26 CAR Part 211 — General Rules of Practice and Procedure

Chapter III

Subchapter A

Subpart 1

26 CAR § 211-101 Petitions for declaratory orders {#sec-26-car-211-101 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-101}

26 CAR § 211-101. Petitions for declaratory orders.

(a) Pursuant to Acts 1967, No. 434, petitions for declaratory orders as to the applicability of any rule, statute, or order enforced by the Assessment Coordination Division shall be in writing and signed by the petitioner.

(b) Petitions shall be filed in duplicate with the Director of the Assessment Coordination Division, who shall:

(1) Have the date of receipt stamped thereon; and

(2) Return one (1) copy to the petitioner.

(c) All petitions for declaratory orders shall be titled as such.

(d) In those instances in which the division’s response to a petition for a declaratory order is to be based on the opinion of the Attorney General, the director shall issue its declaratory order promptly on receipt of the official opinion of the Attorney General.

(e) With respect to all other petitions, the director shall issue a declaratory order in response to said petition within fifteen (15) working days from the date of filing by mailing a copy of the order to the petitioner by certified mail.

History

• Codification Notes: This section as promulgated prior to codification into the Code of Arkansas Rules provided as follows:"STATUTORY AUTHORITY: A.C.A. 25-15-206""Adopted 10/01/99" Authorities: Arkansas Code § 25-15-206; Arkansas Code § 26-24-107

26 CAR § 211-102 Public right to petition {#sec-26-car-211-102 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-102}

26 CAR § 211-102. Public right to petition.

(a) Any person has the right to petition for the issuance, amendment, or repeal of any rule.

(b) Within thirty (30) days after submission of a petition, the Assessment Coordination Division shall either:

(1) Deny the petition, stating in writing its reasons for the denial; or

(2) Initiate rulemaking proceedings.

History

• Codification Notes: This section as promulgated prior to codification into the Code of Arkansas Rules provided as follows:"STATUTORY AUTHORITY: A.C.A. 25-15-204""Adopted 10/01/99" Authorities: Arkansas Code § 25-15-203; Arkansas Code § 26-24-107

26 CAR § 211-103 Administrative Hearing Advisory Board {#sec-26-car-211-103 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-103}

26 CAR § 211-103. Administrative Hearing Advisory Board.

(a) There is hereby created an Administrative Hearing Advisory Board (hereinafter called the hearing board), which shall consist of seven (7) members appointed by the Director of the Assessment Coordination Division as follows:

(1) Four (4) appraisal managers, one (1) representing each United States congressional district;

(2) One (1) member representing public education;

(3) One (1) at-large member who is a property owner and a resident of the state of Arkansas representing taxpayers; and

(4) One (1) assessor who has an Assessment Coordination Division Level 4 designation.

(b)(1) Each hearing board member will serve for three (3) years except for the first year when the members will draw lots to initiate the necessary staggered terms system.

(2) The first working year shall begin immediately upon adoption of this section and last until the second Monday in January 2008, when the second year shall begin, and each year shall continue in a like manner thereafter.

(c) At the first meeting of the hearing board each year, after the new appointees to the hearing board have taken office, the hearing board shall elect a chair and a secretary for that year.

(d) Appointment to the hearing board shall be made by the director after seeking nominations from organizations or individuals representing each of the required sectors.

(e) A hearing board member may be dismissed by the chair if they cease to meet eligibility requirements herein or fail to attend three (3) consecutive meetings without justification, or for other reasonable cause.

History

• Codification Notes: This section as promulgated prior to codification into the Code of Arkansas Rules provided as follows:"Adopted 12/20/06" Authorities: Arkansas Code § 25-15-203; Arkansas Code § 26-24-107

Subpart 2

26 CAR § 211-201 Scope {#sec-26-car-211-201 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-201}

26 CAR § 211-201. Scope.

(a) The provisions of the Arkansas Administrative Procedure Act, Arkansas Code § 25-15-201 et seq., as amended, are applicable to all final orders and decisions of the Assessment Coordination Division.

(b) This subpart applies to, but is not limited to, all requests for administrative adjudications concerning such decisions and orders resulting from the division:

(1) Out-of-compliance findings and directives for corrective action;

(2) Termination of reappraisal contracts and plans;

(3) Removal of appraisal companies from the list of registered contractors;

(4) Decisions suspending or revoking professional designations of appraisers and appraisal managers; and

(5) Any impositions of civil penalties.

(c) The provisions of the Arkansas Administrative Procedure Act addressing "licensing" is applicable in situations where division rules refer to "professional designations".

26 CAR § 211-202 Presiding officer {#sec-26-car-211-202 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-202}

26 CAR § 211-202. Presiding officer.

(a) The Chair of the Administrative Hearing Advisory Board (hearing board) shall request the Attorney General to provide a presiding officer to preside at the hearing.

(b) If the Attorney General does not provide a hearing officer the chair may preside or designate other members of the hearing board to preside.

