Agenda

Return

C. 94

To:	Board of Supervisors
From:	David Twa, County Administrator
Date:	August 7, 2018

Contra

Costa

County

Subject:

RESPONSE TO CIVIL GRAND JURY REPORT NO. 1805, ENTITLED "EFFECTIVENESS OF IT OPERATIONS IN COUNTY GOVERNMENT"

APPROVE	OTHER
RECOMMENDATION OF CNTY ADMINISTRATOR	RECOMMENDATION OF BOARD COMMITTEE

Action of Board On: 08/07/2018

APPROVED AS RECOMMENDED

OTHER

Clerks Notes:

VOTE OF SUPERVISORS

AYE:

John Gioia, District I Supervisor
Diane Burgis, District III Supervisor
Karen Mitchoff, District IV Supervisor
Federal D. Glover, District V Supervisor

ABSENT:

Candace Andersen, District II Supervisor

Contact:

Julie DiMaggio Enea (925) 335-1077

I hereby certify that this is a true and correct copy of an action taken and entered on the minutes of the Board of Supervisors on the date shown.
ATTESTED: August 7, 2018
David Twa,

BY:	, Deputy

RECOMMENDATION(S):

ADOPT report as the Board of Supervisors' response to Civil Grand Jury Report No. 1805, entitled "Effectiveness of IT Operations in County Government”, and DIRECT the Clerk of the Board to transmit the Board's response to the Superior Court no later than August 20, 2018.

FISCAL IMPACT:

No fiscal impact.

BACKGROUND:

The 2017/18 Civil Grand Jury filed the above-referenced report, attached, on May 18, 2018, which was reviewed by the Board of Supervisors and subsequently referred to the Chief Information Officer and County Administrator, who prepared the attached response that clearly specifies:

Whether the finding or recommendation is accepted or will be implemented;

BACKGROUND: (CONT'D)

If a recommendation is accepted, a statement as to who will be responsible for implementation and a definite target date;

A delineation of the constraints if a recommendation is accepted but cannot be implemented within a six-month period; and

The reason for not accepting or adopting a finding or recommendation.

The California Penal Code specifies that the Board of Supervisors must forward its response to the Superior Court no later than August 20, 2018 (90 days from receipt).


FINDINGS

F1. Individual departmental IT groups are useful in supporting the very different businesses of each department, but many find it difficult to stay abreast of all technology areas.

F1 Response. The respondent agrees with the finding.

F2. The County does not have sufficient policies to promote coordination and/or centralization in IT strategy, policy, procurement and strategic knowledge concentrations, especially in advanced cost-saving technologies.

F2 Response. The respondent agrees with the finding.

F3. The County’s IT Strategy document, which sets out goals, guiding principles, and policies, is out of date, having last been updated May 2000.

F3 Response. The respondent agrees with the finding.

F4. The County's Information Technology central governance structure has almost completely disappeared. Governance has been left to the individual departments resulting in wide variations as to whether or how it is carried out.

F4 Response. The respondent partially disagrees with the finding. A governance structure exists for certain large, coordinated multi-department systems such as the personnel and benefits administration system (Peoplesoft), which is overseen by an executive steering committee; and law and justice systems, which are overseen by the Justice Automation Advisory Committee.

F5. Neither the County nor many individual departments have a consolidated IT budget or track overall IT expenditure, making it difficult to assess.

F5 Response. The respondent agrees with the finding.

F6. The County may not be taking full advantage of economies of scale due to the lack of policy coordinating equipment and service procurement among separate departments.

F6 Response. The respondent agrees with the finding.

F7. County-wide email and associated calendaring and address book functions are not sufficiently consolidated. Infrastructure and management is distributed throughout the departments. Policy and procedure have hindered efficient communication.

F7 Response. The respondent agrees with the finding.

F8. The County is constrained in implementing IT technology advances, in part due to insufficient or lack of access to appropriate skill sets.

F8 Response. The respondent agrees with the finding.

F9. DoIT does not have the staff to extend security oversight from County level to the departmental level. Cybersecurity capabilities vary by department.

F9 Response. The respondent agrees with the finding.

F10. Disaster recovery plans are in various stages of completion and readiness by department and typically are not tested on a regular basis.

F10 Response. The respondent agrees with the finding.

F11. There are insufficient Project Management resources with the expertise and authority to consistently implement the County’s critical IT projects on time and within budget.

F11 Response. The respondent agrees with the finding.

RECOMMENDATIONS

R1. The BOS should consider directing the CIO to update the County’s IT Strategy (last updated in 2000) by December 2018.

