Morning.

We are getting ready to start our committee meeting.

And with me, I have Counselor Nave.

President Paniagua.

And Dave Pro.

All righty.

So what we're going to do is we're going to start with you.

And we all have the questions that was asked.

So if you could walk us through some of them.

So uh appreciate the opportunity, as you mentioned, Vinny Skippy on Chief Information Officer joined by you know Dave Pro Ec RIT director.

Um the questions here, well, the information in front of you uh was compiled to address uh you know questions related to both legislative items that are currently being considered and uh um some other ongoing just technical operations around Microsoft 365 and our just maturity uh of as an organization.

So uh within this uh um I think there's a couple um well primary things uh I say a couple primary it's comprehensive as as much as it can be while being concise.

Um the two main uh things uh on page two, as you can see the appendix breakdown, the way that we did this, right?

Um is uh Microsoft specific, so just for those listening, you know, uh relative to our license inventory and uh you know contract structure with Microsoft expenditures, um deployment status among each of those uh modules that we procure, uh some of the uh you know financial stewardship and uh you know internal redundancy review relative to uh you know potential or uh uh well yeah potential duplicative functions, uh cyber security, big part of that data governance, uh, and just uh overall strategic planning as we move forward.

So um that's from a a Microsoft perspective.

Also from as I mentioned the legislative items, we've got uh a handful of um areas covered here, one being uh capital funding, which uh funds a variety of uh, you know, IT, I wouldn't exclusively say equipment, it's uh uh functional technology, uh certainly, but then also uh um investments into more modern uh systems and infrastructure to allow our operational departments to have access to uh modern tools to to execute on the on the you know work that they do and and how they can uh serve constituents.

So uh the other legislative items uh well no, that is it, yeah.

One uh being capital funding, the other one being the platform modernization uh components.

So um happy to answer any specific questions.

Uh I mean to I I don't want to read through what I'm sure you all have read through a couple times already.

So um if there's any more specific or Dave, I don't know if you have anything else you want to add to that.

You're good.

No, we we didn't couldn't read that fast.

We were trying to um I'm gonna stop from the right.

Councilman Nave, do you have any specifics?

Um what I would ask is what is uh the uh the cycle security that we have.

It's like when I go to read my email, sometimes it'll say uh uh responses off, which I don't understand.

Like I'll go on my email and it will take me multiple times.

Um is that added security though?

Just need to log in and access it.

Well, I get log in and access, but just like to like uh I got something scary from the controller and I thought I would just read it, and then you had a log in.

There was another system that you had uh log into.

And I just wanted to know, is that common though?

So what it probably is is you probably either clicked the link or went to an attachment that was in the cop trollers email.

Okay, and that probably you probably opened it within the 365 environment, which may have asked you to authenticate to verify who you were up there.

That's what happened.

Yeah, it happened.

So the time I went in there.

Yeah, so that's that's the world we live in now.

Okay.

Okay, thank you.

And we are also joined by Counselor Jones Rouser.

Good morning.

Morning.

Questions?

Just a note, you know.

I mean, based on the history, right?

Uh what we've learned from it, and as we move forward into this new project and trying to maximize our efforts to make it work.

How confident are you that we're on the right track?

Yeah, uh, so I I think you've got a good blend here to to uh answer that in the sense that obviously I've been in this uh this newer role for me only three, four months.

Uh so you can appreciate uh any um you know questions of how you know we move forward.

I think also uh Dave and his experience and other members of the team who have been here for uh uh a long time have are going to be able to provide context, right?

Historical knowledge, institutional knowledge of how things have uh um been conducted, and uh leveraging that to inform ourselves moving forward, how do we pursue projects, etc.

I think um there's two sides of or two things that come to mind, I should say, when uh the you know, for the question you posed, one of them being um the partners that we pick, right?

And ensuring that we uh have proper uh you know, vendor management and uh uh uh oversight into the deliverables and the work that's being done and making sure that they're fulfilling their commitments, right?

The other half is uh the tools that we select, right?

And which I think there's a a good mix in uh the legislation that's being considered now, right?

