Morrison County contracts with global partner to improve cybersecurity | News

The total cost of the service is $78,105.79 annually. The first year will be paid for with $50,000 coming out of the IT Department’s budget and the remaining $28,105.79 to be covered by a portion of the $6.5 million in federal American Recovery Plan Act (ARPA) funding the county received in 2021.

“At the end of the quarter I do some budgeting work,” Middendorf said. “So, at the end of the quarter here, I was reviewing my budget and I did have $50,000 earmarked for the cybersecurity overhaul for 2022, knowing last year that we needed to do some improvements this year.”

In February, Middendorf and the County Board met in a closed session to discuss a cyber resilience review (CRR) the IT Department did in conjunction with the Department of Homeland Security. During that meeting, it was decided that Morrison County should move cybersecurity posture, or maturity, up to Level 2. That essentially states that the county has standards and practices in place, whereas Level 1 indicates a foundation for a sound security posture.

Middendorf was also tasked by the Board, at that February meeting, with creating a Cybersecurity Incident Response Team (CIRT). She said that was complete, and that team planned to meet later in the week.

The ultimate goal identified at that meeting was: “To quickly increase our cybersecurity posture in a timely, effective manner with keeping the organizational trust a commitment of safeguarding the confidential information of our citizens, while maintaining our fiscal responsibilities.”

“The way I see how we can get there is utilizing a global partner,” Middendorf said. “Info-Tech would be a global partnership with Morrison County. Myself, my team, and the key stakeholders here that would be part of that CIRT have a varied, plethora of knowledge of how we do business here in Morrison County, what we need and don’t need. However, having that global look-in, and then melding our expertises together to decide on how we want to move our posture forward is really how I think we can effectively and quickly increase our Level 2 posture.”

Included in the total price tag of Info-Tech’s service is a reference membership and membership add-ons that normally cost about $20,000 at no additional charge. During further discussion, Commissioner Randy Winscher asked Middendorf if she thought — due to technology “exploding the way it is,” with several types of viruses and phishing techniques — that the county would need to hire an additional IT staff member in the future.

Middendorf said her belief is that the role of IT is rapidly changing, as it already has in many ways since she joined the county’s IT Department in 2008.

“The nature of the business we do is changing,” she said. “We may have to change the skillsets that we’re hiring for. As people either leave — we re-evaluate those positions and ensure that we’re still aligning the business need and the skillsets we’re seeking are still what are needed in Morrison County.”

She said in the last five or six years, the role of IT has shifted away from being focused heavily on hardware. The county is not building its own programs. It is purchasing them and pushing everything to the cloud.

She said that means IT has been more focused on what is getting pushed out and how that information is protected, who should have access to it and who actually is accessing it.

“It’s more monitoring, watching, education,” Middendorf said.

She said her department used to not even meet with the County Board regularly. Due to the nature of their work now, she said it is “very important” that she now gives regular updates to the Board.

Ultimately, she said she could not say the department will need another staff member, but there may need to be changes in a certain employees’ duties.

“The one sticking point that I’ll just say in my little crystal ball that I wish I had — that’s a little foggy and blurry — is, we may need someone part-time or some sort of a tool to help us gain visibility in what is actually on our system,” Middendorf said. “Sometimes that means having a physical log and then getting notifications and ensuring those people are legit.”

Piggybacking off of Winscher’s question, Commissioner Jeffrey Jelinski asked if they would be having the same conversation if the department had a staff member dedicated to cybersecurity.

Middendorf said, once the standards and practices that come with Level 2 maturity are in place, she believes her existing team will have a “better roadmap.” It will have an idea of benchmarks it needs to look at and hit.

For what she is seeking in a partnership with Info-Tech, Middendorf did not see that as a full-time job.

“I feel like having that (Level 2 maturity) would really help shape the positions and identify the skillsets that we need moving forward, because it would be a business decision, not just an IT decision,” she said.

Commissioner Mike Wilson commended Middendorf and her staff for the work they do on a regular basis, and for what they put into coming up with the request to partner with Info-Tech. He said he was “very comfortable” knowing she was in charge of the county’s cybersecurity initiative.

Board Chair Greg Blaine echoed those sentiments, adding that he appreciated Middendorf’s willingness to take time to keep the Board informed on her department.

“Your vision and your leadership on looking at addressing the IT needs for the county are stellar,” Blaine said. “We appreciate that and we appreciate you being here, and also your ability to communicate with us in a very clarified manner that all of us — who are not IT people — can have a good understanding.”

Board of Commissioners Briefs:

In other business Tuesday, the Morrison County Board of Commissioners:

• Welcomed Curt Bryniarski as the county’s new chief financial officer;

• Proclaimed April 24 - 30 as National Crime Victims’ Rights Week, May as Vulnerable Adult Abuse Awareness and Prevention Month and April as Distraction-Free Driving Month in Morrison County;

• Approved a request for Morrison County Ducks Unlimited to hold a raffle, April 29 - May 1, at Rice Creek Hunt Club;

• Approved a request to increase the License Bureau’s credit card account balance by $5,000; from $15,000 to $20,000;

• Authorized paying a Land Services Department administrative support specialist at the same rate as a record specialist — a raise of $2,500 — for the remainder of 2022, as discussed at the April 12 planning session;

• Approved 2022 food, pools and lodging license renewals for Shamineau Acres Resort in Motley and Pine Grove Zoo in Little Falls;

• Approved a resolution for Morrison County Health and Human Services, along with Cass, Crow Wing, Todd and Wadena counties, to apply for community impact funds through Sourcewell. The funds would help build upon the Collaborative Intensive Bridging Services project;

• Authorized Public Works Director Tony Hennen to enter into an agreement with CTC for the installation of communication infrastructure — phone and internet — and for CTC to provide service for the Morrison County Solid Waste Management Facility using funds from the $6.5 million in federal aid the county received through the American Recovery Plan Act (ARPA); and

• Awarded a contract to Knife River - North Central in the amount of $2.464 million to complete a road project on County State Aid Highway (CSAH) 15 from CSAH 19 to Trunk Highway 28 in Swanville.

The next meeting of the Board of Commissioners is a planning session at 8:30 a.m. Tuesday, April 26, in the Board Room at the Morrison County Government Center.