 This testimony, we were looking to have some understanding of where our municipal and state systems are most frequently So so I put together just a sampling list of where municipal Governments interact or interface with state website systems and Having pardon So But John did basically the same thing and has a far more complete list Okay, so we might want to go through the details with reference to commissioners Secretary Sure, so I brought copies we we pulled this information from our application inventory These were that there may be missing some things that connect, but we tried to look at it from perspective Most systems that we really share and where was their vulnerability, right? Like a tri-state fingerprinting system where if one state got infected it could potentially bleed over to the other states That's kind of the approach we took we took so just because someone has access to an site We didn't necessarily list all of those because the list is extremely extensive and goes beyond just municipalities and could touch ordinary, you know for monitors or others we added school districts or school systems in as well, so You know here is the list of the things that we found Really intersected the most and potentially added some level of security Vulnerability or potential risk and that's really just to be clear about at least my intention of understanding here It's to understand where we have added or shared risk between state and municipality outside systems and Understanding maybe the need to prioritize or think about those in a shared way. I think that Karen's list is Valuable to me because it gives me You know a different list to work from to look at those sites from From all these the cities and towns perspective on the things maybe that are front and center for them on the things To make sure that there is accessible and easy to use as possible, so I think her list is going to be great for me as well even if We took slightly different approaches. I think her list will be valuable. Have you had the chance to compare lists? Well, you know that all of yours are on here. I Think I haven't looked at it in great detail, but I think all of mine are in here I think the biggest ones for us are Department of Environmental Conservation and What about the tax and the elections issues? Those are the ones that we Spend the most time on then which you might want You might have some thoughts about but the municipal the beamers system, but those are Individuals, you know like remote municipal employees retirement system So that's a little bit of a different animal. I think And then we have things like vital records where the town parks can access the vital record system here at the state and Load information back and forth which Again, you know from ransomware type of perspective would potentially add risk if you're able to Write to a system It adds additional risk. What is IPTMS? What page are you on sir? So kind of very first under state property tax system Plans for the IPTMS to replace that system Joe and we're going to hear from Joe It's integrated property tax management system Is that something is under development now or Yes, we are we I know plenty enough did we go shortly, but it's that we Thank you as you can as you can see from the list. I mean it's several pages, but State and state government and local government intersect them in many different areas. I Focused on the main it agencies and how they connect And so To understand how you broke how this has been broken down and it looks pretty comprehensive At least in a big picture way It's by agency. Yes, and then by individual system Yes so each Each one of these is an individual system. Yes Somewhere along the line, I think this is probably one of the Conferences that Civility and I attended during the course of the summer. It was mentioned made that systems that are dot gov are Somewhat more secure than systems that many municipalities use that are not got gov Does that make sense to you? It does We made the transition a few years ago over to gut gut the before that we were in the Vt. US space and they opened up the US space to a much broader audience or to a much broader clientele so to speak and so, you know, we looked at it from the standpoint of being able to mask the addresses were a little bit easier for Potential threats So when you look at John doc Quinn at the old address at state vt. US You know, someone could have easily bought this the space at states Vt. US or something similar to that or vtt. US and The dot gov space Was only for government So, you know, we made that switch at that time There was new legislation in the past couple of weeks and I haven't read the Nassio article, but about bigger push to move All government entities to the dot gov space The local as well local as well because that's a one of the issues I haven't read the Nassio update yet, too But but I'll send it to you And I believe that we did hear that in reference to municipal governments that there was more ability to protect Yeah, and we have some towns that the cities and towns that are on dot gov But we have quite a few that are not Do you have Is there are their best practices somewhere for municipalities regarding online presence of cyber security care, we have Page on our website that has a lot of resources for local governments around those issues We've done a number of trainings now and we'll continue to do trainings around that And As I mentioned, I think at our last meeting that the keynote speaker at our Animal meeting this year was a cyber security Expert and that actually generated a lot of new interest in Yes, we need to do something at the local of online and of our game considerably also we've had some It's not ransomware, but the Norwich situation where there was a email sent Presumably from the town manager and funds transferred that also raised people's awareness considerably Unfortunately, so and we have covered that That loss that what the town was not able to recover in that instance Some some of the Bank accounts my understanding is we're in the United States and so they were able to track those But not I don't believe an actual individual, but I may not be up on the latest information about that. Okay With regard to these systems, do you have a sense of Which ones Which ones are most often used like the volume of use I Wasn't able to pull that together in a short period of time But would you is that something that you would? We that you would know you feel we would be able to track so that information. Yeah, and similarly Are these ranked in any kind of order in terms of no, okay, so other questions I have are Is there any I'm sure that there are some that are that potentially Have a much bigger like a hack into those systems would provide would be a much bigger impact The breach of those systems would be much bigger impact than others Eventually, yeah, okay, and so would is that something that you would be able to share with us? In the executive session Yes, okay, and would you be prepared to do that today or would that be something you'd need to compile? Yeah, we would need to compile that I mean there's a lot that goes into You know the risk assessment or you know to look at not only how many people access it but age of system and You know potential vulnerabilities and overall network. There's a lot to go through there Okay, well, I guess the issue is one of how when you have an inventory this large How do you prioritize what you do and almost to the extent of adding another column and On the basis of your assessment to summarize it in terms of red green and yellow So that you know those things that pose a significant risk to at least point it out to us at this level without necessarily Going into each and every painful detail. Yep Yeah, we can we can certainly For us, you know right now having close to fourteen hundred different applications out there You know we're focused on the In order to close, you know what we've been talking about is the five-year gap that trajectory of expenses to revenue coming into the state One of the biggest ways ADS can help is to be able to Reduce the number of overall systems, which reduces the manpower that we need to build capacity to do projects better And so we've picked certain platforms whether it be in Human resources and financial space and being able to look across the enterprise and look at you know that the 10 or 12 grants management systems and You know the three different or five different or seven different Financial systems that we have out there and focus on a platform that they can all go into so bucket like systems one of those areas is case management as you can imagine the state does a lot of Case management type of stuff Constituent management type of stuff. I think we've identified like a hundred and seventy five just a human services different processes and Applications that do case managers and we're focused on Building those into buckets building those into certain platforms like a Salesforce platform Where you know we can turn applications around and modernize them in eight to twelve weeks for a lot of the applications rather than Doing an RFP that takes 12 to 18 months Building a one-off system that may not fit everyone's needs. We're working on the platform that everyone can still Have a unique type of system, but we can share the data on the back end and Reduce the number of people we need at the same time keep the systems updated When I say that the systems those platforms are updated by the companies So we're out of the business of having to go through these cycles of every three to five years of an expensive upgrade So that's kind of the way we're trying to tackle the consolidation and get a handle on the number of applications that we have Is the federal government I can't remember that the acronym for it create a system both for federal agencies, but also Available to the states that modularized a lot of common processes run by the GSA Has a number so that ring a bell with you. It's not ringing about I'll find it that's a lot of You know frustration on the parts of the state and we talked about it a lot through the National Association of State CIOs You know if the federal government could get themselves on the same page and not for a rock-staking class house, but You know being able to use the same system across Multiple areas of government. That's what this was this program is designed to do and I know it's up and running But I don't know whether or not it's it's interacting for example with with a lot All right, and evidently from your perspective. It's not I think it depends on the I think it depends on the agency So someone like CMS has their own rules compared to someone like Department of Labor is completely off on a different page doing their own thing They're not following the GSA rules right So I would I would like to be really clear I understand that you the municipalities, you know our other branches of government are all really Scrambling to you know, make sure that we are doing as much as we can So I don't want to I don't want to burden with a lot of unnecessary or But I do think that it's important for us to have for the legislature to have a sense of which which systems should be prioritized in terms of thinking about Municipalities who it seems like they may be we don't really have a good assessment, but it seems like they may be pretty vulnerable a lot of them Which which ones which state systems are being accessed the most by our municipalities and Of those systems, where's the greatest risk for the biggest impact, right? those could be different things the most Used systems or most access systems may have all the security in place that it needs, right? We have to follow federal regulations and compliance in a lot of these systems whether it's IRS 1075 compliance or some kind of HIPAA compliance or social security compliance So when we talk about, you know the access of the system the risk may be different for our system That isn't used as much, right? That may be a higher risk than you know our most used system I do think that there are definitely from the municipal point of view definitely systems that we use more frequently than others and for instance, listers are exchanging information on the tax might be to tax system weekly The Department of Environmental Conservation the permanence notices of violation complaints from folks Those are get pretty high use the community development Grant program has an interactive site. So if you've got those kinds of grants you're on that site quite frequently, so There there are some and then of course elections, which is kind of seasonal But when you're using it, you're using it a fair amount so I think I think Secretary Quinn what I am trying to understand is if we have a number of potentially not optimally secured It's accessing into Just if there's additional risk Mm-hmm Sure, I mean, you know that I mean is that something that you can I Think so I think we can you know overlay a Assessment of some of these of all these things and say you know whether or not It may it may just