Hello. It looks like you’re using an ad blocker that may prevent our website from working properly. To receive the best experience possible, please make sure any blockers are switched off and refresh the page.
If you have any questions or need help you can email us
Small Business
The Neat Mobile App provides small business owners with the ability to connect with their bank and credit card accounts, create and send invoices, and receive…
Jul. 21, 2022
The Neat Company announced the launch of a powerful iOS mobile app that complements its award-winning financial management platform. The Neat Mobile App provides small business owners with the ability to connect with their bank and credit card accounts, create and send invoices, and receive online payments from customers right from an iPhone or iPad. In addition, the Neat Mobile App can be utilized to capture and search for financial documents such as receipts, invoices, and statements while on the go.
As small business owners find themselves working in various locations and needing to streamline day-to-day activities, Neat lets them take control of their bookkeeping practices. Neat’s all-in-one financial management platform makes it possible for business owners — with or without accounting expertise — to quickly and confidently manage their books and keep business finances in order.
“Based on my past experience as a small business owner, I understand how critical it is to keep finances current,” explained Garrett Baird, President & CEO of The Neat Company. “With spreadsheets and dated software packages, I found bookkeeping difficult to do and almost impossible if I wasn’t at my desk. It took time away from growing my business, and I worried that I had surely done something wrong. Neat is acting on the problems I saw during those years by overcoming the limitations of homegrown spreadsheets and making the process truly mobile. Neat’s platform is comprehensive yet easy-to-use, and accessible from wherever a small businessperson needs to be. It will save them time, avoid headaches, and save money by getting books done faster and more efficiently right from your iPhone.”
The Neat Mobile App is built to mimic Neat’s user-friendly, intuitive, and versatile web experience, showcasing its simplicity while powerfully delivering needed help.
Neat’s all-mobile functionality includes:
The Neat Mobile App is now available for download from the Apple Store. The Neat financial management platform can be tried for free for 14 days. Users then pay only $289.99 for a yearly subscription ($24/month) with a 30-day money-back guarantee. A month to month subscription is also available at $29 per month.
Small Business
Small Business
Small Business
Small Business
Jason Bramwell
Subscribe for free and get unlimited access to all CPA Practice Advisor content
Subscribe
CPAPA is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors.
© 2022 Firmworks, LLC. All rights reserved
An information security management system (ISMS) is a set of policies and procedures for systematically managing an organization’s sensitive data. The goal of an ISMS is to minimize risk and ensure business continuity by proactively limiting the impact of a security breach.
An ISMS typically addresses employee behavior and processes as well as data and technology. It can be targeted toward a particular type of data, such as customer data, or it can be implemented in a comprehensive way that becomes part of the company’s culture.
An ISMS provides a systematic approach for managing the information security of an organization. Information security encompasses certain broad policies that control and manage security risk levels across an organization.
ISO/IEC 27001 is the international standard for information security and for creating an ISMS. Jointly published by the International Organization for Standardization and the International Electrotechnical Commission, the standard doesn’t mandate specific actions but includes suggestions for documentation, internal audits, continual improvement, and corrective and preventive action. To become ISO 27001 certified, an organization requires an ISMS that identifies the organizational assets and provides the following assessment:
The goal of an ISMS isn’t necessarily to maximize information security, but rather to reach an organization’s desired level of information security. Depending on the specific needs of the industry, these levels of control may vary. For example, since healthcare is a highly regulated field, a healthcare organization may develop a system to ensure sensitive patient data is fully protected.
ISMS provides a holistic approach to managing the information systems within an organization. This offers numerous benefits, some of which are highlighted below.
The ISO 27001, along with the ISO 27002 standards, offers best-practice guidelines for setting up an ISMS. The following is a checklist of best practices to consider before investing in an ISMS:
Understand business needs. Before executing an ISMS, it’s important for organizations to get a bird’s eye view of the business operations, tools and information security management systems to understand the business and security requirements. It also helps to study how the ISO 27001 framework can help with data protection and the individuals who will be responsible for executing the ISMS.
Establish an information security policy. Having an information security policy in place before setting up an ISMS is beneficial, as it can help an organization discover the weak points of the policy. The security policy should typically provide a general overview of the current security controls within an organization.
