The City of Vandalia held a study session on December 1, 2025, at 6:00 PM. The session covered a cybersecurity plan presentation, ordinances for a zoning code amendment and 2026 pool/golf fees, resolutions for a hospitality contract at Cassel Hills Club House and a Rumpke price increase, and a discussion of the legislative calendar. No votes were taken on the main agenda items, but a motion to enter executive session passed 7-0.
Cybersecurity Plan Presentation (Mr. Davey): Mr. Davey presented an overview of House Bill 96 requirements, which mandate that municipalities adopt a formal cybersecurity program by January 1, 2026. Key provisions include: (1) legislative approval for any ransomware payments via a resolution or ordinance; (2) mandatory reporting of cyber incidents within specific timeframes to the Department of Public Safety and the Auditor of State; and (3) adoption of a cybersecurity program based on CIS or NIST standards. The plan applies to all city employees, elected officials, contractors, and vendors. The city has developed a two-year plan to ramp up compliance. Mr. Davey noted that many elements are already in place. A detailed briefing was reserved for executive session.
Ordinance: Code Amendment PC 25-0020 – Processes & Review Criteria (Mr. Cron): Mr. Cron reported that the previously discussed text amendments to the zoning code were being split. A section on proposed uses in the Vandalia City Center Overlay District (VCCO) raised questions, so it was removed from the ordinance to avoid delaying the rest of the amendments. The remaining amendments, which include changes recommended by the law director and boards/commissions training, will proceed to a second reading during the regular council meeting later that evening.
Ordinance: 2026 Pool and Golf Fees (Mrs. McCracken): Mrs. McCracken proposed a 5% increase for all Cassel Hills Pool passes and a $1 increase for daily admission for both residents and non-residents. The last increase was in 2023. Pool rate recommendations were supported by the park board. For the golf course, no uniform percentage increase was proposed; instead, rates are being aligned with area courses (Homestead, Meadowbrook). Golf cart rates for nine holes also increased. The golf advisory board supported the proposals. The department plans to review all membership fees annually.
Resolution: Hospitality & Food Service Contract at Cassel Hills Club House (Mrs. McCracken): Mrs. McCracken introduced a proposed partnership with Social Light, an established food service operator in Kettering. Social Light would be responsible for all staffing, inventory, cleaning, toiletries, and interior renovations (kitchen, dining room, snack bar) at the club house. The city would handle structural items (e.g., porch beam work). Monthly base rent is $3,500 plus a $1,200 utility allowance. The agreement has been reviewed by the city attorney and an outside firm.
Council discussion raised several points:
The resolution will be formally considered at the December 15, 2025 council meeting.
Resolution: Rumpke Price Increase (Mr. Cron): The Montgomery County Solid Waste District increased the generation fee from $3.00 to $3.65 per ton, with an annual 6% increase thereafter. Rumpke, under the city's contract, can pass this fee to the city. The increase amounts to $0.06 per resident per month (approximately $4,000 annually for the city). Staff recommended that the city absorb the cost for 2026 to avoid revising recently published rate notices (in MyVandalia magazine and water bill mailers). The council concurred. A formal resolution to amend the fee and confirm the city will absorb the cost will be presented at the December 15 meeting.
Discussion: Legislative Calendar (Mayor Herbst): The council briefly discussed upcoming items. Mayor Herbst noted the calendar of future meetings and agenda items.
Law Enforcement Morale Funding: Council discussed a proposal from the city manager to allocate $10,000 from fund balances for law enforcement morale. After discussion, council agreed to split the amount evenly between two fund balances, rather than taking from a single fund. No supplemental appropriation is needed as both funds have sufficient monies.
