Harmon County IT Department

Scenario: On a Friday at 2:45 PM, a finance department employee at FAC-01 clicks a phishing link in an email mimicking a Tyler Technologies invoice notification. Within 20 minutes, ransomware has spread across VLAN 10 via SMB, encrypting the Tyler Munis ERP application server (SRV-04), file server (SRV-07), and 47 administrative workstations. A ransom note appears demanding $180,000 in Bitcoin within 72 hours. The 911 CAD system (VLAN 30) is unaffected — VLAN segmentation held for public safety. However, county payroll totaling $2.1 million is due to be processed and disbursed by direct deposit on Monday morning. The Veeam backup server (SRV-09) is accessible but no restore has ever been tested. IT Director Webb is the only person authorized to make the ransom decision and is simultaneously fielding calls from the County Administrator, all department heads, and the Board of County Commissioners chair.

• What are the first 60 minutes of containment actions? Who do you notify, in what order, and what do you not do (e.g., reboot systems, run antivirus) that could destroy forensic evidence or worsen the spread?
• The county has never tested its Veeam backups. Walk through the decision tree for attempting a restore versus paying the ransom — what information do you need before making that decision, and who has authority to authorize a ransom payment on behalf of a county government?
• Ohio Revised Code §9.08 requires notification to Ohio DAS within 72 hours. Does this incident trigger that requirement? Draft the notification. Does the CORSA cyber insurance policy ($2M limit) require notification to the insurer before paying a ransom or engaging an IR firm?
• County employees will not receive payroll on Monday without Munis. What are the emergency payroll options — and which county official has authority to authorize emergency manual payroll disbursement under Ohio law?
• Which three specific C2M2 domain gaps most directly enabled this incident? For each, identify the specific practice that was not in place and estimate the cost of implementing it versus the cost of this incident.

Scenario: At 11:15 PM on a Saturday night — peak call volume period for 911 — the Zetron Viper CAD system (SRV-06) at FAC-03 crashes and does not respond to restart attempts. Dispatchers report that all CAD screens have gone dark. Incoming 911 calls are still being answered by the 12 dispatch consoles (the PSAP phone infrastructure is separate from the CAD server), but dispatchers have no computer-assisted dispatch capability and must revert to paper logs, radio, and verbal unit tracking. The 911 Communications Director pages IT Director Webb at 11:22 PM. Webb is on personal time 45 minutes from FAC-03. Zetron's support line confirms their SLA is "next business day" — the earliest a Zetron technician can be on-site is Monday at 8 AM. SRV-06 (Windows Server 2012 R2) has no recent backups (it is outside the Veeam scope), no hot spare, and has never been patched. The cause of the crash is unknown — it could be hardware failure, software corruption, or a cyberattack.

• What is the immediate notification chain? Who must be notified within the first 30 minutes — Sheriff, County Administrator, neighboring county 911 center, Ohio EMA, CISA? What is the legal obligation to notify the Ohio 911 Coordinator's office under Ohio RC §4931.49?
• Manual dispatch has not been practiced in over three years. How do you assess and manage the operational risk during the degraded dispatch period? What mutual aid agreements with neighboring counties should be activated, and who has authority to activate them?
• How do you determine whether this is hardware failure or a cyberattack — and does it matter for your immediate response actions? What forensic evidence preservation steps apply even if you suspect hardware failure?
• After restoration, what is the minimum acceptable patch and resilience posture for the 911 CAD system — and how do you make the business case to the Board of County Commissioners for emergency capital funding to replace an EOL life-safety server that has "never failed before"?
• Which C2M2 domains — specifically — failed in this scenario? What would a MIL 2 posture in each have looked like, and what would it have cost to achieve?

Scenario: At 9:10 AM on a Tuesday during pre-election Logic & Accuracy testing preparation, the Ohio Secretary of State field auditor present at FAC-08 observes that the Dominion Democracy Suite 5.17 EMS workstation has an active network cable connected to the county wall jack. A ping test from the auditor's laptop confirms the workstation is live on the county Admin VLAN (10.10.14.22). The auditor immediately stops all L&A testing and issues a verbal stop-work order. Under Ohio SoS directive, the EMS workstation must be completely air-gapped — no network connection, no Wi-Fi — during the entire pre-election period. Reimaging of the workstation may be required per SoS protocol if the isolation requirement was violated. The county Board of Elections Director, David Cho, is on-site. The primary election is 19 days away. Ballot programming on the EMS workstation is 70% complete. IT Director Webb is at FAC-01, 12 minutes away. The SoS auditor has given the county a two-hour window to respond before she suspends the L&A testing certification process entirely.