be on the amount of access that a town or municipality has into the system That adds additional risk not that the systems necessarily not secure from a Outside perspective, but when we give someone full access to a system to be able to do something if they're infected Or if they get hit with ransomware it could potentially bleed over into our system if they access the system in the ransomware client gets put on our side of the wall Is there equity of access to all of these systems from municipalities or they're like levels? There are levels. Yes. Okay, and is it by like position or you know, you've got a register or I couldn't tell you size I think it all depends on the system the GSA thing that I was mentioning earlier says it seems very so much in your description of what you're doing now It's called 18f and it's a digital service delivery strategy modular contract It's an acquisition strategy that we use many of our partners and internal programs with modular contracting We break up large complex systems into multiple tightly scope procurements to impact technology systems and successive Operable increments, and they have at this stage a Service descriptions and we use them stand so that that is what that is something that you were using them on the Integrated eligibility project And they've helped considerably in the procurement space. Okay, that that's where they've been really Get positive Force for state government helping us reduce the amount of time it takes to go to contract and building smaller Modular deliverables for different projects and so it has been valuable in that space Where we where we differ and you know, I think this always happens with technologists They like us to build things from the ground up and I hate that You know, I like to buy something and implement it I do not like our staff to build things because I think historically we put ourselves in a position of Several leaves and then we don't have a way a good way of supporting it It's written in a way that is really hard to support So that's where we differ but in the procurement space 18f has been valuable to us There's this more actually A little bit of time to digest and understand Yeah, and we can we can continue to build off from this and add some okay some more clarity to the list What do you think that we should be concerned about with this list? This list what do you think we should worry about or now or care about with regard to this list? The legislature I would say, you know Give it where we are, you know, we're having a challenge doing Keeping track of the 1400 applications to be completely transparent There's so many we have 10 security staff in total and When you look across the enterprise when you look at, you know, how we secure these things how we Do assessments of these things on a regular basis? We just can't keep up and the number of outside systems that we share while it's valuable from a standpoint of data and Reducing the overall number of systems that we would need maybe we share a system that each Municipality would have to buy if we didn't share it It adds it adds a lot to our plate, right? And it adds vulnerability because we don't have enough people just to be quite frank we just Things have been built off from and just added to for so long in a Decentralized way that it's going to take up, you know Quite a few years to really put us in a better position well, one of the things about risk assessment is you take a look at the risk that you face and the resources that you need to address those risks and it becomes a balancing act of Can you afford to add the resources versus of the risk that you're facing in terms of the potential loss if you don't And have you done any kind of an analysis like that? We have And that's why I think each year We we add to that analysis or we look at that analysis and that's why each year That ADS has been in existence the main area if we have an increase in our budget has been in the cyberspace First we started with visibility to the to the overall network looking at our main intrusion detection points and Getting some visibility through large University Last year we expanded on that contract and added additional money to upgrade pieces of our network that we're Failing and added vulnerability this year There's three more things that I'm proposing in the governor's budget that will further Reduce the amount of risk that we have based on you know internal analysis on Where we see the most vulnerability based on assessments that we've done that we've talked about in the executive session When it when it comes to a system by system standpoint, we're doing that at the time of modernization or upgrade just because of the The sheer number and we do a lot of that based on prioritization of how old and what risk it involves Yeah, that's why as I say with just this inventory admittedly is a summary of the 1400 systems that you're just right here Giving us some sort of an indication of what the priority and risk is so that we can again from a legislative standpoint try to prioritize But what we do on our end to support you So one of the items that we're going to talk about at the end of the day is this memo That will be sending to the committees of jurisdiction It includes recommendation to consider funding at third-party assessment Cyber security risks. I don't know if you've seen this I think I've seen a draft. Okay by local government to the state systems and develop parameters for that assessment with the LCT Secretary of State so This information here. I think really is is relevant to that point Both in making sure that our Municipalities can access can can safely access state systems and that we're protected Okay, so at our next meeting It would be I would like it if you would come back with As much specificity in terms of prioritization I don't need a comprehensive, you know, I Don't know what the committee would like I am not looking for a comprehensive of each one of these rank each one of these I'd like to know what is really in terms of volume and risk and potential impact like where what are the What is rising to the top? Okay, so let me repeat what I just heard. Okay, so a Ranking of the systems based on volume and risk as we see it to both state and local Summarized down into a smaller list potentially of the most. Yeah, that's what that is what one page Yeah, I think of document. What's about to fall on its face if it does cause us huge losses of data Huge risk in terms of public safety or the grinding to a halt of all government operations as we know Those little ones. I'd like to see at the top Or when we're considering whether or not to do this assessment Why? Right You're asking for specific systems as opposed to policies and strategies, right? Yes Yes, and so if that is something that I and I would like as much Specificities possible and so if if possible so if that needs to be an executive session then If if not would be better And then I would note We've been working on we'll be talking about later today a cyber security class with Norwich That is coming in hosted by FEMA and Texas A&M I don't know if that information has made its way around yet that we have In addition to inviting the legislature and the judiciary VLCT will be invited to attend that and if there are open Spaces Thank you, Joe, are you ready? Yes Big break maybe do you want to be up on the screen? I don't think so It's a copy So good morning, my name is Jill Remick. I'm the director of property valuation interview at the tax department Thank you. I my head out has Vermont partner taxes at the top here and normally I'm all about projecting and avoiding paper But I thought this would be helpful for me, especially to make sure I get to my points to you folks And you know keep current use in business So the division of property valuation review oversees any of the work that we do with The statewide education property tax so we have a team of district advisors who are field-based who are Responsible for oversight and assistance to several towns most of them have 30 to 40 towns a piece assigned to them We also implement the current use program The tax increment financing portion we work closely with that see but we oversee You know, we work with the towns and oversee the implementation of that and tracking the increments We also do railroad corporate tax utility valuations And work pretty closely with the income tax folks for homestead decorations and property tax adjustments so basically were the entity that Maintains the statewide education grand list in partnership with the towns and then we work with the towns We established the tax rates with the agency of education and push those out. So the reason I'm here I really appreciate you folks giving me a little bit of time I've started following your group with interest last month when Karen Horn let me know that you folks were interested in Municipal IT specifically Because we just this summer did a survey with the LCT of towns and it's a very informal You know, it took it was estimated took about nine minutes to take But there were some good nuggets of information. So I thought that would be helpful to you folks And part of the context of why we wanted to ask some of these questions is we are working at earnest to replace our current Grand list software program That's the that's the IPTMS So we are at the very final stages of selecting a vendor for that That has currently been carried out by New England Municipal Resource Center Since basically since access to an access date past that's the system that we've had in place and it's It's pretty outdated. It's pretty cumbersome to implement You know as secretary Quinn has on his list, you know There's file manual file transfers that have to happen on a daily basis to get that information back and forth And it's really time that we make it a little bit more user-friendly for the towns That we take advantage of some of the more, you know, modern ways that we can use GIS integration and also last year there was some Negative press that numeric New England Municipal Resource Center got regarding share software Or what municipalities use for things like payroll and human resources? So while it wasn't the component that we were contracted with them to do obviously It's the same entity and that caused a great deal of concern and that just sort of helped reinforce what we were already working on Which is working to really move us off of this very old platform That's very manual and very vulnerable into something much more modern So it's a little easier for towns to use. So that's why I thought this would just be helpful information for you folks to know So I'll just quickly read through my testimony before you do So with regard to replace one of that system, is that something that has already been budgeted for and approved? Yes, okay, and when did that happen? So I think in the last session we got the approval We're going to be using the computer modernization fund that we have access to So I think it was in the either the budget adjustment act or Somewhere it gave us the spending authority to do this. We've come in well under that budget We were I think we were allowed up to 10 million over five years and we're looking at half that So we currently right now we pay for numeric out of our operating budget the tax department You know, it's it is very inexpensive and it's very inexpensive for towns I think that's part of the reason why we've all sort of continued to sort of Limp along and use this system because it does get the job done and we're all used to using it because we've been using it for 25 years and it's very inexpensive So that is that is part of why it's been able to just be part of our operating budget The contract was like a hundred and twenty thousand dollars a year For the whole for the grantless software. So now we'll be looking at spending more than that for a year, but But over time I think the gains in time and safety are So could I just say I'm sorry, well, maybe I'll let you get through it and then maybe you'll answer Okay, I can I normally try not to read off my paper. I wanted to make sure these boys do folks I wanted to make it worth your time So just thank you for the opportunity to update you on this recent survey We did in partnership with the Leeds Cities and Towns like I said, this was really to collect data on the current state We really hadn't done any sort of comprehensive Survey And we really just wanted to get a handle on you know, especially from our you know perspective We want to make sure that whatever system we use towns are going to be able to open up and use it on their end Towns do get an annual appropriation for the grand list maintenance reappraisals and participating in equalization studies. So there is a per parcel payment that all the towns get to carry out this work It hasn't changed that figure is in statute It's like a dollar per parcel for one of them and I think 850 per parcel for the other so I think there's you know That's a possible place where we can maybe try to bring that up to today's dollars and try to get towns a