COUNCIL MEMBERS MARIO GONZALES CARMELA GARCIA ALLENLEE JIMMY "JJ"F RIVAS GREGGI ROBINSON CITYI MANAGER LOND. SQUYRES CITY SECRETARY JOYCE RAINES CITYATTORNEY JIMDEFOYD City - ofacinto City JACINTO CITY, TEXAS77029 wwwjachnlociy-tx.goy 1301 MERCURY DRIVE - PHONE (713)674-8424 - FAX(713)675-8525 MAYOR ANADIAZ October 4, 2024 The Mayor and City Council will meet in regular session on Tuesday, October 8, 2024 at 6:00p.m. in the Council Chamber at 10301 Market Street. With the following items on the agenda: 1. Call to Order 3. Roll Call 2. Invocation and Pledge of Allegiance 4. Approval of the Minutes of the previous meeting(s) 5. Reports of Officers, Employees and Committees 1. Mayor's Report 2. City Manager's Report 6. Public Comments 7. No Unfinished Business: 8. New Business: 1. Mayor and Council to select and appoint representative and alternate to H-GAC General Assembly. 2. Mayor & Council to adopt Covered Applications and Prohibited Technology Policy. 9. Council Comments Posted this 4th Day of October 2024. Christal CAy City Secretary Rodriguez This facility is wheelchair accessible and accessible parking spaces are available. Request for accommodations ori interpretive service must be made 48 hours prior to Meeting. DESIGNATION OF REPRESENTATIVE AND ALTERNATE HOUSTON-GALVESTON AREA COUNCIL 2025 GENERAL ASSEMBLY BE IT RESOLVED, by the Mayor and City Council of Texas that be, andi is hereby designated as its Representative to the GENERAL ASSEMBLY of the Houston-Galveston Area Council for the year 2025. FURTHER, that the Official Alternate authorized to serve as the voting representative should the hereinabove named representative become ineligible, or should he/she resign, is THAT the Executive Director of the Houston-Galveston Area Council be notified of the designation of the hereinabove named representative and alternate. PASSED AND ADOPTED, this day of 2024. APPROVED: Ana Diaz, Mayor ATTEST: Christal Rodriguez, City Secretary h 19461 INTO JACINTO CITY Covered Applications and Prohibited Technology Policy Date: October 8, 2024 Version: 1.0 CONTENTS 1.0 Introduction 1.1 Purpose. 1.2 Scope. 2.0 Covered Applications. 2.1 Scope and Definitions. 2.2 Covered Applications on Government-Owned or Leased Devices. 6 / 8 8 9 10 10 11 2.3 Ongoing and Emerging Technology Threats. 2.4 Bring Your Own Device Policy. 2.5 Covered Application Exceptions. 3.0 Prohibited Technology Policy. 3.1 Scope. 3.2 State Agency-Owned or -Leased Devices. 3.3 Personal Devices Used For State Agency Business. 3.4 Sensistive Locations. 3.5 Network Restrictions. 3.6 Prohibited Technologies Exceptions. 3.7 Bring Your Own Device Policy for Governmental. Entity] Not Subject to 3.8 Ongoing and Emerging Technology Threats Pursuant to the Governor's Section 3.2. Directive. 4.0 Policy Compliance 5.0 Policy Review. 11 11 3 PAGE LEFT BLANK INTENTIONALLY 4 1.0 NTRODUCTION 1.1 PURPOSE On December 7, 2022, Governor Greg Abbott required all state agencies to ban the video-sharing application TikTok from all state-owned and state-issued devices and networks over the Chinese Communist Party's ability to use the application for surveilling Texans. Governor Abbott also directed the Texas Department of Public Safety (DPS) and the Texas Department of Information Resources (DIR) to develop a plan providing state agencies guidance on managing personal devices used to conduct state business. Following the issuance of the Governor's directive, the 88th Texas Legislature passed Senate Bill 1893, which prohibits the use of covered applications on As required by the Governor's directive and Senate Bill 1893, this model policy establishes a template that entities subject to the directive or bill may mimic to prohibit the installation or use of covered applications or prohibited technologies on applicable governmental entity devices. devices. 1.2 SCOPE AND APPLICATION Due to distinctions in requirements between the Governor's directive and SB 1893, Sections 2 and 3 apply to distinct organizations. Where appropriate, each section will identify the unique entities to whom the section applies and the appropriate definitions. Governmental entities, including local governments, must adopt a covered applications State agencies to whom the Governor issued his December 7, 2022, directive must adopt a prohibited technology policy as described by Section 3.0. To the extent a state agency is also subject to the requirements of Senate Bill 1893, that agency must also policy as described by Section 2.0. adopt a covered applications policy as described by Section 2.0. 