Item four is approval of minutes.

As I mentioned before our meeting, um our January minutes did not uh get attached, so we'll hold those over till our next meeting to get approved.

Um that takes us to item five, which is our business items.

We have a few uh items to talk about tonight.

And 5A is to review and approve a contract with Main Star for a new permitting code enforcement and inspection system.

Chris, you want to kick this off?

Yeah, sure.

Um our current uh building permit code enforcement um sys system went in in 2014, and um I a couple years ago they gave us notice that they were gonna end support for the on-premise uh version, and so we're gonna have to move out to the cloud, and so we had um we had had some issues with that vendor.

Uh the product had been sold four times at least four times uh since we've owned it.

Uh the first sale coming about 30 days after we inked the contract.

So um it's been it's some of the support's been problematic, and um and so we said, well, if they're gonna force us to go to the cloud, we're gonna take this as an opportunity to um look around and see if there's a a better product out there because essentially the quote that they had given us, there was no real break.

We're gonna have to pay migration costs and and that sort of thing.

So uh during the 2025 CIP budget process, this project was approved.

And so last year we went out to RFP and um reviewed the RFP.

We we scored them.

So we have Maria Pandazi from uh she's our deputy community development director, and then uh I have Mark Probuki, he's my uh business solutions architect.

Uh they've been uh heavily involved with this project, but we went out to RFP.

Um there was a group from IT community development and engineering.

Uh we scored the RFPs, we ended up bringing in a handful uh for vendor demonstrations.

Uh we did went through the demos and uh Main Star is the one that bubbled up to the top.

And um so this is this is uh what we have before you.

It is a SAS solution.

So I did it, I did attach the IT uh uh technical questionnaire uh answers that we got back, and so with that uh we'll open up the floor to questions.

So operationally, uh Maria can hand uh handle those questions and Mark is super familiar with uh the current product.

In fact, he's uh he's had to do the troubleshooting for their support um on some stuff, and then he's also pretty f uh really familiar.

He kind of led the the demo part of the RFP um process.

So Maria, is there anything you want to add before we pepper you with questions as far as I know this touches your department probably more than any other sound?

It does, it does.

We um we probably have at least six thousand either permits, projects, or code cases that go through this software every every year.

Um and that number is growing.

Um I think Chris did a good job of explaining our challenges and the the cost of keeping the software moving to the cloud didn't seem to make a lot of sense without assessing better software for us.

One of the challenges I think in addition to the um the customer support or lack of support or challenge of support, was their customer portal also, so for when contractors are logging in or the general public wants to report something their interface, I think that's the right word.

Um not IT, but they're you know, what what the public sees is very cumbersome and it's not very customizable.

Um one thing that I really wanted to see out of new software was a really nice customer facing um piece, and and that's I think what we're gonna get with Main Star.

So I was I was on council when we implemented track it.

So I remember that.

And I I do remember that their customer portal was one of the things that was supposedly a selling point of that product.

So it's disappointing to hear that that never really well that portal from 2014 is the same portal we have now in 2026.

I'm sure it's good.

Yeah, and I think that's the issue.

I mean, it knows its job, yeah, but it's very difficult to navigate, and it's not, you know, maybe it was okay in 2002.

Yeah.

Well, Maria was just uh commenting, she was at a conference a couple years ago for it, and they they talked about one of the jokes that during the keynote was that their uh customer facing portal is what yeah, somebody stood up and said, Oh, it's state of the art for 1972.

So they I mean I think they acknowledged that it was an issue, or they heard it was an issue, but nothing really ever changed with it.

So I'm really looking forward to that part of Main Star actually.

Questions from the board just sounds to me like they rang the money out of it, you know, uh early on 30 days after we saw it and then proceeded to sell it and it for bagged data.

So yeah.

So what other um features are you looking forward to in the software compared to what you currently have?

Um considering how much I mean it appears to be quite a bit more expensive.

Yeah, annually because of the cloud costs.

Right.

Um yeah.

Uh but it's right in that same ballpark as track it would have been in the cloud.

Got it.

Yeah.

So there was only one out of out of the three that we brought in for demos, there was only one less expensive than this one.

But it was uh product that really wasn't finished.

It was kind of like if you were going from paper to electronic, that would have been a first good step.

Um, but it it but it just wouldn't work for some, you know, uh I mean some of their just calendar functions for scheduling inspectors wasn't there with that product.

So um there's you know, there's a lot that was left to be desired there.

Um so but I'll let you finish answering brands.

No, I think that's that's the thing too with the cost of track it in the cloud would have been similar to this.

Um in addition, I think there's a lot of um customization that we can do with auto automatic emails and um that would be a little bit easier to adjust and so forth.

Um right now we can do that, but it's a little bit again, it's just a little cumbersome to do.

And so um I think that is another feature of general and has a lot of modernized features, is kind of what you're what you're saying.

Yes.

You do a lot of the functions, but just in in more efficient and modern way.

I think that's a good good summary.

And there's a lot of features like if they're working with the company and then they have uh employees right now.

Each employee has to have like a login or some shared login.

Now you can have a company with employees and they can log in as an employee of that company, so you have that relationship.

So that's a selling point.

Um if let's say licenses are expiring for contractors, you can email notify them through flexible workflows so you can customize uh you know, let's say you want to change something, track it's gonna hardwired, you have to stick to their flow.

Um, it's programmed that way with uh more modern infrastructure.

Most most of the software had this.

You can flexibly change how you want it to behave.

You want to send an auto email after they apply, you can set that up.

You can just you know build it into a workflow.

Um so there's a lot of features, um, even permits expiring, you can set up uh auto notifies for that saying, hey, your permits expiring.

Um so it can do that automatically behind the scenes.

Uh just a lot of features that we're hoping to get uh, you know, but aren't available in track it, they just don't have that.

Um that's meant to sort of look and feel the UI's kind of dated.

There's a lot of um bugs in the software.

Um they're they're listed along.

Um, but uh we did a lot of like since it's on-prem, we were look at their code and um fix some things, make things work better or look better, but it's just uh been an ongoing challenge.

They've done, I think they're kind of stretched in on their side.

Um all their features have been going into the cloud.

So yeah, all the uh you know updates or fixes are on the cloud platform now.

So it's just like you're kind of hanging on, and eventually they'll uh cut it off for mobile apps.

They've actually ended support for that.

Um, but the the thing is there their mobile app isn't it been working, it's not functional.

Um they've admitted that, and it's just like well, we can't go to that, it doesn't work, and um so it's kind of like that's kind of the state they're in.

Right for sure.

We also spoke with some other communities that use Main Star, and they were very pleased with it.

They were pleased with their customer support.

Um, so that also was I think uh selling it.

One more question.

What about interfacing with um any other existing systems?

Is that on your roadmap at all?

Oh definitely.

Do they support that pretty seamlessly and they have experience with that?

Like your financial system, whatever you have to do.

That was that was part of the RFP questionnaire.

Uh not only just the RFP even pass that I sent uh you know pages of questions to our our contact there and kind of drilled them on you know our municipal financials, our current integration.

Uh we're kind of limited, like uh, you know, APIs, but we we're gonna replicate how track it did the file nightly interface um capabilities there to do an API.

Um we also looked at laser fee showing integration there, that's all capable.

Uh yeah, GIS is gonna be way improved right now.

It's just uh I don't even know if I should touch on that, but it kind of goes through four hops from an access database to a temporary SQL database to a job, and it's it's it's kind of so now it'll go it's it's pretty interesting.

Uh but now it'll go directly to uh is that uh our GIS RESO it'll go directly, um, which is sweet.

Um so we won't have those hops in there.

Um some of them some of the vendors had real time, so it's pulling directly.

