Explanation
BACKGROUND
This ordinance authorizes the Director of the Department of Technology to enter into contract for the procurement of a Governance, Risk, and Compliance (GRC) tool. This procurement falls under the Ohio Revised Code (ORC) 9.64.
The City of Columbus, Department of Technology, seeks to implement a solution to support organizational governance and ensure compliance with the administrative requirements of ORC 9.64. This GRC tool is a customizable platform that will establish an automated framework for the continuous monitoring of organizational controls, the maintenance of a comprehensive risk register, and the systematic tracking of corrective action plans and project milestones. By unifying disparate operational data into auditable workflows, the Department shall ensure transparent internal reporting, risk mitigation, and timely deficiency remediation across all departmental systems.
The Governance, Risk, and Compliance (GRC) implementation represents a strategic technology investment that will establish a foundational cybersecurity and compliance management platform for the City. The initial project includes platform acquisition, implementation services, configuration, workflow development, data integration, and deployment activities necessary to create a long-term enterprise capability supporting cybersecurity governance, risk management, regulatory compliance, corrective action tracking, and continuous monitoring. These implementation activities provide a multi-year benefit to the City by establishing the underlying technology framework that will support ongoing compliance with Ohio Revised Code 9.64 and related cybersecurity initiatives.
Ordinance 0260-2023 authorized the Director of Technology to enter contract with RSM US LLP to provide a review of available software solutions that manage on-going activities necessary to reduce risk and comply with current mandates. As a result of this project, it was determined that the vendor advised by RSM US LLP will best fit the needs of the City. Consequently, the Department of Technology requests a bidding waiver under City Code Section 329 to enter contract with said vendor for the procurement of its secure cloud-based data platform.
The term of the proposed contract is one year, expiring one year from the date of the confirmed purchase order, with the option to renew for four additional one-year terms. This ordinance authorizes funding for the first year of the contract term. The Department of Technology will plan for future costs of this contract within its operating budget and will seek Council approval for such funding, as required by City Code.
The vendor for this procurement is not debarred according to the Excluded Party Listing System of the Federal Government or prohibited from being awarded a contract according to the Auditor of State Unresolved Findings for Recovery Certified Search.
CONTRACT COMPLIANCE
Vendor is contract complaint.
Expiration date: 5/13/2028
FISCAL IMPACT
The funding of $336,890 is budgeted within the Department of Technology 2025 Capital Improvements Budget, Fund 5105. A budget amendment and transfer of funds is necessary to establish sufficient budget authority for the project, which includes $135,090.00 in contingency funds. The subsequent annual subscription fee is $190,950.00, which will be planned and budgeted for by the Department of Technology operating budget if renewals of this contract are pursued.
EMERGENCY DESIGNATION
An emergency designation is necessary to avoid immediate operational disruptions and ensure the timely implementation of mandatory regulatory controls per ORC 9.64.
Title
To amend the 2025 Capital Improvement budget; to authorize the transfer of funds within the Information Services G O Bonds Fund; to waive the competitive bidding provisions of Chapter 329 of the Columbus City Codes; to authorize the Director of the Department of Technology to enter contract for a Governance, Risk, and Compliance tool with the option to renew for four additional one-year terms; to authorize an expenditure from the Information Services G O Bonds Fund; and to declare an emergency. ($336,890.00)
Body
WHEREAS, the Department of Technology has a need to implement a Governance, Risk, and Compliance (GRC) tool to ensure compliance with the administrative requirements of ORC 9.64; and
WHEREAS, the Department of Technology requires funding to be available for the Security Program - GRC Tool project for the procurement a Governance, Risk, and Compliance (GRC) tool; and
WHEREAS, it is necessary to amend the 2025 Capital Improvement Budget to establish authority within the correct project; and
WHEREAS, it is necessary for Council to authorize a transfer of funds within Fund 5105, the Information Services G O Bonds Fund, to establish sufficient cash to pay for the project; and
WHEREAS, it is in the best interest of the City to waive the competitive bidding provisions of City Code Chapter 329 as the vendor was selected after RSM US LLP provided a review of available software solutions that manage on-going activities necessary to reduce risk and comply with current mandates; and