little bit more funding But that is not the position of the Department of Administration But that's my you know, that's one of the things I've been trying to tell That we'll be talking about because those figures have not changed so I think you know what they were asked to do 30 years ago and what the money paid for versus what towns are asked to do now is pretty significantly different So, you know, we did learn a lot about internet access to internet speed and IT security and obviously What software and hardware that towns use varies a great deal Like I said, we're embarking on this much needed upgrade for our grand list software system Which is used by the state and each municipality to state carry out the statewide education property tax system So it's really important that we assess where our towns are at with regards to IT But also just as important that we select a system that can meet the towns where they are and is able to support the towns and provide the training and access that they need With some of the very limited resources and bandwidth that towns have VLCT has definitely been a proponent of this and agreed and helped work with our staff to design a 16-question survey It's very informal like I said, I've got that the original question is attached to the back of this testimony It was estimated to take about nine minutes and it was distributed this summer It had basically four key components that it covered internet service internet speed Financial systems and the grand list maintenance It's pretty impressive to note that the survey had an 83% response rate Which by surveys is excellent and surveys of these folks that shows the respect that I think the towns have for VLCT And interest in making sure that we knew where they were all that So this means that we heard from a great cross-section of Vermont towns big and small We heard from listeners assessors Calclerks treasurers financial officers and others The way that the LCT designed the survey it made sure that only one response per town could come in So and a lot of these folks wear multiple hats But I think that was also good because it didn't skew about having a wife people in one town take the survey So it really isn't a pretty good representation of what the towns have And I just want to be really clear that we are not survey experts, you know the way you design survey questions to get at the right answer is a skill But VLCT had some of that had some of that expertise for sure But it is just an informal, you know, not mandatory survey and I'll walk you through the answers to some of the questions that we got And You know, it would be helpful to do sort of a more in-depth polling either by role or by Navy system that they use You know, this was a pretty Wide net that we passed and obviously our interest was really only in the grand list maintenance and what they used a number for So there is definitely the potential for a lot more data out there to be collected And Also, what was really interesting is VLCT was able to tell a lot about who took the survey you could tell where they took it What kind of device they use so that was all over the map You know, some people took it on their phones and people took it on a PC Some people took it maybe their own vacation and other states and what browser that they use and all these things are actually really helpful because again our number one priority with replacing the grand list software is that Vermont towns no matter where they are can use it. It's really not helpful to Just grab something off the shelf if it's not going to work for the towns that have really Slow or limited internet access Who may need to have things stored on a local server versus on the cloud. So this has been really helpful It's kind of fun to read some of the answers to some of the questions You know in some cases they have a very professional IT system. They have a contracted Provider with best practices. Some of them said well my husband comes in That's their IT That's their IT support. So there's definitely a pretty huge variety of resources and expertise about IT security and infrastructure I'm certainly learning a lot VLCT had a their annual town fair They focused purely on cyber security and it was there was something fascinating Speakers and presenters that that gave some pretty pretty hard facts about how vulnerable they are and that really human beings Continue to be the weak link Regardless of the best system you have if I stick my password on like monitor and I share the computer with three other people Or I know I mix my work and personal email addresses when I'm filling out forms I mean there's all kinds of ways that just the human element is really still the biggest concern So there's really a need for first a lot of training and best practices to be more Proactive and I think that's going to be part of our role when we roll out this granular software It's not just teaching them how to use the software But here are some just really good basic best practices that you should try to use just You know for what you can because it's the it's the clicking on the links. It's the sharing of you know Things on insecure sites. It's that sort of stuff that makes people really vulnerable I'm happy to say that because well what we're responsible for is the Grand List That's all public information the Grand List is public data so I feel a little bit a Little bit more that we can breathe a little easier about this interface with the towns It's not income tax or anything like that, but the practices should be the same It would be helpful to do additional surveying like I said of either by role or You know, maybe sort of focusing in on where there are places where there are Poor internet access or towns with a much smaller population should really get a handle of what they want I mean Burlington, for example has a bigger IT team than our building does, you know So if there's quite a variety there And that there's just some really good best practices that individuals need to do About what the passwords are that they use how they share computers and logins How important it is to have really professional managed IT services and sort of proactive steps that can be taken versus You know, I call my husband or I take a stab at it or my son comes in and helps us out And and why and how municipal government is is pretty particularly vulnerable So the the information we got from the survey was helpful We also did a listening tour this spring where we actually went around to we had folks from all 14 counties We did 11 meetings where we asked clerks, treasurers, listeners, everyone to come in and just tell us You know, what's working with the groundless software? What's not working? What they're afraid we're gonna mess up Tell it to us now and also what what they've seen or what they think could be better whether folks work for that And so combining with the actually getting out there in the field and talking with them about some of the problems that they face with the current system and then finding out more and more about the need for these sort of better practices and IT services at the local level It's helped us really focus in on the fact that the vendor that we choose really is going to have to be In Vermont and supporting towns and helping us get that educated We're not going to get more staff in the tax department to do this Our district advisors, there's eight of them that cover the state But on top of everything else that they they do they'll be out there being sort of the front lines But we really need Support to help towns get off in the right foot. This is going to be a pretty major change This is fascinating and sort of heartening in a sense. I'm curious how does the municipal Property tax side of the equation which is I'm assuming a little more still based in municipal Computer systems and I guess I would like to understand how that works and if it relates to the new system and Then sort of part of that question also is income sensitivity which Starts to get at some more Personal data, so I don't know if I'm articulating this well, but Could you just just discuss that a little bit? Yeah, and I've learned quite a bit about that There's a lot of ins and outs and like I said because this system has been in place since access to you asked It's all very sort of come along together, but the short answer is is that yes The system we provide now and the system we will provide has a municipal tax rate Basically calculator that that the towns have their own system whether they use their whatever they use for their their grand list ledger or their general ledger or their You know administrative revenues so on and so forth, but at some point they get to point that they actually Use the calculator that's in the system to come up with the new rates And then they can also enter like if it's part of a village district or if there's a veterans exemption or other kinds of exemptions They have that and we will provide that still Does that mean that that's all housed or going to be all housed at the on the state system or is it? duplicated you know for for your system and also the municipal system they could Technically choose to use their own if they wanted to but this seems pretty handy for them because then it's all in one place And at certain points we have to collect all that data anyway because we use the municipal tax rate information for all kinds of Calculations on our end including like a whole harmless payment for current use and so we and for estimating property tax adjustments for the next year Like there's lots of reasons why we don't need that data anyway The Homestead Declaration of Property Tax Adjustment is a little different because that comes in through the V tax this that the large-scale much more, you know sophisticated Income tax system that we use at the tax department so when people file their Homestead Declaration that goes in that's processed in the income tax division But then it creates a file that right now is uploaded and then downloaded by the town for their particular So they're merging those two data points. Yes so I guess I'm under I Don't feel like I have the language in some level, but I guess the simple way I think of it is The state system We have a better shot at a secure system in our central system Given the staff resources and expertise, which is not to say it's flawless. I understand that compared to you know, some of our particular tiny towns where You know spouses coming in for IT expertise and you know, that's sort of nerve-wracking, right? And so I'm trying to understand in the new system How much of the vulnerable the personal sort of Stuff that we'd be really afraid was Leaked out or held ransom. How much of that? Sensitive data will be centralized in the new system versus also left behind at the municipality Maybe you know, you know that that's what I'm trying to understand So I think the good news is that all of the sensitive pieces are housed in the tax on the state system already That's part of the income tax. Yeah Vault that we don't ever see the towns don't necessarily see either They get a number a state payment for that individual, right? So there is the argument that if if I was a nefarious Town treasurer, I could look at your income tax or I could look at your state adjustment and see well Then you must make less than 47,000 and therefore you're getting it right that circuit breaker payment But as far as where that data that actually lives about the individual Social security income anything that that that's in that vault that that's not part of what gets sent to the town So literally the way that I finally have been able to wrap my brain around it is when you actually look at the property tax bill Those data points are filled in by by us. Yeah from this download The town doesn't see the calculations behind where that state payment came from last year There was language pass that requires that the state payments for municipal Adjustments and education adjustments are separated side-by-side. It used to be just you get a state payment and it could be for All of those in which case it was a little bit more protective of that sort of confidential nature of low-income adjustments, so now we've adjusted it so that there is a municipal State payment and an education state payment So there was some concern at the local level that that really does say who those folks are that are getting that very specific property tax adjustment That's the level of that data though, there's there's not More sensitive data than that in ours What what actually the municipalities were vulnerable about Well, last year the ones that were using the system was their their employees payroll and things like that Okay, you're sticking that out on a server and that's where that lives That was where there was a vulnerability. You're saying that in the past in the past tense correct Yes, so that's been there was a font. They were fined by this I think it's Secretary State's office for that. Yeah, that's yeah But it helps sort of reinforce. We were already pretty well on our way on the grand