Council reviews draft cybersecurity and AI policy; staff to refine with Cal Cities guidance

Cotati — City staff presented a draft cybersecurity and data‑protection policy that establishes baseline technical protections and a governance approach for emerging tools including artificial intelligence.

Policy summary: The draft policy would require appropriate encryption for data at rest and in transit, adopt the least‑privilege principle for system access, and require tested backups for operational continuity. It proposes annual cybersecurity training for all employees and more frequent, specialized training for finance staff who are most exposed to wire‑fraud and phishing risks. Staff also recommended requiring SOC reports and PCI compliance where vendors process city financial or payment data.

AI guidance: The draft takes a permissive but cautious approach to AI: it encourages use of approved tools to improve efficiency but requires human review of AI outputs, documentation of what tools were substantially used, and treatment of AI outputs as public records subject to retention rules. Staff noted widespread informal AI use and said the policy should be iterative so City procedures can add or remove approved tools as the technology evolves.

Council feedback and next steps: Councilmembers supported labeling or citing AI‑assisted content and recommended staff consult Cal Cities and other model policies. Several members emphasized training should be targeted and not merely increase hours. Staff said they will circulate the draft to department managers, unions and Cal Cities, then return with a refined policy and an implementation plan including training and monitoring.

What’s next: Staff will incorporate council direction, seek Cal Cities and department input, and bring a revised policy back for final council approval and a rollout schedule tied to training and insurance/IT monitoring.