Stronghold delivers interim IT assessment to Bourbon County and Fort Scott; recommends network segmentation and camera refresh

Bourbon County commissioners and City of Fort Scott staff heard an interim cybersecurity and IT assessment from Stronghold, an outside IT contractor, in a joint virtual meeting held to review preliminary findings and schedule delivery of a final report.

Stronghold consultants told officials they found dozens of legacy devices, several servers near end-of-life, and network overlap between city and county systems. The consultants recommended network segmentation to separate city and county networks, a phased camera refresh after vetting vendors, and targeted device refreshes and monitoring to reduce operational risk.

"One of the things that I would like to accomplish by the end of the meeting is kind of schedule a time when we can deliver those," Jason, a Stronghold consultant, said at the start of the update, describing a timeline to deliver full assessments "either late next week or early next week." The update included a Stronghold team made up of Avion Bridal, Adam Lupardo and Joe Thomas.

In the technical review, Stronghold reported the county inventory included about 82 active computers, 95 active users, roughly 181 inactive computers and 45 users who had not logged in for 30-plus days. Avion Bridal, a Stronghold consultant, summarized the finding for Bourbon County: "we are picking up that you have as a county 82 active computers. You have 95 active users. We're finding about a 181 inactive computers..." Stronghold also identified about 27 of the county workstations as nearing end-of-life.

For the City of Fort Scott, Stronghold said it discovered roughly 246 devices across five networks, and noted many devices were security cameras (Dahua among the most common). "Out of the greatest percentage of devices connected is some security cameras. Dahua is leading that," Bridal said, adding that the consultants would reference FTC guidance and federal procurement restrictions in their final recommendations.

Commissioner Sam Tran asked whether recommended camera replacements would be proprietary systems requiring the vendor for ongoing maintenance. "Will those cameras be proprietary? For instance, will they be Siemens cameras where only Siemens technicians can maintain them?" Tran asked. Avion Bridal replied that Stronghold would present options rather than prescribe a single vendor and said Stronghold would provide three candidate options with trade-offs on cost, maintainability and federal procurement concerns: "we don't actually, you know, sell cameras...we can actually, you know, give you a list...taking into account your budgetary constraints."

Stronghold flagged Dahua and Hikvision hardware because of federal guidance and procurement restrictions. The consultants said they would include links to FTC guidance and recommendations in the written report. The team also described two recent operational incidents as examples of routine support needs: one county machine had a 32-bit/64-bit software mismatch that effectively required reimaging, and a city workstation was bricked after an automatic update interrupted payroll work.

Sheriff Bill Martin raised security and data-access concerns specific to law enforcement, asking whether Stronghold would recommend separation between elected-official offices and department heads so that, for example, the sheriff's systems and CJIS-protected workflows remain isolated. "Are you going to list out or explain the need of the separations between certain elected officials office and department heads that they should not be tied together in the same network?" Martin asked. Stronghold said segmentation could be implemented using virtual LANs (VLANs) and access controls so each office has an isolated address space and that Stronghold is CJIS-aware: "We are CJIS certified, so we completely understand that process," a Stronghold consultant said.

Officials discussed procurement and next steps. Stronghold offered to deliver a scope of work and recommended timeline for segmentation and device refreshes in the final report. The consultants proposed in-person delivery of the final presentation and said any security-sensitive materials could be shared separately with appropriate attendees. Meeting participants tentatively scheduled follow-up work sessions; Stronghold reiterated the final assessment would be ready "the latter part of next week or early part of the following week," and referenced a planned in-person meeting for "Monday the 20 first" to review findings.

Votes at a glance: the meeting recessed to executive session under KSA 75 43 19(b)(1) to discuss personnel matters and later returned to open session with no action; the meeting then adjourned. (Formal motion texts and vote tallies were not specified in the meeting transcript excerpt.)

Officials said they will use Stronghold's assessment to develop procurement requirements (a performance work statement or PWS) to support an apples-to-apples bid process for longer-term IT services and to identify budget and scope for camera and device replacements. Stronghold will provide a written assessment with links to the FTC guidance and recommended next steps for segmentation, camera replacement options, targeted workstation refreshes and ongoing monitoring.

The meeting closed with Stronghold noting it will remain available for interim reactive support and that the county and city should expect a final assessment package and recommended scope for segmentation and device refresh projects in the near term.