list but it just sort of helped to reinforce that This was a really good opportunity to Provide towns with a better The opportunity and and since this hasn't changed since the late 90s I'm not sure how long it's going to be until we're going to change the end a lot of folks are saying Please don't change it. I know it's not perfect, but we know how to use it leave it But just as many are saying Please get me out of here So, yeah, it's it's tangential to what we're using it for but not really because it was the same system and and I think part of the reason why towns used it is because it was The same entity as what we were using it for for grand list. So we do have a responsibility to respond to that So what I attached to this is just a few of the charts that just sort of show some of the big picture data points And then at the very end is the actual questions, you know, some of the questions we asked are not things that really chart well, like how satisfied are you or How long does it take you to do certain things? but but You know it talks about internet service providers and we can provide the sort of full list of data I really was trying to keep it high level for you folks. So we have time Joe. Okay We have some time here. So if you want to go through Um just Oh, yeah, it's like a committee. Yeah, one more point I mentioned it is is that I think the combination of the um The impact that this software that we will select has on every news quality It's actually not just going to be used by the 17 of us and it's probably the evaluation over here It's being used by every town and the fact that there has been this attention on cyber security And there was the concern last year with the current vendor ADS has been very involved with us helping select vendor Establish really strong requirements for all of those components And also frankly in our new current contract with With the current vendor numeric that has been significantly increased with ads's input to make sure that We're going to continue to use them until that's replaced And so we really needed to make sure that we're going to continue to have them in place That We still have to require these higher level higher standards for security So that that is in place now and is going to be in place for whoever we go Do you given that? Actually, you guys are buying a system that most users will not be in your department as you said How how have the frontline users? Have they been part of or are they part of or is the lead part of the selection process? I mean I cringe to think that we've got a system that you guys think is fantastic and Miss Polly's know our number. They will You know any of those changes is tricky, but but uh, so we've been It's an unusual idea We've gone to every conference that will have us every, you know, we did the listening tour We also, you know, we have a monthly letter that goes out to towns and we had a You know If you can't come to the listening tour here's what we're asking we want your feedback But in terms of like trying the software options or or So we have them snapshot of it when we were rolling out the municipal users for v-tax we had them come in as For for user testing we've had clerks treasurers listers. They've come in every step of the way We actually did have Representatives from Valla, which is the Vermont Assessors and Listers Association and VLCT Sit in on the demonstrations for the vendors. So they've had a pretty You know that was definitely with the goal of having their input in mind I go to every Valla meeting and talk about it. Um Like so we did the listening tour there's eight pages of sort of our summary of what we heard out there um, I think the very broad summary is that they are Very anxious for something to get better They know that this can be better and they want it to be better They are very concerned about the viability of the current vendor In providing the other services they use it for if they don't get our grand list software contract and if that by sort of You know Hitting that domino is that going to really cause a bigger problem So whether or not we the tax department are responsible for what towns use for payroll and finances and things like that The the fact is we're paying attention and I want to make sure that who we go with we'll we'll be able to meet numeric where it is for all the other pieces because It that is that is one of the big concerns They know it can be better. They want it to be better, but they're worried about the ripple effect That numeric will continue to exist and continue to serve towns for services other than the property evaluation piece Absolutely. They do reappraisal services for towns. They're kind of they that's a huge piece and I have to be really clear We haven't actually selected our vendor. So it could theoretically still be numeric that is selected as our as our vendor And then they also provide like I said, and I think that's part of what we asked in the survey Provide they provide accounting Billing and administration so towns have the choice of who they use for those pieces, but one of the questions was about Who they use for their financial services and 90% use numeric So that's why we have to make really sure and we've actually had really great assistants from abs They have some really phenomenal business analysts who are actually literally Breaking apart each piece and listing what the functional requirements are not just for our piece But to make sure that all the pieces that towns literally need These systems to use so that there's no gray area because that was the big concern is Is where does the state Responsibility and their system and where does the towns begin and we don't want to create a gap so As much as we don't want to get into the business of trying to provide that service to town The reality is they're also interconnected And and even to the point about the property tax bill, you know The majority of pieces end of the property tax bill have at some point come through us and gone back out to the towns But they're the ones that are responsible for Billing collecting tracking and then paying making the payment. So It's all connected. So you've had to make that a pretty big priority, but yes, sorry long answer Chill you said that 90% of the municipalities are using numeric. Is there any commonality to the 10% that are not So, I'm sorry. I didn't number this. It's one of the pieces in here. Um, okay Do you want to walk us through the the results? So We did collect, um, you did collect the name and the contact information if everyone I didn't put it in here But um, if you are interested in knowing if your if your town could skate it But like I said 83 percent response rate pretty good So right so we asked who their internet service provider was Um And and you know a large number are Comcast a lot were ec fiber and a whole other long list of of other providers We asked if they have a managed it service provider for the organization. This is the Oh my god, we you know, we call the guy whatever or or yes, we do or we don't know. Um But 44 percent said they do have a managed it service provider, which is a good thing Um And then what services do they provide so, you know management antivirus upgrades security audits um help desk to 24 hour monitoring You know some of these numbers like the 24 hour monitoring and resolution at 28 percent is um is Apparently pretty low by industry standards. We want that to be a lot higher The antivirus installation Um Again, I'm not an it expert as far as cyber security goes. But my understanding is that Um, you really need to have somebody sort of doing some regular Testing on that. You can't just take the what comes on your computer at Staples and assume that you're protected um Cloud services has actually been I've had to learn a lot about cloud services because a lot of the towns That's where everything sort of going right like you log on to amazon to log on to your bank account You log on to vtax. You're not actually logging on to a local server But a lot of towns are concerned about their Either rather get to buy servers to host it if they don't have the internet speed available So there may be a few cases And these would be towns that are doing this now that their internet speed is is low enough or Small enough that they have to work offline and save things on their server And then one of the other thing they upload it So It again, they're asking, you know, I was just at the vermont assessor's unless just association meeting earlier this week And they again were asking about is the legislature going to continue to pay attention to getting broadband access because that is still like You know, that's still very apparent on this this chart I could come Of course the the issue is the 66 who don't know right but of those who do know Those that have internet speed Of 25 or more is a very small number No, you're ahead of us It's only about 20 percent right right and I could See people actually Doing it locally and then taking it home to upload potentially And it has a whole another security Yes, I've heard at least one where they take their laptop to the local gas station So, um, yeah, so item number nine what what's your contract rate of internet speed? The way we got at that is there's a really simple in in the in the No, we send out there's a link you can click on that runs it Basically, I think it's xfinity or something like that You can you can run it and it tells gives you a number that gives you that so so we add them tell us We hit them run it and we said, you know, what date and time are you using it? I didn't feel that was help, you know, necessarily helpful for you folks But, you know the time of day and the day that they did it and what their numbers were that can also vary apparently depending on period giving it a high traffic time Your bandwidth might be lower. You're on nine. Yes. I'm sorry. That's right Don't know is really Do you Right, which is funny because we did we sent the link that said, you know, just click on this and I've done it You know, I've done it at home to see if it's better in my upstairs versus downstairs. That's pretty straightforward But but a point that that I think Is that I've had to sort of reel it up We don't all have to know all these things. We don't all have to become internet experts. We don't all have to be it security experts that he is making sure that They have that resource available to help them do that not that they all become experts But yeah, if if they don't know then how can we design a system that they'll log into to do their Grand list if we don't even know if it can leave them there So yeah with 66 percent saying they don't know that seems like a problem. Right, right How are you going to deal with that? Well, and And maybe it's because it's fine. So they don't You know Because obviously more than 66 percent have decent internet access, but And is this a download or upload or yeah, we asked both I think for this one. I only did the The upload speed. Okay, but we did ask both. We do have that data So then uh six what type of service provider do you use for these? Um, and this is you know, getting back to We have an IT department. Some folks use the state of Vermont Um Plenty have a contractor or professional managed service provider So those are good, but um It would be it would be good to sort of You know, they don't know not available internal support Like I said, maybe some of the bigger towns and cities Have very robust support and that's sufficient, but for a lot of places. It seems like they're um they're kind of relying on Learning on the job or trying to manage it themselves I think it'd be kind of interesting to ask secretary quinn about these folks who the state of Vermont provides their computer security Yeah, whether he knows that or not. Yeah, I was surprised to see that Kind of skeptical Um, all right, and then the contract rate of speed Again, maybe that's because they're not familiar with the contract. It also depends on who filled this out you know, it could be that the Financial manager in the office, they know that So here back to this earlier question about On number 10 what financial software systems do you use? So So the vast majority do use nimreck because right now that's the grand list software. We also host Nimreck's camo software, which is how the town's actually the town lister actually enters the data from the field and comes up with Values for the property. So that's actually sort of the appraisal side of things and then the tax filling where they can actually Print the tax fields out of it, but you can see a lot of them use Quickbooks if you use peach tree excel google Other things but the vast majority do use nimreck. So we want to make sure well, they're using multiple systems So Right and I think peach tree might be human resources specific or something like that or payroll So like I said, there's there's room for more in-depth Questions if you want to what's the timeline for your selection and do you have a timeline? Yeah, we hope we can announce in january. I'm I'm very excited about where