This one will just be pulled in uh I believe overnight, which that's kind of fine with the changes.

We're not making like dramatic changes throughout the data we need to pull in.

Uh and I think um uh an credit card authorized.net they support fine.

Um so all of our interface points were there.

Uh database-wise uh was the most interesting.

We spent a lot of time on that.

So we're going with their uh rather than customize all these things, like when you customize software extremely you get into a pickle where you've customized it such that you know, then when they go to support you, oh whoa, you're way different.

So uh going straight what their offering is, which is gonna be um highly available uh database in the cloud.

Uh the alternative would be to create some kind of virtual server in the EC2 instance in AWS, and well, if it goes down, you may be down a few hours, and so that didn't sound too good the more we looked at it.

Uh and then uh the only there's kind of a pro and con uh with the HA offering uh that we would probably getting at data would be a little bit more difficult because it's they restrict that um because they don't want people going after and running performance, things like that.

So we may partner with them to build those in their portal uh versus having like our own EC2 instance uh which is a virtual server, and then we can just go at the database all we want.

Um but the caveat is high high availability, so that seemed to be a better solution, and also being non-customized so that way they can support us right out of the box.

Thank you.

This new system will that allow the public to access to submit permit requests and get status updates and be able to put it.

Yes, our current one does now circa 197, you know, the you know, it's not it's not um very clean and easy to find sometimes.

Um so we do have that, we have that capability.

Um but this the way it looks and the way it's formatted on screen is much cleaner, much neater, and we can uh customize that ad notes and things to it where in the track it system.

It was really challenging to add a note like where you really needed to make a contractor aware of something.

But yeah, right now we we process all our electrical and plumbing permits, those are auto-issued through you know the contractor uh who's a you know vetted licensed contractor would just apply and get that those permits auto-issued.

Um certain permits they submit and uh there's plans to review and so that kind of just pauses the process until it moves to the next step.

But so right now their contractors are able to log in and see the status of their permits now too.

Well, homeowners be able to build their own.

Yeah, so right now we have because I like the renewing.

Yeah, okay.

I have experienced the permitting process through the city walkshop.

Oh, you have okay.

Yes.

Have you done the e-track it online?

I did not.

Okay.

I was managing the project for my home.

Okay.

I walked into the permitted office and just kind of laid out what I'm trying to do.

Okay.

And there was all kinds of issues that we don't need to get into this evening.

But uh I do know it was a very cumbersome and challenging process.

Uh so I'm hoping that this new software makes things more streamlined.

Uh, because I also know several other people that like the U projects in the whole and have also experienced you know issues with the current system.

Yes, so we do have a button.

What have you, but yeah, I'm very interested because I have some projects coming up.

Well, this will be for this won't be up and running for a while.

And it'd be by end of year, but yeah.

Yeah, so I'll probably still be able to track it.

But I would write currently right now, I could get logged in or set up an account on your existing system in everyone.

As a public, yeah.

Okay.

Will then the public be able to schedule inspections with the inspectors via this stuff, or do they still have to call?

Um it's so for building inspections, it probably would be a phone call or an email, just because the inspectors schedule, you know, some inspections may take longer or less time, so they kind of schedule their time right now for electrical and plumbing, it's all scheduled online.

Okay.

So what's nice about the newer software is um the way they handle scheduling.

So right now it's like AMPM, and uh with the newer software, they can do it by hour.

So you have like say um inspection.

Um I was always talking to Mark, they'll have the ability to do that.

They don't have the ability to let's say uh an inspector has meeting in the afternoon, they couldn't like automatically block out a day or every Wednesday or things like that.

But the scheduling is improved with the new software versus current, so that'll be a bonus.

And you've already got this in the 2025 budget.

We need to go.

So yeah, it was a 2025 project.

Obviously, uh it's 26.

Those funds will just carry over.

Um so yeah.

Um, I guess from a financial standpoint, just you can pull it up here.

Um year two.

Uh so because it's SAS, year one costs are right up front for you know, licensing costs.

But uh for year two, they uh those costs stay the same as year one, and then starting in year three, there will be a three percent increase in the in the annual costs moving forward.

So that was one where they wanted to they started off with five percent right away, and so they were pretty open to uh not just this, but the the contract as a whole, all the red lines that uh Brian running, the city attorney had uh had in there, and then I negotiated the costs and and and that sort of thing, and they said yep, all changes accepted.

So uh they were real easy to work with from that way.

Uh they've been real responsive to Mark, uh emails, phone calls, all that stuff.

So it's been a good experience with them thus far.

So it's a five-year contract.

No, it's uh this is just showing um that um oh I guess uh in the contract it shows five the first five years, but if you read right underneath that it's uh three percent uh every subsequent year after that.

What I'm getting at is is that guaranteed though that rate no?

Three percent is guaranteed forever.

Okay, fratuity.

Yeah, yeah.

Okay.

Because I was just wondering about you know, there's there's no bandwidth charges, additional storage charges, anything like that.

No, down the road, nope.

Okay.

And we're not under a certain year commitment.

We're year to year.

Um yes, I mean not that we would want a project of this size after two or three years, but we're not committed to being locked in.

Correct.

Yep.

If we we just uh there's uh maybe like a 30-day notice or something like that that we have to give.

So it was 90.

Is it 90?

That's still so I got a question about how do we find uh software companies that you know do what this does.

Do we go to the other municipalities and say, hey, do you guys have a uh uh you know a company that you've worked with or heard about so uh yeah there is a little bit of that.

We all have uh peers in other municipalities that we know, and and so um you know we'll we'll shoot emails out hey, what are you doing for this?

And you know, for like us being munis customers, that's for our financial system.

There are um there are a lot of Munis customers in this area, Brookfield, Wawatosa, um, New Berlin, and so like we have a when Muniz puts their user group on, it's always in the area here because there's so many customers, so uh you know we can talk to them about that.

Um but is they these software companies, I don't know if they have staff or if they're or if they hire it out, but they watch municipality websites for RFPs to get posted.

And so as soon as RFPs um hit our website, um those contractors know.

And you know, there's times where we're doing a little bit of um you know recon prior to uh budget, you know, trying to figure out what a cost of a new system is gonna be, and so we start just kind of doing some research that way, and we may have some phone calls with some with some vendors, and we may put a request for information out there so that we can get a budgetary number, and then any vendor that replies to an RFI when we post the RFP, we do email them a link to the RFP, letting them know that it's been posted just uh as a courtesy.

As a note, um our current vendor central central square track it did not respond to the RFP.

That's correct, yeah.

And we sent it to them.

Yeah, interesting.

Yeah.

And after they wanted it.

Yeah, but then afterwards, then they wanted to respond to the RFP.

It was closed already, so yeah.

No, so surprise, surprise.

So, Chris, it looks like from uh from a budget standpoint.

We came in under capital, you know, the capital side of things.

Yep, which is good.

Um are you at all concerned about finding an extra sixty thousand dollars in the operating budget for continued support?

Uh well, Joe Shiro is he's our finance director.

Um yeah, uh well, as part of our financial management planning, you know, in the five year that we've been doing.

Um this has been uh uh this this has been part of the number.

So I've had I've had these dollar amounts, and so what I've been putting in for my forecast uh budget for the planning has been the most expensive one.

Um which I think was question yeah, it was probably like another uh 50 or 60,000 more than this one.

Public words does that all the time they build that cushion in there all the time because well, this is for forecasting what our operating budget's going up, so knowing that we're gonna be switching from track it to something else, we needed some kind of number, and so putting the worst case scenario in there is better because now when we update those numbers on the forecast, it'll you know that's basically it's not ideal, but that that number's been planned for and is baked in.

