Item - 2007.AU4.3

The Audit Committee submits the staff recommendations contained in the report (July 31, 2007) from the Auditor General:

            The Auditor General recommends that:

1.         The Chief Information Officer implement a user authentication system for all users accessing the Internet.

2.         The Chief Information Officer, in consultation with the Executive Director of Human Resources Division and the City Solicitor, implement systematic Internet usage monitoring for compliance with the City’s Acceptable Use Policy, including:

a.         developing criteria for Internet use that may not be in compliance with the policy, particularly relating to Internet time, bandwidth usage and visits or attempts to visit inappropriate sites;

b.         utilizing appropriate analysis tools to generate exception reports identifying users with Internet activity deemed to be inappropriate according to established criteria;

c.         providing Divisional management with detailed reports and technical support to facilitate review of apparent violations of the City’s Acceptable Use Policy;

d.         establishing written procedures outlining the types and frequency of management reports on Internet usage and the responsibility for review and follow-up of such reports; and

e.         communicating to all City staff reiterating the City’s Acceptable Use Policy, clarifying the responsibility of the City and users, and advising of the procedures in place to monitor compliance with the Policy.

3.         The Chief Information Officer conduct an ongoing review of top sites visited that are likely for personal use, have highly automated activity, or carry security risks such as instant messaging or email and determine whether further site restrictions are warranted.

4.         The Chief Information Officer take appropriate steps to ensure Internet connections of all City computers are consistently configured so that Internet logs record all Internet activity of all users but exclude visits to City internal sites.