Monitor data access. Companies must monitor their access control policies to ensure only authorized individuals are gaining access to sensitive information. This monitoring should observe who is accessing the data, when and from where. Besides monitoring data access, companies should also track logins and authentications and keep a record of them for further investigation.
Conduct security awareness training. All employees should receive regular security awareness training. The training should introduce users to the evolving threat landscape, the common data vulnerabilities surrounding information systems, and mitigation and prevention techniques to protect data from being compromised.
Secure devices. Protect all organizational devices from physical damage and tampering by taking security measures to ward off hacking attempts. Tools including Google Workspace and Office 365 should be installed on all devices, as they offer built-in device security.
Encrypt data. Encryption prevents unauthorized access and is the best form of defense against security threats. All organizational data should be encrypted before setting up an ISMS, as it will prevent any unauthorized attempts to sabotage critical data.
Back up data. Backups play a key role in preventing data loss and should be a part of a company’s security policy before setting up an ISMS. Besides regular backups, the location and frequency of the backups should be planned out. Organizations should also design a plan to keep the backups secure, which should apply to both on-premises and cloud backups.
Conduct an internal security audit. An internal security audit should be conducted before executing an ISMS. Internal audits are a great way to for organizations to gain visibility over their security systems, software and devices, as they can identify and fix security loopholes before executing an ISMS.
There are various ways to set up an ISMS. Most organizations either follow a plan-do-check-act process or study the ISO 27001 international security standard which effectively details the requirements for an ISMS.
The following steps illustrate how an ISMS should be implemented:
When it comes to safeguarding information and cybersecurity assets, a unilateral approach isn’t sufficient. Learn about the different types of cybersecurity controls and how to place them.
Function as a service (FaaS) is a cloud computing model that enables cloud customers to develop applications and deploy functionalities and only be charged when the functionality executes.
East-west traffic, in a networking context, is the transfer of data packets from server to server within a data center.
Citizens Broadband Radio Service, or CBRS, is the set of operational rules given to a slice of the shared wireless spectrum and …
Private 5G is wireless network technology that delivers cellular connectivity for private network use cases, such as private …
A time-based one-time password (TOTP) is a temporary passcode generated by an algorithm that uses the current time of day as one …
The zero-trust security model is a cybersecurity approach that denies access to an enterprise’s digital resources by default and …
A RAT (remote access Trojan) is malware an attacker uses to gain full administrative privileges and remote control of a target …
Organizational goals are strategic objectives that a company’s management establishes to outline expected outcomes and guide …
Spatial computing broadly characterizes the processes and tools used to capture, process and interact with 3D data.
User experience (UX) design is the process and practice used to design and implement a product that will provide positive and …
Talent acquisition is the strategic process employers use to analyze their long-term talent needs in the context of business …
Employee retention is the organizational goal of keeping productive and talented workers and reducing turnover by fostering a …
A hybrid work model is a workforce structure that includes employees who work remotely and those who work on site, in a company’s…
CRM (customer relationship management) analytics comprises all of the programming that analyzes data about customers and presents…
Conversational marketing is marketing that engages customers through dialogue.
Digital marketing is a general term for any effort by a company to connect with customers through electronic technology.
All Rights Reserved, Copyright 1999 – 2022, TechTarget
Privacy Policy
Cookie Preferences
Do Not Sell My Personal Info
Eligible government agencies can use our free one-on-one inquiry service.
With one call or click you can get a personalized answer from one of our trusted attorneys, policy consultants, or finance experts!
Ask MRSC
VIEW MORE
VIEW MORE
VIEW MORE
Data as Records: PRA Disclosure of Database Information November 14, 2022
How Can Local Governments Celebrate the Holidays? November 9, 2022
Care and Feeding of Your Library Collection Policy November 7, 2022
VIEW MORE BLOG POSTS
MRSC E-Newsletters
MRSC Insight Blog
MRSC Quarterly Print Newsletter
Local Governments In The News
Landlord/Seller Disclosure Requirements
VIEW MORE
Upcoming Trainings – Attend our live webinars, virtual workshops, and in-person trainings to learn about key local government issues!