26 CAR § 211-203 Appearances {#sec-26-car-211-203 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-203}

26 CAR § 211-203. Appearances.

(a) Any party appearing in the Assessment Coordination Division proceeding has the right, at his or her own expense, to be represented by counsel.

(b) A party may request a formal hearing, or adjudicatory proceeding, on his or her own behalf or may do so through an attorney.

(c) Any attorney representing a party to an adjudicatory proceeding must file notice of appearance promptly upon being retained.

(d) Service on counsel of record is the equivalent of service on the party represented.

(e) On written motion, served on the party represented and all other parties of record, the presiding officer may grant counsel of record leave to withdraw for good cause shown.

26 CAR § 211-204 Consolidation {#sec-26-car-211-204 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-204}

26 CAR § 211-204. Consolidation.

If there are separate matters that involve similar issues of law or fact, or identical parties, the matters may be consolidated if it appears that consolidation would:

(1) Promote the just, speedy, and inexpensive resolution of the proceedings; and

(2) Not unduly prejudice the rights of a party.

26 CAR § 211-205 Notice to interested parties {#sec-26-car-211-205 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-205}

26 CAR § 211-205. Notice to interested parties.

If it appears that the determination of the rights of parties in a proceeding will necessarily involve a determination of the substantial interests of persons who are not parties, the presiding officer may enter an order requiring that an absent person be:

(1) Notified of the proceeding; and

(2) Given an opportunity to be joined as a party of record.

26 CAR § 211-206 Service of papers {#sec-26-car-211-206 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-206}

26 CAR § 211-206. Service of papers.

Unless the presiding officer otherwise orders, every pleading and every other paper filed for the proceeding, except applications for witness subpoenas and the subpoenas, shall be served on each party or the party's representative at the last address of record.

26 CAR § 211-207 Initiation and notice of hearing {#sec-26-car-211-207 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-207}

26 CAR § 211-207. Initiation and notice of hearing.

(a) An administrative adjudication is initiated by the request of the respondent for a formal hearing and upon which event the Assessment Coordination Division shall issue a notice of hearing.

(b)(1) The notice of hearing will be sent to the respondent by United States mail with:

(A) Return receipt requested; and

(B) Delivery restricted to the named recipient or his or her agent.

(2) Notice shall be sufficient when it is so mailed to the respondent's latest address on file with the division.

(c) Notice will be mailed at least twenty (20) days before the scheduled hearing.

(d) The notice will include a:

(1) Statement of the time, place, and nature of the hearing;

(2) Statement of the legal authority and jurisdiction under which the hearing is to be held; and

(3) Short and plain statement of the matters of fact and law asserted.

26 CAR § 211-208 Motions {#sec-26-car-211-208 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-208}

26 CAR § 211-208. Motions.

(a) All requests for relief will be by motion.

(b) Motions must be in writing or made on the record during a hearing.

(c) A motion must fully state the action requested and the grounds relied upon.

(d)(1) The original written motion will be filed with the Assessment Coordination Division.

(2) When time allows, the other parties may, within seven (7) days of the service of the written motion, file a response in opposition.

(e)(1) The presiding officer may conduct such proceedings and enter such orders as are deemed necessary to address issues raised by the motion.

(2) However, a presiding officer will not enter a dispositive order or decision unless expressly authorized in writing to do so, otherwise the motion must be heard and ruled on by a majority of the members of the Administrative Hearing Board that are present.

26 CAR § 211-209 Answer {#sec-26-car-211-209 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-209}

26 CAR § 211-209. Answer.

(a) The party filing the request for a hearing shall be called the respondent.

(b) A respondent may, but is not required to, file an answer or objection to the action of the Assessment Coordination Division that brought about the request for an adjudicative hearing.

26 CAR § 211-210 Discovery {#sec-26-car-211-210 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-210}

26 CAR § 211-210. Discovery.

(a) Upon written request, the Assessment Coordination Division will provide the information designated in Arkansas Code § 25-15-208(a)(3).

(b) Such requests should be received by the division at least ten (10) days before the scheduled hearing.

26 CAR § 211-211 Continuances {#sec-26-car-211-211 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-211}

26 CAR § 211-211. Continuances.

(a)(1) The presiding officer may grant a continuance of hearing for good cause shown.

(2) Requests for continuances will be made in writing.

(3) The request must state the grounds to be considered and be made as soon as practicable and, except in cases of emergencies, no later than five (5) days prior to the date noticed for the hearing.

(4) In determining whether to grant a continuance, the presiding officer may consider:

(A) Prior continuances;

(B) The interests of all parties;

(C) The likelihood of informal settlements;

(D) The existence of an emergency;

(E) Any objection;

(F) Any applicable time requirement;

(G) The existence of a conflict of the schedules of:

(i) Counsel;

(ii) Parties; or

(iii) Witnesses;

(H) The time limits of the request; and

(I) Other relevant factors.

(b) The presiding officer may require documentation of any grounds for continuance.

