INFO PAGE
COIT Policy
COIT policies apply to all City departments. Policy supports strategic goals like cybersecurity, disaster preparedness, and environmental sustainability.
BUYING TECHNOLOGY
- Cloud Acquisition and Management Policy To ensure City departments incorporate the appropriate requirements, processes, and risk mitigation strategies in the use and procurement of cloud services.
- Green Technology Purchasing Policy To establish green information technology purchasing requirements that improve the environmental profile of City government operations, and that foster expanded environmental stewardship in the IT industry.
- Software Evaluation Policy To ensure that all departments thoroughly and fairly evaluate software alternatives, including open source prior to acquiring new software.
DESIGNING SERVICES
- Digital Accessibility and Inclusion Standard To make digital information, programs, activities and services accessible.
MANAGING DATA
- Data Classification Standard To categorize and label or mark data per classification levels and review classification of data on a regular basis.
- Data Custodian Policy: To clarify data ownership and responsibilities for the Department of Technology and City departments.
- Data Management Policy To establish a framework for the proper management of data across the City.
- Metadata Standard To help users search, find, and understand published data.
PROTECTING PRIVACY
- Unmanned Aircraft System (Drone Technology) Policy: To establish a unified framework for all departments to prevent operational fragmentation and inconsistent practices that could create safety hazards, inefficient resource allocation, or coordination failures, especially during multi-agency responses.
RISK MANAGEMENT
- Citywide Cybersecurity Policy to maintain and enhance key elements of a citywide cybersecurity program.
- Citywide Technology Resilience Standard To develop achievable Technology Resilience Standards that ensure the delivery of public services during and after a disaster.
- Cybersecurity Awareness & Training Standard To help mitigate cybersecurity risks by training users, documenting the training, and communicating with them about cybersecurity best practices.
- Disaster Preparedness, Response, Recovery, and Resiliency Policy (DPR3) To develop, test, and maintain departmental IT focused Continuity of Operations plan for all the Critical IT System/Applications being managed and supported by the city departments to meet the needs of critical system operations in the event of a disruption.
TECHNOLOGY INFRASTRUCTURE
- Domain Registration and Management Policy: To standardize and unify the internet domain process.
- Email Policy To outline the standards for use and management of email systems in the City and County of San Francisco.
- Service Set Identifier (SSID) Standard To improve public access and transparency to online information.
- SF.gov Subdomain Standard: To establish the guidelines and procedures for the creation, management, and governance of public-facing and public-serving subdomains under the SF.gov root domain for the City and County of San Francisco.
USING TECHNOLOGY
- Acceptable Use Policy To protect City and County of San Francisco employees, partners, and departments from illegal or damaging actions by individuals, through intentional or unintentional means, by outlining the acceptable use of all City-owned or leased computer equipment.
- Mobile Device Use Policy. To establish a policy for both secure and cost-effective management of mobile devices, such as smartphones and tablets, used for City business.
- Software License Compliance Policy To establish the policy for software licenses compliance and tracking.
- Technology Project Management Policy To help ensure the successful implementation of technology projects across the City by applying best practice techniques and processes for the management of projects.