Digging Into Public Works – In-person regional forums and training resources for public works staff and local contractors
VIEW MORE
On-Demand Webinars – Watch pre-recorded versions of our recent webinars, at your own convenience.
PRA/OPMA E-Learning Courses – Free video courses for city/town elected officials on the Public Records Act (PRA) and Open Public Meetings Act (OPMA).
VIEW TRAINING CALENDAR
www.mrscrosters.org
VIEW MORE
VIEW MORE
Public Records Act
Open Public Meetings Act
Purchasing and Contracting
Budgeting
American Rescue Plan Act (ARPA)
Coronavirus (COVID-19) Resources
VIEW MORE
Economic Development
Environment
Finance
Governance
Legal
Management
VIEW MORE
Parks and Recreation
Personnel
Planning
Public Safety
Public Works and Utilities
Transportation
VIEW MORE
November 14, 2022 by Sarah Doar
Category: Public Records Act
One of the more seemingly complex public records request types are those that seek information held within a database. There are several questions we are often asked, and I hope my answers below will assist in unravelling this digital conundrum.
Are databases even public records at all?
First, let us agree on a few terms. A database is an organized collection of data stored and accessed electronically. In turn, data or datum, are the individual pieces of information stored within the database.
A database management system (DMS) is the visual interface that organizes the data, translates the data from zeros and ones, and allows users to access and view the data in a manner they can understand. A DMS can be incredibly sophisticated, with multiple databases of information and the ability to link, manipulate, and analyze data, or it can be a simple Excel spreadsheet. Both are database management systems.
What would be the analog version? For those of a certain age, a database management system is roughly the same as a library card catalog. Each card is a piece of data, all the cards together are the database, and the cabinet that keeps everything organized, cross-referenced, and accessible to library patrons is the DMS. Without the cabinet, you’d be faced with a pile of cards and no way to find what you are looking for.
Let us apply this analogy now to the Public Records Act, Chapter 42.56 RCW (PRA). The PRA defines a “public record” as:
any writing containing information relating to the conduct of government or the performance of any governmental or proprietary function prepared, owned, used, or retained by any state or local agency regardless of physical form or characteristics.
Each of those cards in the card catalogue is a writing that contains information, and it happens to be in paper form. For databases, each piece of data in the DMS is a writing that contains information, and it happens to be in digital form.
So, if that piece of data in the database pertains to the conduct of government and it was prepared, owned, used, or retained by the local agency, then, yes, it is a public record. But it is the data itself, and not the database management system, that is the public record.
How do you disclose data in a database?
Under the PRA, we are obligated to disclose the data in the database but not necessarily to provide unfettered access to that data. At the same time, we cannot somehow turn over a bunch of zeros and ones and think that we have met our obligations under the PRA — we must provide the data in a form that the requestor can actually read.
There are several ways to do this. Some jurisdictions simply provide public access to the relevant DMS, although access is limited to view only. Examples of this include a county assessor’s property tax database, a city’s planning and development permit records online portal, or a clerk’s website that posts all the council’s agendas and meeting minutes.
However, in many situations, the DMS is a part of a public employee’s daily workflow, one which is constantly being updated with new activities and may contain information that is subject to an exemption or prohibition against disclosure such that is inappropriate to provide the public with unfettered access.
If you are lucky, your DMS allows you to run reports that extract the responsive data and present it in a form that you are then able to provide to the requestor. Alternatively, you have to consider providing customized access to the database that will limit the requestor’s access to only the data they are entitled to.
Isn’t running a report creating a new record?
We do consider the results of extracting data from a database into a new spreadsheet or word document to be the creation of a new record that is itself fully subject to the PRA. But sometimes, especially when it comes to databases which you often cannot provide unrestricted public access to, that approach makes the most practical sense.
Creation of a new record is not addressed in the Public Records Act, but there is case law that states agencies are not under an obligation to create records for a requestor. See Citizens For Fair Share v. State Dep't of Corrections, 117 Wn. App. 411, 435, 72 P.3d 206, 219 (2003) ("the law does not require creation of nonexistent records in response to a public records disclosure request”).