26 CAR § 211-212 Hearing procedures {#sec-26-car-211-212 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-212}

26 CAR § 211-212. Hearing procedures.

(a)(1) A simple majority of the Administrative Hearing Board shall constitute a quorum.

(2)(A) The presiding officer:

(i) Presides at the hearing;

(ii) Declares a quorum of the hearing board present or not present; and

(iii) May rule on motions, require briefs, and issue such orders as will ensure the orderly conduct of the proceedings.

(B) Provided, however, any presiding officer shall not enter a dispositive order of the case unless expressly authorized in writing by a majority of the hearing board participating in the hearing to so do.

(b) All objections must be made in a timely manner and stated on the record.

(c) Parties have the right to participate and to be represented by counsel in all hearings or prehearing conferences related to their case.

(d) Subject to terms and conditions prescribed by the Arkansas Administrative Procedure Act, Arkansas Code § 25-15-201 et seq., parties have the right to:

(1) Introduce evidence on issues of material fact;

(2) Cross-examine witnesses as necessary for a full and true disclosure of the facts;

(3) Present evidence in rebuttal; and

(4) Upon request by the hearing board or the presiding officer, may submit briefs and engage in oral argument.

(e) The presiding officer is charged with maintaining the decorum of the hearing and may refuse to admit, or may expel, anyone whose conduct is disorderly.

26 CAR § 211-213 Order of proceedings {#sec-26-car-211-213 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-213}

26 CAR § 211-213. Order of proceedings.

The presiding officer will conduct the hearing in the following manner:

(1) The presiding officer will give an opening statement, briefly describing the nature of the proceedings;

(2) The parties are to be given the opportunity to present opening statements;

(3) The parties will be allowed to present their cases in the sequence determined by the presiding officer;

(4) Each witness must be:

(i) Sworn or affirmed by the presiding officer or the court reporter; and

(ii)(a) Subject to examination and cross-examination as well as questioning by the Administrative Hearing Board.

(b) The presiding officer may limit questioning in a manner consistent with the law; and

(5) When all parties and witnesses have been heard, parties may be given the opportunity to present final arguments.

26 CAR § 211-214 Evidence {#sec-26-car-211-214 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-214}

26 CAR § 211-214. Evidence.

(a) The presiding officer shall rule on the admissibility of evidence and may, when appropriate, take official notice of facts in accordance with all applicable requirements of law.

(b)(1) Stipulation of facts is encouraged.

(2) The Administrative Hearing Board may make a decision based on stipulated facts.

(c)(1) Evidence in the proceeding must be confined to the issues set forth in the hearing notice unless:

(A) The parties waive their right to such notice; or

(B) The presiding officer determines that good cause justifies expansion of the issues.

(2) If the presiding officer decides to admit evidence outside the scope of the notice, over the objection of a party who did not have actual notice of those issues, that party, upon timely request, will receive a continuance sufficient to prepare for the additional issue and to permit amendment of pleadings.

(d)(1) A party seeking admission of an exhibit must provide three (3) copies of each exhibit at the hearing.

(2) The presiding officer must provide the opposing parties with an opportunity to examine the exhibit prior to the ruling on its admissibility.

(3) All exhibits admitted into evidence must be appropriately marked and be made part of the record.

(e)(1) Any party may:

(A) Object to specific evidence; or

(B) Request limits on the scope of the examination or cross-examination.

(2) A brief statement of the grounds upon which it is based shall accompany such an objection.

(3) The objection, the ruling on the objection, and the reasons for the ruling will be noted in the record.

(4) The presiding officer may rule on the objection at the time it is made or may reserve the ruling until the written decision and recommendation of the hearing board.

(f)(1) Whenever evidence is ruled inadmissible, the party offering that evidence may submit an offer of proof on the record.

(2) The party making the offer of proof for excluded oral testimony will briefly summarize the testimony or, with permission of the presiding officer, present the testimony.

(3) If the excluded evidence consists of a document or exhibit, it shall be marked as part of an offer of proof and inserted in the record.

(g)(1) Irrelevant, immaterial, and unduly repetitive evidence will be excluded.

(2) Any other oral or documentary evidence, not privileged, may be received if it is of a type commonly relied upon by reasonably prudent men and women in the conduct of their affairs.

(h) Reasonable inferences. The finder of fact may base its findings of fact upon reasonable inferences derived from other evidence received.

26 CAR § 211-215 Default {#sec-26-car-211-215 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-215}

26 CAR § 211-215. Default.

If a party fails to appear or participate in an administrative adjudication after proper service of notice:

(1) The Assessment Coordination Division may proceed with the hearing; and

(2) The Administrative Hearing Board may render a decision in the absence of the party.

26 CAR § 211-216 Subpoenas {#sec-26-car-211-216 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-216}

26 CAR § 211-216. Subpoenas.

(a)(1) At the request of any party, the Assessment Coordination Division shall issue subpoenas for the attendance of witnesses at the hearing.

(2) The requesting party shall specify whether the witness is also requested to bring documents and reasonably identify said documents.

