QUESTION
How can the public be assured that the Office of Technology and Innovation (OTI) is following local law 89 regarding cybersecurity policies?
1:54:31
·
61 sec
The Chief Information Security Officer states that OTI routinely updates its cybersecurity policies and frameworks as required by law, but is open to discussing ways to provide more public awareness while protecting sensitive security information that could be exploited by threat actors.
- OTI wants to balance public transparency with not revealing too many internal security details
- The official is willing to discuss disclosure options with the council committee
- Periodically updating cybersecurity policies and frameworks is standard practice for OTI
- There are concerns about publicly releasing information that could aid cyber attacks against the city
Jennifer Gutiérrez
1:54:31
Would we be able so the what we looked at was I didn't I don't we were not privy to any updates since the last administration.
1:54:38
And it's probably because it's not publicly available and they know pursuant to local law 89 cyber command must regularly update these policies.
1:54:49
Is there a way that it can be made public or that it can be shared, or how can we the public know or or trust that OTA is following this law?
Kelly Moan
1:54:58
Absolutely.
1:54:59
You you ask a great question.
1:55:01
I would endeavor to offer an opportunity to discuss with your office in in this particular committee more broadly about what that might look like.
1:55:10
We obviously want to strike the balance between public awareness that.
1:55:13
Yes.
1:55:14
It is absolutely normal and routine for us to be periodically updating policies and frameworks while also not wanting to reveal too much internally sensitive security documentation that would lead threat actors to be able to perpetrate attacks against the city.
1:55:29
So I think that that's definitely something that we would be open for discussion.