The Attorney General PRA Model Rule (WAC 44-14-04003(6)) states that an agency has discretion whether to create a public record:
. . . The decision to create a new record is left to the discretion of the agency. With respect to databases, for example, there is not always a simple dichotomy between producing an existing record and creating a new record. In addition, an agency may decide to provide a customized service and if so, assess a customized service charge for the actual costs of staff technology expertise needed to prepare data compilations, or when such customized access services are not used by the agency for other business purposes. RCW 42.56.120.
If the agency is considering creating a new record instead of disclosing the underlying records, or creating new records from a database, it should obtain the consent of the requestor to ensure that the requestor is not actually seeking the underlying records, and describe any customized service charges that may apply.
According to RCW 42.56.100, your agency must provide the “fullest assistance” to inquirers requesting public records, but this does not mean your agency must create a new record upon request. That being said, if your database is itself a compilation of independent records, such as scanned and uploaded records, I would consider the downloading of a previously scanned record akin to making a copy and not generating a new record.
What if our DMS is not set up to allow for the extraction of data, such as to run reports?
You may need to get creative. One brute force method is to take screenshots of the DMS displaying the requested information, although this would not work if the requestor is seeking the data in its native format, nor would it work for a visually impaired requestor. Your other option is to consider providing customized access.
What is customized access, and can we charge for that?
In addition to the regular copying charges that an agency can impose under RCW 42.56.120, paragraph (3) allows an agency to include a “customized service charge.”
A customized service charge may only be imposed if the agency estimates that the request would require the use of information technology expertise to prepare data compilations, or provide customized electronic access services when such compilations and customized access services are not used by the agency for other agency purposes.
Examples may include working with your software developer or IT staff to run a new, customized report that extracts data from the database, developing a new user interface that has restricted functionality, or purchasing a new user software license to allow the requestor direct access.
What if we don’t control the database or database management system?
A record is a public record if it is “prepared, owned, used, OR retained” by the public agency, so even if the agency no longer has control of the record — i.e., did not “retain” the record — if the agency created the record or used the record in the course of public business, it is a public record subject to disclosure.
I am aware of several situations where local agencies access and/or upload information to databases controlled by other private or public entities. Regardless of where that data now lives, local agencies are obligated to make it available to the public upon request. It is not enough to simply direct requestors to the third party.
Any agency that uses third-party databases should review the contract or terms of service for those databases to ensure that the agency has a process for requesting copies of records contained in the database from the vendor.
No. While many agencies make records available online in the hope that members of the public will be able to self-serve and access the records they seek without submitting a records request, once an individual does submit a request, all of an agency’s obligations under the PRA come into effect.
In describing the specific methods by which an agency can respond to a public records request, RCW 42.56.520(1)(b) authorizes the agency to provide “an internet address and link on the agency’s website to the specific records requested.” (Emphasis added). Providing a link to a database that requires the requestor perform the search themselves does not satisfy this obligation. Of course, an agency can inform the requestor that, in the future, they can search the public database themselves and avoid any delay in receiving a response.
Wow, it can get pretty complicated. What if we need more guidance?
You are not alone! MRSC has lots of information available on our Public Records Act topic pages. If your question is not addressed there or you wish to contact one of our consultants directly, eligible government agencies can Ask MRSC.
MRSC is a private nonprofit organization serving local governments in Washington State. Eligible government agencies in Washington State may use our free, one-on-one Ask MRSC service to get answers to legal, policy, or financial questions.
Sarah Doar joined MRSC in September 2018.
Most recently, she served as a Civil Deputy Prosecuting Attorney for Island County. At Island County, Sarah advised on many aspects of government business, including compliance with public record and opening meeting laws. She also defended the County in Growth Management Act and Land Use litigation. Prior to moving to Washington, Sarah practiced land use, environmental, and appellate law in Florida for over eight years.
Sarah holds a B.A. in Biology from Case Western Reserve University and a J.D. with a certificate in environmental and land use law from Florida State University College of Law.
VIEW ALL POSTS BY Sarah Doar
Receive MRSC's latest articles and analysis through our Weekly Insights e-newsletter.
