Oct 29, 2025 | AOC Business Partner
Sponsored content contributed by AOC Business Partner: The Partners Group
As a commercial insurance broker specializing in public entities, we often hear a familiar refrain: “We don’t handle sensitive data directly, our vendors do.” Whether it’s a county outsourcing tax payment processing, a city using a cloud provider for record storage, or a school district contracting payroll to a third-party app, many organizations believe that shifting operations to vendors also shifts the cyber risk. Unfortunately, that assumption can be costly and dangerous.
Third-Party Reliance Doesn’t Eliminate Liability
When a public entity uses outside vendors for IT, billing, data management, or any other online activity, the exposure doesn’t disappear. Most contracts with third-party providers include liability limitations and hold-harmless clauses that protect the vendor, not the municipality or district. If a vendor’s system is breached and residents’ personal data is exposed, your entity will likely still bear the brunt of public scrutiny, notification obligations, regulatory fines, and legal costs. Even if the vendor bears the costs of repairing data, your organization may be unable to provide essential services for weeks or months. The time it takes to return to business in ransomware attacks ranges from three weeks to up to many months.
You can outsource operations, but you can’t outsource accountability. Cyber insurance ensures that when a vendor fails, your services remain financially protected, and most policies also provide forensic and IT experts and communications professionals to get services up and running as soon as possible with appropriate public and internal communications.
Real-World Example: Business Interruption From Vendor Outage
Consider a regional water district that relied on a third-party software vendor to manage billing and service requests. When the vendor’s servers were hit by ransomware, the district couldn’t issue bills for over six weeks. The disruption didn’t occur on their own network, but the result was the same: lost revenue, overtime for manual workarounds, and reputational damage.
A well-structured cyber policy covers these business interruption losses, even when caused by a third-party service provider. Without that coverage, the district must absorb the financial hit while still fielding angry calls from residents.
Phishing: The Human Element
Cyber incidents are often sophisticated but bad actors’ access is often very basic and relies on human error or psychology. One small Oregon city fell victim to a phishing attack in which an employee received an email appearing to be from a vendor requesting updated banking information. Payments were redirected to a fraudulent account for nearly a month before detection. The funds were unrecoverable.
This is a classic case of social engineering, a coverage extension under most cyber policies. Even well-trained staff can make mistakes under pressure. Cyber insurance helps recover the financial losses from these scams and can also cover forensic investigation, notification, and legal response.
Public Entities Are Prime Targets
Public institutions maintain large databases of personal information, often with lean IT resources and outdated infrastructure. Hackers know that municipalities and school districts can’t afford extended downtime, making public entities prime targets for ransomware and extortion.
Even if your entity uses a vendor for email, payroll, and data storage, you’re still responsible for ensuring the continuity of essential services and protecting constituent data. Cyber insurance fills the gaps that neither general liability nor vendor agreements address.
The Bottom Line
Third-party vendors play a vital role in modern government operations, but they are not your safety net. A single breach, outage, or phishing attack can ripple across essential services, disrupt budgets, and erode public trust. Cyber insurance is a fundamental layer of protection for every public entity, regardless of size or sophistication. The Partners Group specializes in providing this coverage to match and protect your needs.
Oct 29, 2025 | AOC Business Partner
Sponsored content contributed by AOC Business Partner: Covenant Global
Not long ago, one of our clients — a mid-sized organization responsible for critical community services — had a wake-up call that changed how they viewed cybersecurity forever.
It started like any other week. Then, late one evening, unusual activity appeared on their network: a legitimate business program being used for malicious intent. Within an hour, our team, supported by Fortify’s layered protections, detected and contained the threat before it could spread.
By the next morning, the organization’s leadership was side-by-side with our engineer reviewing every device, seeing firsthand the difference between being caught off guard and being prepared. Exhausted but grateful, they said what so many organizations only realize afterward:
“Now I understand. Now I know why this matters.”
That incident could have led to weeks of downtime, disrupted operations, and a loss of public trust. Instead, it became a one-day lesson in why a strong cybersecurity foundation is not optional — it’s operational resilience in action.
Fortify: Strength Through Preparedness
Covenant Global’s Fortify framework was built for organizations that protect people, data, and public trust.
Fortify strengthens your Microsoft environment, hardens configurations, and establishes continuous monitoring and governance aligned with CISA and CIS 18 standards. It’s a proactive approach to compliance and security — ensuring your organization is not only protected, but ready to respond and recover when needed.
Cybersecurity isn’t about fear; it’s about foresight. And foresight is leadership.
