County Counsel

The Payment Card Industry (PCI) self-assessment questionnaire (SAQ) process inadequately involves IT resulting in a lack of IT awareness of the PCI Compliance process and errors on attestation reporting. Response to F2: The Board agrees in part and disagrees in part with this finding. Mono County IT itself does not store or process customer credit cards, and as a result has not been involved in PCI. Departments that receive credit card payments do so via 3rd party vendors. As such, payment systems decisions are determined by Finance, managed by the departments that use them, and should go through a contract, technical, and security review process by IT. Nonetheless, Mono County IT can be equipped to better assist departments in managing their obligations with respect to PCI. Implementation of F2: The Board will direct IT will train staff to be aware of PCI and SAQ requirements in order to better assist other county departments beyond the existing technical and security review of all vendor contracts that involve software or some other nexus with IT. IT will work with Finance to identify the correct SAQ form to be used during the self-assessment process and will partner with Finance and other departments responsible for processing customer credit cards to complete the SAQ and will provide input where appropriate. While the Board recognizes that IT cannot control certain customer actions that may jeopardize data, such as when customers send credit card information over plain text email messages, the Board will encourage IT will optimize the Office365 environment and implement data loss prevention policies according to best practice to secure data from the point of receipt forward, such as ensuring that any reply to a plain text email with sensitive data will be encrypted. Implementation Timeline for F2: The Board will direct IT to implement these solutions by close of Fiscal Year 25-26.

The lack of immutable backups results in increased risk of disruption to important County operations due to a ransomware attack. Response to F3: The Board agrees with this finding. The Board recognizes and takes seriously the importance of reliable accessible backups. The Board acknowledges that there are always ways to improve the backup technology that we use beyond what is required. Implementation of F3: The Board will direct IT to research available and practical immutable backups and the possible implementation strategies for Mono County’s needs. In doing so, IT will seek input from and collaboration with departments to identify their most critical systems that require immutable backups. IT will also work to develop a procedure for the implementation of immutable backups that then meets departmental needs. As the implementation of immutable backups will require additional, currently unallocated resources, the Board will direct IT will create a plan for immutable backups that includes those resources in a future budget process for the Board to review. Implementation Timeline for F3: As immutable backups implementation requires currently unallocated resources, the Board expects that IT will include adequate resources in the Fiscal Year 25-26 budget process and implement within that timeframe. Due to the sensitive nature of these discussions, the Board of Supervisors expects to be notified in closed session of significant cybersecurity risks pursuant to newly enacted legislation permitting cybersecurity risks to be discussed in that forum.

Computing devices, no longer supported by the vendor, are present in the environment resulting in an increased risk of cybersecurity vulnerabilities and attacks. Response to F4: The Board agrees with this finding. IT acknowledges that there are pieces of equipment that are past their End-Of-Life (EOL) still operating in our environment. Currently we operate under a Technology Refresh/Internal Service Fund (ISF) that was established in 2014. The ISF was meant to ensure that equipment, including desktop devices, servers, and storage) could be replaced in an efficient fashion as that equipment reached its EOL. The ISF was designed to guarantee adequate funding for those replacements. Each department contributes to the fund annually in accordance with the number of employee positions they have and the number of devices they have in service. However, ISF funding has not always been adequate to replace all the equipment. Relatedly, IT has struggled to maintain adequate personnel resources to replace all equipment. Implementation of F4: New equipment has already been purchased to replace identified network equipment that is at EOL. IT has developed a schedule for the removal of the obsolete equipment and the installation of the new equipment. Replacement equipment that is designed to replace equipment at its end-of-sale is scheduled for purchase in Fiscal Year 25-26. IT will develop a similar schedule for the removal of the obsolete equipment and installation of the new equipment. As budget has not always been adequate to replace all EOL and end-of-sale equipment, IT will update its procedures and monitor the costs of replacement equipment to make the ISF more effective going forward. The Board will review any additional personnel resources, such as another Network Specialist position, during future budget processes and allocation adjustments in order to ensure IT is able to meet schedules for removal and installation of equipment. Implementation Timeline for F4: Replacement of equipment designed for end-of-sale is scheduled for purchase during Fiscal Year 25-26. IT will include additional resources in the Fiscal Year 26-27 budget process as needs are identified.

The lack of consistent periodic external penetration testing and vulnerability scans results in unknown potential exploits which increases the risk of cybersecurity incidents. Response to F5: The Board agrees with this finding. IT recognizes and takes seriously the importance of identifying and understanding potential points of vulnerability to cyberattack. The environment is currently monitored by a 24/7 Security Operations Center and activity is monitored by IT staff. Potential risks are researched and IT staff take the necessary steps to mitigate those risks. Additional security exercises and testing are beneficial ways of protecting the environment. Implementation of F5: The Board will encourage IT will explore additional penetration testing strategies and vendor relationships. To date, IT has pursued low or no-cost services from state and federal partners for penetration testing. Implementation Timeline for F5: As penetration testing requires currently unallocated resources, IT would aim to include these in the Fiscal Year 25-26 budget process and implement within that timeframe, if and as directed by the Board of Supervisors.

Important Cyber Security projects and initiatives have not begun or are lagging due to insufficient staffing. Response to F6: The Board agrees with this finding. Mono County takes cybersecurity seriously and fosters a culture of cybersecurity awareness. While cybersecurity is ultimately the primary responsibility of each individual user in the environment, IT creates and implements policies to encourage a culture of individual concern and responsibility for maintaining cybersecurity. However, IT is currently in the process of staffing up following a series of departures. Implementation of F6: In March 2025, IT hired a Chief Information Security Officer. IT will work with Human Resources to develop a job description, determine the appropriate compensation and benefits, and recruit for a Cyber Security Analyst. Implementation Timeline for F6: The Board expects that IT will include the Cyber Security Analyst in its Fiscal Year 25-26 budget requests.

Quarterly cyber security training is taking place with noteworthy results. However, there’s a lack of visibility to compliance measurements among County executives. Response to F7: The Board agrees with this finding. Historically results of quarterly compliance trainings have not been brought to the Board of Supervisors. Some compliance issues also have not been brought to the Board because discussion of those items in open session may present security concerns. Implementation of F7: The Board of Supervisors will direct Mono County IT to create a standing quarterly agenda item to report out to the Board of Supervisors the results of training. IT will make