This catalog must be made public upon request and be posted in a prominent location on the local agency’s website. SB 272
went into effect on July 1 and going forward cities will need to annually update the public data. Over 140 agencies missed the July 1, 2016 compliance date. The good news is that compliance can be simple using free and publicly available tools.
Enterprise System Definition
Enterprise system refers to software application or a computer system that collects, stores, exchanges, and analyzes information that the agency uses that is both of the following:
- A multi-departmental system or a system that contains information collected about the public; and
- A system of record.
For example, an enterprise system could be a constituent management system, the city’s council meeting management system, or a general financial management system used for budgeting and analytics by the finance department.
The city of Lancaster
and Town of Apple Valley
provide examples of how to be in compliance.
Resources on Enterprise System Catalogs
There are a variety of resources available to help local agencies comply including:
Information on What to Upload and Link
A list or catalog (PDF document) describing each systems’ purpose, product name and vendor, primary users (custodians) and frequency of collection and updates must be posted in a prominent location on a local agency’s website, if the agency has a website. This list needs be updated annually.
Please note that the term “prominent location” is not defined in state law, so this is up to the individual city’s judgment. That being said, it would be wise to err on the side of caution and place it somewhere very prominent on the agency homepage.
Enterprise systems do not include cybersecurity systems, infrastructure and mechanical control systems, or information that would reveal vulnerabilities to, or otherwise increase the potential for an attack on, a public agency's IT system. Additionally, SB 272 does not automatically require disclosure of the specific records that the IT systems collect, store, exchange or analyze, however, the Public Records Act's other provisions pertaining to disclosure of such records still apply. If the public interest served by not disclosing the information described clearly outweighs the public interest served by disclosure, the local agency may instead provide a system name, brief title or identifier of the system.
Digital Deployment is happy to answer questions on this process or provide other assistance.
If you need help or have additional questions, the Digital Deployment
, Inc. team is a good resource.
MISAC has also developed a compliance tool for members. Questions about MISAC’s tool can be directed to Anand Rao
, IT manager with the city of Garden Grove.