Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Attestations topic
No spam. Unsubscribe anytime.
Commissioner presses staff on vendor attestations and security testing for OS updates
Summary
A commissioner asked whether staff verifies vendor attestations about OS updates; staff said functional and security testing is performed and explained that attestations are used when only the underlying OS changes and vendors cannot control Apple update timing.
A commissioner asked staff to clarify what the vendor attestations the board received signify and whether staff verifies those attestations. "So what was the purpose let me just ask what the purpose of the attestation is by the vendor," the commissioner asked.
Staff replied that the county performs functional and security testing when updates are brought before the commissioners: "There is functional and security testing that's conducted when these are brought before the commissioners." A staff member explained that vendors send attestations when the underlying operating system changes but the application does not, and that the county's security team reviews whether Apple OS updates will interfere with the application's security posture. On that point staff observed that "the vendor doesn't have any control over when Apple pushes" updates, explaining why attestations are used.
Commissioners and staff distinguished a prior "10x" de minimis update—where staff said no change occurred to the poll‑worker and voter interface—from the current vendor submission, which staff said includes application-level changes. The exchange concluded with commissioners accepting the staff explanation and moving to a vote on the update.