Let’s Continue the Conversation at the AOC Conference
We’ll be at the AOC Annual Conference in November, and we’d love to connect in person. If you’re ready to take a more proactive approach to cybersecurity, this is the perfect time to start.
Ask us about your Security Score Assessment — a complimentary, data-driven review that benchmarks your Microsoft environment against CISA-recommended security standards.
Together, we can help you protect what matters most: your people, your data, and your ability to serve your community.
Schedule your Security Score Assessment today or stop by our booth at AOC to learn more.
Oct 1, 2025 | AOC Advocacy
The Legislature is meeting in Salem this week for Interim Legislative Days committee hearings. As always, your AOC Legislative Affairs Department actively participates in and monitors hearings, and will use the opportunity to connect with legislators, particularly around AOC Policy Priorities while they are in Salem.
The Legislature will convene for additional sets of Legislative Days meetings before the 2026 regular session — Nov. 17-19, 2025, and Jan. 13-15, 2026.
Below are links and highlights from the hearings with particular relevance to county governance, services, and budgets.
Joint Interim Committee on Transportation
- Oregon Department of Transportation presentations
Senate Interim Committee on Labor and Business
- Oregon Employment Department presentation
- Report on unemployment data
- Around 7,500 jobs added in the month of August 2025, but a net loss of over 15,000 jobs from January to August 2025
- Unemployment rates are rising
House Interim Committee on Emergency Management and Veterans
- AOC, Oregon State Sheriffs Association, and the League of Oregon Cities presentation on Local Emergency Management and Federal Funds
- Uncertainty around federal grant funds continues. Several programs have had funding notices issued, but are subject to court cases regarding terms and conditions related to immigration enforcement.
House and Senate Interim Committee on Judiciary
- Oregon Crime Statistics Update from the Criminal Justice Commission (CJC)
- CJC provided an update on the statewide picture of crime through the end of 2024.
- Department of Public Safety Standards and Training, Oregon State Sheriffs Association, and Oregon Association of Chiefs of Police update on Law Enforcement Identification
- Presentation on local law enforcement practices that present a uniform appearance and promote public trust
- Lane County and Seattle Drug Deflection
Senate Interim Committee on Veterans, Emergency Management, Federal and World Affairs
- Oregon Emergency Management (OEM) Update
- Informational update about past disasters and federal funding. OEM’s message that uncertainty around federal funding impacts emergency preparedness is well-aligned with AOC.
House Interim Committee on Rules
- Oregon Government Ethics Commission (OGEC) Presentations
- OGEC advisory opinion No. 25-126A (food and beverages for public officials and employees)
- If a local government does not adopt an official compensation package that includes meals for public officials, then accepting food and beverage violates ORS 244.040(1)
- FAQ on serial meeting communications
- Key takeaways:
- A quorum of a governing body does not have to be engaged in the same form of communication at the same time for it to be considered a prohibited serial communication
- Prohibited serial communications can occur during a public meeting through electronic messages or even hand-written notes
- A quorum of governing body members should not attend town halls or community events to discuss matters within the governing body’s jurisdiction. If a quorum is present, then the governing body would need to hold the gathering as a public meeting
- AOC staff will be engaging in a legislative workgroup with local government partners in the fall of 2025 to address the food and beverage opinion and serial meeting communications issues.
Senate Interim Committee on Housing and Development
- Department of Land Conservation and Development presentations
House Interim Committee on Housing and Homelessness
- Housing Accountability and Production Office (HAPO) update
- The HAPO is tasked with ensuring local land use codes and decisions meet state law, provide technical assistance and funding to local governments to update their land use codes, and research areas where barriers still exist to develop ways to help local governments, such as model codes and permit-ready plans.
Senate Interim Committee on Natural Resources and Wildfire
- Oregon Department of Forestry and the Oregon State Fire Marshal presentation on the 2025 wildfire season
- The AOC Natural Resources Steering Committee will hear this presentation on Oct. 10.
Senate Interim Committee on Finance and Revenue
- The Legislative Revenue Office overview of the impact of Federal House Resolution 1 (H.R.1) on the state’s General Fund, as well as the most relevant tax breaks to individual and business tax filers
- Panels of advocates in support and opposition of Oregon disconnecting from the federal tax code gave presentations to the committee.
House Interim Committee on Early Childhood and Human Services
- Impacts of federal level changes on nutrition assistance and early learning programs
- Oregon Head Start programs experienced frozen funding and award delays throughout 2025. The regional office serving the Pacific Northwest was eliminated, resulting in loss of direct contacts at the federal agency and of technical and administrative support.
