STAFF REPORT TO THE CITY COUNCIL
DATE: Regular Meeting of April 12, 2022
TO: Members of the City Council
VIA: Dante Hall, City Manager
SUBMITTED BY: Lori Martin, Contract Assistant to Administrative Services Director/City Clerk SUBJECT: Adoption of a Resolution Amending the Internal Service Fund FY 2021-22 Budget for Information Technology Services increasing its appropriation by $400,000 and authorizing acceptance of reimbursement proceeds from cyber insurance in the amount of approximately $330,000 RECOMMENDED ACTION:
Adopt a resolution amending the Internal Service Fund FY 2021-22 Budget for Information Technology Services increasing its appropriation by $400,000 FISCAL IMPACT OF RECOMMENDATION:
The cost of the City’s recovery and response to a recent data breach incident will require an additional appropriation of $400,000. There is sufficient available balance in the Internal Service Fund – Information Technology Services to absorb the cost. Pursuant to the City’s cyber insurance policy the city will be reimbursed for the costs associated with the breach response and business interruption costs minus a $50,000 SIR/Retention payment. A resolution amending the City’s Internal Service Fund FY 2021-22 Budget has been prepared for City Council adoption.
EXECUTIVE SUMMARY:
Staff recommends that Council amend the FY 2021-22 Internal Service Fund FY 2021-22 budget for Information Technology Services in an amount not to exceed $400,000 to allow for the City’s recovery and response to a recent data breach incident. Staff has identified $380,000 in costs to date, some of which are estimations and therefore staff is requesting a not to exceed budget appropriation of $400,000 to allow for additional expenses not accounted for and/or received to date. Fortunately, the City through the Municipal Pooling Authority “MPA” maintained a robust insurance policy to cover data breach incidents and most of these expenses will be reimbursed by our insurer.
A listing of costs incurred and estimated costs related to the recent data breach response and recovery efforts are attached hereto. Also provided in this list is the City’s cyber insurance coverage limits. The costs identified in the attached Data Breach Response and Recovery Expenditures of approximately $351,000 are reimbursable expenses by the City’s cyber insurance policy minus the City’s SIR/retention of $50,000.
The City of Hercules is a member of Municipal Pooling Authority “MPA”, a Joint Powers Authority “JPA” where the City obtains its insurance products in a cost effective pooled risk management program. Staff would like to recognize MPA Staff and Board for their foresight to seek out and provide the cyber insurance program to its members.
Furthermore, in an effort to increase the City’s IT security infrastructure staff is recommending the installation of new IT security products and services in an amount of $30,000. This amount is included in the not to exceed amount of $400,000 above, however the requested $30,000 budget appropriation to increase the City’s IT security infrastructure is not related to the breach recovery response and therefore is not a reimbursable expense under the City’s cyber insurance policy.
The additional software components to increase the City’s IT security infrastructure will be procured using the Fast Open Contracts Utilization Services (FOCUS) contract. The FOCUS program was established over a decade ago, and under State of California procurement guidelines (Gov. Code 25330-25338), is a competitively bid procurement vehicle for counties, cities, schools, special districts as well as Federal and State governments to use in the direct purchase of their technology needs through established public entity (County) contracts.
ATTACHMENTS:
Resolution
Data Breach Response and Recovery Expenditures