VERMILION — A discussion about cybersecurity compliance during Monday’s Vermilion City Council meeting turned into a lengthy debate over the status of the city’s IT services contract, with officials appearing divided on whether the city is operating under a three-year agreement or a month-to-month arrangement.
Cybersecurity issue raises audit concern
The conversation began during Finance Director Chad Angney’s report, when council members asked about potential cybersecurity compliance issues and whether the city could face audit findings related to state requirements.
Angney acknowledged the city may receive an audit note or finding tied to cybersecurity compliance, but said officials are attempting to address the issue properly rather than rushing through a policy simply to satisfy requirements.
“I don’t think it behooves any of us to just throw a policy together for the sake of throwing a policy together,” Angney said during the meeting.
Angney said the city needs to work with IT professionals to properly identify critical systems, establish security controls and determine what infrastructure investments may be needed moving forward.
Contract status questioned
But the discussion quickly shifted toward the city’s existing IT services agreement.
Angney initially referred to the city’s arrangement with IT provider MRRK as month-to-month after the expiration of a prior contract. That statement prompted pushback and questions from several council members.
Councilman Greg Drew said council had previously approved a three-year contract extension and argued the city was still operating under that agreement after an earlier cancellation attempt was later rescinded.
“My recollection is exactly as Councilman Drew had said,” Law Director Tony Pecora said during the discussion.
Councilman Drew Werley then pressed for clarification, saying the conflicting explanations had become confusing.
“I’m confused here,” Werley said. “I’m looking at an ordinance that passed October 6th of ’25 entering into a three-year contract, and now we’re hearing month-to-month.”
The discussion continued for several minutes as officials attempted to clarify the timeline surrounding the agreement, prior cancellation notices and the city’s request for qualifications process for IT services.
Mayor Russ Owens also weighed in, saying his recollection of the situation differed somewhat from Drew’s and Pecora’s.
Owens said discussions had taken place with the provider about maintaining continuity until technology systems associated with the city’s new police station were fully operational.
Despite the disagreement over the contract history, officials ultimately appeared to agree the city is still operating under the council-approved agreement for the time being.
The debate unfolded while city officials also acknowledged ongoing work to address cybersecurity compliance concerns.
Angney said the city recently issued a request for qualifications for IT services and indicated outside expertise will likely be necessary to properly address the issue.
Council members emphasized they do not want disruptions to city operations or police services while any future IT decisions are considered.