1. (a)

   1. (1) Reasonable care must be taken to ensure that county records are protected from accidental or mischievous modification or deletion.
   2. (2) Security shall be provided in tiered layers to facilitate protection of the data without sacrificing efficiency in the regular operations of the office.

2. (b) Office environment.

   1. (1)

      1. (A) Public and private areas of the office shall be designated and clearly delineated by use of walls, doors, counters, furniture arrangement, and signs as necessary.
      2. (B) This should allow the public to easily identify and avoid entering into nonpublic areas and the staff to easily observe any violations.
   2. (2) Computer equipment shall be arranged to prevent observation of sensitive information by persons in the designated public area or areas.
   3. (3) If the public is to directly access the county computer system, separate equipment shall be provided in a designated public area.
   4. (4) In such cases, public users should have a password that limits their access to those applications, resources, functions, and information designated for public use.

   5. (5)

      1. (A) The public should never be allowed to introduce media (floppy disks, USB memory card, portable devices, etc.) to any county computer.
      2. (B) Computers provided for public use should have media interfaces removed or disabled to prevent the potential for system damage that could arise from foreign media.

   6. (6) No one shall:

      1. (A) Connect with or otherwise use any county computer, modem, network, or other computing resource without proper authorization; or
      2. (B) Assist in, encourage, or conceal any unauthorized use or attempted unauthorized use of any county:

3. (i) Computer;

   1. (ii) Modem;

      1. (iii) Network; or

         1. (iv) Computing resource.
         2. (c) Desktop.
   2. (1) Each computer workstation in use by the county for accessing county records shall be secured using password protection as described herein.
   3. (2) Access to each computer should be limited by desktop security to allow only those applications, controls, functions, and resources that are applicable to the user and for which the user has permission of the office holder.

   4. (3)

      1. (A) After a significant period of user input inactivity, the desktop shall be blanked and locked.

      2. (B) Returning the desktop to interactive operation shall require reentry of the security password.

         1. (d) Network.
   5. (1) Access to the county network shall be limited to authorized users and defined network/internet connections.
   6. (2) The system administrator shall maintain a list of all approved connections and connection methods.
   7. (3) A password as described herein shall be required in order for any user to gain access to the network.

   8. (4) Network access and other privileges shall be limited by network security to allow only those applications, controls, and resources which:

      1. (A) Are applicable to the user; and
      2. (B) The user has permission of the office holder or system administrator.
   9. (5) The system administrator shall maintain a list of all approved users and their assigned privileges and access levels.
   10. (6) Network access and privileges shall be assigned in a manner consistent with the designated role of the elected official or employee.

   11. (7)

       1. (A) The use of wireless networks is not encouraged.
       2. (B) If a wireless network is employed in the county computer system, it must conform to a high standard of security and reliability.
       3. (C) Secure wireless networks are typified by customized and suppressed broadcast SSID, 128-bit WEP encryption, and VPN configurations to eliminate rogue access points.

   12. (8) Physical security for the network should include the following for fileservers and workstations where applicable:

       1. (A) Lock the case to prevent unauthorized removal of drives;
       2. (B) Lock fileserver racks to prevent unauthorized access to the drives for removable media;
       3. (C) Maintain servers and network equipment in a locked room to prevent unauthorized access;
       4. (D) Disable the removable media drives via the BIOS; and
       5. (E) Password protect the BIOS to prevent unauthorized access.

4. (e) Internet.

   1. (1) Internet access may be provided by the county to elected officials and staff members to serve the interests of the county.

   2. (2) Specific internet privileges:

      1. (A) Shall be governed by user ID and password; and
      2. (B) May be limited by county policy or the relevant elected official.

   3. (3)

      1. (A) The use of email and instant messaging services may be provided by the county for business purposes.
      2. (B) These services are not a job perk and not for private, personal use.
   4. (4) An elected official may grant limited personal use of emails in the interest of reducing the need for staff members to be away from county duties.

   5. (5) Users are forbidden from using the county’s computer system for:

      1. (A) Chain letters;
      2. (B) Charitable endeavors;
      3. (C) Private business activities;
      4. (D) Political activities; or
      5. (E) Amusement/entertainment purposes.

   6. (6)

      1. (A) Email messages generated or received on the county system are considered public property and subject to the Freedom of Information Act of 1967, Arkansas Code § 25-19-101 et seq.
      2. (B) They may be viewed by others including the system supervisor and should not be considered private.
   7. (7) Downloading information to a county computer is allowable only for business purposes and may be regulated by the system administrator by policy or electronic control.

