Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
Rutherford steering committee forwards resolution to keep county cybersecurity vendors confidential
Summary
The steering committee voted to forward a resolution asking the full county commission to treat the identities of cybersecurity vendors as confidential under Tennessee law, after OIT staff said redaction of vendor names protects county systems from exploitation.
The Rutherford County steering committee voted to forward a resolution asking the full county commission to treat the identities of vendors that provide cybersecurity and related protective services as confidential under state law.
Chairman Phillips read the draft resolution, which cites the Tennessee Public Records Act (TCA 10-7-503) and specifically TCA 10-7-504 as the authority for making vendor identities confidential. The resolution says disclosure of such vendors could expose vulnerabilities in the county’s electronic information processing, telecommunication and data-storage systems.
Commissioners asked how confidentiality would interact with procurement. One commissioner said, "when we go out to bid...how do you see those vendors that will apply or submit?" and raised concerns that redacting vendor identities in public records could undermine transparency in competitive solicitations.
Cody York, representing the county’s information-technology office, told the committee that Rutherford County rarely runs open bids for enterprise-level cybersecurity services and frequently buys off state or federal contracts, or other government contracts. He said the county would treat the procurement process and the public-records process separately and, in the event of a records request for endpoint-protection purchases, would produce purchase orders with vendor names redacted while still disclosing purchase amounts.
York said recent suspicious public-records requests prompted the resolution: "there has been a lot of...requests that are very suspicious...that are even routed through organizations made to keep the requestor private and secret," and colleagues in other jurisdictions have adopted protections to protect sensitive vendor information.
A commissioner moved, and the committee voted by voice to forward the resolution to the full county commission for final action, requesting review by the county attorney prior to that submission.
What comes next: the resolution will be considered by the full Rutherford County Commission. The steering committee did not adopt a final confidentiality designation; it sent the draft forward for commission action and legal review.