(b)(1) A subpoena may be served by any person:

(A) Specified by law to serve process; or

(B) Who is not a party and who is eighteen (18) years of age or older.

(2)(A) Delivering a copy to the person named in the subpoena shall make service.

(B) Proof of service may be made by affidavit of the person making service.

(C) The party seeking the subpoena shall have the burden of obtaining service of the process and shall be charged with the responsibility of tendering appropriate mileage fees and witness fees pursuant to Rule 45 of the Arkansas Rules of Civil Procedure.

(D) The witness must be served at least two (2) days prior to the hearing.

(E) For good cause, the division or the presiding officer of the Administrative Hearing Board may authorize the subpoena to be served less than two (2) days before the hearing.

(c) Any motion to quash or limit the subpoena shall:

(1) Be filed with the division; and

(2) State the grounds relied upon.

26 CAR § 211-217 Recording the proceedings {#sec-26-car-211-217 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-217}

26 CAR § 211-217. Recording the proceedings.

(a) The responsibility to record the testimony heard at a hearing is borne by the Assessment Coordination Division.

(b) Upon the filing of a petition for judicial review, the division will provide a verbatim transcript of testimony taken at the hearing.

26 CAR § 211-218 Factors to be considered in imposing sanctions {#sec-26-car-211-218 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-218}

26 CAR § 211-218. Factors to be considered in imposing sanctions.

(a) The Administrative Hearing Board, in its decision, may recommend that the action of the Assessment Coordination Division be sustained or overruled.

(b)(1) The hearing board may recommend sanctions in addition to or different from those imposed initially by the division.

(2) The Director of the Assessment Coordination Division may impose sanctions in addition to or different from those recommended by the hearing board.

(c) The division, the hearing board, and the director may take into consideration all substantial evidence of record, including but not limited to the following:

(1) The nature and degree of the errors and omissions and/or misconduct for which the action is being taken against the:

(A) County;

(B) Contractor; or

(C) Professional designee;

(2) The seriousness and circumstances surrounding the misconduct;

(3) The loss or damage to:

(A) Taxpayers;

(B) Clients; or

(C) Others;

(4) The assurance that taxpayers, clients, and others will be protected from the type of errors, omissions, and misconduct found;

(5) The profit or benefit to the alleged offender;

(6) The avoidance of repetition;

(7) Whether the conduct was:

(A) Deliberate;

(B) Intentional; or

(C) Negligent;

(8) The deterrent effect on others;

(9) The conduct of the alleged offender during the course of the proceeding;

(10) The alleged offender's prior record, including warnings; and

(11) Matters offered by the alleged offender in mitigation or extenuation, except that a claim of disability or impairment resulting from the use of alcohol or drugs may not be considered unless the alleged offender demonstrates that he or she is successfully pursuing in good faith a program of recovery.

26 CAR § 211-219 Final order {#sec-26-car-211-219 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-219}

26 CAR § 211-219. Final order.

(a) The Administrative Hearing Board will submit its recommendations to the Director of the Assessment Coordination Division in writing along with its proposed findings of fact and conclusions of law.

(b)(1) The director will make the final order or decision in writing and serve a copy on the respondent.

(2) The order or decision will include a recitation of facts found based on testimony and other evidence presented and reasonable inferences derived from the evidence pertinent to the issues of the case.

(3) It will also state conclusions of law and directives or other disposition entered against or in favor of the respondent.

(c)(1) The order will be served personally or by certified mail on the respondent.

(2) If counsel represents respondent, service of the order on respondent's counsel shall be deemed service on the respondent.

History

• Codification Notes: This section as promulgated prior to codification into the Code of Arkansas Rules provided as follows:"Adopted 12/20/06" Authorities: Arkansas Code § 25-15-203; Arkansas Code § 26-24-107

Subpart 3

26 CAR § 211-301 Purpose {#sec-26-car-211-301 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-301}

26 CAR § 211-301. Purpose.

Purpose:

(1) To provide a common set of reasonable and prudent standards for acquisition and operation of county-based computerized information systems;

(2) To increase awareness of data security procedures;

(3) To support accurate and reliable computerized recordkeeping; and

(4) To ensure preservation and effective restoration of computerized records and system operation in the event of a significant disaster.

26 CAR § 211-302 Computer systems general policy {#sec-26-car-211-302 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-302}

26 CAR § 211-302. Computer systems general policy.

(a) County elected officials and all county staff are required to comply with the provisions of these standards to the extent that current staffing and available funds allow.

(b) In order to efficiently and reliably conduct county business and serve the public trust, computer information systems are:

(1) Acquired;

(2) Deployed;

(3) Equipped; and

(4) Maintained.

(c)(1) Computer information systems are defined as the collection of fileservers, desktop personal computers, printers, routers, hubs, switches, and wiring commonly referred to as infrastructure.

(2) Systems also include:

(A) File backup and restore capability;

(B) Uninterruptible power supplies;

(C) Interconnection to the internet;

(D) Software including network and desktop operating systems;

(E) Communication; and

(F) Application programs.

