County staff urges caution on Iowa State University cybersecurity agreement

Muscatine County staff told supervisors on Aug. 3 that they have questions about an agreement tied to Iowa State University that would provide cybersecurity services to local governments. The only clear notice staff could find was dated June 16, and the staff member said the agreement "is scheduled to end August 31."

The staff member said the ISU program lists three core services—assessment, asset inventory and an incident management exercise—but county employees do not yet know what additional services would be provided or who would administer the work. "We're gonna spend all kinds of staff time, and the county gets no reimbursement for the staff time," the committee member said, raising concern about staffing burden. The staff member also reported that an ISAC IT representative had advised counties not to sign the local consent form without more information: "the ISAC IT rep is saying don't sign."

Board members said they need written details before committing. One supervisor asked whether signing could make the county a grant participant and expose local taxpayers if funds were misused; the board agreed not to sign until staff can provide definitive information. Chair summarized the threshold for action: "If they can't, then we don't sign it." The board directed staff to continue pushing for clarification and to return the matter if new information warrants formal action.