R1 Response. The recommendation has not yet been implemented. The CIO is currently reviewing the County’s IT strategy documents and will produce an updated draft IT strategy by December 2018.

R2. The BOS should consider seeking funds prior to the FY 2019-2020 budget cycle to expand existing resources into a centralized cybersecurity unit to support and coordinate County-wide IT security activity.

R2 Response. The recommendation will be implemented. The Board will direct the County Administrator to seek and apply for funds to bolster the County's cybersecurity program, which is under the direction of the CIO.

R3. The BOS should consider directing the CIO to re-establish a County-wide governance mechanism by December 2018.

R3 Response. The recommendation has not yet been implemented. The CIO has begun to restore the current Information Technology Advisory Committee. Additionally, the CIO will work with the County Administrator's Office to reassemble the Information Technology Steering Committee. Both are expected to be in place by December 2018.

R4. The BOS should consider directing the CIO to investigate policies to standardize procurement, equipment, and IT services prior to the FY 2019-2020 budget cycle. Opportunities include departmental networks, and services such as email, IT security, and disaster recovery.

R4 Response. The recommendation requires further analysis. The CIO is currently working with Purchasing, department technical leadership, and vendors to identify areas where efficiency and cost reductions can be realized. The CIO is also evaluating enterprise software and hardware expenditures that can be centralized, such as email and disaster recovery services.

R5. The BOS should consider directing the CIO to centralize the delivery of certain common services in time for the FY 2019-2020 budget cycle. Opportunities include email, IT security, and disaster recovery.

R5 Response. See response to Recommendation No. 4. A review is in progress but will require more than six months to complete in most cases.

R6. The BOS should consider directing the CIO to conduct a review of departments’ disaster recovery plans by December 2018 to ensure they are up to date and routinely tested.

R6 Response. The recommendation will be implemented. A review has been scheduled and will be led by the Security Officer. Timing will most likely be in the third or fourth quarter of the 2018-19 fiscal year.

R7. The BOS should consider presenting a consolidated IT budget for the entire County down to the department level, as part of the annual budget process, by the FY 2019-2020 budget cycle.

R7 Response. The recommendation will not be implemented because it is not warranted. The County's IT model is predominantly decentralized. Additionally, sources of individual departmental revenues are diverse and the majority of these revenue sources are categorical and cannot be transferred from one program or department to another. Consequently, a Countywide consolidated IT budget would not contribute to better budgeting decisions. When directing County resources, the Board must consider, on a case-by-case basis in the context of all related factors, which needs will receive priority. Consolidating IT budgets Countywide serves no business need and to do so would require significant effort merely for presentation purposes.

R8. The BOS should consider directing the CIO to investigate improving coordination between departments of IT procurement to reduce costs, prior to the FY 2019-2020 budget cycle.

R8 Response. The recommendation has not yet been implemented, but implementation is in progress. Through the IT Users' Group and the IT Steering Committee, standards will be developed that will allow Countywide procurement of technology.

R9. The BOS should consider directing the CIO to investigate establishing technology resource centers for dissemination of strategic technology knowledge and support, in order to create efficiencies and attract and retain staff. Candidate areas include cloud architecture and implementation, data management, business process automation, and cybersecurity.

R9 Response. The recommendation will be implemented. The CIO will work with County departments, cities within the county, and surrounding counties to develop centers of excellence that will facilitate the development of a regional knowledge base and resource pool to address technology opportunities all entities face.

R10. The BOS should consider directing the CIO to ensure that there is sufficient County IT project management staff with appropriate authority to effectively manage the County’s large, complex software projects by December 2018.

R10 Response. The recommendation will not be implemented because it is not reasonable. Robust and competent project management continues to be a goal for all of the County's IT projects, large and small. However, the recommendation is predicated on an assumption that the County has sufficient resources to quickly recruit and retain qualified project management staff for all of the County's large, complex software projects, which is not the case. While often critical to County operations and service delivery, IT programs compete with direct operations and other administrative programs for budget priority. When directing County resources, the Board must consider, on a case-by-case basis in the context of all related factors, which needs will receive priority. Additionally, funding is not the only obstacle to maintaining sufficient qualified IT project management staff. The most effective IT project managers have not only strong IT skills and experience but also the necessary subject matter expertise, which can take years to develop for the highly specialized, highly regulated business programs operated by the County. IT is a competitive industry. An unplanned departure of a key project manager can devastate a project. Qualified replacement management cannot simply be purchased.