(d) The function of the computer information system is to accept, store, preserve, manipulate, and present data for the benefit of the county and taxpayers.

(e) A county computer information system may:

(1) Be contained and operated by and for a single statutory office;

(2) Be shared by multiple offices; or

(3) Serve an entire courthouse.

(f) Elected officials may further restrict, control, or establish policies for their respective offices, but may not disregard the requirements of this policy.

(g)(1) A designated system administrator shall be responsible for managerial control of the computer information system as described herein.

(2) The system administrator need not be fully technically skilled and may delegate technical tasks to:

(A) County employees; or

(B) A vendor under contract with the county.

26 CAR § 211-303 Copyright policy {#sec-26-car-211-303 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-303}

26 CAR § 211-303. Copyright policy.

(a)(1) Counties shall apply strict adherence to software licensing agreements and copyrights.

(2) All elected officials and employees of the county must comply with this policy regardless of being on county time or using county resources.

(b) Making copies of software, operator’s manuals, training materials, or other related property without the express permission of the software author or owner is strictly forbidden.

(c) Reproduction, forwarding, or in any other way republishing or redistributing words, graphics, or other materials must be done only with the permission of the author/owner.

(d) Employees should assume that all materials on the internet are copyrighted unless specific notice states otherwise.

26 CAR § 211-304 Security {#sec-26-car-211-304 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-304}

26 CAR § 211-304. Security.

(a)(1) Reasonable care must be taken to ensure that county records are protected from accidental or mischievous modification or deletion.

(2) Security shall be provided in tiered layers to facilitate protection of the data without sacrificing efficiency in the regular operations of the office.

(b) Office environment.

(1)(A) Public and private areas of the office shall be designated and clearly delineated by use of walls, doors, counters, furniture arrangement, and signs as necessary.

(B) This should allow the public to easily identify and avoid entering into nonpublic areas and the staff to easily observe any violations.

(2) Computer equipment shall be arranged to prevent observation of sensitive information by persons in the designated public area or areas.

(3) If the public is to directly access the county computer system, separate equipment shall be provided in a designated public area.

(4) In such cases, public users should have a password that limits their access to those applications, resources, functions, and information designated for public use.

(5)(A) The public should never be allowed to introduce media (floppy disks, USB memory card, portable devices, etc.) to any county computer.

(B) Computers provided for public use should have media interfaces removed or disabled to prevent the potential for system damage that could arise from foreign media.

(6) No one shall:

(A) Connect with or otherwise use any county computer, modem, network, or other computing resource without proper authorization; or

(B) Assist in, encourage, or conceal any unauthorized use or attempted unauthorized use of any county:

(i) Computer;

(ii) Modem;

(iii) Network; or

(iv) Computing resource.

(c) Desktop.

(1) Each computer workstation in use by the county for accessing county records shall be secured using password protection as described herein.

(2) Access to each computer should be limited by desktop security to allow only those applications, controls, functions, and resources that are applicable to the user and for which the user has permission of the office holder.

(3)(A) After a significant period of user input inactivity, the desktop shall be blanked and locked.

(B) Returning the desktop to interactive operation shall require reentry of the security password.

(d) Network.

(1) Access to the county network shall be limited to authorized users and defined network/internet connections.

(2) The system administrator shall maintain a list of all approved connections and connection methods.

(3) A password as described herein shall be required in order for any user to gain access to the network.

(4) Network access and other privileges shall be limited by network security to allow only those applications, controls, and resources which:

(A) Are applicable to the user; and

(B) The user has permission of the office holder or system administrator.

(5) The system administrator shall maintain a list of all approved users and their assigned privileges and access levels.

(6) Network access and privileges shall be assigned in a manner consistent with the designated role of the elected official or employee.

(7)(A) The use of wireless networks is not encouraged.

(B) If a wireless network is employed in the county computer system, it must conform to a high standard of security and reliability.

(C) Secure wireless networks are typified by customized and suppressed broadcast SSID, 128-bit WEP encryption, and VPN configurations to eliminate rogue access points.

(8) Physical security for the network should include the following for fileservers and workstations where applicable:

(A) Lock the case to prevent unauthorized removal of drives;

(B) Lock fileserver racks to prevent unauthorized access to the drives for removable media;

(C) Maintain servers and network equipment in a locked room to prevent unauthorized access;

(D) Disable the removable media drives via the BIOS; and

(E) Password protect the BIOS to prevent unauthorized access.

(e) Internet.

(1) Internet access may be provided by the county to elected officials and staff members to serve the interests of the county.

(2) Specific internet privileges:

(A) Shall be governed by user ID and password; and

(B) May be limited by county policy or the relevant elected official.

(3)(A) The use of email and instant messaging services may be provided by the county for business purposes.

(B) These services are not a job perk and not for private, personal use.

(4) An elected official may grant limited personal use of emails in the interest of reducing the need for staff members to be away from county duties.

