North East board approves cybersecurity upgrades including multifactor authentication and offline backups

The Town of North East voted unanimously March 12 to approve a set of cybersecurity upgrades recommended by staff following a closed-session review of cyber risks.

Assistant Town Administrator Grant Handley presented the package and summarized responses from insurance providers, the Local Government Insurance Trust and Devine Computing. Staff told the board they plan employee training, add cyber response measures to the town's Emergency Response Plan, and implement technical protections.

The board approved adding multi-factor authentication for municipal email and VPN access, with a quoted cost of $7,750, and an offline backup process that includes semi-annual testing (initial-year cost $10,800; ongoing annual cost $4,800). Staff also presented a $9,850 quote for Active Directory but the notes in the record indicate that item was not approved as part of the motion.

Vice-Mayor Kimberly A. Davis moved to approve the cybersecurity upgrades as recommended by staff; Commissioner Catherine Bernard-Dutton seconded the motion and it was approved by all. The motion followed an earlier closed session in which the board reviewed cybersecurity risks under the Annotated Code of Maryland, General Provisions, Section 3-305(b)(15).

Town staff said they had sought information from multiple insurers and IT vendors to understand costs and operational requirements. The record notes the offline backup plan will include semi-annual testing in addition to an initial deployment year.

The board approved the package as a staff-recommended set of measures; no further implementation timeline was specified in the minutes. The meeting adjourned at 7:50 p.m.