Yeah, that's not a shock to anybody next year when that's correct, yeah.

And budget comes around.

And you know, the cover sheets uh before they before the cover sheets go on the agenda, uh the finance director, the city attorney, and the city administrator all sign off on them.

Yep, so you know, if you come down here, they've all seen it, they all know what the numbers are and all that good stuff.

So no surprises, right?

Yeah, correct.

Any other questions, comments, concerns?

So we're looking for approval of this tonight, correct?

Mm-hmm.

Um I'll make a motion to approve the uh contract with Main Star as presented.

Okay, Sean.

So we have a motion and a second to approve the contract as presented.

You're gonna roll call us, Chris.

Any other questions or comments before we go?

All right.

Sean?

Yes.

Dan?

Yes.

Steve?

Yes.

Brandon?

Yes.

Bob?

Yes.

All right.

There we have it.

That passed unanimously.

Thank you very much.

Thank you, Maria.

Thanks for coming.

Thanks for coming, Mark.

You can hang out longer if you want.

Thank you.

Sometimes it is right.

All right.

So that takes us to 5B, which is uh we have some policy review stuff to talk about tonight.

Actually, our next few items.

But uh this one is annual review and discussion of IT policies parens, no action needed.

So I I'm assuming these are things that we're not looking to change.

Right.

This is with the policies as is.

Yep.

Um one of the requirements for all of our policies is that they get an annual review.

Um so I've looked over the the four policies that are under this item.

I've looked over um and I'm not recommending any changes to them.

Okay.

And um and so unless unless someone on the board wants to make some revisions to them, um I'm I'm good with where they're at.

Any questions, comments about that?

Any concerns about the policies as is.

We've we've seen them, we've approved them.

If they're working well for you, Chris, and you don't see any concerns.

I'm I think the board is with you on that.

Yeah.

See some nodding heads.

Okay.

Well, not uh put a check mark in the annual review box for those four that are presented change management, email, malware, and security awareness.

And then we have a few that uh we're gonna look at that we do want to make some adjustments to, starting with uh 5C, which is our AI acceptable use policy.

Didn't we just approve this, Chris?

We sure did.

Yep.

And then it was approved by the council on the 20th.

So in our January, this one came through.

Well, you know, some some things, no matter how many times you look at it, right?

Right.

Um so there were a couple concerns when it came to uh let me pull this up.

Um that's the wrong This is Brian Runnings uh uh red uh uh red lines.

This came back from staff.

Probably at audience came from staff, that would make sense based on based on the cover sheet.

Okay.

So this is um uh under rules of use for the um for the AI acceptable use policy, item or letter C says users must mark AI generated content, example draft prepared using AI.

And um so once we rolled this out to staff, the question came up as to um well where's the where do we draw the line with this?

Do I if I'm asking AI to help with grammar, um do I have to mark that uh my grammar was checked by AI and that sort of thing?

And then ultimately um in my conversations with uh Tony Brown, the Cine uh City Administrator, is we really don't have any practical way to monitor or police this rule.

And um so for fun, I uh took this and I um this this question about getting rid of this line and I put it in the AI.

AI thought we should keep it.

AI said uh you know, rather than just get rid of it, maybe you can modify it and then gave me like this whole decision tree on you know, which would have been like an extra half a page of policy, and then and then and then all the phone calls that come with the decision tree.

But ultimately, when you look at the other items that are under rules of use, which I uh listed here, um, you know, we're already regulating who can use AI.

Um we're already already asking um to or telling people they need to verify that data.

Um we're you know, we talk about you know, like we're not integrating it, we're um you know how it can or cannot be used with employment related decisions, and then understanding that these prompts can become public.

So I mean, I guess the the point being here is there's all these other safeguards that we have in place, and and quite frankly, if if someone is being asked if they've used AI for any of this stuff, well, why wouldn't you know there's no harm no foul in saying yeah, use it.

I mean, I think some of the value that we see with what we have for AI right now is the example I gave earlier in grammar, you know, to hey, can you help me reword this email for clarity type of thing and pop it in there?

And you know, there are some times where you I don't know, I'm sure some of you have been there where you've had an email open for hours as you craft that email and then you go back and redo it and redo it because it's got it, you just got to communicate just right, and you know, maybe maybe with AI you can get there a little bit quicker than so, anyways, there's some good uses, but anyways, so I'm recommending that we just remove item C part in in particular because we don't have a way to police or monitor that, and and then also we have all these other safeguards in place or rules in place on on how to use AI.

So um that is that's what I'm I'm looking at this evening is just to prove uh the modified AI policy by removing line C from rules of use.

So we're we're using uh are we polling uh daily, you know, people that are using and you know, city staff that are using it and and just you know, trying to get a handle on how much AI is actually being in used in our for our um for our Microsoft 365 products, which is Microsoft's product is called Copilot.

For copilot, we can see who's using it and how much they're using it.

We have that dashboard uh to be able to log in and see that stuff.

Um some of the things that we're we're looking at and going through with um Defender is the is our um our malware defense um software, and so what we're doing with Defender because it can show us cloud apps that people are accessing, and we're starting to go through and look at what are some of the different AI apps that are out there, and they give us a Defender gives you a ranking on safe not safe, and I forget the scoring system that they use or how they do that, but um starting to go through and look at all the different AI ones, and and there are a lot.

I mean, for one, it's just pulling every cloud app that Microsoft knows about that people want to try and integrate with um like on ID and stuff like that.

So going through and finding AIs and just blocking blocking the bad ones right away straight up, and then from there we're gonna start going after the more popular ones once we get some training on co-pilot and training on AI use in general, like helping people with prompts and and stuff like that, kind of the um the AI 101, and then also through our no before system, just a some security awareness training around AI.

So going back to your uh email comment, you know, you get you you got five different things going on at least every day, and you know, some days are more intense than others.

You get interrupted, you're you're putting together an email with AI, and you can't remember, you know, especially when you get to be my age, you know what uh what's going on.

So you go back to your email and you say, AI, would you finish my thought here?

You know, because you don't take in what you've written so far, and can AI actually do that?

Yeah, so like if I'm just uh putting an email together, I don't have to think about I don't have to think about all the grammar that goes with it.

I type my bullet points up and just in a list and say send an email and hit go and then it generates that email.

And it fills takes those bullet points, puts it in a into a paragraph, you read through it, um, you know, make sure it's accurate, maybe tweak it, make it your own from there.

But yeah, you don't have uh that's I mean some of those uses of AI are just that.

It's just you throw your bullet points together and let it figure out how to message that.

Yeah.

Say, hey, I'm trying to do this, and I want to do A B C and D.

And then and then just hit go.

Oh and then all your all your former prompts from in co-pilot.

Just like chat GPT, they're just listed on the left side there.

So you can go back to one that you had were working on like a week or two ago, and uh, because you can rename and retitle those so they're they're actually meaningful, and then you can go back and open that up and re-engage that conversation.

What was the I guess intention behind that um originally being in the policy from an IT governance standpoint?

What was the original?

I mean so the original draft that came to us said that users had to get permission from their supervisor every time they used AI.

Oh I remember.

So then we said instead of like that, so instead of that, like let's let's simplify that.

And I I can't remember if this is part of like Brandon um Brandon had a list of ideas that we incorporated in this, and I don't remember if that was one, but it was one.

Yeah, and so that's where this so went from getting your supervisor permission to use AI to mark it as um AI being used.

Yeah, and I I know you know, I know in the in the world out there, there's a lot of talk about that, and you know, a lot of you you see a lot of stuff now, like on even on YouTube and you know media outlets where there is a disclaimer, you know, and even on TV shows, you know, where it says some of this content, you know, may contain AI generated content or this content was generated.