we're at But it's at the point where now it's in an independent review and it's getting you know, there's assessments that are being done by It even finance and auditors that I'm not involved in that You mentioned though that you thought are essential that a vermont-based company Provide the service so as to provide the The interaction with this is that I wouldn't say vermont-based But that can be that can locate here that can actually have a physical presence here Grounds of where they're head for okay. Yeah, um, obviously that's not Always feasible long term but at the very least for The implementation and rollout of this We um, you know, we're not getting more Tax staff who can be like the training team that goes out. We will do our best but but someone who can who can sort of understand Meeting these folks at these different Abilities and resources, you know We've got quite the gamut of folks who are acting as listers and assessors in their towns who can help us Do that successfully because there is a lot of concern frankly about change And and there's also a lot of turnover a lot towns are going to be even finding folks So so I think being vermont-based alone is is pretty narrow a requirement But definitely, you know can be here physically for a period of time to be really helpful I'm just along those lines and I'm sure you've thought of this but I uh Every time I'm in Winooski. I see the empty storefront of optum And they are vermont-based by virtue of that office. I've literally never seen a single person in that office so Make sure you're talking about people on the ground as opposed to some office that has rented as you're Exploring that because I agree with you the basically the customer support In the office is what what we really need right tracking around to help towns sort out this new system Is it time for? more in-depth polling to impact the project or What would you see the use of more in-depth polling? I think for the purposes of selection I don't think I don't think so. I think we you know We've we've set those parameters and we know what they are and we have requirements that will be in the contract um I definitely think sort of overall not just from our small perspective, but from all these state systems and looking ahead Rather than just trying to scramble with what we've got now I think it would be very valuable for the state to really know that you know We pull up these maps of the state that show You know intercede and we pull up these maps that show You know connectivity and and but That doesn't really tell the whole picture and what we're asking between I'm I'm so focused on the grand list, but to look at the list that that that Secretary Quinn and and Karen Horn have of all the other things that right the state works with the towns I wonder they get mad at us that we have them log into two different systems. They've also got 10 others so I I think it would be really valuable to actually have A little assessment of that knowing too that folks can work from their home office. They can work remotely. That's so the key is those sort of steps of what the system is and the password and login sort of things that It doesn't have to be just that the town office alone has high speed, but That the user can take that work with it when they go and how to still be secure And I'm sorry. I'm not like no, that's fine. That's an expert on fine statewide infrastructure. Yeah I'm gonna Ask Karen If you that same question if you don't mind, um, you know, do you like right off the top of your head? Or can you do you see a use for more in-depth polling? Oh, we definitely do We think it'd be really helpful and you know, sort of across the board to have more information and in more accurate information one of the The limitations that we talked about with this particular surveys Who might who answered it and so some folks have a lot more understanding of the whole systems than than others at the local level so Um, that the speed question is is a sort of good indicator there Of the different capabilities maybe of the people who are responding to the survey so Um, and we think also in order to sort of point out where our most significant vulnerabilities are That we're going to need to have a more Robust assessment That's going to take money to your list of recommendations. Um, I I think we cannot do that in-house VLCT we there would have to be a You know outside consultant that did that kind of Survey, thank you So Some of these that are more interesting to me than anyone else Um, but You know like number 13 If you're using that software select the capabilities being used. So this is a great sort of representation of The different things that towns are using that that interact in some capacity with the grand list Um, and then part of reason why 91% use it for grand list and tax billing is because that's the state provides that that's our They have to enter it into that so It should be a hundred percent It actually is At some point it has to come in here Um, here's a great example of maybe we could ask the information differently on number four and I apologize if you're out of work Oh, sure. I mean How is the grand list data initially recorded? So the grand list is that you know every town has their property card that's there's different components acreage grade number of So on and so forth That that they the the lister comes up with a value for that property and and You know, how is it initially recorded manually? So manually and then there's a bunch of other Manually could be handwriting it, but it also could be I typed it on the Computer, you know, so the way that question was worded I think Didn't give us as much because I think we were trying to get at is like I'm happy that 13% said they used a laptop or tablet That's helpful But how about the rest of them? Are they writing it on a Piece of paper and then bringing it in in someone's data entering it. Do they have a way to you know, collect that data in the field so that then Save them some time Who maintains your grand list data, obviously the vast majority are the Listers or assessors But you can see a lot of folks actually wear a lot of these hats Especially in the smaller towns the smaller the town the more hats that individual wears Which is another reason why we sort of tried to time our rollout with the software Not to coincide with fall of 2020 So the very first thing we heard from town courts is that's going to be a crazy election year And if you ask us to start using a different grand list software system in a different way to print property text bills at the same time that we're managing an election That will we would appreciate it if you didn't so we will be spending this year building the new system Testing the new system. We have several towns who have volunteered to be pilot towns for us So they're actually going to be the beta testers that will use the system Months ahead of everyone else so we can work out some of those kinks and they volunteered to do that We we said hey if you want to and we continue to get towns that say they would like to be a pilot So that we would have that but then the actual sort of Flipping the switch from one system together would happen until 2021 Are those pilot towns varying in size and geography? Yeah. Yep. Yeah, I would say so It's like it says voluntary, but yeah, there's a there's a good mix Great and also not just you know the central part of the state So, um, I think that's a good way to do instead of mandating or saying hey all the towns that start with a You get to be our The last chart the one was your last re-appraisal I realize is a little tangential to this conversation, but um, I'm glad we asked it because it also shows um, how old the grand list is getting and I think our systems in some ways are Keeping us from getting some of this stuff done. There's a lot of work Um, we all know what happened in 2008 with housing and the fact that only you know less than 100 towns I'd say Since that time we've actually done a re-appraisal where they do the re-appraisal and and part of the problem Honestly is that some of the towns are having every time finding assessors to do the work Finding appraisal companies who can do town-wide appraisals and it's especially hard for a smaller town because If you're getting paid by parcel, why would you want to bother coming into a town? So it towns are having a hard time finding Professional appraisers to come in and do the appraisals even when they're ordered by us because their CLA has gotten so low So if we could have more robust software We could do some sort of statistical appraisal or we could be much more clear with the town about what's happening with their Values and we could actually audit what's happening with their values a little bit better so we could And maybe maybe some of those companies would be willing to come here if we had a system that They knew and could use a new that it was a little more up-to-date so Totally not really connected to anything except for my interest in the education property tax that Significant amount of reappraisals that haven't been done since 2008 the effect of that Would most likely be CLA is over a hundred Yeah, okay And in this past session You folks passed a slightly different window. It used to be if it was 80 percent or below We would require a reappraisal now. It's if it's between 85 or below 85 or above 115 so now for those ones that are On either end of that sort of extreme where their property values have changed one way or the other We can we can require a reappraisal So we will have more towns that are getting sort of flagged for being under a required reappraisal They can do their own at any time But it's still we still have to make sure that there are folks out there to help towns do that work And I think having a newer system will make it a little more appealing for folks from New Hampshire, New York or Massachusetts even to come up here And do appraisals for small Vermont towns I'm curious on this mark number 13 This asks about the financial software capabilities Is this are all these capabilities going to be an option in the new Packet i'm trying to get a sense of the landscape. I mean you're We are really trying to not take ownership over things that we are not Responsible for because towns have absolute freedom to use whomever they want for all of this stuff except for the grand list This was helpful for us to know because we do have to make sure especially for the tax admin And tax billing That what we go with can talk to all those different systems We don't need to know about Accounts payable accounts receivable their HR benefits. They're purchasing and things like that but Our system has to talk to their system that does this and so that's why that was helpful for us to ask Great, and then the last pages the last few pages are just the actual text of the survey completely so I thought you folks might be curious to know And I think there are some questions obviously, you know, we actually did collect a lot more data in some of those questions Like we actually got the names of all the different We have by town the internet speed as people reported it We asked them how much they paid for what they used Which was helpful in some ways, you know, it ranged quite a bit You know from like $400 a year to $5,000 a year I think is what it was but that's all broken out And then we asked things like how long does it take to to enter things in the system Which is also one of those like I wish we I don't know how to get at what we're trying to get at but it was they're like, what are you talking about? It takes forever depends on Forever. Yeah So, um, you know qualitative versus quantitative But um, but I just I hope that was helpful and I'm happy to I'm going to continue to come and listen And on what you folks are doing because I do think there's a pretty strong connection between what You know our work and working with the towns and It's definitely felt a lot more sort of successful and positive when we're approaching it as a partnership And as a we're all in this together Rather than just saying well, you know, because we could we could grab all kinds of systems for the our end of the grand list software We could just you know, it's it's a database is basically what it is But that's not going to cut it. We need to provide that to the towns too. So Jill how is the project funded Is it capital funds? It's computer modernization fund. That's what you said and I think I think it is a Administrative pullback from the property transfer tax return. Maybe it's it's a fund that the state has for in for structure investments in it I know that there's uh There's something related to current use that I think might also be into the computer modernization I'm sorry Computer modernization fund I was asking where this project department. Okay. So that's not capital So they that's their own thing and they've actually anyway, they Are adjusting the percentage they keep down also so Say that again They collect some money and they keep a percentage of it and they're actually changing that percentage