Waukesha IT board approves three cybersecurity policies and renews AT&T phone contract

The Waukesha City Information Technology Board on April 2 approved three IT policies — an acceptable-use policy, a security awareness training policy and a malware defense policy — and voted to renew the city’s AT&T phone-services contract to move certain nonemergency phone lines onto a new circuit.

Board members unanimously approved the acceptable-use policy, which the staff said consolidates existing rules about employee use of city-owned devices and clarifies responsibilities for end users and IT. The board also unanimously approved a new one-page security awareness training policy requiring regular training for users, and a malware defense policy that will supersede the city’s older antivirus policy.

The policies were presented by city IT staff as part of a broader effort to map the city’s policies to the Center for Internet Security (CIS) critical controls and to reduce overlapping language across policies driven by PCI, CJIS and insurance requirements. Staff said the acceptable-use policy will be part of an end-user handbook and that the city is switching its enterprise password-management tool from LastPass to 1Password. The security awareness training policy formalizes existing quarterly training provided through the KnowBe4 platform; managers receive…