Agency responses to Mono County Cybersecurity Preparedness

Response says

Partly agrees and partly disagrees, explaining that third-party processors and Finance manage payments while IT should assist with assessment and security review.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Agrees that missing immutable backups increase disruption risk and proposes researching practical options with departments.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Agrees that end-of-life devices remain and describes funding and staffing limits within the Technology Refresh/Internal Service Fund established in 2014.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Agrees with the testing gap, describes existing 24/7 monitoring, and proposes additional testing and vendor relationships.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Agrees that staffing is insufficient, reports a Chief Information Security Officer hired in March 2025, and plans work with Human Resources on a Cyber Security Analyst position. Also anticipates losses linked to the County’s remote-work change.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Agrees that training results have not been brought to the Board and proposes quarterly reporting to supervisors and department heads, with sensitive vulnerabilities discussed separately.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Plans staff training and collaboration among IT, Finance, and payment-processing departments. Will seek Board direction on the completion timeline.

Audit analysis

The proposed cooperation engages the recommendation, but the response does not clearly commit to documenting the process or meeting the August 1, 2025 deadline.

Response says

Plans to identify the correct SAQ with Finance and other payment-processing departments before the close of fiscal year 2025–2026.

Audit analysis

Identifies the requested task and partners; its completion window is later than the jury’s August 1, 2025 deadline.

Response says

Agrees and proposes research, departmental consultation, implementation procedures, and fiscal year 2025–2026 resource requests.

Audit analysis

Describes how a plan would be developed, but the budget-request window is not a firm plan-completion date and does not resolve the September 1 deadline.

Response says

Agrees to update replacement procedures, monitor costs, and seek personnel resources by the close of fiscal year 2025–2026.

Audit analysis

Addresses a continuing replacement process and resource constraints, while replacing the jury’s earlier deadline with a fiscal-year window.

Response says

Agrees to explore testing vendors and establish a periodic schedule, with implementation tied to fiscal year 2025–2026 resources.

Audit analysis

Describes the requested recurring-testing process; funding and vendor selection remain conditions, and the September 1 deadline is not adopted.

Response says

Agrees to assess staffing and develop a Cyber Security Analyst allocation and job description; personnel requests are to be included in fiscal year 2026–2027 proposals. Says the full assessment can occur after September 11, 2025.

Audit analysis

Engages the staffing assessment and budget submission, but the response points to the following fiscal-year proposal rather than clearly committing to the jury’s October 1 deadline.

Response says

Agrees to quarterly reports to the Board and department heads, beginning in the first quarter of fiscal year 2025–2026.

Audit analysis

Specifies the reporting recipients, frequency, and initial reporting window. The R7 response subheading is a numbering error within the R8 entry.

Response says

Partly agrees and partly disagrees, explaining that third-party processors and Finance manage payments while IT should assist with assessment and security review.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Agrees that missing immutable backups increase disruption risk and proposes researching practical options with departments.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Agrees that end-of-life devices remain and describes funding and staffing limits within the Technology Refresh/Internal Service Fund established in 2014.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Agrees with the testing gap, describes existing 24/7 monitoring, and proposes additional testing and vendor relationships.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Agrees that staffing is insufficient, reports a Chief Information Security Officer hired in March 2025, and plans work with Human Resources on a Cyber Security Analyst position.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Agrees that training results have not been brought to the Board and proposes quarterly reporting to supervisors and department heads, with sensitive vulnerabilities discussed separately.

Audit analysis

The response’s engagement is evaluated independently of whether the County’s security measures are effective.

Response says

Plans staff training and collaboration among IT, Finance, and payment-processing departments. Expects this work in fiscal year 2025–2026.

Audit analysis

The proposed cooperation engages the recommendation, but the response does not clearly commit to documenting the process or meeting the August 1, 2025 deadline.

Response says

Plans to identify the correct SAQ with Finance and other payment-processing departments before the close of fiscal year 2025–2026.

Audit analysis

Identifies the requested task and partners; its completion window is later than the jury’s August 1, 2025 deadline.

Response says

Agrees and proposes research, departmental consultation, implementation procedures, and fiscal year 2025–2026 resource requests.

Audit analysis

Describes how a plan would be developed, but the budget-request window is not a firm plan-completion date and does not resolve the September 1 deadline.

Response says

Agrees to update replacement procedures, monitor costs, and seek personnel resources by the close of fiscal year 2025–2026.

Audit analysis

Addresses a continuing replacement process and resource constraints, while replacing the jury’s earlier deadline with a fiscal-year window.

Response says

Agrees to explore testing vendors and establish a periodic schedule, with implementation tied to fiscal year 2025–2026 resources.

Audit analysis

Describes the requested recurring-testing process; funding and vendor selection remain conditions, and the September 1 deadline is not adopted.

Response says

Agrees to assess staffing and develop a Cyber Security Analyst allocation and job description; personnel requests are to be included in fiscal year 2026–2027 proposals.

Audit analysis

Engages the staffing assessment and budget submission, but the response points to the following fiscal-year proposal rather than clearly committing to the jury’s October 1 deadline.

Response says

Agrees to quarterly reports to the Board and department heads, beginning in the first quarter of fiscal year 2025–2026.

Audit analysis

Specifies the reporting recipients, frequency, and initial reporting window. The R7 response subheading is a numbering error within the R8 entry.