(5) Users are forbidden from using the county’s computer system for:

(A) Chain letters;

(B) Charitable endeavors;

(C) Private business activities;

(D) Political activities; or

(E) Amusement/entertainment purposes.

(6)(A) Email messages generated or received on the county system are considered public property and subject to the Freedom of Information Act of 1967, Arkansas Code § 25-19-101 et seq.

(B) They may be viewed by others including the system supervisor and should not be considered private.

(7) Downloading information to a county computer is allowable only for business purposes and may be regulated by the system administrator by policy or electronic control.

(8)(A) Using the county computer system to visit nonbusiness websites is not allowed, except to further the interests of the county.

(B) Access to specific websites may be regulated by the system administrator by policy or electronic control.

(9) The system administrator may block any website in the interest of preserving the integrity of the county computing system.

(f) Application.

(1) Computer application programs may be acquired by the county from time to time to facilitate operations of the staff in the creation and application of computerized information.

(2) Computer application programs should be evaluated prior to purchase for:

(A) Suitability to the task;

(B) Compliance with state and county laws and rules;

(C) Compatibility with the county computing system;

(D) Consistency with county security policies; and

(E) Other office efficiency and effectiveness considerations.

(3)(A) Application programs shall have internally configurable levels of security, allowing designated users to access the features required for their work while preventing access to those not so designated.

(B) Program security shall be sufficiently detailed as to accommodate multiple tiers of access ranging from the administrative and supervisory level down to the public user.

(4) Program access levels shall be:

(A) Associated with the user’s login ID; and

(B) Protected by a password as described herein.

(5) Data managed by an application program shall be configured and secured to prevent access or modification by any means external to the core application.

(6)(A) Application programs shall maintain a log file of changes made to the data.

(B) This file shall contain sufficient detail to identify the record, date, time, user ID, and nature of the change or changes made.

(C) The log file shall be readily available to users having administrative privileges.

(7)(A) Application providers should provide notification to the county of any changes being made in the program.

(B) For changes that could alter the application data or a critical function of the program, the notice should occur within five (5) working days of the change.

(C) For noncritical updates, a thirty-day notice is sufficient.

(g) Passwords.

(1) A user ID and password shall be required in order to gain access to any computer, network, application, or other resource that is part of the county computer system.

(2) Passwords shall:

(A) Be governed in all cases except as noted herein;

(B) Be unique to each user and contain no less than five (5) characters;

(C) Be changed not less than annually;

(D) Not be shared or revealed to anyone except the authorized user;

(E) Not be common words, especially those which relate to the user such as spouse/child/pet name, nickname, hobby, etc.; and

(F) Govern the specific rights, privileges, and access for each individual user.

(3)(A) Access privileges should be revoked and accounts locked for any employee or elected official within thirty (30) days of terminating employment with the county.

(B) If termination is involuntary, accounts should be locked within two (2) working days.

(4) In keeping with separation of powers, the elected official for a given office may institute a different policy for passwords so long as it:

(A) Addresses each of the points listed above;

(B) Is documented in writing; and

(C) Is made available to each staff member and to the auditors.

(5)(A) Users shall log out of their computer whenever they expect to be away from their computer or out of the office for any extended period of time.

(B) This would include out-of-the-office breaks, lunch, etc.

(C) Entry of the password shall be required in order to reaccess the system.

(6) An inactivity time-out, no greater than thirty (30) minutes, shall be used and require entry of the password in order to resume system operation.

(7)(A) Failed attempts to access the system with an expired or invalid user ID and password will result in the account being locked by the system.

(B) The period of time for the lockout shall be set by office policy and is recommended to be not less than thirty (30) minutes.

(8) A record of failed login attempts should be available to the system administrator on request.

(h) Virus/spam protection.

(1) Each workstation or other system connected to the county computer network shall employ and maintain up-to-date antivirus and antispam software.

(2)(A) Users are discouraged from downloading files from any internet website or opening attachments to emails unless from a known contact.

(B) The system administrator may block access or remove privileges from users that violate this policy and endanger the function of the system.

(3) Except as required for county business, users are prohibited from copying materials or information to or from the county system using:

(A) Floppy disc;

(B) CD;

(C) DVD;

(D) Tape;

(E) USB memory card; or

(F) Any other medium.

History

• Codification Notes: “BIOS” means basic input/output system."CD" means compact disc."DVD" means digital video disc."ID" means identity."SSID" means service set identifier."USB" means universal serial bus."VPN" means virtual private network."WEP" means wired equivalent privacy. Authority: Arkansas Code § 26-24-107

26 CAR § 211-305 Access {#sec-26-car-211-305 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-305}

26 CAR § 211-305. Access.

(a) Office staff.

(1) It is understood that elected officials and office staff will view, edit, add, and delete records from the county computer system in the normal course of their work.

(2) Specific rights and privileges will be granted to do so in accordance with this document and published office policies.

(3) Violation of this and additional policies may result in a user losing access to the computer system.

(b) Contractors.

(1) It is understood that contractors may from time to time be required to access the county computer system in the performance of their contracted work.