5 2.0 COVERED APPLICATIONS POLICY FOR GOVERNMENTAL ENTITIES 2.1 SCOPE AND DEFINITIONS Pursuant to Senate Bill 1893, governmental entities, as defined below, must establish a covered applications policy: A department, commission, board, office, or other agency that is in the executive or legislative branch of state government and that was created by the constitution or as statute, including an institution of higher education as defined by Education The supreme court, the court of criminal appeals, a court of appeals, a district court, or the Texas Judicial Council or another agency in the judicial branch of state Ap political subdivision of this state, including a municipality, county, or special This policy applies to all. Jacinto City full- and part-time employees, contractors, paid or unpaid interns, and other users of government networks. All Jacinto City employees are Code Section 61.003. government. purpose district. responsible for complying with this policy. Ac covered application is: The social media service TikTok or any successor application or service developed or provided by ByteDance Limited, or an entity owned by ByteDance Limited. Asocial media application or service specified by proclamation of the governor 2.2 COVERED APPLICATIONS ON GOVERMMENT-OWNED OR LEASED under Government Code Section 620.005. DEVICES Except where approved exceptions apply, the use or installation of covered applications is prohibited on all government-owned or -leased devices, including cell phones, tablets, Jacinto City will identify, track, and manage all government-owned or -leased devices including mobile phones, tablets, laptops, desktop computers, or any other internet- desktop and laptop computers, and other internet-capable devices. capable devices to: 6 a. Prohibit the installation of a covered application. b. Prohibit the use of a covered application. Remove a covered application from a government-owned or -leased device that was on the device prior to the passage of S.B. 1893 (88th Leg, R.S.). d. Remove an application from a government-owned or -leased device if the Governor issues a proclamation identifying it as a covered application. Jacinto City will manage all government-owned or leased mobile devices by implementing the security measures listed below: a. Restrict access to "app stores" or unauthorized software repositories to b. Maintain the ability to remotely wipe non-compliant or compromised Maintain the ability to remotely uninstall unauthorized software from prevent the installation of unauthorized applications. mobile devices. mobile devices. 2.3 ONGOING AND EMERGING TECHNOLOGY THREATS To provide protection against ongoing and emerging technological threats to the government's sensitive information and critical infrastructure, DPS and DIR will regularly monitor and evaluate additional social media applications or services that pose a risk to DIR will annually submit to the Governor a list of social media applications and services identified as posing a risk to Texas. The Governor may proclaim items on this list as Ift the Governor identifies an item on the DIR-posted list described by this section, then Jacinto City may also prohibit social media applications or services in addition to those this state. covered applications that are subject to this policy. Jacinto City will remove and prohibit the covered application. specified by proclamation of the Governor. 2.4 BRING YOUR OWN DEVICE POLICY IfJacinto City has a "Bring Your Own Device" (BYOD) program, then the 7 Jacinto City may consider prohibiting the installation or operation of covered applications on employee-owned devices that are used to conduct government business. 2.5 COVERED APPLICATION EXCEPTIONS Jacinto City may permit exceptions authorizing the installation and use of a covered application on government-owned or -leased devices consistent with the authority Government Code Section 620.004 only allows Jacinto City to install and use a covered provided by Government Code Chapter 620. application on an applicable device to the extent necessary for: (1) Providing law enforcement; or (2) Developing or implementing information security measures. IfJacinto City authorizes an exception allowing for the installation and use of a covered application, Jacinto City must use measures to mitigate the risks posed to the state during the application's use including: Measures that the Jacinto City deems appropriate for its own policy. Jacinto City must document whichever measures it took to mitigate the risks posed to Jacinto City may include additional language within its policy as to which employees may install and use the covered application subject to its exception. 3.0 PROHIBITED TECHNOLOGY POLICY FOR. JACINTO CITY the state during the use of the covered application. 3.1 SCOPE This policy applies to all state agencies to whom the Governor issued his December 7, 2022, directive. This policy applies to all employees, including interns and apprentices, contractors, and users of state networks. All Jacinto City employees, contractors, and state network users to whom this policy applies are responsible for complying with these requirements and prohibitions. 