So I know there's a uh a push to have that out there.

I'm not concerned at all about eliminating this bullet point from our policy because I think you know, as you laid out the safeguards are there.

I think I think there will come a time not too far in the future where this stuff is so ubiquitous that it it's not gonna matter, and we're just gonna take for granted that AI probably played a role in the creation of any content that's out there.

So, you know, I think forward looking, this this bullet point would have probably been eliminated not too far in the future anyway, just as a matter of course.

But I think I mean so I remember the permission discussion, and I think because I looked at this revised one too, and I thought it was okay at the time too, and that's why I didn't bring up anything because I think there's a distinction between truly AI generated content and then uh like for lack of a better word, augmented content.

So you you bring your content that you did you created, whether it's a rough draft or whatever, you throw it in there, you have it create something with your content as opposed to prompting it to create something brand new.

And so those are two kind of different things.

And if it's something created brand new, really out of a prompt with you know little data and little input outside of that from you, to me that might be something that you would consider saying, hey, you know what, this was AI generated, as opposed to you know, simple grammar or editing or spell checking, you know all that stuff, yeah, or say, hey, rewrite this email because I wanted to soften the tone.

You know, to me that's just casual use, and so that won't even apply here.

So but I think it's good to get rid of it because it it probably is too gray.

Yeah, there's just there is no way to to really police it.

Um I was thinking that people would self-report that, and that would be kind of the push for people to do that if it's truly you know the majority of it is AI generated.

That's kind of was my thought process behind it.

But I think you know, to Dan's point and to what you've shared with us, it's probably best at this point to just get rid of it completely.

Yeah.

All right.

It's gonna come up with vision after readvision.

Any other questions, comments?

Okay.

Um I will make a motion to approve the uh changes to the AI acceptable use policy as presented.

I'll second it.

Motion and a second.

Any other comments before we Chris, do you want to roll call?

All right, Sean?

Yes.

Yes.

Steve?

Yes.

Brandon?

Yes.

Bob.

Yes.

And that passed unanimously.

So I assume we'll see that again at next council.

Chris.

All right.

Yes, it will.

Uh the 17th.

Okay.

Takes us to item D review and approve additions to the acceptable use policy.

Not the AI acceptable use policy.

The acceptable use policy.

All right.

Chris?

Yes.

So one of the things that this will go back a few years, Dan.

One of the things that we talked about for a long time as a board was a mobile device management policy.

And we never had a good mobile device management system.

So we never put a policy out there because we couldn't enforce the policy.

We drafted one.

We created one, but I don't think it ever went to council for approval, if I remember correctly.

Right.

So looking through, all right.

So one of the goals for me this year with ITB is to go through all of our policies and procedures and make sure they're they align with the CIS controls and specifically implementation group one.

Then just and it's kind of like an audit and verifying that our policies and procedures are aligning with what is considered good cyber hygiene.

From there, um I want to move to probably next year is verifying that we're in line with implementation group number two.

So one of implement uh one of the policies that implement implement implementation group one calls for is a mobile device management policy.

Well, looking at looking over what would be in that policy, um, it made more sense to modify the generic acceptable acceptable use policy with a few lines rather than um create a whole another policy.

So that's that's what um we have um before you today.

So it's just um should be just those couple of changes right there and right here.

So we'll start from the top.

And so you'll see um we are standardized on iOS devices, so iPhones, iPads.

We don't we don't use Androids here.

And um that's uh that's a fun debate.

My staff and I have on a regular basis, Android versus Apple.

But um I don't item C under under user responsibility says that all c own iPhones and iPads and other mobile devices.

That's the just in case someone gets an Android.

Um shall be enrolled in the city's mobile device management system.

Uh user shall not remove disable or bypass MDM profiles or security controls installed on city devices.

All user accounts configured on city mobile devices must use a city issued email address.

Um right now our MDM is Microsoft Into.

And we we used Verizon Verizon and FirstNet are basically our two um cellular providers.

Uh we're almost 100% um first net.

We still have some Verizon, we're slowly moving over.

But every device bought through Verizon or FirstNet, and even another uh CDW G is another uh uh vendor that we might buy iPads through.

Um automatically get enrolled in Apple Business Manager, and then Apple Business Managers integrated with our with Intune.

So as anyone that buys a uh a device, a city device through Verizon First Net or C DW G, uh it automatically goes to um Apple Business Manager, automatically comes down to Intune, and when they open up that box and start to set up that phone, they get a couple screens in and says you must enroll your device into uh Intune, and it's uh click yes or you don't go any further.

And so then it automatically enrolls now.

As we get further down here, um we are really gonna look at two different types of of devices.

One is a fully managed device.

So, like our police department and our fire department have um iPhones in in their cars, but they're not assigned to anyone.

And so squad cars.

So in order to get an app from the Apple i um Apple App Store, you have to have an Apple ID.

Well, these phones don't have an Apple ID, so they have no access to the app store.

So every app that they need, we have to push down to them.

And so, like for the police department fleet, we have a profile set up in Intune, and when we get a new phone that comes into Intune, we push it, we give it that profile, and then all the apps that the PD wants those fleet phones to have, push down to it.

Uh fire department's going through a refresh on their iPhones right now, and we're doing the same thing for them.

So the only way they can get an app is um by request of their supervisor or director, and then they have to tell us yes, you can add this app to the profile.

The second the second type of device would is commonly known as uh co corporately owned personally enabled um device.

So basically a corporately owned phone, uh, but now you can sign into it with uh like an Apple ID, and that Apple ID now allows you to be able to go get apps from the app store, and so you can use the phone basically at your discretion.

So when we look at um plans that we have through um through the government contracts, we're it's 35 bucks a month unlimited data.

Okay, so we have um we have a lot of not a lot, but we have a pretty good chunk of people that have a city issued phone that need to have a city issued phone, and then they have their personal phone.

Some of it is because they're afraid to use the city phone for any personal use because they don't want to get in trouble.

Then the other part of that is they're worried about open records requests.

So when we get down to these changes here, uh you'll see that with director approval, users may utilize a city issued mobile device for limited personal use in lieu of carrying both a personal and a city device, provided such use creates no additional costs.

So if we're thinking about are we gonna use up all our data, taxed all that stuff, it doesn't matter, we're unlimited and and it's really affordable.

Users acknowledge that city devices remain fully managed and monitor IT assets, they're in the Intune system.

If someone leaves the city, we can unlock that iPhone with Intune, we can wipe that iPhone with Intune, and we can reset that iPhone with Intune.

And so um, it's kind of one of those things, no harm, no foul.

Um, we've had we've had people leave the city in a in a in a poor way where they wouldn't uh they were signed into an Apple device with their um personal Apple account and then wouldn't unlock it.

And because we have had no policy, um, we couldn't do anything about it, and so that phone was basically a brick.

Now with our plan, we just turn off that phone and we and then we just order a new one for that person's replacement.

The phone comes free, and so thankfully it's not like we lost a thousand dollars on that device, but what we did lose is any kind of trade-in value that that device might have.

So, I mean, these devices, these older ones, you know, three, four years old, they don't have a ton of value, but we do get some value, which is a credit back towards the the cell bill.

Um, so there is some value there, and because that phone, you know, in that in this one particular case that I'm referencing was was useless, we couldn't we couldn't turn it in.

Oh you know, so uh so the changes to the acceptable use are are just around mobile device management.

And and really I think this covers us from having to have a full mobile device management policy.

So with that can you open up the and make the font bigger?

Yes.

And what you've got that's beautiful.

Thank you.

All right.

So this is uh this one here says that um mobile devices need to be enrolled in our mobile device management system.

The way we're set up with now, they are automatically.