(2) Access to the county computer system by the contractor shall be described in the agreement with respect to:

(A) Connected devices;

(B) Security level;

(C) Timing;

(D) Duties;

(E) Privileges;

(F) Access methods; and

(G) Schedules.

(3) Records may be added, edited, and deleted by the contractor in accordance with requirements and restrictions of the governing agreement between the county and the contractor.

(c) Public users.

(1) It is understood that public users may, in the course of reviewing county records, use the county computer system.

(2) Records may not be added, edited, or deleted by any public user.

(3) The desktop, network, and application security collectively shall prevent any record modification by a public user.

(4)(A) Public users shall not introduce foreign media such as floppy disks, CDs, DVDs, USB memory devices, or any other media to the county system.

(B) This practice shall be prohibited by published policy and system configuration.

(5)(A) The county may provide blank media for the purpose of transferring files from the computer system for public consumption.

(B) Blank media should be approved in advance by the system administrator.

History

• Codification Notes: “CD” means compact disc."DVD" means digital video disc."USB" means universal serial bus. Authority: Arkansas Code § 26-24-107

26 CAR § 211-306 Integrity {#sec-26-car-211-306 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-306}

26 CAR § 211-306. Integrity.

(a) Desktop.

(1) Users should be aware that poor PC performance can have a detrimental effect on the integrity of computer data.

(2) Users should report incidents of computer lockups, freezes, and other unusual behavior to the elected official or system administrator.

(3) Computers that regularly exhibit these symptoms should be repaired or replaced in order to maintain data integrity.

(b) Network.

(1) Improperly functioning servers, drives, switches, hubs, etc., can corrupt information and destroy county data.

(2) Networks must be regularly observed for proper function and performance.

(3) Networks exhibiting poor performance and/or significant downtime should be repaired or replaced in order to maintain data integrity.

(c) Internet.

(1) Many systems make use of the internet for connectivity between satellite offices and/or access by contractors.

(2)(A) Poor internet performance can adversely affect data entry and jeopardize county records.

(B) They also delay customer service operations and diminish taxpayer confidence.

(3) Internet connections that are found to function poorly should be repaired or replaced in order to:

(A) Maintain data integrity; and

(B) Facilitate efficient customer service.

(d) Application.

(1)(A) Application programs shall provide limits to user input in order to reduce operator entry errors.

(B) These should prevent improper data types such as:

(i) Text in numeric fields;

(ii) Incomplete filling of a date field; and

(iii) Invalid entries for which a limited set of correct choices is defined.

(2)(A) Due to the requirement for flexibility in data entry, certain fields may not be suitable for validation.

(B) The system administrator shall maintain a list of fields and reason for which they are exempt from data input validation.

(3)(A) Except as noted herein, fields that are automatically populated in serial fashion, such as check numbers, receipt numbers, change numbers, etc., shall be validated as to avoid duplication or ambiguity between records.

(B) In any case where a unique serialized value is required and has been overridden by the authority of the elected official, a permanent written record must be kept and provided upon request of auditors.

(4)(A) Application providers shall supply instruction manuals containing sufficient information to allow users to effectively operate the program.

(B) Manuals should be updated or subsidized by update bulletins to reflect program changes made from time to time.

(5) Application providers shall offer training in all aspects of program operation and follow-up training for changes and updates in program function.

(6) Application providers shall supply a user assistance help line to answer questions and address concerns which arise in the use of the programs by the county.

History

• Codification Notes: “PC” means personal computer. Authority: Arkansas Code § 26-24-107

26 CAR § 211-307 Data storage {#sec-26-car-211-307 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-307}

26 CAR § 211-307. Data storage.

(a) Active data.

(1) Active data is defined as information that is:

(A) In current use; and

(B) Subject to review or modification on a regular basis.

(2)(A) Active data must be stored on a reliable fileserver drive whenever possible.

(B) Data that is regularly stored on a computer workstation hard drive should be copied to a secure location on the network fileserver on a regular basis.

(3) Active data should be backed up no less than once per week and preferably once per day.

(4) Active data backups should be kept on file for each day for at least a two-week period.

(b) Data archive.

(1) Archival data is made up of records that are essentially static, maintained for historical reference, but no longer subject to change.

(2)(A) An archival backup should be created each year representing the year-end position of the records.

(B) Archival backups should be stored indefinitely.

(c) Backup and restoration.

(1) Data backups may be made:

(A) On CD;

(B) On DVD;

(C) On high density tape; or

(D) By remote electronic means.

(2) Backups shall be stored in a secure location, preferably at some distance from the courthouse, such as a:

(A) Bank vault;

(B) Remote data processing center; or

(C) Remote data backup facility.

(3) Data backups should be validated at least once monthly to assure their integrity and completeness.

(4)(A) Backup validation should confirm the quality of the backup dataset.

(B) Validation should at minimum confirm file names, sizes, and dates for all critical files.

