This page uses extracted PDF text. Text can misread numbers, dates or table columns. Check the PDF before quoting or interpreting it. Redacted areas remain redacted.
Newport News Police Department
7. If department or city computer equipment becomes infected with a virus and the infection is traced
to a personally owned computer system or media device, the individual who transferred the virus to
the system may be held liable for the costs of removing the virus.
V. ACCOUNTABILITY AND AUDITING [C6.8.5, 82.1.6(D)]
A. The IT Unit will perform a documented quarterly audit of all computer systems for verification of
passwords, multifactor authentication, access codes, and user accounts for possible violations and
improper use. The will: [T 7.3.5]
1. Verify all user accounts on all computer platforms currently used by employed users or ensure that
all such accounts for former employees have been disabled. [T 7.3.7(b)]
2. Verify system password requirements are applied to all active directory accounts,
3. Review all permissions to verify that users may access only the information required to perform their
duties as supervision approves. [T7.3.7(b)]
4. Review network security measures as appropriate.
5. Personnel will change their system password every 90 days when logging into the network, adhering
to the following password rules. [T7.3.7(a), T7.3.8]
a. Passwords must contain at least fourteen (14) characters, with at least one of the following:
1) Number
2) Uppercase letter
3) Lowercase letter
4) Special character (e.g., !, @, #, *, ?)
b. Passwords should not contain any word, proper name, or phrase spelled completely using letters
unless used as part of a passphrase.
c. Passwords cannot contain the username or a combination of characters in the username.
d. Users should not modify the old password by adding a single character when changing
passwords.
6. Personnel will create a multifactor authentication pin to access city devices.
a. A minimum of six (6), non-repeating characters, either numeric or letters.
b. The pin must not contain the employee’s active directory username or password.
B. The system administrator will ensure that the internal inventory records for all departmental computer
resources are kept current and available for inspection.
C. System Backups [82.1.6(a,b)]
1. The system administrator will ensure that all dynamically changing computer files are backed up
daily to a secure location with an active, non-corrosive fire suppression system. Daily incremental
backup tapes will be stored in a climate-controlled, secure area. [TA 7.3.6(a)]
2. The system administrator shall ensure that the agency’s complete data storage system is backed up
no less than weekly. Weekly backup tapes are stored off-site in the climate-controlled, secure
building. [TA 7.3.6(b,c)]
3. Requests to review or restore data from backup tapes or stored computer files shall be made in
writing to the system administrator. [TA 7.3.6(a,c)]
4. Computer files ported to tape for backup purposes shall remain viable and retrievable for up to six
months. At that time, the backup tapes will be overwritten and reused. [TA 7.3.6(d)]
ADM-540 - 4 of 6 – 12/30/2024Jump to an indexed page (6 of 6)