Um and then all user accounts must be configured on city mobile devices using a city issued email.

So this here ties into this one here, saying that with director approval, you can use a device this in this manner.

Oh do you have a rough idea of like how many devices live within the city that fall into these categories as far as you know the fully corporate owned, corporate managed that you know, like the squad car phones and fire truck phones and well we'll just say just rough 80 between fire trucks and and squad cars.

80?

Yeah.

Okay.

This is uh I think it's like 30 something on the fire side and 40 something on the on the on the police side from there, and then you and then um and then how many on the other side of like corporate users that have a uh a city issued phone, yeah.

Well it uh so that a lot of that depends on the department.

So um you look at um all right, so there's two in IT.

Me, uh I have one, and then Greg uh Vanessa has one.

Okay.

Then you look at the fire department, and it's their command staff, uh battalion chiefs, division chiefs, assistant chief, and chief.

Okay, and then and then it's the police department.

I know it's command staff, but then there's detectives too.

So um I don't have a good number on that.

Um but um yeah, because then you have uh DPW, you know, and DPW is engineering, uh the clean water plant, uh city garage, and streets, you know, and there's supervisors, and there's inspectors, stuff like that, and then you have community development.

Um, they have their building inspectors and the building inspectors have phones and an iPad because the iPad is how they do their building inspections.

So hundreds.

Yes, yep, hundreds.

Because I know Park Rec has yeah, I know Park Rec has iPads.

Yep, they have iPads and they have iPhones too.

Assuming some of their directors, managers have phones.

Yep.

Yeah.

Okay.

Question?

Yeah, the forestry department uh is does a lot with um like tree inventories and stuff like that, live ownership.

Yeah, I know they've got a lot of apps that manage inventory and pretty wild, like basically every tree in the city is inventoried.

Yeah, it's rising.

Um all these phones, there's always somebody that will try to use and abuse the system.

Have you experienced that or not?

Um well here's uh the I don't really know like when you look at using and abusing, you know, is someone live, you know, just streaming YouTube on their phone all day.

Um are they texting and driving?

That stuff I can't answer.

I mean, that's like that'd be tough for me to know.

Okay, that's fine.

But like because of the unlimited data, you know, um, it's not like you're running over data and and stuff like that.

Um yeah.

How about the um personal information?

Somebody's in there um are they using the phones?

Like you go to the store and use the phone to pay for something.

You can't use these phones to pay for lunch, or you got to no that that has to be tied to a credit card.

Okay, some of us have city issued credit cards for business, and if you're doing that, well, you you have to turn in that expense report, and you have to justify that.

This you know, we're not like the business world where we're out buying lunches for um staff for ourselves or anyone else.

So that's like buying things in the store, going to Home Depot.

Yeah, I mean you're a my credit cards for like when we go to conferences and buying stuff off of Amazon.

Okay, I don't and and then like you have these handful of things like our like our wiki for our IT documentation.

It's a monthly charge, and they don't they won't invoice us that just charge a credit card.

So stuff like that.

So that's just how I use my city credit card.

I can't speak for everyone else, but but that's the only way that you would be able to misuse that.

But again, that's gonna hit your credit card statement, and you have to you have to provide the receipt.

So I mean when the credit card statement comes through, uh before my administrative assistant, she grabs all the we put all our receipts in a folder, and then she grabs those, and then she has to put the account number that each one of those line line items has to hit.

She sends it to me.

I not only sign the receipt, but then I sign the credit card statement, and then she submits it.

So I own that thing 100%.

And so anyone else has to do that.

Um can you put your personal credit card and cell phone in like the Apple wallet and do that as if you're at the grocery store or whatever else and tap tap to pay?

Yeah, absolutely.

You can do that.

Again, but that would be your personal one on there.

Okay.

And the other thing too, with it being enrolled in Intune, we don't allow jail broken iPhones, which means when if it's jailbroken, they can go download apps off of any place that has an app for an iPhone.

Okay.

They're forced to go through the app app store.

What's the phrase?

You said jail, what no, what's it called again?

It's called jail jailbreaking an iPhone.

Jailbreak, okay.

Yeah.

So yeah, it's basically saying my phone is in like some kind of Apple jail right now, because I can only go to the Apple store.

So if I jailbreak it, now I can go get apps from wherever.

Okay.

Which is uh that's an issue.

And that's part of the issue with me and Android devices.

The amount of bad apps that get into the uh the Google Play Store.

Um it's just it's just a constant news cycle about that.

Is Apple perfect?

No, but I mean if you're gonna compare Apples to Apples on um bad apps and app stores.

Now we'll see what happens in the EU with uh with what they're doing with that.

What are they doing?

Um they're forcing Apple to open it up to other app stores.

I don't know if that's gone through, but I know that was uh a big conversation.

Will we be following them?

You think?

I don't know.

There's some there's some good things that they do over there, and we don't follow them, right?

Um and then there's you know, so interesting.

Hey, but if but that is that is between the owner and that Apple device from a corporate standpoint, it's gonna be in our mobile device management.

We would not allow them to use any other app store except Apple if that same policy was applied here in the States.

All right, we still get to control that.

So we don't allow users to what do we allow?

Let me let me ask it this way.

What do we allow from a user standpoint from uh DYOD, bring your own device standpoint if anything?

Well so people who live in both worlds who have a corporate and a personal phone, or maybe don't have uh corporate, uh a city owned phone, they can't do like they can't read their email on their phone, or can they?

They can't.

We it just like you, you can put your city email on your phone, right?

Still on my iPad.

Yeah, we we allow that.

We allow um people to connect their phone to get email, even if it's their personal.

Um so where does that line get drawn?

I guess is my question of what can they and what can they or can't they do from that point?

We don't uh we don't let uh personal devices touch the the network.

They could be on guest net.

The the real yeah cow cow network.

Yeah, cow and yes, cow guest, yeah.

Um that's what they're they can be on a guest net because that's not our network.

So and even even iPhones and iPads um that are being used all over the city.

We tell them do not try and join uh the the cow wifi.

If they can get into Office 365 through their phone, or or any mobile device and iPad, whatever.

And you know, potentially touch any apps that are in there, but that's through you know a secured mechanism.

So that's okay.

Well, it's through it's you know, they're getting those apps from the Apple App Store, you know, and then they're signing in, and everyone has MFA.

And so that's the other thing too.

Like when you look at like uh BYOD, I mean we are um I mean we're we're zero trust here, so we don't let people bring their um stuff here to work on.

Um you can't uh put our VPN client on your home computer.

Um now you can access you can do all the Office 365 stuff from any computer and any browser, but again, your your MFA and all that stuff, so you're more secure.

And so accessing those cloud apps I'm I'm fine with it.

Plugging into my network, no.

Okay.

So because then how do you know?

Yeah, how do you know, right?

And in closing through VPN.

Yep.

So VPN is uh they're only on um city devices.

Okay.

I don't have an issue with that.

I just I you know from a corporate, like from a personal standpoint.

We have we have a different mantra where I work, which surprises me because they force us to put a lot of we have a BYOD policy that forces us to basically put apps on our personal device and to have a personal device that has like authenticator apps and stuff on it, which I think is ridiculous because it's my personal device.

Well, but I guess that's my you know that's that's my cross to bear, and that's my you know responsibility for wanting to continue to work there.

That's the that's the one app that's the one app that we we've asked people to put on their personal phones, but it's an authenticator app.

It's not like we're asking you to put the full suite of apps on there just to get in.

But it makes my personal device a mission critical piece of my ability to do my job.

Oh and that shouldn't be my responsibility to do in in my personal opinion.

Yeah, we're I don't want to get off topic road many things in many different industries.

I healthcare primarily.

Yeah.