- About 310,000 adults will need to be reviewed for work requirements or exceptions for Supplemental Nutrition Assistance Program (SNAP) eligibility; about 3,000 individuals will lose benefits, including refugees, asylees, and other conditionally allowed individuals. SNAP benefits won’t rise with food prices, making it harder for people to afford groceries. About 29,000 households will see an average monthly benefit decrease of $58.
Joint Interim Committee on Ways and Means Subcommittee on Human Services
- Work session: retroactive approval of Oregon Health Authority application to the Substance Abuse and Mental Health Services Administration (SAMHSA) for supplemental Community Mental Health Services Block Grant funding of $302,198. Approved, referred to Full Ways and Means.
House Interim Committee on Health Care
Senate Interim Committee on Human Services
- Stabilization and Crisis Unit (SACU) Transformation Planning
- SB 1557 (Delivery of mandatory services to kids with complex needs) implementation report
House Interim Committee on Behavioral Health
- Oregon Health Authority Behavioral Health Division
- Department of Consumer and Business Services, Division of Financial Regulation
- Care Oregon
- Association of Oregon Community Mental Health Programs
Senate Interim Committee on Early Childhood and Behavioral Health
Oct 1, 2025 | AOC Advocacy, Health & Human Services
In case you missed it: Sept. 26 Local Government Advisory Committee (LGAC) on Health and Human Services (Meeting recording and chat transcript)
Rural health
Oregon’s Office of Rural Health (ORH) was established by the Legislature in 1979 and moved from the state public health department to OHSU in 1989. It collects data and provides reports, technical assistance and coordination of rural health activities, as well as recruitment support for rural communities’ health care and Emergency Medical Services (EMS). ORH defines ‘rural’ as any geographic area in Oregon ten or more miles from the centroid of a population center of 40,000 people or more, and ‘frontier’ as any county with six or fewer people per square mile.
Director Robert Duehmig’s slides provide several maps illustrating the locations of these areas, details and links on their available workforce recruitment and retention programs, and examples of the technical assistance and tailored reporting available to rural communities. This technical assistance may be particularly useful to volunteer-staffed EMS to train them on billing practices to maximize service reimbursements.
ORH staff will return to LGAC early next year to provide an update on the implementation of their integrated mobile health program funded by a new Health Resources and Services Administration (HRSA) grant.
Oregon Health Authority (OHA) Policy Director Steph Jarem gave an update on Oregon’s Rural Health Transformation plan development in response to the application released by the Centers for Medicare and Medicaid Services (CMS) on Sept. 15. A public forum will be held the week of Oct. 6 to gather additional input. The application is due Nov. 5 and award decisions are expected by Dec. 31 for a five-year grant. OHA expects to release its RFP in mid-February with local award decisions slated for early May. Director Jarem’s slides provide helpful details on federal eligibility requirements, allowable and not allowable use of funds, and Oregon’s four priority areas. The ‘ruralness’ score estimates for the program are posted on the Sheps Center website.
Wildfire season recap
While there is still some fire activity, the season is quickly winding down. It was a lighter than expected year with only two major events ─ the Rowena Fire in Wasco County and the Flat Fire in Deschutes and Jefferson counties. The state Office of Resilience and Emergency Management (OREM) is providing recovery coordination which includes training and support to local human services partners for safe drinking water and hygiene and providing impact assessment and disaster case management at a per household level.
The county-based disaster registry is an especially valuable tool, with the help of OREM, to populate ahead of an event to allow for very precise evacuation planning for community members at highest risk and efficient emergency response during a disaster.
Recovery coordination is ongoing for the 2025 spring floods in Harney, Douglas, Coos and Malheur counties and for communities impacted by the 2020 wildfires. Director Ed Flick’s slides include a map of resilience hub resources deployed across the state, details of the Genasys Evac tool OREM is piloting and a look ahead at two likely 2026 legislative session bills.
State response to federal policy and funding actions
Interim Deputy Public Health Director Danna Drum reported that the Women Infants and Children program is the only public health program expected to be impacted by the imminent shutdown of the federal government, with current funding likely to run out Oct. 15. Other programs can be maintained through the end of the calendar year and retroactive payment is anticipated once federal funding resumes.
The Oregon Housing and Community Services department is awaiting direction from federal agencies on the implementation of the presidential executive order on homelessness response. Counties and other federally funded Continuum of Care administrators are concerned about the likely fracturing of local homelessness response programs and coordination when federal policy mandates begin to conflict with state policy mandates for state-funded homelessness prevention and response services.