Where some of the uh capital investments are for, as I was mentioning earlier on, operational or uh you know functional technology where the equivalent of keeping the lights on, where we need network switches, we need routers, we need you know, backup and recovery uh tools, all of those things.

So if slash when an in you know any in given incident occurs, we're resilient, we can you know uh respond in a in a timely manner.

And so that's half of it.

The other half, like I said, is uh being uh um uh you know I say selective or just uh in informed in our decision making for partners, and uh one of those as mentioned uh we're we're going to be seeking out a uh um some replacement platforms moving uh into this next year here and uh approaching that with a holistic view and uh um making sure we know everything that's out there through RFP processes, you know, uh uh uh uh reference checks, the whole works.

So I give it everybody inform it.

Yes, absolutely.

You know, if any mentions um how important our partners are, we have a very small staff.

Okay, there's very few 300 million dollar businesses that are run with an IT staff the size we have.

And the the partners we pick though, it's not just vendors, you know, there's also partnership opportunities with the city school district in the county.

And um I've always been a big proponent of combining resources when we can.

Um in previous administrations, it's been ideas have been advanced and the council has not uh shown them favor.

So um I think there may be some opportunities down the road with our other municipal partners.

So these three entities, we spend a lot of money in IT and we face many of the same challenges.

And it strikes me as there's opportunities out there.

We're all facing the same challenges and sometimes coming up with the same solutions, but we're doing it in three separate silos.

So sometimes I think there's some real opportunity to reach across those uh man-made silos and maybe do some stuff together.

So something we're we're looking forward to, or well, I I there's been some talk about having some conversations with some of those folks.

And I know we um during the Walsh administration, it got pretty far where we were looking at doing some stuff with the county.

The council didn't have a stomach for it there for uh I don't know what reason I don't do politics, but so when we talk, we talk partners.

It's not just the partner we pay, it's also the partners that are down the street in these two directions.

Thank you.

Yeah.

One thing if I can add to that too, I think uh it is also case by case, you know, uh in the sense that there are a good number of things where there is potential for uh collaboration.

There's also some very specific, you know, there are distinct functions right between the city, the county, the school district.

So like not every opportunity is gonna be one where we can, you know, uh collaborate, but to Dave's point, there's uh you know, some probably uh uh more generic functions that can have some overlap to and and worth exploring.

So we work we uh the uh county IT has always been a very good partner with us, and we work with them heavily, especially with moving our police department.

We still have some of our IT infrastructure in the old public safety building, and we've had to bridge it over to the new one.

So we work with uh county IT all the time.

They're great, they're really good partners.

Council Rowser, do you have anything?

Um not sure what part did we go to this page, page four.

We haven't we do having a lot of.

All right, so no, not yet.

Well, you can go to four.

Yeah, we can we can advance it.

We're just general, you know, we've opened it up for okay.

So because I've asked several times before, I just was wanted to get some clarity on this um uh uh document here.

But you have like the licenses or or modules that are available, assigned um in a total.

So are these like where it says total available is 682, the ones that are assigned us are 666 and what we're using is 16 of them.

No, that's okay.

So the inverse, yeah, yeah.

So we we have six, for example, that very first line item there.

We have 682 of those licenses.

Okay.

We have assigned users uh for you know 666 of those licenses, and so we have 16 available.

So that represents 2.3%, right, of those licenses uh that we have available.

The the percentage available that you see throughout uh these uh licenses, uh we consider um uh normal for an organization of our scale, right?

We have typical flux across an organization.

Think about it, every single day that either someone gets onboarded or someone retires, gets offboarded, we have uh an increase in a and a decrease in that number.

So this number arguably changes daily, right?

Because as I said, we bring new people on every day and uh people retire or you know, move on to a new role uh um plenty of different types of things.

Correct.

And um, out of these, which are which are um modules versus licensing?

Um I feel like uh uh these are generally defined as licenses, right?

Uh there are uh modules, we could use that word for the applications that these licenses give you access to.

Yeah, so like you've got uh you know, Microsoft, the core Microsoft suite, which actually is that um pretty much everything uh on the next page, uh page five.

So under A2, this other table, um these are what I would define more closer to modules, right?

