There appears to be no plan in order for an IT info breach as the graph lists “still needed” for mitigation in place, possible mitigation and required action.

Nearly a year since a devastating IT crisis involving an alleged breach of network security that hampered the Camden County courthouse for several months, the Commission has approved a Continuity of Operations Plan (COOP) in the event of another emergency.

Adopted last Thursday, the plan was drafted by a former intern from the Missouri State University, Sierra Thomas, who created the plan as part of a crisis and disaster management internship through the Camden County Emergency Management Agency. Thomas was later hired to a full-time position by the county.

The purpose of the COOP is to “ensure Camden County can maintain a viable system of government in response to a broad range of emergency and operational interruptions” that may include “routine business renovation or maintenance; mechanical failure of heating or other building systems; fire; inclement weather, flooding, or other acts of nature; or a range of threatened or actual attacks.”

First District Commissioner Bev Thomas recommended the office adopt the plan now and add changes later in the year. Several additional safety recommendations were added to the plan on a Feb. 1, 2017 amendment, mostly related to Information Technology (IT) communications.

“We have to approve this. I think they’re wanting to make some minor changes to it, but my suggestion would be that we approve it, because it’s been here now and as we need to make changes — amendments — later in the year, we can,” Thomas said. “I think we need to have this in place.”

Presiding Commissioner Greg Hasty said the office has three copies available on hard disks they plan to each store away from the courthouse and recalled a presentation made approximately a month ago by EMA Director Ron Gentry on the subject.

“I’m happy with all of it,” Hasty said. “I think she did an excellent job on it. Of course, this was all written before she was an employee.”

Second District Commissioner Don Williams was equally satisfied and made sure his fellow colleagues had ample time to review the document prior to the day’s vote.

“I was impressed by it. I thought it was thorough, detailed,” Williams said. “I couldn’t think of anything it didn’t cover. I thought it was very well done.”

According to the safety recommendation list, Sierra Thomas suggested the county purchase three roll-up ladders for $65 a piece to be placed on the windows in the auditor’s, treasurer’s and planning and zoning offices in the event of a fire.

The second suggestion was for the human resource’s department to keep a continually updated employee list on hand at all times, providing a copy of that to Gentry, designate “floor wardens” on each floor of the old courthouse and the creation of an up-to-date emergency contact roster.

In the event of an emergency, the last two suggestions dealt with continuity of government operations on a technical level. Thomas suggested providing a laptop or a backup hard drive to all members of the COOP team “in order to have all information accessible and mobile” as well as a regular backup of hard drives being used.

“There needs to be either an option to speak to all employees unanimously through the VOIP phones or the installation of an interoffice chat system,” Thomas wrote, suggesting several free options for inter-office communications channels. “Albeit everyone has access to their email while at their desk, not everyone checks their email on a regular basis throughout the day.”

Members of the COOP team include Gentry, Emergency Management Assistant Director Christina Helms, Maintenance Supervisor Mel Miller, Maintenance Assistant Supervisor David Garrison, Purchasing Supervisor Janet Fry and all three commissioners.

According to the document, essential functions have been classified under three tiers with the first tier requiring immediate restoration, the second tier within 24-48 hours and the third tier within 48-72 hours.

Tier I — County Commission, Emergency Management Department, Maintenance and Purchasing

Tier II — County Clerk, Treasurer, Auditor and Waste Water

Tier III — Mapping and Addressing, Collector, Payable (County Clerk Office), Recorder, Planning and Zoning and Assessor.

In the event of an emergency, the COOP team will meet up at the EMA office or a pre-determined location and establish a center of command led by Gentry. The EMA office will act as a temporary operations facility along with Huber & Associates in Jefferson City in the event of a cybersecurity emergency.

According to a risk matrix analysis attached to the plan, five potential hazards have been identified as well as mitigation solutions and actions required.

Tornadoes and fires have the highest likelihood of occurrence with a score of 5 and moderate impacts, followed by an active shooter at 4 and moderate impact, terrorism or HAZMAT at 3 and extreme impact and IT info breach at 2 and minor impact.

Mitigation in place for a tornado is listed as a small gathering area, while possible mitigation included a safer storm sheltering area, regular building integrity checks with action required listed as updating evacuation routes. In the event of a fire, there appears to be no mitigation in place, but the possibility of sprinters, fire drills and posted evacuation routes with action required listed as checking and verifying evacuation routes and equipment testing.

In the event of a terrorism or HAZMAT disaster, mitigation in place includes closed circuit television, with the possibility of added security and required action of monitoring the CCTV stream. Similar scenarios and recommendations are listed for an active shooter situation.

There appears to be no plan in order for an IT info breach as the graph lists “still needed” for mitigation in place, possible mitigation and required action.

“After completing the risk analysis as well as the business impact analysis I have drawn the conclusion that the highest risks that offices in the court house face are those of of damage from severe storms (tornado, general debris, heavy down pours, straight-line winds), fires (there are no sprinkler systems in the three story building), and the potential for civil unrest or singular attack on select offices by disgruntled county residents or previous employees,” Thomas wrote under the report’s conclusion.