Item - 2022.GL32.13

The General Government and Licensing Committee recommends that:

1. City Council authorize the Chief Information Security Officer to enter into a one (1)-year non-competitive contract with Ernst & Young LLP in the amount of $1,900,000 net of all taxes and charges ($1,933,440 net of Harmonized Sales Tax recoveries) to develop an Integrated Risk Management solution on terms and conditions satisfactory to the Chief Financial Officer and Treasurer and in a form satisfactory to the City Solicitor.

2. City Council direct that the information in the confidential attachment to the report (June 17, 2022) from the Chief Information Security Officer, and the Acting Chief Procurement Officer, Purchasing and Materials Management, remains confidential as it includes information relating to the security of City assets.

The purpose of this report is to seek City Council authority for the Chief Information Security Officer to enter into a one (1) year non-competitive contract with Ernst & Young LLP for professional services to immediately develop an Integrated Risk Management solution. The services are urgently required to support the City's Cyber Risk Assurance Program by integrating risk management practices into processes, standards, governance and compliance across the City's divisions, agencies and corporations. An Integrated Risk Management solution will ensure that the Office of the Chief Information Security Officer can effectively address Council's direction in agenda item GL30.12 to report instances of non-compliance with cyber risk assessments and the City's Cybersecurity Confirmation Program in a timely and effective manner.

The Integrated Risk Management solution is required to enhance cyber risk oversight, governance, and compliance across the City, its agencies and corporations. Due to the increase in complexity and frequency of cyber threats, building a robust Cyber Risk Assurance program that includes a comprehensive, Integrated Risk Management solution to manage cyber risk effectively and holistically is crucial. The Integrated Risk Management solution will create a culture of cyber security, and improve decision-making. Due to the time constraints of having these services begin immediately, a competitive procurement process cannot be conducted.

The total potential amount of this engagement is $1,900,000 net of all taxes and charges, and the total potential cost is $1,933,440 net of Harmonized Sales Tax recoveries.

City Council approval is required in accordance with Municipal Code Chapter 195- Purchasing, where the current request exceeds the Chief Procurement Officer's authority of the cumulative five-year commitment for each supplier, under Article 7, Section 195-7.3 (D) of the Purchasing By-Law or exceeds the threshold of $500,000 net of Harmonized Sales Tax allowed under staff authority as per the Toronto Municipal Code, Chapter 71- Financial Control, Section 71-11A.