• What are the immediate decisions that must be made in the next two hours? Who makes them — the IT Director, Board of Elections Director, County Administrator, County Attorney, or the SoS auditor? What happens to the election timeline if L&A testing is suspended?
• The Ohio SoS protocol may require reimaging the EMS workstation if it was connected to the network during the pre-election period. What information do you need to know before deciding whether to reimage — and what are the consequences of reimaging (loss of 70% complete ballot programming) versus not reimaging (SoS may decertify the equipment)?
• Mandatory notification: who must be notified — Ohio SoS, CISA, county legal counsel, the Board of County Commissioners? What is the timeline for each notification, and what do you say in the notification?
• The EMS workstation was connected to VLAN 10 — the same VLAN as Tyler Munis, the file server, and 280 general workstations. What is the scope of potential compromise in both directions (from network to EMS, and from EMS to network)? How do you assess this in the two-hour window?
• After the immediate crisis: what policy, technical, and training controls would have prevented this? Which C2M2 domains cover election system supply chain management and configuration control?

Scenario: On a Monday morning, Sheriff Linda Torres delivers a certified letter to IT Director Marcus Webb. The letter is from the FBI CJIS Division Ohio Compact Officer notifying Harmon County of a scheduled CJIS Security Policy audit in 90 days — a "Triennial Compliance Audit" covering all county systems that access, process, or transmit Criminal Justice Information (CJI) via the statewide LEADS network. The audit will evaluate compliance with CJIS Security Policy v5.9.2, specifically Policy Area 1 (Information Exchange Agreements), Policy Area 4 (Auditing and Accountability), Policy Area 5 (Access Control), Policy Area 6 (Identification and Authentication), and Policy Area 8 (Configuration Management). The Sheriff asks Webb to confirm that the county is compliant. Webb knows immediately it is not. The most significant gaps: no MFA on VPN for remote CJIS access (direct §5.6.2.2 violation), no MDM for 12 Sheriff mobile devices, missing screensaver timeout policy on Sheriff workstations, and the VLAN 10→VLAN 20 ACL misconfiguration that allows admin network traffic to reach the CJIS segment.

• What do you tell the Sheriff right now — and what do you not say without county legal counsel present? What is the legal exposure for the Sheriff personally if the county is found to be in CJIS non-compliance during the audit?
• In 90 days, what can realistically be remediated? Prioritize the four identified gaps by: (a) time to remediate, (b) cost to remediate, and (c) audit consequence if not remediated. Which gap, if unmitigated, is most likely to result in a LEADS suspension?
• The VLAN ACL misconfiguration (VLAN 10→VLAN 20) is a structural network change requiring a maintenance window. How do you plan and execute this change without disrupting Tyler New World RMS operations for the Sheriff and Courts — and how do you document the remediation for the auditors?
• CJIS Policy Area 6 (§5.6.2.2) requires "advanced authentication" equivalent to MFA for any remote access to CJI. Pulse Secure supports RADIUS-based MFA integration with Duo Security. What is the implementation plan, timeline, and cost to achieve CJIS-compliant MFA for the county VPN in 90 days? What is the business case to the Board of County Commissioners?
• If the audit finds non-compliance, what are the consequences — immediate LEADS suspension, corrective action plan, or both? How does LEADS suspension affect the Sheriff's operations for the 2–4 weeks it typically takes to remediate and restore access?

Scenario: On a Thursday at 3:20 AM, a Microsoft 365 Defender alert (one of only a handful configured) fires to the IT Director's personal email. The alert flags a successful interactive sign-in to a county Microsoft 365 account from an IP address geolocating to Kyiv, Ukraine. The compromised account is the shared "countyit" service account — the Domain Administrator account used for all server management. A follow-up check of the county network logs (manually reviewed on the Fortinet FortiGate) shows that the "countyit" account authenticated to SRV-08 (the COGNOS BI server hosting federal tax information) at 3:24 AM and ran two SQL queries against the COGNOS database before the session dropped. The COGNOS database contains Federal Tax Information (FTI) for approximately 41,000 Harmon County property tax accounts — names, addresses, partial SSN data, and prior-year income brackets used for property tax calculations. IRS Publication 1075 §10.0 requires notification to the IRS Office of Safeguards within 24 hours of discovering a potential FTI breach.

• What are the immediate containment actions — specifically, how do you disable or rotate the "countyit" shared account without locking out all active IT staff and potentially breaking server-to-server communications that depend on that account?
• IRS Publication 1075 §10.0 requires notification to the IRS Office of Safeguards within 24 hours of a potential FTI disclosure. Draft the incident notification. Who at the county is authorized to submit an IRS Pub 1075 notification — the IT Director, County Administrator, County Auditor, or County Attorney?
• The COGNOS SQL logs show two queries were executed. What do you need to know about those queries to determine whether FTI was actually exfiltrated — and how do you obtain that information from an EOL SQL Server 2014 instance that has no formal audit trail configuration?
• The compromised account is the shared "countyit" Domain Administrator. This means the attacker — if they maintained access — had full control of all 10 county servers, all 8 facilities, and all county systems at 3:24 AM. How do you scope the full extent of the potential breach, and what does "assume compromise of everything" mean operationally for county government?
• After resolution: the IRS Pub 1075 requirement to notify 41,000 affected residents may apply depending on investigation outcome. What are the costs — financial, legal, and reputational — of a county government sending breach notification letters to 41,000 property tax account holders? Which C2M2 domain gaps (minimum three) directly caused this incident?