St. Joseph Fortifies Digital Defenses with Comprehensive Cybersecurity Audit

At a glance

• First-ever audit: St. Joseph, Michigan, has hired an outside firm to audit its IT systems.
• Outside firm: CBIZ Cybersecurity and Audit Services will run the review.
• NIST framework: The audit follows the NIST Cybersecurity Framework and also covers the water plant’s operating technology.
• Cost: The contract costs $36,000, with $8,000 paid by the water plant and the rest from the city’s general fund.

City approves its first cyber audit

St. Joseph, Michigan, is getting its first cybersecurity audit. At a commission meeting in March 2025, City Manager Emily Hackworth said she wasn’t aware of the city ever having such a review. Commissioners approved the contract the same night, WSJM reported.

Why the city wanted an outside look

Hackworth said the audit will look at the city’s current IT setup for weak spots and risks. “I want to make sure that city staff and that I as a city manager understand what’s happening on our backend and ensure that we are as efficient as possible as well as as secure as possible,” she said, as quoted by WSJM.

CBIZ gets the contract

Finding a firm wasn’t easy, Hackworth said. Staff eventually picked CBIZ Cybersecurity and Audit Services, which does this kind of work nationwide. CBIZ recommended using the National Institute of Standards and Technology (NIST) Cybersecurity Framework as the yardstick.

The water plant is in scope

CBIZ also suggested reviewing the operating technology at the city’s water plant. City Commissioner Michael Sarola backed the idea, since the plant’s security affects the health of the whole community.

What the auditors will check

The review covers the city’s networks, systems and software. Findings should tell the city which fixes to make first.

Who pays

The audit costs $36,000. The water plant covers $8,000 and the city’s general fund pays the rest.

What comes next for St. Joseph

The audit gives St. Joseph a baseline it never had. The next step is acting on what CBIZ finds, starting with the most serious gaps on the city network and at the water plant.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.