MAYOR-PRESIDENT SHARON WESTON BROOME
The City of Baton Rouge has a tremendous opportunity before it to make its operations more efficient, secure, and cost-effective. The strategies, initiatives, and actions presented in this report are just a beginning point, providing a roadmap for the coming years.
The primary recommendation of this committee is to create a Chief Information Officer role and consolidate IT authority, IT security, IT procurement, etc. under that role. This will help establish consistent standards and priorities, normalize costs organization-wide, and protect our resources from security and privacy risks.
As part of the effort to consolidate IT activities under a CIO, the city should create a centralized IT procurement budget that is managed by the CIO’s department. By developing a standard IT asset management lifecycle, the city can potentially receive volume discounts and can procure and retire assets on a defined schedule. This will improve forecasting of IT costs, increase security, and decrease required resources for ongoing maintenance and support.
It is the committee’s belief that once a CIO has been put in place with proper control and authority, IT security should become a top priority for the administration. The city faces tremendous financial and legal exposure from cyber-attacks, as well as internal threats. Taking appropriate steps to mitigate these risks should be of the utmost importance.
We recommend strengthening the current Open Data initiative by requiring departments to liberate their data either through an executive order, or city ordinance. This will help reduce future development costs, increase public transparency, and invigorate civic engagement.
By liberating important public information and supporting policies of Open Government, East Baton Rouge Parish will democratize access to services, enable innovation that improves the lives of its people, and increase transparency and efficiency.
The City-Parish should create an open data Executive Order that outlines data required to be liberated across all departments. Currently, there are no requirements for departments to participate in the Open Data initiative, so critical data is not available to the public.
Resources:
Sunlight Foundation Best practices
City of Chicago Executive Order
Given the increased importance of data management, data privacy, and data-driven decision making, the committee recommends establishing a Chief Data Officer (CDO) role. This role will ensure the city is building the right infrastructure to capture and analyze critical data.
In addition, it is recommended that the City-Parish create partnerships with local universities that can help perform the data analysis duties.
Resources:
Establish data-driven decision making philosophy by ensuring that data collection and analysis is a part of every project and initiative.
As part of this process, build departmental dashboards which report Key Performance Indicators to measure department by department performance.
Resources:
Infusing Government with a Data-Driven Culture
New Orleans Is Moving From Dysfunction to Data-Driven Decision-Making
It is the committee’s belief that once a CIO has been put in place with proper control and authority, IT security should become a top priority for the administration. The City-Parish faces tremendous financial and legal exposure from cyber-attacks, as well as internal threats. Taking appropriate steps to mitigate these risks should be of the utmost importance.
The city needs to develop a strategy for protecting city assets, monitoring digital traffic, and responding quickly to potential attacks. Ignoring this issue could lead to the exposure of personally identifiable data, credit card data and other highly sensitive data that the city captures and maintains.
The City-Parish should conduct a series of assessments across departments to identify security gaps and deficiencies. These reviews can include (but aren’t limited to): vulnerability assessments, penetration testing, compliance audits, and internal control reviews.
The ultimate goal of these reviews is to help provide an independent assessment on where your IT department should prioritize and focus its security remediation efforts based on the likelihood and magnitude of the security risks.
This administration should create and implement appropriate policies and controls to ensure sensitive information (PII, PCI-DSS, etc.) from getting breached/exposed. There are serious financial and legal risks associated with data breaches and the City-Parish needs to take the necessary steps to mitigate these risks.
Conduct a review of onboarding and termination processes to ensure appropriate controls are in place to mitigate risk of employees maintaining inappropriate levels of access to critical systems.
This administration should develop an annual IT training program to train all government employees on proper processes and protocols that can help prevent security incidents from occurring.
By establishing a regularly recurring training program you ensure that both new and old employees are always up to date on the latest policies and procedures.
Based on the results of the security reviews, the City-Parish should consider outsourcing certain security functions where the cost-benefit makes sense.
The City-Parish has historically has not been competitive with the private sector IT salaries in the current market. Therefore, the department should engage in strategic partnerships and outsourcing to close voids in the employment gap.
Many cities are in the process of re-imagining their procurement process to aid in streamlining the process to encourage new businesses to participate and improve the depth and quality of the ways in which their process is open to the public.
The goal of these efforts is to reduce delays, decrease costs, and support the local economy as well. The committee believes the city should investigate ways to leverage modern technology to improve the depth and quality of the ways in which their process is open to the public.
Currently, departments are responsible for funding and purchasing their own IT equipment (computers, laptops, etc.). There is no centralized IT Procurement budget.