Okay.

Well, I think I mean I think what what's here makes sense from you know the justification of uh you know having it there.

I think you know, I think operationally we're doing what we we need to be doing, and this supports that.

Yeah, I mean, this isn't really a change to anything operationally, it's just kind of documenting how we're already doing things right, yeah, and coming into compliance with uh best practices, best practices and standards, standards and practices that we're trying to meet.

Any other specific language under the section I which is with director approval?

Is it director U or any directory?

Uh so my staff, if they had uh a phone, they would have to have my approval.

Um DPW, they have to get Alex Damien, the director of public work, director of the department that they work in.

Okay, yeah.

Chris, I did have oh, never mind.

That's the next one.

I'm I'm good with this.

All right, anyone want to motion?

Yeah.

Motion that we will approve the acceptable use policy.

And I'll second that.

So we have a motion to approve the changes to the acceptable use policy as presented.

All right, any other questions, comments before we vote?

Chris, call the role.

Sean?

Yes.

Ann?

Yes.

Steve?

Yes.

Brandon?

Yes.

Bob?

Yes.

And that passed unanimously.

Okay.

Takes us to item E.

And Chris, I assume that'll be moving on to council at our next meeting.

Yes.

Okay.

Now, item E.

Review and discuss enterprise asset management policy.

Okay.

So this is a uh a new policy.

Um before you guys.

I thought we had talked about this once last year, but um, because I actually had a date on the original uh starting to wrap my brain we had was I had a date of like April of 25 at the bottom.

Yeah.

And then I went and I looked through all of our uh agendas last year and uh could never find it.

So I'm like, all right.

Um I guess I never brought this through.

So um yeah, so basically um the enterprise um asset management policy is basically saying that we need to have our assets in an asset management system.

We need to understand what we what we own, what's on our network, um, and really kind of manage that whole uh device lifecycle from um from procurement through recycle basically.

Oh we um take a look at the policy here.

Um we define what an enterprise so here's the purpose of the policy.

Um enterprise asset management is the process of procuring, identifying, tracking, maintaining, and disposing of an asset owned by an enterprise.

The enterprise asset management policy uh provides the processes and procedures for governing the enterprise asset lifecycle.

Um we go through the definitions, and I'm not looking for action tonight.

This is first presentation to you guys, so you can see it.

Um look it over, and then I'll bring it back in April, and um and we can we can do some more with it.

So it's uh your standard definitions, what that looks like, um user responsibilities, and then the IT responsibilities.

So first, from an acquisition standpoint, we this is um so this is the same language that we have in our software policy, and it's uh basically um they have to be acquired um through the city using the city purchasing policy through IT.

IT has to be involved.

Um we have to review that I and then the capital projects part of it, which you guys are very familiar with.

Um then when we look at um going four down, this is really like what what we need to do and and how we manage assets now.

So um we assign unique identifiers uh to every asset.

Typically, we just use uh the serial number of the device as the unique identifier.

Um we are starting to put actual asset tags on workstations and laptops.

We're not asset tagging like docking stations or monitors or or phones, um, just um just uh laptops and desktops, and then within the asset management system, this is the this is the uh this is what we're collecting.

So when we when we order laptops and they come in, they have uh they have all the barcodes on the outside of the package, and so we take a barcode reader and we scan them into our asset management system, and so we already have the serial number, um, the make, the model, all that stuff, and then when we bring it in there, we put the purchase costs in there, we put the warranty expiration date in there, and then we put the the device's expiry date in there.

So we get a four-year warranty with devices that we buy that's based that's um mandated by state contract.

So uh HP laptop will have a four-year warranty, and we put a six-year expiry uh date on it.

So we are now replacing devices every uh six years.

It used to be five, three years of warranty, and then run it for two without.

And now when you look at the demands of laptops and desktops nowadays, there's so much that is web-based, so many applications that are web-based that there's not that demand for the CPU and the RAM, and they all have solid state drives nowadays too.

So they just they last longer and they perform like they were new longer.

Eventually you start hearing that thing grinding away and all that stuff.

So that's that's what we do.

Um start two years ago, the state contract changed, so we get a four-year warranty.

And so that's what we do.

Now when we image the laptop before we deploy it, um we put an agent that connects back to our asset management system, and that so it scans it and then pulls all the software in too.

So we have a our software inventory um is built through that that agent as well.

Um and then it also grabs the Mac address, the IP address.

Um it does um, you know, when we were first building out the asset management system with the client, it did pull all the model serial number and all that other stuff, and um, so um that's what we need to do.

So when we look at um when we look at mobile devices, when they go into Intune, um we export I the iPhones and the iPads out of Intune, our mobile device management system to a CSV, and then we can pull them into our asset management system, and we can synchronize um that way.

And then um, and then verifying enterprise asset inventory every three months.

So a lot of that is um we have different categories for our assets, they're either in store, that means they're sitting on the shelf ready to go, they're in use in repair on loan, expired, or disposed.

So uh, you know, as my techs are going through and doing their PC replacement cycles, it's going back through not only in the asset management system but an active directory and making sure uh what was replaced was removed from AD and has got its proper uh state inside um asset management system.

We also track uh the department and then site.

Um so if it's a fire department, it might that site could be station one, two, three, four, or five.

Um this is the discoveries um portion of it.

Um so part of this is if um if we come across assets that are not in the inventory, we need to figure out why they're not there, and uh that sort of thing.

So we've been doing this long enough where um where all of our lap, all of our devices are are in there now, and um, so it's not really like a big surprise.

Um let's see.

Um yeah, so permanently air gap systems must be approved by IT.

So we have two critical infrastructure utilities on our network, water utility, um, and the wastewater clean water plant, and um, and they have their their SCADA system is air gap.

So any asset that's being bought and being put on there, we we we talk it through with them.

All those PLCs and stuff like that on their SCADA network, we don't touch that is that is for them, they are the experts with that.

We just make sure their SCADA networks uh stay protected.

Um Chris, what's PLC you send you?

Uh programmable logic controller.

Okay.

Uh so it's what controls all the switches and pumps and pulleys and all the manufacturing or water system.

Okay, very good, thank you.

Um, and then we define uh control disposal here.

Um one of the things that we'll get into at a later date with uh with uh data management um is we train our end users not to put any data that's worth anything on their local device.

We everything should be shared to um OneDrive, SharePoint, the network, or stored in uh in a system, but never on the laptop itself, and so I typically do uh a yearly reminder email saying, hey, just reminder, don't store your data locally because if we come up to a laptop and it's have and it has issues, we're gonna give it maybe 15-20 minutes of troubleshooting, and if it's just not right, now we're gonna re-image it, and we'll start from there.

So documenting the removal of the enterprise asset from the enterprise within the asset inventory, so that's making sure that it's removed.

So that's making sure that it's removed.

Um and then the company that hauls our uh electronics away, they give us a certificate of destruction.

Um, and that's got the serial number and all that stuff uh of the device.

So then we can take that and we can attach it to the asset and uh inside the asset management system, and then we can um and then we can change that device to um disposed.

Is that on the same schedule as uh for the residents of the city of Walkershaw, those three three dates that we've got per year for uh electronics?

No, we we have a Gaylord uh back on the dock here, and we fill it up, and when it's full, we call we call up a company.

It's not it's not John's or whoever no, this isn't John's either.

I can't remember the name.

Yeah, and I know you can go to the drop off.

We don't know, we don't we have a we have a company that uh specializes in getting the valuable stuff, yeah.

And then making sure like all those laptops and stuff aren't just let you you know ending up in a landfill.

Question is there a chance that they could take the laptops and take information, try to find information about the city.