We'll go ahead and get started with our study session. It is six o'clock. First item we have a presentation from Mr. Davy on a summary of the cybersecurity plan. Good evening, Mayor, members of council. I just wanted to give a public update on the cybersecurity program, what it's about and why we're doing it. So the basics of House Bill 96 were there were some provisions that require municipalities, government agencies to adopt a formal cybersecurity plan. A lot of cities have cybersecurity plans, but they wanted to make sure that it was formally adopted and that there were processes in place for a cybersecurity plan. So here's the main takeaway slide. If you uh get anything out of this, it's that the basics state that we should formally adopt a cybersecurity program by January 1st, 2026. Another provision is that we must obtain approval for any uh ransomware payments. So legislative body such as yourself would have to approve any ransomware payments that we make to anybody. So we can't do it on the down low, we can't do it on the secret, it has to be approved in front of legislative body. And then the third one is that any cyber incidents must be reported within specific time frames, uh, which I'll list later to the uh Department of Public Safety and the attorney uh the auditor of state. So it was adopted on June 30th, signed into law, and uh September 30th is when the ransomware payment came into effect. Any any ransomware payments need to be approved. Uh and then the deadline to adopt a formal cybersecurity policy is January 1st, 2026, right around the corner. So we've had a few months to prepare for this. Um on ransomware payments, the basics, uh it prohibits local governments from paying ransoms unless the legislative authority formally approves the payment via a resolution or ordinance. Um that's pretty easy and straightforward. Now, I don't know how much has to be disclaimed in that payment, but the intent of it is that the citizens are informed of what council's doing. So I'm sure more is going to come out with this as time goes on. What they don't want us to do is to pass a resolution that says we approve any future ransomware payments. They they don't they don't want us to do that. Uh the next thing is incident reporting. So this is for them to collect data to figure out you know how many attacks are actually going on and what type of attacks those are, and if if there's data getting leaked, what type of data, if there's ransomware uh involved. So uh starting on September 30th, uh, any incidents since then have to be sent to the state uh in the auditor of state. So we haven't had any, so that's good. An incident is uh a substantial loss of confidentiality, integrity, uh, availability of covered entities information systems, a serious impact on the safety and resiliency, a disruption of the business's ability to engage in business and industrial operations, and unauthorized access to information systems, and this could even be from vendors or or people that we work with. Um there are lots of things that we run into where we'll have attacks coming and we can thwart them or we can block them. That doesn't count. Uh even the extent of like business email compromises, sometimes an email address might get compromised. That doesn't necessarily mean it's an incident, but it could be if there's a loss of uh of data or or threat. So the cybersecurity program, um there are some basics that they want with this, and the the biggest thing that we have to do with the cybersecurity program is adopt a set of standards to follow. And there are two types, one's called CIS and one's called NIST. A lot of cities are choosing to use what are called the CIS framework policies. There's like 153 different metrics that you have to follow. Um, and there's different risk from low to high on each of those metrics. So the the biggest thing that we have to do compared to what we're already doing is basically analyzing all of our risk, and that would be vendors that we do business with. So if we have a financial system that is storing data on the internet, we have to assign a risk to each of those, and every contract that we have with different vendors has to include certain language that requires them to inform us of a breach. And if they don't do their cybersecurity compliance, then we assign them a higher risk. Um, what do we do with that moving forward that determines you know if we continue to use those vendors? Um, but the the cybersecurity program is basically assigning risk and then dealing with those risks one by one, so to speak. Um and then the other thing that uh came out of this is cybersecurity awareness training for everybody, so not just people that are using computers, but this could be people operating lawnmowers, it could be volunteers that are coming in and just filing paper. Um we have to apply this program to everybody, which is it's a huge under undertaking, really. Another thing that's in House Bill 96 is just stating that uh cybersecurity records are confidential and they're not open for public record. Um this was kind of kind of already understood by uh IT folks because it's kind of an infrastructure record, so we don't normally release anything that's critical like that. But this is just laying it out that the cybersecurity program and things related to that are not public record. Um again, the purpose is just to protect the data and the resources, make sure it's available, uh confidential and its uh integrity. Um we're gonna comply with our program with House Bill 96 by adopting the CIS controls uh version eight.