March 8, 2005

SUBJECT:  Follow-Up to 2002-2003 Santa Clara County Civil Grand Jury Inquiry into Computer Information Systems Disaster Recovery Plans

REPORT IN BRIEF

The 2002-2003 Santa Clara County Civil Grand Jury conducted an audit of computer information systems disaster recovery plans for agencies within Santa Clara County and presented its findings to the City of Sunnyvale by letter dated June 24, 2003.  The City agreed with those findings and responded accordingly pursuant to City Council direction given on September 16, 2003 (RTC #03-321).  The Grand Jury requested a confirmation and status of actions taken by the City subsequent to the Findings and Recommendations on January 27, 2005.  Staff prepared a response to the follow-up inquiry, which was signed by the Mayor on February 22, 2005.  This report is notifying the Council of that response, which contained a draft copy of the City’s Disaster Recovery Plan and status regarding the testing of that Plan.

BACKGROUND

An audit report issued by the Santa Clara County Internal Auditor in May 2002 indicated shortfalls in disaster recovery plans and physical security for computer information systems of the Santa Clara Valley Health and Hospital System.   As a result, the Civil Grand Jury conducted an investigation of various agencies within Santa Clara County relating to disaster recovery plans for computer information systems.  The Grand Jury’s findings recommended that all cities/towns within the County have written disaster recovery plans for mission critical computer information systems and should regularly test and update those plans.  The City agreed with those findings and responded accordingly to the Grand Jury in 2003.

By letter dated January 27, 2005 (Attachment A), the Civil Grand Jury requested a confirmation and status of actions taken by the City subsequent to the Findings and Recommendations made in 2003.  Although the Disaster Recovery Plan is still in draft format and has not been formally tested, the Information Technology Department tests information systems as part of its routine operational tasks.  Staff prepared a response to the status request, which was signed by the Mayor on February 22, 2005 (Attachment B).

EXISTING POLICY

Legislative/Management Sub-Element Policy 7.3I – Provide data processing, communications, records management, and other information management functions in order to facilitate and enhance City operations.

DISCUSSION

In January 2005, the Civil Grand Jury requested a status of actions taken by the City in response to its Findings and Recommendations of the 2002-2003 Santa Clara County Civil Grand Jury.  The response requires Council approval as the governing body and staff is requesting Council’s approval of that response.  The City has a draft Disaster Recovery Plan that covers both mission critical and non-critical information systems.  Although the Plan has not been formally tested, the Information Technology Department tests recovery of systems as part of its routine operational responsibilities.  The IT Department will formally test the disaster recovery plan and finalize the plan as staffing and/or monetary resources are available.

FISCAL IMPACT

None

Conclusion

The City has a draft Disaster Recovery Plan that covers both mission critical and non-critical information systems.  Although the Plan has not been formally tested, the Information Technology Department routinely tests disaster recovery practices as existing staffing and monetary resources permit.  The City should respond accordingly to the Civil Grand Jury’s request for a status of actions taken subsequent to 2003.

PUBLIC CONTACT

Public contact was made through posting of the Council agenda on the City’s official bulletin board, posting of the agenda and report on the City’s web page, and the availability of the report in the Library and City Clerk’s office.

ALTERNATIVES