Security

City Innovate partners with AWS GovCloud for secure cloud solutions, to give our government customers the flexibility to architect secure cloud solutions that comply with the FedRAMP High baseline; the DOJ’s Criminal Justice Information Systems (CJIS) Security Policy; U.S. International Traffic in Arms Regulations (ITAR); Export Administration Regulations (EAR); Department of Defense (DoD) Cloud Computing Security Requirements Guide (SRG) for Impact Levels 2, 4 and 5; FIPS 140-2; IRS-1075; and other compliance regimes.

AWS GovCloud is operated by employees who are U.S. citizens on U.S. soil. AWS GovCloud (US) is only accessible to U.S. entities and root account holders who pass a screening process.

As required by NIST-171, a System Security Plan (SSP) that is available upon request.

City Innovate is hosted within the AWS GovCloud regions in the United States. AWS GovCloud (US) is FedRAMP High, DoD IL2, 4, 5 and only allows access to US citizens.

The City Innovate platform can integrate with your agency’s Azure Active Directory Single Sign On or through our application authentication. Application authentication uses credentials that meet NIST standards and are one-way hashed per the OWASP recommendations.

As required by the California State Administration Manual (SAM), CI maintains a Technology Recovery Plan (TRP) that is available upon request.

The City Innovate platform and APIs utilize redundant data centers and redundant servers to provide maximum uptime for our customers. Our published availability is 99.9% and we have exceeded this target for the last year.

City Innovate has designed failover to support several scenarios:

• Datacenter loss – in the event of a datacenter loss, a redundant datacenter will immediately take over with minimal service interruption.
• Database loss – if a database becomes unavailable and cannot fail over to another datacenter, then the most recent backups will be utilized to recover data to a new datacenter. AWS RDS offers continuous backup and point-in-time recovery (PITR). Additionally, snapshots are taken every 30 mins and retained for 7 years.
• Image storage loss – images are stored on a system that provides 99.999999999% durability.