, the following definitions shall apply:

Unacceptable Uses of Town IT Resources

Unacceptable use of Town IT Resources includes, but is not necessarily limited to, the following:

No Expectation of Privacy

The Town of St. John owns and operates all technology equipment utilized for the conduct of the Town's business. The maintenance, operation, and security of information system resources require the Town to monitor and access its IT Resources. The Town will monitor all communications made using its IT Resources, including, but not limited to, electronic mail communications. Employees have no expectation of privacy regarding the use of and access to Town IT Resources. The Town, at all times, reserves the right to enter, search and inspect the electronic mail and computer files of any employee, without advance notice, for business purposes. Employee consent with the Town's right to enter, search and inspect its computer systems shall be a condition of employment. In the event of suspected abuse of information system resources or suspected violations of this or other policies of the Town or suspected violations of law, the Town may:

Access Control. Identification, Authentication, and Authorization are controls that facilitate access to and protect Town IT Resources and data. Access to nonpublic IT Resources will be achieved by unique User Credentials and will require Authentication. The Town will assign User Identification and Credentials for Identification and Authentication (UID) purposes to each employee with a need to access Town IT Resources. Authorization for Town IT Resources depends on the individual's job responsibilities and need to access specific electronic information maintained by Town IT Resources. In all cases, only the minimum privileges necessary to complete required tasks are assigned to that individual employee. Privileges assigned to each employee will be reviewed on a periodic basis and modified or revoked upon a change in position and/or employment status with the Town.

No Unencrypted Authentication. Unencrypted Authentication and Authorization mechanisms are only as secure as the network they use. Traffic across the network may be surreptitiously monitored, rendering these Authentication and Authorization mechanisms vulnerable to compromise. Therefore, all Town IT Resources must use only encrypted Authentication and Authorization mechanisms unless otherwise authorized by the Town Manager and/or IT Resource Manager.

Email. In order to ensure transparency and accurate record-keeping under applicable law, employees are required to use their Town-issued email accounts for all electronic communication related to official Town business.

Use of E-mail for Town Business. An official Town e-mail or gmail account shall be considered an official means for communicating Town business, and may in some cases be the sole means of communication. Users are expected to read, and shall be presumed to have received and read, all official Town e-mail messages sent to their official Town e-mail account. Because the contents of such e-mails are subject to state laws governing public records, employees will need to exercise judgment in sending content that may be deemed confidential and/or sensitive. Furthermore, e-mail transmissions may not be secure, and contents that are expected to remain confidential should not be communicated via e-mail.

The author of any business e-mail messages assumes responsibility for assuring that messages do not violate any Town policies, regulations, or procedures. Disclaimers of confidentiality included in e-mail messages do not protect the sender if confidential information is shared or disclosed inappropriately.

E-Mail Retention and Disposal

Any e-mail sent from an employee's Town-issued email/gmail account may be considered a public record under the Indiana Public Records Act (IC 5-14-3) and may be subject to disclosure.¹ E-mail correspondence and associated documents sent as attachments may be considered official Town records, and, as such, may need to be retained as public records. It is the responsibility of the Town employee engaged in the e-mail communication to determine the required retention period, to comply with applicable state law, and Town policies and procedures regarding record retention, and to preserve these e-mail records either electronically or in printed form with all of the associated header and transmission information.

E-mail stored on official Town systems shall generally be preserved on that system and/or pursuant to other policies and/or procedures of the Town or Department governing the saving and archiving of email, as amended from time to time. Log files associated with e-mail messages which provide a record of actual e-mail transactions, but not the e-mail content, shall also be preserved.

Users may not configure their official Town e-mail account to forward e-mail to an external e-mail address, unless written authorization is obtained from that employee's immediate supervisor or Department Head.

The Town may monitor the content of electronic mail as a routine procedure. The Town reserves the right to inspect, copy, store, or disclose the contents of electronic mail messages, but will do so only when it believes these actions are appropriate to:

Any Town Manager who believes such actions are necessary must first obtain the written approval of their immediate supervisor or Department Head, or if a Department Head, seek approval from the Town Manager.

Personal Electronic Devices

Electronic devices or services, including all cellular telephones, e-mail devices, and electronic access devices are valuable tools. The primary method for employees to use electronic devices and services for a documented Town business need is for Department In limited situations, Department Heads may authorize the use of Town-owned electronic devices or services for temporary periods, short-term events, and emergency purposes.

A review should be performed at least annually by each department head or designee to affirm continued business need of all electronic devices and/or services, as well as the effectiveness of any selected plan for same. This review may be incorporated as part of Town annual reviews and reminders coordinated by the department head with an employee's immediate supervisor.

When using a personal electronic device for official Town business, users are reminded that they are subject to all Town policies. In particular, users should be mindful of the Town's legal responsibility to preserve public records and handling of data that may be classified as same, as well as other policies and procedures regarding the secure use and transmission of Town data and/or public information.

In limited situations where Department Heads authorize Town-owned electronic devices for official Town business needs; the employee, supervisor, and Department Head, must sign an Employee Agreement for Town-Owned Electronic Device and Services acknowledging the responsibilities of each party as part of the Electronic Devices and Services policy. The departmental account will be billed in accordance with the associated contract(s).

For all Town-owned cell phones, employees and their immediate supervisors or designee will be provided a monthly detailed billing for review. The department will receive monthly billing reports, quarterly reports summarizing activity for each user, and a quarterly exception report. The department will review these quarterly reports with the department head or designee to assure an economical approach for each employee has been demonstrated, and to manage usage.

The department head or designee should verify at least annually the continued business need for these services for their employees and review the selected plan to assure an economical approach has been demonstrated for each user. In the application of this policy, departments or units have the discretion to adopt more restrictive provisions than outlined above.

Town departments may not separately enter into contracts for Town-owned electronic devices and services.

Personal Use of Devices. Town-owned electronic devices are intended for Town business use. These devices may be assigned to an individual employee or maintained within a department for "check-out" purposes. For purposes of this policy, personal use of a Town-provided cell phone of up to 10 minutes per month will be considered "de minimis" and will not require reimbursement to the Town.

For all Town-owned equipment, it is the responsibility of the department head to assure that:

Use of Devices while Driving. Use of electronic devices while driving Town vehicles is strongly discouraged. Drivers should pull off the road to a safe location while using an electronic device. The employee must also recognize that any local or state laws governing conduct of the use of certain electronic devices while driving preempt any policies, procedures and guidelines herein and that any violation and fine resulting from use of an electronic device shall be the responsibility of the individual employee. The Town will not reimburse the employee for fines and/or expenses incurred from violation of any local or state laws governing the use of certain electronic devices.

Remote Access (May not be necessary). Remote access to Town IT Resources must be accomplished in a manner that enables employees to carry out official Town business, while preventing unauthorized access and protecting the Town's IT Resources.

Unless specifically designated elsewhere in this Personnel Policy, such as in a job description requiring the employee to have remote access to perform work responsibilities, Remote access to IT Resources is not permitted unless the employee receives express written authorization from their immediate supervisor and/or Department Head.