(a) City Departments. Each City Department, (“Department”) shall:
(1) Appoint a Departmental Information Security Officer (DISO) to coordinate cyber security efforts with the CISO.
(2) Adopt the City’s information security standard for reducing the risk of compromise to the City’s information resources as a basis of their Department’s cyber security program.
(3) Consult with the Office of Cyber Security to evaluate cyber security risk prior to initiating new information technology projects, implementing major changes to information systems, or selecting vendors of technologies or vendors providing technology-related services.
(4) Support cyber incident response in accordance with the then-existing San Francisco Unified Cyber Command Plan.
(5) Conduct and update a Department cyber security risk assessment based on standards established by the Office of Cyber Security.
(6) Test and update the Department’s cyber security emergency response plan based on standards established by the Office of Cyber Security.
(7) Maintain Department cyber security requirements that are equivalent to or greater than the citywide information security standards and provide non-standard Department requirements to the Office of Information Security.
(8) Participate in citywide cyber security forum meetings organized by the Office of Cyber Security.
(b) Given the broad definition of “City Department” under Section 22I.3, and the wide range of sizes of City Departments, the requirement in subsection (a), above, that each City Department appoint a DISO shall not be understood to preclude the same person from serving as DISO for more than one City Department, nor preclude the DISO for a City Department from having other responsibilities.
(Added by Ord. 49-22, File No. 211294, App. 3/31/2022, Eff. 5/1/2022)