Uh in uh terms of the applications that you get access to with these variety of licenses.

So all right.

So I guess my main concern is um because in the past there was some issues with us utilizing some of the um modules to the full capacity, they there they weren't um adding additional modules that were paid for um and available.

So I just wanted to make sure, like, are we getting away from that um and using um every tool that we have?

Yeah, the intention is to maximize the value behind the the tools that we procure.

Yeah, okay.

All righty, before I go into any questions, then do you have something?

I'm sorry, Patrona were you fine fan?

Yeah, yeah, I'm fine.

Nada Roon.

Um first of all, thank you, Vinny, for putting this together.

It was a combined effort too.

I don't want to take completely credit for it, yeah, yeah.

Others within the IT API environment.

So on behalf of the council, and I I just I was away myself, so I'm just reading this.

Um the Microsoft, I think needs more in-depth review on our part um to come back with.

So I would uh say that we'll review this.

I will and share with the council what it is that I kind of glean from all of it.

Um but this is a great first start to what what we have.

So I just I want to let you know that appreciate it.

Um good response to the questions that we provided.

And um I think like Council Rouser was just saying, um we want to get into a little bit more detail.

Some of them, there are some detail, others leave a little bit of ambiguity.

So I just wanted to mention that.

I understood, yeah.

No, I well welcome the conversation.

So all righty, and when before we move on, I have a couple of things on B5.

I need to ask you.

B5?

B5, yes.

It's page 10.

So when I'm looking at this and we're looking at the projects that we expected to be completed within 2526, we're in 26 now.

So will this carry over to 2627?

Yes, I anticipate that.

Yeah, just given the the overall timeline, right?

Uh um, acknowledging that there was desire or intention for these projects to start earlier in the in the fiscal year, like just the nature of the overall environment we work in, you know, scope create timelines shift uh and uh even with those timelines shifting, though, these are investments that uh while it would have been ideal or for them to occur five months ago, like they are inevitable.

And the a lot of these uh um investments are uh tied to hardware that is end of life, right?

So or or approaching end of life, I should say either or so we only have a matter of time before we will it will be necessary for us to replace these things.

So whether it happened five months ago or it happens in five months from now, you know, a computer, a workstation, right?

Any of the you know, equipment that's used around our city facilities uh will uh have a a finite lifespan to it that will eventually need to be upgraded anyways.

Okay, and then five and six, the question is for both of them how is it gonna be tracked and by who is who's gonna track it?

Yeah, so uh this is uh quite honestly an interesting question uh to to answer because um the breakdown, the the main categories that I broke down here, right?

There's some high level acknowledging that those are some uh you know, high-level uh um you know, kind of more general descriptions, but uh I guess I would ask the question back how do you know how do you measure if your computer is working, right?

Do you get access to the internet?

Right, does do the applications load the way that you anticipate them to?

So the measuring or you know, uh um assigning a KPI to a piece of hardware, I guess is where um uh there's a little bit more um uh I don't know if ambiguity is the right word or not, but uh it's just a little bit more difficult to uh again if we take it even a really simple sense.

Does your pen write or does your pen not write, right?

And you know, if your pen writes, that means it's functional and it's successful.

If it doesn't write, it means it's time to get a new pen and you throw the pen out, right?

And so um, does your equipment work?

Does it not work?

Uh because we quite literally have equipment that reaches end of life or you know has functional issues and doesn't work.

Um but the more indirect uh uh efficiencies that we gain are as described here, right?

Uh the the more um modern the equipment that we keep our workforce equipped with, then the less potential help desk uh uh tickets that get put in, right?

If we've got, I mean there can be a uh a handful of different reasons why someone hit contacts the help desk and says, hey, my computer's running slow, or you know, my computer keeps restarting each night on its own for whatever reason.

I mean, just generic uh you know uh examples here, but um there are uh a handful of more indirect uh benefits that we will gain uh um that are a little bit harder to articulate than just a simple uh you know high-level KPI.

But Dave, do you have anything else to add to that?

No.

Okay.

So we're gonna jump down to B7 because it talked about the process in the six month period.