It's part of the budget discussion and part of the joint fiscal discussion has been coming up there. Okay. Okay And which committee? If any, did you did this? Looked at this This project a little bit the gov ops committee. I mean generally we're in raising means a lot, but um I think the last is where they were interested in this and you know, it's almost more sort of But just to provide you guys some color and context. I'm not sure You know the action, but people will be at contacting you regardless of who we selected We don't want to be successful Okay Great, do we have any other question? I guess I'm just still trying to understand the uh The NEMRIC That that's what people use for payroll that we said They can they have the choice they can use them or something else But they are using 90% are using it and that's part of the current package. And so as a payroll Feature going to be part of the new I I'm trying to I just this is the theme for me is that I continually we have a better shot at Our security and That we should try to make it as easy as possible for town. So I'm I'm trying to understand It's been very thoughtful the process you're going for but as you've said you have a narrow slice of the universe That you're considering so trying to understand Are we inadvertently Hunting them off of a system that a lot of them are using Because our packages can the new packages can be more narrow So the short answer is no We only contract with NEMRIC for the grand list software and the cam of a computer-assisted mass appraisal software The thing is that they have a menu of services that the towns use and so a lot of them go Yep, NEMRIC we're going to use that for payroll, HR, and so on if you wouldn't be like, okay So I don't think that I don't know if because of the virtue of the fact that we have the contractor rate They get some sort of a discounted rate. I don't know that answer, but we don't currently contract for those Um, we don't want to but the concern is there that the towns that use them for their whole suite of services Is it going to make it harder is now when we go to print property tax bills so that we can start to You know charge interest and penalties and folks that have made it If it's not all in one System Is that can be a problem? So that's why we're trying to get at that piece of where where ours needs to talk and hand it over to Whatever system they use whether it's NEMRIC or Excel or QuickBooks or anything else But it's that is one of the very real risks and realities of this change I don't think it's necessarily for the worse. I think the the benefits outweigh that that impact But it's going to require us to sort of reach on where we meet them and it's going to require The that whoever they use for that payroll to make sure that they're But but payroll for example on HR we don't We don't want anything to do with that data. We don't need that data That's not part of our daily work, but when it comes to printing property tax bills That's where we need to make sure that we build the bridge to the right place Could we ask Karen the same Sure comment on the same sort of dynamic like are we worried that The upgrade now forces everybody up two systems or We think there'll definitely be some You know dissatisfaction with the new system, but Jill and the and the pvrs work really closely with towns on it They're they've done one of the more thorough processes that any state agency has done recently in You know working out this kind of system. So I think that It may be the case that over the next few years if a different vendor is selected for the grand list software that you might see towns migrating their other financial You know databases over to that system to be consistent and Because there are these security issues that are going to continue coming up and Whoever you've got handling those Those payrolls and things has to be up to date and then You vendor might have much more to offer in that respect Well, maybe that's the question then does the new vendor Also to your understanding or are you watching to see if they have A commensurate suite of options that are not something you'll take advantage of but we went into that hoping We would find that sort of panacea that has not really been the case property tax administration is so specific I think part of frankly why never has it is because they saw the need in vermont and it wasn't there And they knew that they somebody needed it, but we were hoping that there would be A vendor because they oh and we'll also negotiate a state contracted rate for these other services That's the the folks who do this work. It's pretty tailored to this because you know tiff and utilities. There's so many complexities to Property valuation and administration, but they they don't seem to have the other Okay That was wishful thinking I'm satisfied at least figured out my question, but So I I would like to ask Jill and then Karen the same question. What was the most surprising finding for you in the survey? I was thrilled so many responded Which is not exactly what you're asking, but I was very happy because I think it shows that there is that need I think it definitely demonstrated the variety of abilities and expertise in this I was surprised by the I knew that the breadth of what they used numeric for Was significant, but the breadth of that is really something we can't ignore I don't know that we were particularly surprised by anything because we know that it's all over the map in terms of what towns use and how they handle their Computers and also the speeds that are available just on the Contract rate of speed for internet if you have very slow internet You might not be able to run that test at all Because it won't load. So that might be part of that 66 percent. That's certainly the case Where I am at home when I'm trying to run that thing, but um any Anyway, I think we were gratified that so many people Answered and I think it also showed where we need a lot more specific information about what's going on out there The one comment I remember of the it support services Somebody said me Did they say you I call Karen more So in general, I would support kind of expanding this sort of thing as far as economies of scale saving town's money giving a kind of a state level suite of security and IT systems You know not By any means mandating but making it available As far as security goes You know security vulnerabilities identified per day is in the six digits So hundreds of thousands of security vulnerabilities per day And no a nationwide and You know top tier security stuff is updated every five minutes. So Before dealing with sensitive information Having somebody run at something from Best Buy is You know, maybe five ten years old is Not the most secure So I've added that uh is a discussion item for our memo And I don't know what um, you know, there's a statewide procurement arrangement that vgs offers that towns and school districts can take advantage of So they may have some of those sort of negotiated rates like for payroll and General ledger and things like that that that towns can take advantage of One of the other Things that we've learned after going through this process is we want to host an annual um Sort of showing all the different camo vendors the computer system mass appraisal vendors instead of leaving towns sort of on their own We had been contracting with nimmer to offer that and so a lot of the towns use that for their actual assessment and so um There's definitely but towns can use whoever they want for that and a lot of them do use other Other software to come up with their actual values So if we could we could host some sort of we could negotiate a state rate that Towns could take advantage of if they wanted to and then host some sort of a way for them to sort of see their options Why would that be why would why would the towns help you understand to be on their own on that piece? Why is it advantageous to each? Well right now right now they they can use whomever they want And so it just seemed like if we can rather than letting them sort of Negotiate with these vendors on their own if we could get some sort of a state rate that they could take advantage of Maybe modeling it after that bgs procurement system. Maybe that would be Because maybe part of the concern is If you're just a small town that knows you need an assessment software, where do you start? How do you find out how much it costs? Do you really want to get into negotiating a contract? Maybe the state could offer some sort of a A cold rate. You know it seems like those things would go together Well, that's There is an argument to be made that we could require them to use the same System and that's pretty much what other states do I've heard the municipalities like it will require them to do things. Oh, yeah Parents for ever demanding Care do you have any thoughts actually on that on why it's advantageous for the municipalities to have their choice in assessment systems I'm sure I could bring you back some reasons. I don't have them on the top of my head. Okay Do we have other questions on this topic? This was really helpful very Nice to know that this was done. So thank you And I I would love to uh Hear more about the project as it starts going in. So we look forward to Okay, so And you're ahead of schedule and your next witnesses are here and ready to go whenever you like. Okay. So why don't we take um Why don't we come back at 10 30 instead of 10 45? 10 Is that good? Yeah. Have a day You're off the record. Are you all set? We're all set? Okay, so Yeah, I'm ready to go on the record. Is everybody here? Secretary Quinn get your presentation up present. Okay It's very easy to do Get this mouse and everything we do here goes up on the tv So there's your presentation. We'll put a full screen and we'll get it up there and Your Yep, just like that You're on the record Okay, good morning. Good morning. So I you are new to me Um, if we need your names for the record and then maybe we will uh introduce ourselves as well Okay, um, good morning. Laurie Collins. I'm the chief operating officer for diva Um executive sponsor for mmys and the ie me program. Okay Good morning. I'm sarah clark. I'm the chief financial officer for the agency of human services And you are here today, uh to talk to us, uh, actually, sorry Chris pierce and senator from chitlin county Such as colchester Randy broad franklin and part of ground And lores billy from dover So, uh You are here. We've been meeting. I'm sure you probably know this. We've been meeting regularly To hear about this project And so At our last, uh At previous meetings, we've really wanted to get a sense of What is the overall? Picture here with regard to costs and Framing and then how things are going to be going forward. And so it looks like you've prepared some testimony Yes, so why don't we let you go through that and then We will ask questions We have 45 minutes We have 45 minutes scheduled. I don't know if do you have time limitations? I do not Secretary quinn, does your office have time limitations? You're all set. Okay, so we uh after this we are with Becky and doing some committee discussions. So we'll have plenty of time for a question. So We'll just let you go ahead. Great. So again, good morning, everybody Um, I wanted to just start out this morning by giving you a little bit of a background Um on my um history as a state employee and at the department of remand health access and before that social welfare um and This transition with cast madison leaving um as of giving her notice as of october So I have worked um in state government for 41 years Um, all of my time in state government has been with the agency of human services in different roles I spent 11 years as deputy commissioner During that time, um as deputy commissioner. I was responsible for the mmis program And project work in the medicaid management information systems program Um, I have also launched a number of different um programs across the operations I'll mention a couple of couple of them I worked um at the time with mike costa From the governor's office to lead the technical, um Implementation of the aco model Bringing in zero pay claims and encounters into the nmis solution and paying providers differently So the relationship with one care. So I led that in 2017 We've done a number of different projects In the ms program a number of different modules that we've implemented and I'll go into those in my slides Um, I bring a team approach um, my approach is um focusing on teamwork Being inclusive collaboration communication and support Um, as a result today, you'll hear from a number of our team members I work really really closely and have been throughout the whole mmis program and launching these projects with secretary quinn in in his staff Sarah and her staff at the agency of financials office And across all programs in the agency of human services Over the last three weeks, we've um the mmis program and I myself as executive sponsor Over the last three weeks, um have worked really really hard at understanding timelines For the i e