Washington County IT committee reviews penetration test, approves $63,025 managed detection contract

The Information Technology Committee met to review project reports and cybersecurity work, and approved an annual managed detection and response (MDR) service contract totaling $63,025.

Committee members discussed the county's recent penetration test and the need to keep staff training current as phishing and AI-enabled attacks evolve.

IT staff reported the penetration test was completed this week and that consultants left monitoring equipment in the county network; the final report is pending. "We finished the penetration testing... once we get the final report, we'll be able to share," an IT staff member said. Committee members emphasized continuing staff training because "emails... are getting better and better" at mimicking legitimate correspondence and remain the primary entry vector.

The committee also reviewed operational reports: completed projects noted included a backup-system upgrade and a camera upgrade for the public-health office; ticketing reports will be modified to include graphical output from the new system.

On procurement, staff presented an annual quote for the county's managed detection/response service (described in the packet as a SIM/MDR service) priced at $63,025 and noted that the amount exceeds the committee's $50,000 informal threshold for competitive quotes. Staff said the purchase is on Sourcewell and was the best-value offer because the county's established vendor (SHI) receives contract pricing and other large vendors provide quotes at higher prices under standard quoting exercises. "It is on Sourcewell, so it is on contract. And we just felt that this was the best way to be able to move forward," an IT staff member said.

A committee member asked whether the purchase was included in the current budget; staff confirmed it was budgeted and that this is the second year of a two-year agreement. A motion to approve the purchase was made and carried on a voice vote.

Committee members flagged continuing cybersecurity priorities: annual penetration testing, improved phishing awareness training, and annual reviews of cloud and AI tool policies as those capabilities expand. The IT staff said they plan annual pen tests and incremental reporting changes to better show ticketing trends.

The committee directed staff to bring the final penetration-test report back when it is available and to proceed with the Sourcewell contract as approved.

Ending: The committee scheduled no additional business on cybersecurity for the immediate meeting and adjourned to other agenda items.