I would like to see quarterly reports on that that you can provide to the council, and you can work with um Nader to put together dates for the quarterly reports.

Understood.

All right, happy to share go ahead.

I have a question.

Can you explain to us uh what the Barracuda network is?

Sure, the uh so before you're so we pay for a subscription to Barracuda, which is a uh well, how we use it as an email security tool.

That's what I hear.

So email gets sent to Marty before it gets to exchange and before you see it, Barracuda, which lives up in the cloud, interrogates that email.

You see it has any red flags, does it look like spam?

Is it um does it have a link that's not associated with the sender, you know?

Does it says it does it say it came from the whitehouse.gov and it really comes from somebody else.

Right.

So Barracuda will stop those ones that are obviously um um attempts at spam or to uh to grade your grab your credentials.

Because it says like I have one new quarantine.

Yeah, that means it means it means we're hanging on to this.

This doesn't look right to us.

Okay.

If you it's saying to the user, if you really think this is okay, come over and take a look at it.

If you go in and manually say, I want to see that email, you're taking on some of the responsibility.

Okay.

Kind of like a kind of like at a house or an apartment where they have a camera out front when you buzz to get in.

You don't let them in, you let them in.

But before that, they if they don't have a card, they can't get in.

So the Barracuda does two things for us.

It interrogates all our email, and it also creates a copy of all our email.

So if you go back and whatever, you delete every email in your in your Microsoft Exchange, we have a copy of everything in Barracuda.

We're responsible to do that.

Uh uh New York State uh records law, whatever it is, we keep everything for seven years.

So you can delete it however many times you want.

We have a copy up there.

And that's why we like to remind people that you send a personal email.

You can delete it 50 times if you want.

It's still up there.

And I guess technically it's probably still FOILable.

Yeah, because I I look at it and I'm familiar with the sender, but then sometimes I'm not familiar with the sender.

That's right.

And it could be it probably is spam.

Yep.

Yeah, I'm glad that um Marty let with that question because I was about to ask something very similar.

Because um a lot of times we might have constituents who say like they sent us an email and and we haven't received it.

So what I've found is that when constituents send emails that have a great number of photos with it, it doesn't come through.

Um so but sometimes it doesn't.

Well, I haven't seen where it had the barracuda on it, it just doesn't come through at all.

Um so is that something that's that that if that's the case, then that most likely is on the sender's end where the total size of all the attached photos is too big.

Okay, you go to spectrum, you can send this many, but if you can try and send this many, it doesn't okay.

So that's probably what they're seeing there.

Okay, and if they send one or two at a time, yeah, then that's the way to do it.

An even better way to do it, not everyone's gonna do this, but if they are there, their photos are stored somewhere online, it can just send you a link to it.

You don't have to send it via email.

Okay.

And happy to follow up with you afterward, too.

There's uh um a portal that you can log into yourself at Barracuda and see uh, you know, sometimes you get an email saying it's quarantined, right?

You know, there's other ones that you'll be able to see that the ones that were perceived by the system to not even be worthwhile to forward to you, but it might be a legitimate one.

So there's ways that you can uh log into that yourself and see your own account and okay.

All righty, let's go to B8 because we're talking about the licenses.

Is that date specific for B8 and B9?

When and what are they date specific?

Sorry, can you repeat your question?

On BA, it talks about the licenses, and on B9, it talks about the um unsupported out of warranty.

Are those date specifics and when will they be out of warranty?

When it comes when it comes to hardware, um they will uh companies will let you know that they're they're no longer gonna offer support on this.

So if you want to run that piece of equipment, you're on your own, they call end of life.

They say we're gonna put that end of life by the end of 27.

So it's kind of a warning that you need to replace this by the end of next year, otherwise there will not be any support.

So if it breaks or you have a problem with it, you call them up, they're not they're not likely to give you the answer they want because then they're not offering support on this.

They've dead they've debt that product.

So that drives a lot of our replacements.

Also, what occurs is as this gets older, we'll stop sending updates for it.

So on our network switches and our firewalls, we want those to get all the all the current cybersecurity updates.

Companies not gonna put a lot of money into keeping this up to date when they've got other products to sell you.