and e program dependency cms commitments We've um helped a number of meetings with secretary quinn and his team With um mike smith the new agency secretary. We're meeting with him weekly. We're providing him updates We have one-on-one meetings with secretary quinn and um secretary deputy secretary nailer Um, and we're really trying to understand this program and um what we need to do to move it forward Our team is confident and With our abilities and commitment to work together to succeed for the good of our monitors and Um, we really feel like our experience. Um doing project work. I mean, I've been doing project work for probably 30 years um We'll be able to move this forward in the way that um has been laid out and We'll be able to meet the deadlines So i'm going to turn it over i'm going to start going through the slides now to give you a little more detail than about myself So again, um, I have 35 years of experience and knowledge across all three of these programs enrollment and eligibility The medicaid management information system or VAM MIS and health information technology I have my experience has shown that teamwork Collaboration communication strong partnerships And trust are all essential elements for successful completion of projects I'm going to employ an approach that empowers the team to make progress with clearly defined roles and responsibilities That will ensure all of our success We're going to rely on hs finance and diva finance for finance ads for technology and the Project resources so that the folks the humans that actually work on the projects um, we're going to rely The program and policy staff across the agency of human services will represent the business and Lastly we'll rely on guidance from AOA hs and diva for for legal support so Now i'll um introduce our The interagency team a adsa hs and diva Our collective success is based on the team-based approach The transition following deputy madison's resignation provided an opportunity from hearing from a handful of key team Stakeholders including myself representing the department of online health access And i'll be speaking to the business i'm going to work alongside john zaniker Who's here in the audience? As the deputy ie me program sponsor in jill lizinski, and i have been working for 20 years together And he is the deputy program lead for mmis He has incredibly strong relationships with the staff working on the projects And he works very closely with our federal partner cms Sarah clark and marie hayward will represent a hs finance and secretary john quinn darin frail um, and i don't think march is here today, but they'll be representing ads and speaking to technology and lori Going forward in the future. Who will we direct? Our concerns about this project me Okay, i am a second Okay, so you will direct your concerns Thank you So now i'm going to turn it over to sarah to talk about the the financial picture here Thank you Good morning again. Thank you for the opportunity to come in and provide some additional details surrounding the financials of the ie me project Unfortunately, i was not at your last joint meeting But i did hear Coming out of that meeting that there was a request for greater financial detail So what you've seen in a slide right here is some high level information I am prepared today if you would like or at a later point to go through some more detailed project level budget and financial information So Let me orient you first to the chart up here. Okay This represents Gross spending on ie and e over three fiscal years Fiscal year 19 are the columns shaded in green So those reflect the budget in 19 as established in october of 2018 The second column over from that reflects what we actually spent As of june 30th of 2019 when the state fiscal year closed As well as any encumbrances an encumbrance would be a contractual obligation for services that were delivered in state fiscal year 19 That we couldn't pay because of timing of how the year end closed process works And so the obligation rolls from one year to the next i'm going to Stop and i apologize if this has already been done. Um, but i'm not sure that we let folks know we have dan smith From the joint fiscal office. It was on the phone with us. So i wanted to make sure that folks were aware of that I apologize for not letting you know that at the beginning. Thank you So the green columns reflect state fiscal year 19 Um, and I believe the november 1st report. Um, that was delivered to you We'll have some of that information in there. Um, then the next the next two columns reflect the state fiscal year 20 State fiscal year 21 projections These are um, kind of our best estimate of what we anticipate spending As of october of 2019 that day is kind of critical because that's when we um, are doing our work to prepare for the capital budget adjustment process And so I just want you to know the kind of timing of the numbers that are included in this presentation today So at a high level State fiscal year 19 We closed under our budget as established in october of 2018 by four and a half million dollars gross When I say gross that means it's a mix of state and federal dollars So, um, the budget For state fiscal year 19 was 17.8 million that was comprised 14.1 million of federal funding 3.6 million of state funding In this scenario When I say state funding i'm talking about the capital appropriations that have been established in our remaining to support the iene project We spent in state fiscal year 19 from a total perspective 13.3 million Which is comprised of 11 million dollars of federal funding and 2.2 million dollars of state funding the existing The balance in our capital appropriation at the close of state fiscal year 19 So as of june 30th 2019 was 103 thousand dollars We are planning to and it's assumed in these numbers request an additional capital appropriation of 600 thousand dollars in the capital budget adjustment process that will be delivered to the legislature this winter Um, which is in line with our capital budget requests from last year if you recall the The original request from the governor included four and a half million dollars for state fiscal year 20 four and a half million dollars for state fiscal year 21 um The appropriation that eventually was made by the legislature Was 4.75 million dollars in state fiscal year 20 However, of that original appropriation 250 thousand dollars was a set aside for the it consultant dan smith who's on the phone So it left four and a half million dollars for integrated eligibility in state fiscal year 20 State fiscal year 21 the appropriation in the as-pass capital bill was 3.9 million dollars Which was a 600 dollar reduction from the governor's recommended capital bill At the time with the legislature the conversation was If you need the funds and you demonstrate progress On your deliverables And a clear financial picture We would like to have the conversation with you in the budget adjustment process and so a hs is Requesting the 600 thousand dollars that would bring us back to the original request from the capital bill I asked a question just regarding totals one of the Questions that keep recurring is how much is integrated eligibility going to cost? Is fiscal 21 the last year in which you anticipate that costs will be incurred And so if it is then is it fair to say that the sum total cost for integrated eligibility Is the sum of 13.3 million from 19 19.2 from 20 and 16.8 for 21 So let me start with the first part of your question and I may need others from the team to weigh in but State fiscal year 21 will not be the end of the integrated Eligibility enrollment project That it is anticipated to continue beyond that And I should let it experts speak but my kind of understanding of Technology now is that it is an ongoing process of improvement that the days where we would build a system That would last for 20 or 30 years is not kind of the realm of technology I can talk for something by Darren frail director of digital services for the agency of digital services CMS has directed us to build these giant systems That support eligibility programs in a modular way and that means Buying the best pieces you can to build the whole system. They're very complicated systems that Have a lot of different parts and sometimes when you buy Different parts from different vendors you get the best of pretty essentially so we in in fact, we have continued to Modify and develop the existing old system concurrently Because you can never let these systems Get out of compliance or out of security Hatching or any of that so you so not only do we have to build a new system and continually maintain it Pretty much for the life of the system We have to swap out the parts which we hope will be smaller parts and less costly parts over time so Just to follow up on that. I mean I understand we'll need to continue to maintain improve upgrade But in terms of the original projected project is 21 the end Will the original projected project be I do not believe that that would be the end of the project I mean the one question that that we Continually ask is how much is this going to cost? So It's a pretty simple question and you could ask the same question about the existing legacy access system That we still use today on the mainframe and it's been in It's been in production use for over 35 years. Sure. They're maintenance costs There are adjustment costs there improvement costs, but in terms of getting the system integrated eligibility as has defined based on what the feds have asked Do we know what it's going to cost? I think until the roadmap that lori is going to talk about is complete We won't have that total picture. I mean it comes to me. It comes back to things like vermont health connect How much did vermont health connect cost? It's a question. I've been asking for five years and I can't seem to get an answer Senator john coin for the record What I would say is Kaz madison when she was here. She showed us a roadmap a couple of times of the modules that we would be doing each year Um, and I'm I'm not remembering exactly how many I think there were there were four projects going on this year and the next year and the next year Integrating with the mmis program and having lori oversee both has given us better visibility into where we can save money Across the agency potentially and so we're going through a re re roadmaping exercise To make sure that everything aligns correctly requires the projects A lot of work has been done over on this over the past three or four weeks and it's been a really really good Exercise not only for hs, but for abs giving us a better vision of what that looks like in the years out So we'll be able to Give you better estimates of those pieces of work In future meetings right now We want to make sure that we're utilizing our federal money appropriately to the best of our ability and As technology changes that we build those modules in years out that we're using the newest technologies and doing things in a way that More sustainable than maybe, you know, they were three or four years ago and we started playing I'm curious the the line about being under budget by four and a half million. Is that all Eligible to be carried forward or does any of the federal money come with a timeline? baked in so we Roughly on a six months from a federal funding perspective roughly on a six month basis We submit something that's called implementation advanced planning documents iapd's Which is essentially a grant agreement with the federal government And so we lay out for them roughly every six months This is our kind of planned spending over the next two years These are things that Change as you move through projects And I think one of the things that we'll want to talk about today is our kind of module approach to integrated eligibility And how because of these smaller Bites of projects It allows us to be more nimble and to adjust as we You know and counter changes along along the way and so The funds that so the the federal funding doesn't go away I guess is the kind of the short answer to your question, but it is something that we You know kind of renew and refresh with the federal government every six months on a formal basis But that there are weekly conversations with the federal government in terms of like the status of the projects and you know How things are progressing We'll let you keep I I have more questions, but kind of Along the same lines of senator Brock, but let's keep going. Sure. Do you um want to um go through this is um a spreadsheet that essentially reflects for 1920 and 21 By project in the iene program Um what our kind of spending or plan spending is I it's not in the slide packet because it's a little easier to read on a larger sheet of paper But we can go through that at a high level and i'm certainly um You know willing to sit down to to dig in a little bit more on a whole spending on vermont health connect So have you have you are you aware of the testimony that's been provided to this committee this summer? Um, have you had a chance to review that in terms of timelines