Lifetime Citizen Portal Access — AI Briefings, Alerts & Unlimited Follows
County IT flags Microsoft price increases, recommends state antivirus and more cybersecurity training
Loading...
Summary
Story County's IT director told supervisors Microsoft G3 licenses will rise next year, recommended shifting to the state's antivirus offering while it is funded, and proposed expanded phishing training, multifactor authentication and DNS protections to reduce cyber risk.
Colin Gers walked the board through several recurring software and security costs that will affect the IT budget. He said Microsoft notified customers that G3 licenses will increase by about 10% starting July 1 and another 3% the following year; Gers suggested the county can save roughly $17,000 a year by using local LTSC (desktop-only) Office installs for users who do not need full G3 capabilities instead of issuing a G3 license to everyone.
On endpoint security, Gers said the county currently pays for an antivirus/EDR solution but the state provides a similar service that is funded through 2027. He recommended migrating county endpoints to the state-provided solution while it remains funded to achieve short-term savings, acknowledging the state’s future funding is uncertain.
Gers urged stepped-up phishing awareness and monthly simulated campaigns, saying he has observed more sophisticated phishing emails in recent months and that staff training is now more important. He also said multifactor authentication had been renegotiated to a lower cost (an $8,000 line item) and discussed DNS-level protections (Cloudflare gateway) to reduce risk of malicious redirections.
Board members discussed meeting/webinar platforms and the costs of Zoom webinar licenses versus Teams; Gers noted some commission/board features may still require Zoom but urged departments to use Teams where possible to reduce duplication.
Supervisors directed staff to produce refined estimates for licensing strategy, the potential short-term savings from adopting the state EDR provisioning, and to bring back plans for phishing campaigns and MFA deployment. No formal procurement or purchase decisions were made at the meeting.