BLOG
Court of Appeals Reverses Large Public Records Act Penalty Imposed on University of Washington
IN THE NEWS
County auditors have received an unprecedented amount of public records requests since the 2020 election, and it’s likely just the beginning
ASK MRSC
If a staff member installs and uses a cloud-based communications tool like Microsoft Teams on their personal cell phone, is it possible…
PUBLICATIONS
Knowing the Territory – Basic Legal Guidelines for Washington City, County and Special District Officials
TOPICS
Managing Electronic Records
Subscribe to E-Newsletters
MRSC Insight Blog
LEARN MORE ABOUT NEWSLETTERS
www.mrscrosters.org
VIEW MORE
Alpharetta, GA and Toronto, ON, Canada, December 16, 2021 – Agilysys, Inc. (NASDAQ: AGYS), a leading provider of next generation SaaS software solutions, today announced it has entered into a definitive agreement to acquire ResortSuite, a Canada-based fully integrated property management solution provider focused on the complex multi-amenity and resort market. This acquisition creates the opportunity to bring next generation SaaS solutions to ResortSuite customers who have been served well by a trusted partner for more than twenty years. With unparalleled experience and commitment to the hospitality industry and innovation driven roadmaps and expertise, this combination will enable revenue synergies and delivery of world class integrated hotel property management and contactless capabilities to the global hospitality industry.
”Only a handful of technology providers have the experience and expertise to offer robust, comprehensive and end-to-end integrated property management solutions which can help run complex resort environments and enable enjoyable guest experiences. This acquisition combines two such providers creating the most compelling hospitality technology unit serving the resort market. Frank Pitsikalis (CEO & Founder of ResortSuite) and his talented team have built a company with deep understanding of hospitality and a long history of providing world class service to some of the most well-known resorts and spas across several regions, including the U.S., U.K. and Canada,” said Ramesh Srinivasan, President & CEO of Agilysys. “Thanks to our successful recent product modernization efforts, ResortSuite customers will enjoy numerous modern technology options including migrating to the cloud.”
Frank Pitsikalis, CEO & Founder, ResortSuite added, “Agilysys and ResortSuite share an unwavering commitment to the hospitality market, several shared customers, integrated software solutions, a passion for world class customer service and a strong desire for continued innovation which constantly improves and enriches guest experience. We are excited to join and contribute to the new chapter of modern technology driven growth of Agilysys 2.0 and bring an expanded product base and SaaS options to our longstanding customers. Both ResortSuite and Agilysys customers now have access to next generation cloud-native technology-based products and the opportunity to offer a fully integrated contactless solution for their guests while empowering all departments through a unified common profile across the entire resort. We share a common work ethic and culture with Agilysys. Together we have a solid growth path ahead of us.”
The transaction is expected to close the beginning of January 2022 for approximately 25 million USD in an all-cash deal subject to customary closing conditions. Further details of the transaction will be discussed during the upcoming Agilysys fiscal 2022 third quarter earnings call towards the end of January 2022.
CIBC Capital Markets Inc. acted as exclusive financial advisor to ResortSuite.
ResortSuite provides a fully integrated suite of hospitality solutions for the full service and resort market such as property management, spa, golf, sales & catering, retail, food and beverage, ski and concierge applications to manage properties with multiple amenities. ResortSuite operates out of headquarters in Toronto, Ontario and services multiple geographic areas, including Canada, the United States, the United Kingdom and the Caribbean.
Agilysys has been a leader in hospitality software for more than 40 years, delivering innovative cloud-native SaaS and on-premise guest-centric technology solutions for gaming, hotels, resorts and cruise, corporate foodservice management, restaurants, universities, healthcare, and sports and entertainment. Agilysys offers the most comprehensive software solutions in the industry, including point-of-sale (POS), property management (PMS), inventory and procurement, payments, and related applications, to manage the entire guest journey. Agilysys is known for its leadership in hospitality, its broad product offerings and its customer-centric service. During recent years, Agilysys has made major investments in R&D and has successfully modernized virtually all their longstanding trusted software solutions. Some of the largest hospitality companies around the world use Agilysys solutions to help improve guest loyalty, drive revenue growth and increase operational efficiencies. Agilysys operates across the Americas, Europe, the Middle East, Africa, Asia-Pacific, and India with headquarters located in Alpharetta, GA.
For information visit Agilysys.com.
Jen Reeves
Director, Events & Communications
Hospitality Net membership explained