Lake County Technology Committee adopts access-control and system protection policies

The Lake County Technology Committee voted May 1 to adopt an access-control policy and a system and communications protection policy meant to tighten who may access county IT resources and how county systems are configured and monitored.

County CIO Chris Blanding said the access-control policy sets a baseline so employees have only the access necessary for their jobs and so access can be changed or removed quickly when roles change or staff leave. “The policy requires a formal offboarding process,” Blanding said, “so former employees cannot continue accessing sensitive data after they leave.” CTO Eric Carlson said the policies are based on the NIST framework and reflect practices the county already follows.

Members pressed staff on implementation details: who approves permissions, how departments maintain inventories of devices and whether periodic audits will verify settings. Carlson said departments will continue to approve access requests for their own systems and that IT will centralize enterprise-level account management; he also said the county will consider annual audits similar to Sarbanes-Oxley style testing as the policies and processes mature.

The system and communications protection policy requires secure system and network configurations, segmentation of public-facing systems from internal networks and the removal of default credentials before a server goes live. Carlson gave examples including encrypted remote email connections and placing public websites behind monitored web filters to reduce the risk of interception or exploitation.

Vice Chair Kasman moved to approve the access-control policy; Member Roberts seconded. The motion passed on verbal vote. A separate motion to adopt the system and communications protection policy was also approved. Committee members asked staff to present a deeper security program briefing at a future meeting that would tie the policies to ongoing projects such as threat monitoring, cloud backup and incident-response planning.

The policies will be published through the county policy process and will be accompanied by standard operating procedures and training to help departments follow consistent access and security practices.