Commissioners press for countywide cybersecurity umbrella as auditor modernizes systems

Lorain County commissioners used a budget work session with the auditor's office to press for a coordinated, countywide approach to IT security and monitoring that would satisfy insurers and reduce duplicated efforts across elected offices.

Commissioners told the auditor's office they want a single documented umbrella for cybersecurity monitoring, not to strip offices of specialized software. The meeting referenced guidance from insurers and county associations that they will 'risk rate' the county and expect a countywide policy in place.

The auditor described current arrangements: the office pays for much of its software through the real-estate assessment fund, runs three IT staff supporting Oracle and the upcoming cloud-based real-estate system, and currently uses CrowdStrike and third-party monitoring services. "We're implementing our new real estate system that goes live first of the year. That's gonna be cloud based," the auditor's office representative said.

Commissioners said the goal is to reduce duplication while keeping offices' necessary software and to make incident monitoring and response consistent across the county. Staff recommended ensuring IT staff from different offices coordinate, and commissioners asked that the auditor's IT team communicate directly with county IT leadership and outside vendors to align monitoring and incident response plans.

The auditor's office agreed to coordinate with other IT staff and to provide further details on what may be funded from existing cash or administrative code allowances. Commissioners also noted some ARPA funds previously used for cybersecurity and asked staff to confirm what remains and how it might be applied to countywide protection.