Yamhill County IT reports security upgrades, software savings and Windows 11 timeline

Shane Hoffman, of the county IT department, briefed the Yamhill County Board of Commissioners on security work, software projects and budget savings during the board’s April 24 meeting.

Hoffman told commissioners the county has stepped up network segmentation and restricted vendor and contractor access. He said the county continues to run annual penetration tests with an outside vendor and has begun a rollout of enhanced network access control that integrates existing cybersecurity tools to improve correlation of security events. "A penetration test is really just a simulated cyber attack to look for vulnerabilities and weaknesses and the potential impact of those weaknesses," Hoffman said.

The update included several operational items. IT replaced core networking infrastructure and upgraded connections for some Health & Human Services (HHS) locations. The county is deploying servers on Windows Server 2025 and has begun changes to SQL Server configurations aimed at performance and reliability. Hoffman said servers and new network video recorders (NVRs) were installed at multiple HHS and transit sites, and the county upgraded a Motorola access-control server (ACM) to the latest version.

Hoffman outlined staffing and project work: a senior programmer analyst assigned to HHS, a January hire named James Holiday who created an internal intranet expected to avoid about $20,000 per year in external hosting, and ongoing projects including integration of journal entries into Oracle, Affordable Care Act reporting for HR, a new commissary service, migration of legacy GEMS reports to Excel-based exports, jail identification wristbands, and an incoming civil system from Washington County intended to track service and court documents.

On cybersecurity training and phishing, Hoffman said the county’s click rate on simulated phishing campaigns has been higher than the industry average for similar government entities: "Our click rate... is 8%. Our last campaign was 11.3%. Industry average for a government entity our size is 4%." He said department heads have been engaged and that further training is planned.

Hoffman also summarized cost savings identified by IT. The department reduced access to GEMS and moved to Excel-based historical reports, yielding about $52,000 per year in savings. Another legacy product tied to GEMS and the civil system is slated for removal, with annual savings of $76,600; subscription removals he cited would save roughly $16,000. Replacement of a backup storage solution and other efficiencies contributed to a multi-year savings projection; Hoffman said the total savings the county will "recognize" in the near term is about $88,000. Separately, working with a Verizon representative produced reported monthly savings of $4,485 (about $53,830 annually) from plan changes across departments.

Hoffman told commissioners that most county endpoints are on track to be upgraded to Windows 11 by an October 2025 deadline; he said the sheriff’s office and emergency management are still in active upgrade work but that the rest of the county is largely migrated.

On service metrics, Hoffman said IT logged 7,090 work tickets between March 1, 2024, and March 1, 2025, closing 7,039 of them. He gave special recognition to help desk and desktop support staff for high closure counts.

Commissioners asked for budget implications; county leaders said some of the listed savings will reduce the software maintenance line and that the IT budget to be presented in the coming week will reflect lower software maintenance costs. Hoffman and commissioners emphasized licensing compliance as an ongoing operational priority.

Hoffman thanked staff and named individual contributors by first name for their roles in the upgrades and savings.