So when they do those updates, just not coming with uh hashtag.

No, no, no, because we have software maintenance on this.

So we we may buy a network switch for uh eight thousand dollars and it may cost a thousand dollars a year for software maintenance, and that includes all the updates and support on that switch if we have any questions.

Okay, and when we're um when we are seeing um end of life for some of the software, um to another module or license.

Um how is the like system migrations um per, you know, whatever else we have.

We're we're going through this right now with our security camera system, which is a genetic system, which the police department in the city use.

So um we're reaching uh we need to upgrade the software, and in order to run the new software, we're up we're putting it on a new server.

So the old server will be retired, the new software run on the new server.

So they kind of go hand in glove uh for those upgrades.

So when you say server, is it a physical server?

And in in some cases, it's a physical server here.

We have a few other locations where you house a limited number of equipment, but more and more we're paying for a physical server up in up in the cloud.

Yeah, that's okay.

Yeah, so that so technically when we are experiencing issues with system migration, then that costs us additional money because we have to now upgrade something else.

Yeah, so okay.

All right, okay.

And then I got two more for you.

B13.

Is you can you provide with a project date?

A project date, you send yes.

Um, as so short answer is yes, when we know the project date essentially, right?

As we start to embark on migrations, as as Dave said, we'll know at that point, based on team members' availability, who gets assigned to the project, who's overseeing it, et cetera.

And I think that's where at these quarterly updates that you've requested.

Uh by all means, I mean, like, we should be able to provide you that level of detail.

Um, you know, uh I think that's a uh an you know a reasonable cadence to be able to show progress on uh you know a lot of these either migrations or other uh projects underway.

Okay, and then on 14, we already talked about quarterly reporting.

So we'll work with that and you'll work with later on doing that.

So you have guys have anything else?

I I do, I do.

Um you talked a little bit about it.

Oh my god, I'm so sorry.

Oh Sharon.

You better take that one.

Shoot shoots you see.

So um where was that?

Oh, you talked a little bit about the um what when the when stuff moves around and so they they're either promoted or they leave, or so there are active licenses.

So the active licenses can they be transferred, yeah, at least that's transferable to somebody in coming in.

Oh, yeah.

So we don't do we don't lose any no, it's just a bucket.

We get those licenses for the length of our contract with Microsoft, for example, and uh yeah, they can be reassigned to to people as they come in and out.

All right, yep.

All righty, anything else?

Um I guess um more uh online.

I don't know if it's in here because I'm just receiving it, but more online with um the um concern about the number of software systems that we are using that aren't speaking to one another, um, and how we begin to bring that number down so that everyone is kind of on the same wave, I should say.

Yeah, as we look for new platforms, uh we top of the list, very high up on the list, is interoperability, meaning that they speak with other platforms.

Uh there are known gaps to your as you're alluding to, right?

On certain platforms, and it is in one of these as a uh um more relative to uh some of the the codes are permitting platforms, right?

Where we're saying there's a more, you know, I say antiquated, it's a it's a legacy system that's uh you know architected in a way that doesn't allow us to have a more robust connection between some of the more modern systems we're you know presuming.

So absolutely those are requirements when we go seek out new platforms that uh they are interoperable, we are able to you know leverage them uh for more communication or uh you know more robust communication across the the organization.

Okay, and then the ones that are more or less antiquated, do we know like what the timeline is to move away from those?

We a lot of these older systems that we're referring to, these legacy systems are so uh ingrained in our operations, they're heavy lifts to migrate, right?

Yeah, um there it's it's a multi-year, I guess is the the best I can uh you know uh high level estimate I give you is a multi-year effort because just frankly, internally don't have the capacity to facilitate even more than that, and even if we did have the capacity to then make all of our operational departments go through significant updates at one time, you know, you need some sort of business continuity uh throughout there.

So it's a it's a multi-year effort, yeah.

That's all you have anything else?

No, all righty.

Thank you very much.

Thank you for this comprehensive review of all of the issues, and we'll just keep moving forward.

Absolutely appreciate it.

Thank you.

Thank you.

Thank you.