Explanation
This ordinance authorizes the City Auditor to set up a certificate in the amount of $2,500,000.00 to implement a comprehensive Cyber Security program. The city is in need of a universal system of addressing cyber-security issues to be adopted and practiced throughout the city.
The Department of Technology (DoT) serves 21 quasi-independent departments, encompassing six elective offices and 15 administrative agencies, many with IT investments unique to their department. Overall, the city’s enterprise IT investment of approximately $60 million is growing by around 32% annually in new and/or upgraded tech purchases. Further, the number, scale, state and whereabouts of city systems, data and connected devices is unknown. As such, the city is in need of a universal system of risk, tech, cybersecurity and contracting practices that are consistently practiced and monitored for all IT procurements in the city.
Through solicitation of proposals, DoT will undertake a three-phased approach to establishing an on-going citywide IT cybersecurity and privacy plan. The first phase will be to identify and assess current and future cyber threats. Once identified, the department will triage the threats and take steps to remediate them. The final phase will be to maintain and secure all city systems. DoT will, within two years, bring all city systems up to code and will secure new purchases as they occur.
The moneys to be certified following passage of this ordinance will be used to contract with a qualified vendor for the study and implementation of a comprehensive cybersecurity program. This vendor will be selected through the formal solicitation of proposals.
After proposals have been accepted, DoT will submit ordinances seeking Council authorization to enter into contracts. This ordinance also authorizes the expenditure of $2,500,000.00 for the purpose described above.
Emergency Justification: Emergency action is being requested so that a certificate can be established prior to the City Auditor’s 2021 year-end deadline.
Fiscal Impact: $2,500,000.00 was expressly budgeted, and is available in the 2021 Information Services operating fund for implementation of a comprehensive cybersecurity program.
Title
To authorize and direct the City Auditor to set up a certificate in the amount of $2,500,000.00 to enter into contract for the implementation of a comprehensive Cyber Security program for various city agencies; to authorize the expenditure of $2,500,000.00 from the Information Services Operating fund for the purpose described above, and to declare an emergency. ($2,500,000.00)
Body
WHEREAS, the city is in need of a universal system of addressing cyber-security issues to be adopted and practiced throughout the city; and
WHEREAS, funds totaling $2,500,000.00 were budgeted in the Department of Technology’s 2021 operating budget for the purpose of contracting with a qualified vendor to develop and implement the above-noted comprehensive cyber-security system; and
WHEREAS, in accordance with the relevant provisions of the Columbus City Code, Chapter 329 the Department of Technology will solicit formal proposals for the above-noted system; and
WHEREAS, to ensure the availability of moneys budgeted in the 2021 Information Services Operating Fund for the above-noted purpose in 2022, it is necessary to authorize the City Auditor to establish a certificate in the amount of $2,500,000.00; and
WHEREAS, it is necessary to authorize the expenditure of $2,500,000.00 from the Information Services Operating fund; and
WHEREAS, DoT will submit ordinances seeking Council authorization to enter into contracts with the selected consultants; and
WHEREAS, an emergency exists in the usual daily operation of the Department of Technology in that it is immediately necessary to authorize the City Auditor to establish a certificate in the amount of $2,500,000.00 to ensure the availability of funds for the implementation of a comprehensive cyber-security program for the preservation of public health, peace, property, safety, and welfare; NOW, THEREFORE
BE IT ORDAINED BY THE COUNCIL OF THE CITY OF COLUMBUS:
SECTION 1. That the City Auditor is hereby authorized to establish a certificate in the amount of $2,500,000.00 to ensure the availability of funds in 2022 to contract with a qualified vendor to develop and implement a comprehensive cyber-security program for the City of Columbus. The Department of Technology will submit future ordinances seeking Council authorization to enter into contracts with selected consultants.
SECTION 2. To authorize the expenditure of $2,500,000.00 from the Information Services Operating fund for the purpose stated in Section 1. (See attachment 3011-2021EXP)
SECTION 3. That the funds necessary to carry out the purpose of this ordinance are hereby deemed appropriated, and the City Auditor shall establish such accounting codes as necessary.
SECTION 4. That the City Auditor is authorized to make any accounting changes to revise the funding source for all contracts or contract modifications associated with this ordinance.
SECTION 5. That for the reasons stated in the preamble hereto, which is hereby made a part hereof, this ordinance is hereby declared to be an emergency measure and shall take effect and be in force from and after its passage and approval by the Mayor, or 10 days after passage if the Mayor neither approves nor vetoes the same.