California Code of Regulations › Title 11 - Law › Division 1 - Attorney General › Chapter 18 - Electronic Recording Delivery System › Article 9 - Audits and Oversight › Section 999.219 - Local Inspection

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) Local
				  inspections by a representative of the ERDS Program are required to meet the ongoing
				  oversight requirements for an existing certified Single-County ERDS or Multi-County
				  ERDS. A local inspection shall be performed of all Single-County ERDS and the Lead
				  County of a Multi-County ERDS upon initial certification and thereafter biennially.
				  A local inspection shall be performed of a Sub-County of a Multi-County ERDS upon
				  initial certification and thereafter on a randomly scheduled basis.
(b) An ERDS Program representative shall contact
				  the County Recorder, or their representative, to schedule an on-site inspection of
				  the ERDS and all associated hardware, software, workstations, and network devices
				  comprising the ERDS, including those located at the offices of Authorized Submitters
				  and/or their Agents, on a mutually agreed upon date.
(c) The ERDS Program representative shall verify
				  all of the following during the local inspection:
(1) An auditable log is being maintained for two
				  (2) years or a computer security audit has taken place within the last two (2)
				  years.
(2) Documentation has been
				  maintained and distributed in cases where an incident has been reported.
(3) Access request and inventory reports are
				  maintained.
(4) Computer Security
				  Auditor reports that reference all of the following are being maintained for a
				  period of two (2) years: a list of all Secure Access users; confirmation that ERDS
				  operating procedures and/or features within the ERDS design have been incorporated
				  in order to restrict the content to meet the requirements of this chapter; security
				  of the system, including the vulnerability of an ERDS to fraud or penetration;
				  results of testing of the system's protections against fraud or intrusion, including
				  security testing and penetration studies; recommendations for additional precautions
				  needed to ensure that the system is secure; transmission of reports and responses to
				  recommendations to the Board of Supervisors, the County Recorder, the County
				  District Attorney, and the ERDS Program.
(5) For a Single-County ERDS, that a copy of the
				  following is on file: the County's System Certificate of Operation; the County
				  Resolution to establish the ERDS; any applicable county policies and procedures; a
				  signed Statement of Understanding form #ERDS 0011; a list of all Secure Access
				  users; a signed Acknowledgement of Responsibilities Form #ERDS 0012; a completed
				  Change of ERDS Role form #ERDS 0008 for individuals that have changed an ERDS role;
				  the Computer Security Auditor ERDS certificate of approval and contract; the letter
				  of deposit to an approved escrow facility; and the Certified Vendor of ERDS Software
				  certificate of approval and the contract, if any; and a copy of any certificate of
				  insurance required pursuant to Section
				  999.165, subdivision (e).
(6) For a Multi-County ERDS, that a copy of the
				  following is on file: the contract or agreement with the other county(ies); a list
				  of all Secure Access users; a signed Acknowledgement of Responsibilities form #ERDS
				  0012; a completed Change of ERDS Role form #ERDS 0008 for individuals that have
				  changed an ERDS role; all Sub-County resolutions to participate in the ERDS; the
				  Application for Sub-County System Certification form #ERDS 0001B; all Sub-County
				  Recorder signed Statement of Understanding forms #ERDS 0011; and any certificate of
				  insurance required pursuant to Section
				  999.165, subdivision
				  (e).