   8. (8)

      1. (A) Using the county computer system to visit nonbusiness websites is not allowed, except to further the interests of the county.
      2. (B) Access to specific websites may be regulated by the system administrator by policy or electronic control.
   9. (9) The system administrator may block any website in the interest of preserving the integrity of the county computing system.

5. (f) Application.

   1. (1) Computer application programs may be acquired by the county from time to time to facilitate operations of the staff in the creation and application of computerized information.

   2. (2) Computer application programs should be evaluated prior to purchase for:

      1. (A) Suitability to the task;
      2. (B) Compliance with state and county laws and rules;
      3. (C) Compatibility with the county computing system;
      4. (D) Consistency with county security policies; and
      5. (E) Other office efficiency and effectiveness considerations.

   3. (3)

      1. (A) Application programs shall have internally configurable levels of security, allowing designated users to access the features required for their work while preventing access to those not so designated.
      2. (B) Program security shall be sufficiently detailed as to accommodate multiple tiers of access ranging from the administrative and supervisory level down to the public user.

   4. (4) Program access levels shall be:

      1. (A) Associated with the user’s login ID; and
      2. (B) Protected by a password as described herein.
   5. (5) Data managed by an application program shall be configured and secured to prevent access or modification by any means external to the core application.

   6. (6)

      1. (A) Application programs shall maintain a log file of changes made to the data.
      2. (B) This file shall contain sufficient detail to identify the record, date, time, user ID, and nature of the change or changes made.
      3. (C) The log file shall be readily available to users having administrative privileges.

   7. (7)

      1. (A) Application providers should provide notification to the county of any changes being made in the program.
      2. (B) For changes that could alter the application data or a critical function of the program, the notice should occur within five (5) working days of the change.
      3. (C) For noncritical updates, a thirty-day notice is sufficient.

6. (g) Passwords.

   1. (1) A user ID and password shall be required in order to gain access to any computer, network, application, or other resource that is part of the county computer system.

   2. (2) Passwords shall:

      1. (A) Be governed in all cases except as noted herein;
      2. (B) Be unique to each user and contain no less than five (5) characters;
      3. (C) Be changed not less than annually;
      4. (D) Not be shared or revealed to anyone except the authorized user;
      5. (E) Not be common words, especially those which relate to the user such as spouse/child/pet name, nickname, hobby, etc.; and
      6. (F) Govern the specific rights, privileges, and access for each individual user.

   3. (3)

      1. (A) Access privileges should be revoked and accounts locked for any employee or elected official within thirty (30) days of terminating employment with the county.
      2. (B) If termination is involuntary, accounts should be locked within two (2) working days.

   4. (4) In keeping with separation of powers, the elected official for a given office may institute a different policy for passwords so long as it:

      1. (A) Addresses each of the points listed above;
      2. (B) Is documented in writing; and
      3. (C) Is made available to each staff member and to the auditors.

   5. (5)

      1. (A) Users shall log out of their computer whenever they expect to be away from their computer or out of the office for any extended period of time.
      2. (B) This would include out-of-the-office breaks, lunch, etc.
      3. (C) Entry of the password shall be required in order to reaccess the system.
   6. (6) An inactivity time-out, no greater than thirty (30) minutes, shall be used and require entry of the password in order to resume system operation.

   7. (7)

      1. (A) Failed attempts to access the system with an expired or invalid user ID and password will result in the account being locked by the system.
      2. (B) The period of time for the lockout shall be set by office policy and is recommended to be not less than thirty (30) minutes.
   8. (8) A record of failed login attempts should be available to the system administrator on request.

7. (h) Virus/spam protection.

   1. (1) Each workstation or other system connected to the county computer network shall employ and maintain up-to-date antivirus and antispam software.

   2. (2)

      1. (A) Users are discouraged from downloading files from any internet website or opening attachments to emails unless from a known contact.
      2. (B) The system administrator may block access or remove privileges from users that violate this policy and endanger the function of the system.

   3. (3) Except as required for county business, users are prohibited from copying materials or information to or from the county system using:

      1. (A) Floppy disc;
      2. (B) CD;
      3. (C) DVD;
      4. (D) Tape;
      5. (E) USB memory card; or
      6. (F) Any other medium.

Codification Notes: “BIOS” means basic input/output system. "CD" means compact disc. "DVD" means digital video disc. "ID" means identity. "SSID" means service set identifier. "USB" means universal serial bus. "VPN" means virtual private network. "WEP" means wired equivalent privacy.