Highland County commissioners OK new cybersecurity policies

Highland County commissioners Terry Britton, David Daniels and Brad Roades voted to adopt several cybersecurity policies for the county during their Wednesday, July 22 meeting.

The meeting began with Britton recognizing Roades and commission clerk Ashleigh Willey, who served on Highland County’s America 250 committee and were instrumental in the organization of the county’s July 18 commemoration.

“I want to personally thank Ashleigh and Brad for all the work that they've done on the 250 celebration,” Britton said. “I know there was a lot of other people involved, but these two have done an outstanding job. They worked on it over a year. It's been a year and a half, I think. Getting the committee together, getting this thing done, it was a huge success.”

During the brief meeting, commissioners voted to adopt several different policies related to cybersecurity, including the Cybersecurity Program Policy, Cybersecurity Awareness and Training Policy,
Acceptable Use of Information Technology Resources Policy, Cybersecurity Incident Response Plan and
Cybersecurity Incident Reporting and Ransomware Response Policy.

As previously reported, commissioners and several other county officials held a work session to discuss a potential county IT (information technology) and cybersecurity policy and/or employee May 20 meeting. It was brought out during the discussion that commissioners were concerned about complying with various laws and regulations on cybersecurity. It was suggested that Highland County Prosecutor Anneka Collins reach out to other counties to research county policy frameworks while implementing some of the ideas discussed during the work session.

The Cybersecurity Program Policy “is to establish a comprehensive cybersecurity program for Highland County, designed to protect County data, information technology systems, networks, and technology resources and to ensure the confidentiality, integrity, and availability of County information and services,” the policy says. 

During the work session, it was brought out that some departments, including the prosecutor’s office and sheriff’s office, have different requirements for cybersecurity. Although the policy lists the commissioners as the office “providing oversight,” it also states that “each department head and elected official shall be responsible for implementing cybersecurity requirements within their respective offices as needed in addition to this policy.”

The Cybersecurity Awareness and Training Policy outlines training requirements for “all County employees, elected officials, contractors, temporary personnel, and volunteers who access County information systems,” as well as reporting requirements for employees in the event there is “any suspected cybersecurity incident.”

The Acceptable Use of Information Technology Resources Policy lists authorized uses for “county information technology resources” as well as “prohibited activities,” password requirements and information on email security and data protection.

The Cybersecurity Incident Response Plan “establishes procedures for identifying, reporting, responding to, mitigating, and recovering from cybersecurity incidents affecting Highland County information systems, networks, applications, and data,,” including the formation of the Incident Response Team to include a representative from the county commission, IT team, prosecutor’s office, affected department head, law enforcement if appropriate and third-party cybersecurity consultant if retained. 

The Incident Response Plan further lists incident priority classifications, ranging from low to critical, and response procedure phases.

The Cybersecurity Incident Reporting and Ransomware Response Policy defines several types of cybersecurity breaches and outlines when and how to respond to incidents. 

In other discussion, Cierra Moore of the county’s maintenance department brought three quotes for commissioners to review for a previously discussed proposal for isolation valves at the Highland County Justice Center. No action was taken, as commissioners said the quotes varied too much in their scope.

The quotes from Moore were from Weller’s, for nine valves, at $5,760; T&S Mechanical, for 19 valves, at $12,705; and one from Cornele Plumbing, for 17 valves, at $14,500.

“All of them have looked at the prints,” Moore said. “All of them have looked at the pipe. They put their heads in the ceilings. It's basically all pretty well in the same area where the valves will go.”

Roades asked if Moore “let [the contractors] decide where they wanted to put valves, or did you determine?”

“I let them decide,” Moore said. “There's just a little variation between Weller’s and Cornele. They're at the same area. They're just in a different room.”

She added that she explained to the contractors the “need to isolate” the different departments at the Justice Center — Municipal Court, the jail and the sheriff’s office — and they “popped their heads up in different areas and came to an agreement” on how and where to do the work.

Roades pointed out the variation in the number of valves involved for each quote, plus “all the valves are of different sizes.

“There’s nothing apples to apples,” he said. “What I’m getting at is do we need nine valves or need 17 valves to make it all work?”

“Well, nine valves would get it,” Moore said.

Britton agreed with Roades, saying that “with the discrepancy between the three estimates, we need to we need to figure out exactly what we want” and obtain comparable quotes.

“They all need to be bidding on the same thing,” Britton said.

Following the regular board meeting, commissioners were scheduled to meet at 11 a.m. with representatives of the RPHF Solid Waste District and Rumple at the planned future site of a recycling center on Hobart Drive. Later on Wednesday, the county was also holding a post-audit meeting to review the county’s 2024 audit.

Commissioners also made the following approvals, each by a 3-0 vote:

• The hiring of Garen Ryan as a part-time records assistant.

• A contract with the Highland County Airport Authority and Stantec Consulting for the T-hangar construction project.

• An addendum to the Community-based Corrections Subsidy Grant agreement with the Probation Department and the State of Ohio Department of Rehabilitation and Correction.

• The execution of specifications and bidding documents with Sweet Meadow Farm Drainage LLC for FY 2026 improvements for the Runway 23 PAPI-2 replacement project at the Highland County Airport.

• The execution of a planned services agreement with Johnson Controls for the county records building.

• The execution of a notice to proceed to Dance Excavation, LLC for a new courtyard for Highco, Inc.

• A resolution to determine a 1980 Ford truck as no longer needed by the County and obsolete, pursuant to ORC 307.12 (A)(1). Therefore, the board declares the listed item to be surplus property and no longer
needed by the county.

• A transfer from County, Transfers Out to Airport Capital Improvement 4220 in the amount of $14,331.

• A resolution to authorize a “then and now” purchase order and to authorize the county auditor to issue warrants for payment.

• A request from JFS for a budget modification within the 2115 Children’s Services fund in the amount of $9,000.

• A budget modification within the 2280 Records Preservation fund in the amount of $1,500.