8 3.2 STATE AGENCY-OWNED DEVICES N/A 3.3 PERSONAL DEVICES USED FOR CITY BUSINESS Employees and contractors may not install or operate prohibited applications or technologies on any personal device that is used to conduct state business, which includes using the device to access any state-owned data, applications, email accounts, non-public facing communications, state email, VolP, SMS, video conferencing, CAPPS, A state agency that authorizes its employees and contractors to use their personal devices to conduct state business must also establish a "Bring Your Own Device" (BYOD) program. If an employee or contractor has a justifiable need to allow the use of personal devices to conduct state business, the employee or contractor must ensure that their device complies with Jacinto City's BYOD program, which may include proactive Jacinto City's BYOD program prohibits an employee or contractor from enabling prohibited technologies on personal devices enrolled in the Jacinto City's BYOD Texas.gov, and any other state databases or applications. enrollment in the program. program. 3.4 SENSITIVE LOCATIONS The City Manager should identify, catalogue, and label all sensitive locations. A sensitive location is any location, physical or logical (such as video conferencing, or electronic meeting rooms), that is used to discuss confidential or sensitive information including information technology configurations, criminal justice information, financial data, personally identifiable data, sensitive personal information, or any data protected by An employee whose personal device, including their personal cell phone, tablet, or laptop, is not compliant with this prohibited technology policy may not bring their federal or state law. 9 personal device into sensitive locations. This includes using their unauthorized personal to device to access any electronic meeting labeled as a sensitive location. Visitors granted access to sensitive locations are subject to the same limitations as employees and contractors. If a visitor is granted access to a sensitive location and their personal device has a prohibited application installed on it, then the visitor must leave their unauthorized personal device at an appropriate location that is not identified as sensitive. 3.5 NETWORK RESTRICTIONS DIR has blocked access to prohibited technologies on the state network. To ensure multiple layers of protection, Jacinto City has also implemented additional network- based restrictions, which include: a. Configuring agency firewalls to block access to statewide prohibited services on all agency technology infrastructures, including local networks, WAN, and VPN b. Prohibiting personal devices with prohibited technologies installed from connecting to agency or state technology infrastructure or state data. With the City Manager's approval, providing a separate network that allows access to prohibited technologies with the approval of the executive head of the connections. agency. 3.6 PROHIBITED TECHNOLOGIES EXCEPTIONS Only the City Manager may approve exceptions to the ban on prohibited technologies. This authority may not be delegated. All approved exceptions to applications, software, or hardware included on the prohibited technology list must be reported to DIR. Exceptions to the prohibited technology policy must only be considered when: the use of prohibited technologies is required for a specific business need, such as enabling criminal or civil investigations; or for sharing of information to the public during an emergency. For personal devices used for state business, exceptions should be limited to extenuating circumstances and only granted for a predefined period of time. To the extent practicable or possible, exception-based use should only be performed on devices that are not used for other state business and on non-state networks, and the 10 user should disable cameras and microphones on devices authorized for exception- based use. 3.7 BRING YOUR OWN DEVICE POLICY FOR A GOVERNMENTAL ENTITY NOT SUBJECT TO THE GOVERNOR's PROHIBITED TECHNOLOGY DIRECTIVE Ifa Governmental Entity is not subject to the Governor's prohibited technology directive but is subject to Senate Bill 1893, it may also consider prohibiting the installation or operation of prohibited technologies and covered applications on employee-owned IfJ Jacinto City adopts a "Bring Your Own Device" (BYOD) program, then the Jacinto City shall institute a "Bring Your Own Device" (BYOD) policy requiring the enrollment of these personal devices in the entity's program before their continued use in conducting devices that are used to conduct government business. governmenta. business. 3.8 ONGOING AND EMERGING TECHNOLOGY THREATS PURSUANTTOTHE GOVERNOR'S DIRECTIVE N/A 4.0 POLICY COMPLIANCE Jacinto City will verify compliance with this policy through various methods, including but not limited to, IT/security system reports and feedback to leadership. An employee found to have violated this policy may be subject to disciplinary action, including termination of employment. 5.0 POLICY REVIEW This policy will be reviewed annually and updated as necessary to reflect changes in state law, additions to applications identified under Government Code Section 620.006, 11 updates to the prohibited technology list posted to DIR's website, or to suit the needs of Jacinto City. 12