WHEREAS, this ordinance authorizes the Director of the Department of Technology to enter a contract for the purchase of the vendor’s GRC tool, with the option to renew for four additional one-year terms; and
WHEREAS, it is necessary to authorize the expenditure of up to $336,890.00 for the purchase of software platform licensing and professional services, which includes $135,090.00 in contingency funds; and
WHEREAS, an emergency exists in the usual daily operations of the Department of Technology in that it is immediately necessary to authorize the Director to enter contract for the purchase of a GRC tool for the preservation of public health, peace, property and safety and welfare; now, therefore
BE IT ORDAINED BY THE COUNCIL OF THE CITY OF COLUMBUS:
SECTION 1. That the 2025 Capital Improvements Budget authorized by ordinance 1790-2025 be amended as follows to establish sufficient authority for this project:
Fund / Project / Project Name / Current / Change /C.I.B. as Amended
5105 / P470071-100000 / Telephony and IVR Infrastructure (Information Services Carryover) / $0.00 / $133,373.00 / $133,373.00 (to match cash for cancellation)
5105 / P470047-100002 / Enterprise System Upgrades - Security Program (Information Services Carryover) / $41,000.00 / ($41,000.00) / $0.00
5105 / P470052-100001 / IVR Telephony Enhancements-Upgrades (Information Services Carryover) / $60,637.00 / ($56,764.00) / $3,873.00
5105 / P470071-100000 / Telephony and IVR Infrastructure (Information Services Carryover) / $133,373.00 / ($133,373.00) / $0.00
5105 / P470075-100000 / Security Program (Information Services Carryover) / $300,000.00 / $105,754.00 / $194,246.00
5105 / P470075-100001 / Security Program - GRC Tool (Information Services Carryover) / $0.00 / $336,891.00 / $336,891.00
SECTION 2. That the transfer of $41,000.00, or so much thereof as may be needed, is hereby authorized within Fund 5105 (Information Services G O Bonds Fund), from Dept-Div 4702 (Information Services), Project P470047-100002 (Enterprise System Upgrades - Security Program), Object Class 06 (Capital Outlay) to Dept-Div 4702 (Information Services), Project P470075-100001 (Security Program - GRC Tool), Object Class 06 (Capital Outlay) between projects per the account codes in the attachment to this ordinance.
SECTION 3. That the transfer of $56,764.00, or so much thereof as may be needed, is hereby authorized within Fund 5105 (Information Services G O Bonds Fund), from Dept-Div 4702 (Information Services), Project P470052-100001 (IVR Telephony Enhancements-Upgrades), Object Class 06 (Capital Outlay) to Dept-Div 4702 (Information Services), Project P470075-100001 (Security Program - GRC Tool), Object Class 06 (Capital Outlay) between projects per the account codes in the attachment to this ordinance.
SECTION 4. That the transfer of $133,373.00, or so much thereof as may be needed, is hereby authorized within Fund 5105 (Information Services G O Bonds Fund), from Dept-Div 4702 (Information Services), P470071-100000 (Telephony and IVR Infrastructure), Object Class 06 (Capital Outlay) to Dept-Div 4702 (Information Services), Project P470075-100001 (Security Program - GRC Tool), Object Class 06 (Capital Outlay) between projects per the account codes in the attachment to this ordinance.
SECTION 5. That the expenditure of $336,891.00, or so much thereof as may be needed, is hereby authorized in Fund 5105 (Information Services G O Bonds Fund), Dept-Div 4702 (Information Services), Project P470075-100001 (Security Program - GRC Tool), in Object Class 06 (Capital Outlay) per the accounting codes in the attachment to this ordinance.
SECTION 6. That the Director of the Department of Technology be and is hereby authorized to enter into contract for Governance, Risk, and Compliance (GRC) tool at a cost of $336,890.00, starting on the date of a confirmed purchase order, with the option to renew for four additional one-year terms.
SECTION 7. That this Council finds it in the City's best interest to waive the competitive bidding provisions of Chapter 329 of City Code to enter this contract and does hereby waive the same.
SECTION 8. Funds are hereby deemed appropriated and expenditures and transfers authorized to carry out the purposes of this ordinance, and the City Auditor shall establish such accounting codes as necessary.
SECTION 9. That the City Auditor is authorized to make any accounting changes to revise the funding source for all contracts or contract modifications associated with this ordinance.
SECTION 10. That the City Auditor is hereby authorized to transfer the unencumbered balance in a project account to the unallocated balance account within the same fund upon receipt of certification by the Director of the Department administering said project that the project has been completed, and the monies are no longer required for said project.
SECTION 11. That for the reasons stated in the preamble hereto, which is hereby made a part hereof, this ordinance is hereby declared to be an emergency measure and shall take effect and be in force from and after its passage and approval by the Mayor, or ten days after passage if the Mayor neither approves nor vetoes the same.