The first issue this creates is it limits the City’s ability to make volume purchases and receive more favorable pricing. In addition, this increases maintenance and support costs by forcing IT to support hundreds of different combinations of hardware and software, some of which are woefully outdated. Finally, this poses a security risk for the city as some older versions of software that have not been replaced timely may no longer be supported with appropriate security updates.
It is recommended that the City-Parish consolidate these types of purchases under the IT Department and the IT department create an IT Asset Management Lifecycle to accurately forecast the purchase and retirement of City assets.
The City-Parish should create and utilize Qualified Vendor Pools in order to speed up the RFP process, reduce costs, get higher quality work, and lower risk of failure.
By creating a pre-approved group of IT vendors that the City-Parish can use to help complete the various tasks and jobs needed during the life of a project, the city can reduce its costs while increasing its speed.
Resources:
Creating and Using Qualified Vendor Pools
California uses Qualified Vendor Pool for major project
The City-Parish should reform the current technology RFP process for development based projects to require submitters to build prototypes as part of their submission. A majority of the RFP evaluation is then based on the quality of a prototype each vendor submits in response to a challenge.
Resources:
The City-Parish should improve its digital tools to streamline service and enable citizen-centric, collaborative government. It has the opportunity to expand social media engagement, implement new internal coordination measures, and continue to solicit community input.
The City-Parish website should be redesigned in order to facilitate more services being processed online. In addition, the site should be responsive and more user-friendly to service the public’s information needs.
This administration should facilitate and host the first ever series of City-Parish Hackathons. These events can partner with local firms and use the City’s open data to create prototypes that help solve real-world problems our community is facing.
Resources:
This administration should plan to launch digital services and platforms that increase civic communication and engagement. The government should work to reach its citizens where they are active regardless of medium. This should include things like social media, live chat on the city website, and opt-in push notifications.
Several cities have created a “Mayor’s wish list” for solutions. This list is effectively a call for the local technology community to develop solutions to community problems.
In addition, the Mayor could highlight a different app or website each week that’s helping our city. This will help promote the technology community as a whole and incentivize civic participation in building solutions.
Create a city answers website where citizens can ask a question or type in keywords using standard language and receive friendly and comprehensible responses.
This can be built to serve the community in the interim while the City website is being re-designed. In addition, there’s open source code that can be leveraged to build this quickly and free. Several cities even involved the community on building their sites.
Resources:
The City-Parish partner with local businesses, developers, entrepreneurs, and universities to build an Urban Innovation Group. The goal of this group is to build digital services and tools that the community can utilize to help or solve key issues the community faces.
By leveraging the city’s resources and data this group and work to resolve problems like Blight and Infrastructure using similar methods as other cities.
Resources:
New Orleans BlightStatus app (open sourced)
The administration should continue to support a growing digital media sector through a wide array of programs, including workforce development as well as a more streamlined path to do business in the city.
Establish a streamlined online portal to streamline the permitting and business creation process for new companies by consolidating all required applications and permits by industry in one place.
Resources:
This item is primarily addressed in the IT Procurement section, but the City-Parish should work to lessen the hurdles and time required to work with the City on government contracts. This will help open opportunities to more small businesses, minorities, and entrepreneurs.
This can be accomplished through a variety of modern methods like creating an eProcurement processes, utilizing micropurchases, or reverse auctioning (where vendors bid until they hit the lowest price). In addition, utilizing best practices like Qualified Vendor Pools or Vendor Prototype Challenges can help ignite more local business development.
There is a greater demand for tech talent than our city can currently supply. Our depth of talent is consistently one of the biggest challenges the city faces in attracting and retaining businesses.
One part of the solution is to help coordinate classes where citizens of all skill levels can develop or improve their skillsets. This can be done by promoting existing initiatives and partnering with local entrepreneurs and technology firms to create technology education classes across all ages and skill levels.
In addition, some cities that have taken on similar goals have created an option for attendees to have work seen by prospective employers. This helps employers better evaluate potential employees and adds a new path to employment for individuals.
Resources:
Kansas City Digital Life Skills
NYC Digital Ready School Partnership
There is a significant need to develop a robust Business Continuity plan to ensure limited service disruption or loss in case of an unplanned event or crisis.
Perform a Business Impact Analysis (BIA) and rank mission critical data, systems, and applications. This will help guide future decisions for planning so that tasks and activities can be stack ranked by order of importance.
Resources:
Business Impact Analysis Overview
City of Virginia Beach Business Impact Analysis
Use the Business Impact Analysis to help develop a Business Continuity Plan (BCP) that covers what to do for employee transitions, facility outages, system crashes, etc
As part of the Business Continuity Plan, a disaster recovery plan should be built using the information gathered to minimize downtime during a crisis or unexpected disaster.
In addition, critical portions of this plan should be tested annually to ensure the processes and procedures are in place and operating effectively.