Ashley Thirstrup from the OHA director’s office shared this August Oregon Department of Administrative Services analysis which includes the following excerpt:
“H.R. 1 Medicaid program changes have varying implementation dates. Effective fall 2026, OHA anticipates $22 million in reduced funding, impacting services for certain non-citizens, which includes asylees, refugees, and victims of human trafficking. As noncitizens lose access to services under this category, these populations will likely shift to access coverage under the Healthier Oregon Program (HOP) in order to access benefits. It is not yet clear how these changes will impact Tribal populations’ ability to access Medicaid-funded health services.
“Beginning January 1, 2027, OHA will have to implement changes to meet updated requirements to access Medicaid-funded services. To comply with these changes, OHA will need to make upgrades to existing IT systems to ensure that benefits are being offered in alignment with H.R. 1 provisions. OHA noted a potential need for additional staff to manage call centers to help benefit enrollees navigate pending program and benefit application changes, and staff will be needed to begin verifying eligibility of plan holders beginning in 2027. OHA projects that upon implementing processes to verify benefit eligibility every six months, Oregon will see a reduction in Medicaid funding of $127 million in the 2025-27 biennium, $534 million in the 2027-29 biennium, and $571 million in the 2029-31 biennium. When OHA implements processes to ensure that enrollees comply with work requirements, the projected revenue lost is $344 million in the 2025-27 biennium, $2.2 billion in the 2027-29 biennium, and $2.3 billion in the 2029-31 biennium.
“While OHA manages upgrading existing IT systems to enact this work, the agency will also be working to complete work to stand up a new State Based Marketplace for individuals to secure health insurance coverage. It will be important to ensure that OHA has the capacity and clarity needed to deliver on the work required in H.R. 1, as well as projects included in the agency’s 2025-27 budget. OHA anticipates receiving approximately $175 million to support rural hospitals and health systems during the 2025-27 biennium.
“H.R. 1 will also reduce the resources OHA can draw down from Medicaid based on the Hospital Provider Tax assessed on providers and insurers. The projected reductions to revenue will be $603 million in the 2027-29 biennium, and $1.7 billion in the 2029-31 biennium. Additionally, adults that have Medicaid-funded plans through the Affordable Care Act will have to share a portion of the costs for accessing benefits and services.”
Oregon Department of Human Services Deputy Director of Self Sufficiency Programs Jessica Amaya Hoffman shared the agency’s analysis of the impacts of H.R. 1 on the USDA’s Supplemental Nutrition Assistance Program (SNAP) in Oregon. Immediate impacts include:
“The current levels of support to community providers serving existing SNAP clients will be insufficient to meet needs once SNAP benefits are reduced or eliminated for a portion of the current caseload. The exemption of certain individuals from SNAP benefits will likely place additional pressure on the food bank system as well as other systems of social support throughout Oregon. About 310,000 adults will need to be reviewed for work requirements or exceptions for SNAP eligibility; about 3,000 individuals will lose benefits, including refugees, asylees and other conditionally allowed individuals. SNAP benefits won’t rise with food prices, making it harder for people to afford groceries. About 29,000 households will see an average monthly benefit decrease of $58.
“It should be noted that ODHS expects significant staffing cost increases to comply with the changes in H.R. 1, particularly in the Oregon Eligibility Partnership (OEP) to administer the new Medicaid-eligibility and redetermination requirements. The effective date for many of those changes is December 31, 2026. The changes will require extensive administrative infrastructure, including monthly verification systems, rulemaking, notices, and coordination across ODHS, the Oregon Health Authority (OHA), and the Employment Department. Implementation of the changes will also require significant IT system changes that will carry additional costs. For example, ODHS has estimated a need for approximately 600 positions solely for the more frequent Medicaid eligibility redeterminations.
“Aside from immediate impacts to ODHS customers, the Department is in the process of forming a team to bring down the SNAP error rate. Under H.R. 1, if the SNAP error rate is below 5.99 percent, a state’s share of the cost of benefits remains at zero percent. Only eight states are below 5.99 percent, according to the most recent data reported by Federal Funds Information for States. OEP has indicated that the SNAP error rate will still be above the national average for federal fiscal year 2024, the error rate is expected to be closer to 13 percent, compared to 16 percent in 2023 and 22 percent in 2022. If Oregon can bring down the SNAP error rate, potential savings are significant. If the current error rate continues, the state will be responsible for 15 percent of SNAP benefit costs or approximately $0.5 billion per biennium.”
Contributed by: Jessica Pratt | Legislative Affairs Manager
