Norfolk County CIO puts forward network and cybersecurity administrator in FY26 budget

Sam Evans, the county chief information officer, presented the county’s requested fiscal year 2026 information-technology budget to the Norfolk County Commission on Feb. 19 and proposed a new full-time network and cybersecurity administrator position as part of the FY26 submission.

Evans told commissioners he identified roughly $45,000 in expense reductions compared with last year’s non-personnel spending, but the packet also includes a new position with a $90,000 salary line. He said the new hire would be “mostly cybersecurity” but would also handle network administration across county locations and support the agricultural school. Evans said if the commission cannot fund the full salary this year, he would prefer to restore some consulting or contracting dollars to cover immediate cybersecurity needs.

Why it matters: Evans cited a cybersecurity incident earlier in the year and described a continuing workload from federal- and state-provided monitoring reports that require staff time to review and remediate. He said outsourcing a short-term cybersecurity assessment can be nearly as costly as a full-time hire and that a permanent staff member would provide continuous log monitoring and hands-on support for the county’s servers, the agricultural school and other sites.

Details from presentation: Evans explained several software and licensing cost drivers in the FY26 request, noting a migration of county staff to Microsoft cloud services increased recurring license and backup costs. He said some IBM/BrownTech renewals cycle on multi-year terms, which creates uneven renewal-year “bumps” in the maintenance line. In the personnel group, Evans proposed the new role under the CIO/data-processing account; the budget spreadsheet labels the position “to be hired.”

Evans described the proposed post as a combined network administrator/cybersecurity administrator and said the role might spend roughly 60–75% of its time on cybersecurity tasks with the remainder on network administration. He also said the county already uses federal monitoring services, state cybersecurity offerings and weekly checks that generate reports; a full-time staffer would review logs and act on those alerts.

Commission questions and next steps: Commissioners asked whether the position could be part time or shared regionally. Evans and other staff said there are regional cyber collaboratives (he cited Wellesley and an unnamed North Shore collaborative) but that part-time coverage can be difficult because security work requires continuous log analysis and follow-up. Evans said he had discussed a possible contribution from the agricultural school but had not received a firm commitment; commissioners directed staff to pursue those conversations and to provide updated cover sheets and spreadsheets to the board.

Ending: The commission took the CIO’s budget presentation under advisement and asked staff to return with any revised materials, including follow-up on a possible school contribution and additional line-item clarifications.