Moose Jaw City Council approved measures for City Hall to enhance its cybersecurity and add another IT position during 2023 budget deliberations last night, but it's coming with a price tag.

City council approved the hiring of a business analyst for the Department of Information Technology at a price of $76,000. The funds would come from the operating budget, bringing the proposed 2023 tax increase from 4.75 per cent to 4.98 per cent.

Contracting an IT security company for the amount of $100,000 was also approved for the operating budget. The funds will be transferred from the IT Equipment Reserve to the operating budget, so there will be no impact on taxes this year. It will have impacts on future budgets as it would have equated to a 0.29 per cent tax increase.

Manager of Information Services Ryan Nelson gave a presentation to city council. He says the number of complex software systems the city uses over the past 10 years has increased, yet the support staff has remained the same. The Information Services department has 5.5 in-scope staff including two helpdesk employees, a technical analyst, a senior technical analyst, a part-time webmaster and a business analyst.

The Information Services department has had a second business analyst position since March of 2021 funded from the capital and equipment reserve funds. In 2022, the department decided to fund the position through a vacant Geographic Information System (GIS) technician position. In turn, it put GIS projects behind. City council approved the funding to make the second business analyst position permanent in the operating budget. Coun. Dawn Luhning was the only councillor opposed.

The second position will support the Department of Financial Services as it transitions to the new Enterprise Resource Planning (ERP) system. City manager Jim Puffalt said the position could entail cost savings in the long run.

"You know we don't come with a lot of requests for staffing, but this is one we felt was critically important as we move forward and take full advantage of the ERP program. Even if we look at the JD Edwards system from before, we didn't use it to its fullest extent," Puffalt said.

City council also approved $100,000 to contract a third-party IT security company. Nelson said the city was unable to purchase cybersecurity insurance as the insurance company left the market. City administration searched the market and found that the bar had been set so high that the city would not qualify for cybersecurity insurance. IT specialists are in high demand and Nelson said they come at an astronomical cost to build a team in-house.

He said cybercriminals are no longer attacking large banks and companies and focusing on smaller targets such as hospitals, schools and local governments. For example, the City of Saskatoon lost $1 million in the summer of 2021 due to a cyberattack, while an attack in 2020 shut down Saskatchewan Polytechnic's computer systems.

"We don't want to be the next headline. This is something that we need to do to stay ahead of that. IT security is a cat-and-mouse game. Everyone is getting better at everything including the bad people," Nelson said.

The cybersecurity company will install an intrusion detection system that will look for attacks 24/7 and, if an attack occurs, it can alert staff on what to do within 30 minutes. Contracting the cybersecurity company was approved unanimously by cit council.