(5) All errors observed in the backup procedure or backup validation shall be reported to the elected official and/or system administrator.

History

• Codification Notes: “CD” means compact disc."DVD" means digital video disc. Authority: Arkansas Code § 26-24-107

26 CAR § 211-308 Disaster preparedness {#sec-26-car-211-308 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-308}

26 CAR § 211-308. Disaster preparedness.

(a) Preparation.

(1) The elected official and/or system administrator shall develop a document that shall be used to prepare and, if necessary, respond to potential disasters that adversely affect the function or integrity of the county computer information system.

(2) The plan shall identify critical elements and resources and provide for securing significant assets and taking steps to restore functional operation of the county computer information system within one (1) week of the disaster.

(3) The county shall maintain sufficient insurance to assure the replacement or restoration of computer equipment, data, and service in the event of:

(A) Fire;

(B) Theft;

(C) Vandalism;

(D) Terrorism; or

(E) An act of God.

(4) The plan should outline the steps to restoring system function beginning with analyzing the situation and selecting team members, either employees or contractors, to carry out each step.

(5) The plan should be flexible in order to accommodate the unknown aspect of the potential disaster and lack of availability of one (1) or more staff members or other critical resources.

(6) The plan should be reviewed and updated periodically, not less than biannually, to reflect changes in:

(A) Organization;

(B) Staffing;

(C) Methods;

(D) Technology; and

(E) Priorities.

(b) Personnel.

(1) A list of users shall be maintained including a job description, security level, and contact information for each.

(2) Personnel should be cross trained in all routine system functions to allow continued or restored system operation in the absence of one (1) or more users from their regular job functions.

(c) Facilities.

(1) A list of facility requirements for temporary operation of the computer information system shall be developed and kept by the county.

(2) Potential alternate facilities should be identified and listed for possible temporary use in the days following a disaster that renders the regular facility unusable.

(d) Equipment.

(1) A list of equipment, critical for operation of the computerized information system, shall be kept by the county along with detailed specifications.

(2) An inventory of all information system equipment shall be kept on an office-by-office or countywide basis.

(3) Contact information for critical equipment suppliers shall be kept and updated not less than annually.

(e) Data.

(1)(A) A list of datasets that are critical to regular county operations shall be kept by the county.

(B) These shall include both current and archived records of all data types.

(2) Contact information for critical information system suppliers shall be kept and updated not less than annually.

(f) Applications.

(1) A list of operating system and application software that are critical to regular county operations shall be kept by the county.

(2) Contact information for critical application program suppliers shall be kept and updated not less than annually.

26 CAR § 211-309 System maintenance {#sec-26-car-211-309 omnilex-key=us-ar-regs-official--title-26-part-211--26 CAR § 211-309}

26 CAR § 211-309. System maintenance.

(a) Definition.

(1) System maintenance consists of regular or special actions taken to ensure the proper operation of the computerized information system.

(2) Typical system maintenance tasks include administering user access accounts for:

(A) Passwords;

(B) Privileges;

(C) Data access; and

(D) Internet access.

(3) System maintenance includes:

(A) Observation and application of system performance including but not limited to:

(i) Speed;

(ii) Memory; and

(iii) File storage capacity;

(B) Protection from virus, spam, and other electronic threats; and

(C) Managing the backup system.

(4) System maintenance may also include:

(A) Communication with hardware, software, and operating system vendors; and

(B) Application of new or replacement equipment, programs, updates, and patches that are necessary to maintain proper system performance.

(b) Methods. System maintenance may be:

(1) Performed by the system administrator;

(2) Delegated to county staff; or

(3) Contracted to a qualified computer systems vendor.

(c) Contracts.

(1) Obtaining computer system support from an outside vendor requires:

(A) Evaluation of the vendor as described herein; and

(B) A written contract.

(2) Contracts should identify the scope and any limitations of the service provided as well as:

(A) Hours of operation;

(B) Methods of contact and making requests for service; and

(C) Predicted response times.

(3) Contracts should define:

(A) The methods and means by which the contractor shall access the county computer information system; and

(B) Any restrictions imposed by the county.

(4) The county may require the contractor to provide proof of E&O insurance or other proof of financial stability to prevent significant loss to the county in the event of employee error or misdeed arising from computer system access.

(d) Vendor requirements.

(1) The county should have a policy setting forth minimum qualifications for prospective computer system vendors including:

(A) Product applicability to task;

(B) Professional experience and certifications;

(C) Arkansas-based experience in the area for which a contract is sought;

(D) Age and financial stability;

(E) Staff size and capacity;

(F) Professional references of county offices of similar needs; and

(G) Vendor policies with respect to support.

(2)(A) In cases where a vendor is expected to play a large part in disaster recovery, an agreement between the county and the contractor is suggested.

(B) This agreement should be renewed annually and include the:

(i) Role of the contractor;

(ii) Chain of command; and

(iii) Line of authority to initiate a recovery effort.

History

• Codification Notes: “E&O” means errors and omissions. Authority: Arkansas Code § 26-24-107