City staff presented a draft cybersecurity policy at the Umatilla City Council meeting on Aug. 19 and recommended adopting a framework that would be reviewed periodically by staff and brought back to the council as needed.

The draft, prepared in part by a staff member identified only as Nancy, was described as built on outside resources and insurance‑provider guidance. “Included is a draft cybersecurity policy…we believe we have a really strong framework,” Nancy said during the discussion.

Council members asked whether training would accompany the policy. A staff member responded that training modules would be provided through the city’s insurance portal and that some user training was planned. “Are you actually gonna have a training module for the staff with this?” a councilor asked; the staff reply summarized that training would be provided through the insurance company’s portal and the city would follow up on implementation.

The staff presentation framed the policy as a risk‑management tool and recommended that the council treat the draft as an initial policy and allow staff to handle routine changes administratively, bringing substantive revisions to the council.

Councilors praised the draft. One councilor said they had compared parts of the draft to employer standards and that it “compares very favorably.” Another said the city probably should have adopted such a policy years earlier.

No final vote on the policy occurred; staff presented the draft for first review and suggested subsequent administrative implementation and council oversight of substantive changes.

Next steps identified during the meeting include assembling training materials tied to the policy and returning to council with a formal adoption item after staff review and any edits requested by councilors.