Under SB272, the system must have these two main characteristics:

• Multi‑departmental or containing public information — The system must either support multiple departments or hold information collected about the public.

• Original source of data (“system of record”) — The system must serve as the authoritative source of data for the agency.

 An Enterprise System does not include any of the following:

• Information Technology security systems, including firewalls and other cybersecurity systems.
• Physical access control systems, employee identification management systems, video monitoring and other physical control systems.
• Infrastructure and mechanical control systems, including those that control or manage street lights, electrical, natural gas or water or sewer functions.
• Systems related to 911 dispatch and operation or emergency services.
• Systems that would be restricted from disclosure by Section 6254.19.
• The specific records that the information technology system collects, stores, exchanges or analyzes.

1. Create a catalog of enterprise systems, containing:

• Current system vendor
• Current system product
• System’s purpose
• A description of categories or types of data
• The department that is the prime custodian of the data
• The frequency at which system data is collected
• The frequency at which system data is updated

 2. To make the catalog publicly available upon request

3. To post the catalog in a prominent location on the agency’s website