Um take the laptops and kind of go through them and find information or not um well that's why we that's why we worked with the company we do work with the e cycle, so that we don't have to do um so we don't have to go through the process of wiping the drives and stuff like that because that believe it or not, wiping a drive is actually time consuming if you're gonna do it the correct way.

Okay, um, because a quick wipe that stuff.

We have a guy that works on digital forensics right here, so he'll tell you a quick wipe, you can get that stuff back pretty quick.

Um but um so that's why we get the certificate of destruction.

We used to like for police department hard drives, we used to stack those things, and then we um in the in the data centers we were replacing computers and laptops, we pull the drive, stack them, and then we would have a company come out and shred them on site.

Take a bit of a fire, yeah.

So the whole machine the actual machine we shredded, they should yeah, so yeah, literally like a paper shredder, but they were shredding hard drives, and ground grind them basically.

That's what we do, right?

So we do we do um so we do e we do e-cycling with our stuff, so we have a company that does that, and then they um also do the certified uh certificate of destruction for white uh destroying the drives.

Uh and then on control just disposal, that's basically lost or stone, just report it uh back to us, and then um, you know the penalties of violations that every policy has.

So with that, you've got a lot more discussion or questions.

You have a tool set that is managing this, right?

This is we have a third-party software piece of the case.

Yeah, it's the the same software that we use for our service desk, does our asset inventory.

Um, and that's that's where we we keep it.

Um yeah, so we have you know, every laptop, every computer, all 300 plus cameras around the city and buildings and everywhere else.

Um we are working on iPhones and iPads right now, and um, and then you know, every printer.

Um when I click on if we go into an asset, um, because just about everyone has two monitors at their station, right?

We can see the serial number of the docking station that that assets plugged into, plus the serial number of the monitors that are plugged into that dock.

So um, and so then actually when we put the cost in for a laptop, we actually figure in the cost of a docking station too, even though we don't necessarily have to buy a dock every time, but we just what we because we use that for knowing how many laptops or workstations we have to replace in the upcoming years and the cost of what it's gonna do.

We're budgeted for so that if uh if this next version of the HP Z book doesn't work with uh the current docking station because the doc can't supply enough power or whatever it is, um, or we need an an extra graphics card for a third monitor in that dock or whatever, we can uh we we have that budgeted for.

I was just gonna ask um why you weren't tracking those assets in the same way, but you bundle it in.

Do you what about for insurance purposes?

Do you like for example if you had a fire and you have a way to track all the monitors and and everything else that are those tracked separately?

Those are well, they're in our they're attached to that asset.

Right.

So we would we would have it.

You do track them.

You just don't tag them.

Yeah, we don't asset tag them, and we don't have like a specific, I don't I can't go in and click on monitors and see every monitor.

I click on the asset, and then I can see the monitors.

So yeah, so let's just say um we had a fire and it wiped out all the computers in the clerk's office.

We'd be able to go in our asset management system and see every asset that was in there, including their laptops, their diverse stations, their monitors, their MF um their MFPs or MFDs, whatever you want to call them.

So do you track all the accessories?

So I would you kind of classify them as accessories then too, the machine in a way.

So um I think I think it might even pick up the keyboard and mouse.

Yeah, okay.

I was just curious how you how you manage those.

Yeah.

The the ones that were concerned, docking station monitors are what we're most concerned with.

Um because docking stations in particular, um, because there's a uh you know, a cost to them if if we're replacing a computer and it needs a dock and we didn't factor in the dock, well that's four or five hundred dollars.

We we we didn't budget for um yeah, I think I think laptops are like over three hundred dollars more this year than they were last year.

Yeah, same model.

Yeah, maybe even four.

Yeah, I've seen three thousand, five thousand, five thousand, seven thousand.

Yeah, old school laptops now.

So there's that uh chip costs, yeah.

That's great.

The memory and storage process.

Yeah.

And monitors, I mean, you know, monitors, they might last 30 years.

They might last two, you know.

For the most part, they're they're stable, and they'll just last forever.

Well, yeah, I was gonna say probably a good seven to ten years.

They'll last longer than the PC.

Yeah, it's I mean that's easily.

Yep, okay.

Network equipment and stuff in this uh well, I'll have to go see if we have it in our asset man.

So we have a we have a different system for all of our switches and firewalls.

It's our network monitor, and that has our inventory.

And so that network mark monitor not only has an inventory of everything, but you know, it shows the relationship where the switches are connected.

We monitor, you know, the um what's the bandwidth monitoring flow um Vita?

No, it's the uh speed of there's a protocol with Cisco switches where you can see how much bandwidth is being used.

NetFlow, I think is what it's called.

Something like that.

So it does all that stuff, and then but it also backs up the configs of all our switches every night, too.

So nice because if you lose one, it's a pretty quick restore, which we just uh we're having a small issue with we have a small firewall that connects the police department to badger net, and we're having uh issue with it, and that was something that we've been meaning to replace, and so we had the replacement firewall sitting in a box, so we we were able to log in to it and get the get the config off, but the config wasn't backed off initially.

So we got the config off of it, had to do some tweaking because it's a different model, you know, went from a 50f to a 70f 4048.

But that sort of thing there, I mean, if we if we would have lost that badger net firewall without any kind of config.

Oh I mean, it would yeah, it would just have been a pain in the butt because there's a huge ACL on there.

Because if you're not if you're not on that list, you're not going to the state, you know what I mean?

So is this a new policy per se?

Or is it this one here?

Yeah, yeah.

Yeah, okay.

So if you look at uh CIS controls, uh number one policy, asset management.

And that is all like you know from a control standpoint, how how do you protect something you don't know you have?

Right.

Or is it just you've just been doing it for your software all the time?

We've just been doing it all this time.

Gotcha.

Yeah, yeah.

And then um, and then it was a combination of the spreadsheet and this um asset management part because we had the the client that was reporting, and then um uh yeah, I don't know, a handful of years ago um is when we went formally full asset management inside this uh software because tax would get done report replacing a computer and they wouldn't update the spreadsheet.

So uh do we have a mean number uh you know per uh C or not not seat, but you know, for each employee, do we have a mean number of what that looks like IT wise per year, what that cost is.

Oh what do you mean by like so you know we've got 500 and some employees and the mean number, it doesn't matter what their position within the city is, but the mean number to support them with our IT.

No, I mean we know what their devices cost, we know what their software licensing costs, but I mean I think about like Muni Court.

That's that's one department.

Now they're small, yeah, but that's one department that doesn't call us very often.

Oh, really?

Yeah.

And you know, they they're basically using um you know, Microsoft Office and then their municipal court software system.

And if there's ever a problem with that with that system, they call their vendor directly.

Um but yeah, you know, some some departments uh use this more than others, and some users use us more than others.

But we don't do like internal chargebacks, so I mean we can see um uh tickets open and closed and what was done and stuff like that.

Yeah, but um do you do uh like uh copier is it are the copiers you gotta log into it and make your copies so they know how to how to uh you know plan for resource and and newer copiers as time comes along, you know.

Yep, we have a uh we have we we track those devices too.

We have a life cycle for them.

Um we do use managed print services, um, and so they manage those devices.

Now we used to re uh we basically have the big ones, they're on a 10-year replacement cycle.

That's because that's where finance decided to depreciate them.

Um our managed print services, they'll tell you like until uh the repair is 50% more of the value of that, then we're not then we won't ask you to replace it.

That's um that's and that's it's within our contract.

So um boy, we've recently we've replaced some printers at 13, 14 years old.

That's great.

And they're finally just like and the managed print service provider didn't ask us to replace it.

We just got sick of fixing it.

And it's like, well, look how old it is.

Let's replace it.

So it's funny.

So the one the one question I had, just because of how this reads to me.

