County will look at its security policies

The state has identified cybersecurity as a priority moving forward.

County officials are taking a step toward meeting those requirements.

Jay County Commissioners OK’d creating a task force Monday to update the county’s cybersecurity plan.

They also talked about disbanding local volunteer emergency service Rescue 19.

Jay County Emergency Management Agency director Samantha Rhodehamel explained new state legislation regarding cybersecurity takes effect July 1, 2025.

Per the new statute (Indiana Code 4-13.1-4), public entities may adopt a policy regarding cybersecurity, a policy clarifying employees’ use of the public entity’s technology resources and a mandatory training program related to technology and cybersecurity. 

Public entities connecting to “technology infrastructure of the state” after July 1, 2027, must complete a cybersecurity assessment and regularly complete cybersecurity assessments at least once every three years; “if identified as a state agency or political subdivision have an ‘in.gov’ or ‘.gov’ domain name; and have a secondary end user authentication mechanism.”

“I think we want to (make) some changes in the county,” noted Rhodehamel, specifically pointing to potentially switching to an in.gov domain name for county employee emails.

“(That’s) depending on what they deem ‘technology infrastructure of the state,’” she added.

The county’s website is jaycounty.net, and department heads currently utilize emails ending in co.jay.in.us.

Rhodehamel noted per the statute the county will need to undergo a cybersecurity assessment and implement secondary end user authentication. She added that county attorney Wes Schemenaur has also suggested revising employee policies in relation to technology use.

She said it was determined the current cybersecurity plan is lacking, and she asked commissioners’ permission to put together a team to devise a new plan.

“Several counties around us have been hit recently by cybersecurity issues,” Rhodehamel noted. “I just want us to be on track toward being able to mend the issue.”

Schemenaur added that the new cybersecurity requirements likely impact most county offices. He mentioned the county’s personnel policy, which will need to be adjusted per the new statute to prohibit employees from using county technology resources to engage in lobbying, engage in illegal activity or violate cybersecurity policy, as well as creating disciplinary procedures for violating those rules.

Rhodehamel pointed out cybersecurity plans may not be disclosed to the public — that is stated in the statute — and that may make it difficult to look to other counties for examples. She confirmed she should be able to get a template for Jay County to utilize while creating the new plan.

Commissioner Rex Journay asked how much the county’s cybersecurity insurance alone costs annually. County auditor Emily Franks said it came in at just over $53,000 for this year. 

Also Monday, commissioner president Chad Aker noted he and Rhodehamel met with fire chiefs from the county’s six fire departments regarding the future of Rescue 19.

Currently, the service has three active members and three inactive members.

“The fire chiefs, their unanimous feelings on this was that Rescue 19 was great when it was started, it’s served it’s purposes, and at this time it’s really not needed,” said Aker. 

Answering a question from Aker, Rhodehamel said the group has had about 15 runs this year.

Aker noted fire chiefs from the county’s fire departments have confirmed they have the necessary equipment to do extrication and rescue calls.

(Rhodehamel also confirmed that, pointing to grant funding each fire department has used recently.) Aker also pointed to Portland and Dunkirk fire departments having 24-hour service.

Commissioner Brian McGalliard asked for Schemenaur’s thoughts, with Schemenaur noting it’s been difficult in years past to get volunteers involved.

Commissioners briefly discussed what the county should do with the department’s truck and response equipment. Schemenaur noted the law likely requires that they offer the equipment to local responder agencies before putting it up for sale. Commissioners asked Rhodehamel to look into details regarding the Rescue 19 vehicle and create an inventory list of equipment owned by Rescue 19.