Um with regards to disposal, we don't we don't eliminate those out of uh inventory, we just mark them as disposed.

Yes.

So there's a record of this once upon a time was an asset and now it's gone.

Yeah.

So that the very last bullet points E3 sub I for uncontrolled disposal, it says the enterprise assets must also be removed from the inventory.

When I read that, I I that reads to me as if we're taking it out of the inventory list altogether, as opposed to marking it as disposed.

Yeah, that should be uh yeah, that should be reworded.

That that just it read funny to me, so I wanted to ask about that because I I would assume we would be keeping track of, you know, and I guess I don't know, you know, if there's a records retention thought behind any of this as far as you know, I could see I could see a persnickety constituent out there doing like some kind of open records request for like all of our IT expenditures for the last X number of years.

And I would think that this would be something that would you know be discoverable potentially under some kind of not that I'm giving anybody an idea out there, but I'm saying probably uh state guidelines on this type of record.

Yeah, and if I recall it's it it's probably it's probably anywhere from it's either three, five or seven years.

Yeah, I was thinking of five or seven.

So whatever the length, I think sometimes it's also the length of what your uh your um replacement policy is plus a year.

I mean they do have lots of different things, just depends on the record.

Yeah, I suppose you guys do it then.

And then the other thing I was gonna suggest uh what Dan was talking about is maybe if it is lost or stolen, it's marked that way.

You have another instead of disposed, it would be marked that way, and you get that record that way to track it and and you know, just kind of change the wording around a little bit.

All right.

Let's make the note on the policy as we speak.

Just out of curiosity, do you um encrypt your laptops?

Yeah.

Okay, so if they're taken and I mean in theory, they it without knowing anything else, they're they're not really usable.

Right.

That's good though.

Yeah.

That's a good symbol for NSIC level.

Unless you take them.

Well, yeah.

It's a pain in the butt if you have.

It takes a while.

Yeah.

It's it's a pain in the butt if uh when if you are replacing hardware or even updating the BIOS.

Um put in your big bit locker record.

Yeah, bit locker.

Yeah, your 48 digit key.

What is it?

48 characters.

48 characters.

That's a long password.

And you can't copy and paste it, so you gotta type and then we type in that.

I think I'll BIOS change too because our top one of our taxes offside was doing it, and I had to put that key in about eight times and finally.

Yeah, and then it finally works.

I just yeah, it was.

Or you go into BitLocker and BitLocker shows like three or four different ones.

You're like, shoot, why?

Exactly.

Surprise.

Yeah.

All right.

Uh so I made note um that uh that instead of remo we're gonna we're gonna create a we'll create a state like this here, like an asset state.

Um we'll probably just make it lost lost or stolen, or maybe we'd make two more.

And then that way um if that happens, it won't be removed from inventory, but we will uh mark it as lost or stolen in its in its state.

I would also suggest that you do look at the um record retention laws and just add a statement about that, you know, we'll maybe we'll re keep these assets this amount of time.

Yeah, so if there was an open records and someone did that, that would be all you'd be required to pull that.

Yeah.

I mean, it's been three three years now since we went full on and just started throwing everything inside there.

So it's fine for now, but there's gonna be a point where we're gonna want to purge that database.

Right.

Yeah.

All right.

Very good.

I think it looks good, Chris.

I mean, I read through it and it you know made sense on the face of it.

I was just I mean, I'm I I knew we were doing this, and I assume we were doing this.

I was just curious, like how we were doing it in terms of tool set or you know, where we were storing this, because I know I I've I've worked in enough companies to know that this kind of thing is done sometimes on a very ad hoc, you know, spreadsheets, homegrown databases, tools.

Well, trust me, and it's I've seen for the I've asked for the PC replacement schedule and been given it, and like, oh wait, that's the wrong version.

So it's nice, like you know, uh one of the things like last year uh was the first year all the COVID laptops need to be replaced.

And if we weren't using uh our asset management system for the replacement schedule, we would have we would have just gone through the budget process and then and and then all of a sudden been like, oh crap, you know, we have like 30, 40 extra laptops that need to be replaced right now.

Right.

Was that ARPA money that was used back then for that?

Is that was that ARPA money that was used back then for that uh no that's that way ARPA was do it was different.

Okay.

There was COVID reimbursement money.

Yeah we probably could have ourselves back for Marpa money but we didn't oh yeah we used that in other ways yeah I just figured they must have had a different tracking way of doing things because they were just throwing it out like candy.

Does your does your tool set have some uh AI built into it where it alerts you uh when things are getting close to end of life or do you have to go through and query that um we have reports that uh show the next five year replacement schedule okay so um so we see some tools exactly how many and then that helps you manage that so I would think that would be a big bonus to having a well yeah having uh a tool set involved in that yeah the um you know the one thing that it doesn't do well is the software inventory because it inventories every piece of every soft Microsoft uh application that's installed in Windows and you can't get rid of it because it keeps bringing it back and then like some other shortfalls of it that we're just dealing with are like you know everyone has you know a version of Adobe they're all set to automatically update but there are you know it doesn't matter if it's Adobe Acrobat um every version is its own uh piece of software sure and so like we were we try and do license tracking in there well it says well you know we own a hundred uh copies of Adobe but there's all these you know this one isn't licensed because you're only licensed for dot three not dot two yeah but anyways any other thoughts on this I think any other you good with the feedback you've gotten yeah okay so we'll we're not gonna take action on this since it's the first time we've seen it Chris is gonna bring it back on our next meeting April next month say pass April by the IT on on this date so at the bottom I don't know what does that mean we have to vote on that no no that's just the placeholder okay the it's always the pass date uh by ITV date and then uh the pass by council date and then and then I have uh a spot on the employee internet site so when you go to IT policies it shows when it was approved by council and the last annual review of ITV.

So I I looked at that policy I'm like I don't remember passing this and then I I looked at I I went down and looked at that exact thing and I'm like well there's a date on it maybe we did I didn't go back through the agendas to make sure one way or another but I was con I was uh wondering about that so 2025 good question right yeah okay uh that takes us to item six communications and referrals um Chris you want to mention the board member celebration so everyone should have got an invite from Rebecca Peterson um next next uh ITB meeting would have been March 4th but there's uh celebration dinner for people that have served on on boards and that's one of the things that we're trying to do is recognize um people like you that take time out of their schedules to serve as um you know citizen board members and so there's a dinner at Tuscan hall on March 4th and uh so if you are able to make it that'd be great I thought it's perfect for us because we already had something planned.

Yeah you were planning to be here and you can um and you get to bring you know a plus one so um I know uh Paul's gonna be there and and his wife Lori so Paul's wife Laurie was just appointed uh as our municipal judge through April 30th um because uh judge wimmer passed away unexpectedly um a couple weeks back that's gonna hold what's the hour I 6 p.m 6 p.m okay I think if I threw it's like drinks and then six oh yeah six or seven is the uh let me pull that up real quick yeah 5 30 is drinks and six or seven is uh dinner meal no Chris thanks for thanks for remembering and putting that on the agenda because I remember seeing that email and it yeah totally slipped my mind but I do remember it being on the same night as our as our meeting so certainly if you can make it I'm signed up so and and if you haven't RSVP'd to Rebecca yeah please do so I don't think I have so I should probably do that if I Mr Manning

Manny Yeah go February 18th to uh RSVP okay thank you yeah there we go five thirty doors open cash bar and dinner and then program all right Wednesday March 4th yeah all right that night off work all right okay um but any other communications Chris from IT that's it that's it anything from the board no okay um item seven on our agenda is adjournment is there any objection to adjourning hearing and seeing no objection we're adjourned by unanimous consent at 742 all right thanks everybody thank you