that it's been yes, yes, I have yes Okay Okay, so giant spreadsheet there's some extra copies if anybody would like Um Let me orient you to the spreadsheet So the um in the red column that is the projects um Underneath the iene program If you look at the three columns that are in green that reflects the Budget for state fiscal year 19 as of october 2018 The middle green column reflects the total actual expenditures plus the encumbrances in state fiscal year 19 And the third green column reflects the delta between budgets to actuals When it's a negative number it means there was under spending versus the budget that was established The purple column Is projected spending for state fiscal year 20 as of october 2019 This is our kind of roadmap our plan for spending The orange column is the projection for state fiscal year 21 so At a high level if you want to kind of maybe first talk about state fiscal year 19 um And I we can go through each of the projects I don't know all the details But I can maybe just call out for you some of the like key areas of either under spending or where we over spent Which I think would be in line with the report that was submitted You know before you do that. Yeah, maybe maybe it would be helpful if we do kind of go back to some of their Questions, so I think we had wanted my understanding Was we really wanted to understand there was a project That was um opposed. Yeah agreed to and we've been building it in modules and We started building it um And funding it and then at some point We will largely be done with building the project And so What in that frame is not on the sheet? Are there a lot of things that are not on this? So what is on here is everything that we either Engaged in during state fiscal year 19 or plan to over 20 and 21. Okay, so if there's something beyond 21 for example That hasn't yet been identified or perhaps it has and it's further out in the future. It's not included on the sheet And if it's something that was completed prior to state fiscal year 19, it's not on the sheet either And so I acknowledge that I I was trying to Address the questions that I heard came out of the last committee, which which I think I've not captured here exactly Because I'm I'm understanding you want a bigger accounting to include You know going back to vermont health connect Well, I I use rock health connect as an example And of course one of the questions I have is the question is to what extent if any Does any of the work here in fact replace pieces in vermont health connect that were broken to begin with and have never worked Which goes back to the question that that I asked The corallel question is what if vermont health connect cost? And some of those costs in fact here We we we hear anecdotally that vermont health connect cost about 200 million dollars But then I see an army of temps and contractors still today Doing things that that system was supposed to do that didn't do that is an ongoing cost If we have in this project something that doesn't work and we've got to do manual interventions We've got to add contractors. You've got to add temporary staff. Where are those costs? Are those considered project costs or those become operational costs? And so there's just a lack of clarity that I have about how much is all this costing And what buckets is it in? And I will add on to that that I have found the testimony that we've gotten this summer to be helpful in terms of where we are in time With specific modules So that's been helpful. I feel like we're okay. We're fairly comfortable in that space. It's really that Okay, it's a big picture. Yeah, okay very marky to me at this point My apologies because I definitely I I understood that you wanted a little bit more Project level detail for kind of where we are now and where we're planning to go I very clearly understand your question is vermont health connect. What did we pay for the development of it? But also what are we continuing to pay for the operations of vermont health connect that would include perhaps some of the more Manual aspects that we are continuing to engage in while we remediate Well, that's the issue is that in terms of looking at project costs and I applied the same thing here And I understand there's a different development philosophy and and certainly more control here today Through the was when vermont health connect was done and I acknowledge that and congratulate people for that But at the same time, uh, if we have continuing costs because we built something that doesn't work The functionality isn't there, which is still the the legacy of vermont health connect How are those costs being encountered for are they part of the project are the operational costs are the in the new project? And it's it's very very murky So, I mean I can speak to one of the projects that will um, we'll Help us to um get out of the costs that we are now experiencing with vermont health connect And secretary twin is going to talk about the vi project and where we are with that So the business intelligence project is moving um out of the sieble Database and over to The state of vermont data warehouse that the ads staff Is building right now. So he's going to go into that project in more detail Um they're also building And uh, all of the operational reports that we now rely on a vendor to produce for us over at vermont health connect And those operational reports will be built and maintained by state of vermont staff Moving forward when the business intelligence project Is launched So that will help us to start moving away from the vermont health connect And to help us start saving costs Another project that we have launched is um electronic content management So same kind of um situation happened. We were relying on Siebel to store all of our documents In their solution We've now moved them all over to a state of vermont hosted on base ECM solution So we're making Strides at doing replacing vermont health connect and the very expensive solution that we're That we're supporting right now So we're making strides at doing that and I think I think you should hear us say we would like to appreciate Those strides with a little better understanding. So we're just trying to grapple with that Is there someplace that from an accounting perspective you've accounted for vermont health connect to know how much we've spent overall as of this point That's what I'd like to know. Yeah. Yeah, there is Okay, I don't have that And I'd like to know in particular these ongoing costs that we are continuing to incur Yes, are they being accounted for as part of that project as operational costs or part of this project? Operational costs And we can we'll provide the kind of full scope Of costs for vermont health connect How it relates to integrated eligibility and the operating costs associated with vermont health connect Yeah, and I certainly like to know in far as integrated eligibility is concerned How much money are we spending in integrate for integrated eligibility? That actually is simply to replace the non-functionality that we are continuing to live with from vermont health connect Why don't you walk us through what you what you thought we're wanting? And um, okay, we'll keep great. So, um The let's see. I think we're going to do the top then this is the list of It's not up on the screen. It's the um, right this detail So, um, it is a listing of projects underneath the IE&E program If you wanted to focus on the third green column that tells you Off of the budget that was established in state fiscal year 19 Were the key areas of under spending and over spending But remember this is on a state fiscal year basis. So it's not going to reflect What's the total budget for each one of these projects? This is a state fiscal year comparison um, and so At a high level you could see that the IE program support underspent off of the budget by four million dollars um It's a pretty large bucket the program support. Um, it reflects state staff staff aug security costs When we have to do independent reviews on a project, which is a believe a legislative re-required process Um, there's a lot of different costs in that bucket We spent less than we budgeted for a whole variety of reasons Including um, some projects Just didn't move as quickly as were originally anticipated For a variety of reasons, but because of that our um spending on staff aug Was less than originally anticipated in the budget Does that mean that those are expenses that are not saved but are simply deferred and will appear later? I think um that yes some of those costs will be pushed into the future And are accounted for in the 20 and 21 estimates that you see on this page So if it was something that originally maybe we intended to have done in 19, but it didn't It's reflected in the 20 and 21 So as we go back and look at what is the total cost of this project based on how it was originally envisioned uh How is that going to impact? The actual cost to that budget because if if it's being deferred there aren't any savings there Does that mean that in terms of where we're we are in terms of our forecast versus Original budget original plan that were on target that were over that were under Are we able to To tell So I think and I'm going to let it and project Folks fell in a little bit more, but so my understanding of you know Why we're doing one of the reasons that we're doing this module approach is so that when we take a smaller bite From both a budget perspective and a performance perspective That we are able to as we move forward if we come up with challenges that we're able to adjust course So that would mean both from a financial perspective as well as like do we need to do something different to make sure that we're Achieving our intended deliverable And so in that manner Though when a project is delayed it does push costs potentially into the future We're also able to uh write put ourselves on the right course so that we don't um And I'll say kind of maybe similar to Vermont health connect so that we don't commit To a solution that ultimately is not going to work for us and it's going to cost us more money in the long term So I think cast or I'm Positive cast and some of her testimony talked about these you know smaller projects like the consolidated paper application So that was the first project that launched and that was an idea of getting all of the health care programs into One paper application That really had nothing to do with um With technology that was more foundational work to get prepared for One of the phases of the portals and When we come back in and talk to you more about How we plan or looked at this roadmap as we we've been again three and a half weeks into this project So we're we're still working these things out Like you know all of this work that's been done in this smaller chunks that has allowed us to Kind of contain the project Have less risk You know, how are we going to move it? all of these smaller projects Figure out what we actually need in the end and then we have to tie it all together And that's just a simplified kind of view of it And that's what we're trying to get on a roadmap Because we have commitments to our federal partner We have commitments to you And we have to make sure that we're meeting all of these All of these deadlines and we end up with a solution That is going to tie things all together. Remember they're they're tiny little there's phases of the customer portal There's an ECM solution. There's a business intelligence solution There's a premium processing solution All of these little modules and we have to Tie it all together and what we have been calling and unsure cast is referred to a case management solution and a worker dashboard That comes that comes in the out years And we haven't yet figured out On our timeline how When that will actually fit in But we will figure it out. Do you have any sense? We do have a sense when you will figure that out and you can tell us about it Yeah, I think if you give us Six weeks or so we should have a really firm idea of about that and How that will work? Are there new systems that are being used for the first time now that we're in open enrollment? Can you give us a snapshot of how that's going? Are we still in the legacy? Um, well the document uploader is being used So that was launched and that's being used So what that means is for monitors can actually upload any of their verification documents that they need Even in open enrollment and that gets um Created it creates a pdf to the worker And the worker will act on the change that way as we move through this modernization In the different phases of the customer portal Um, a lot of that will no longer be a manual process. It will be an automated process And so that's working okay. That's working fine. Do you want to keep going through? Do we have more do we have more? Good. I mean we we can go through each of the projects the areas of over and under spending Um, if you want or there's more slides. I think um So I will I I am So I'm looking at yep Okay, and I'm seeing that we have different projects listed here. I was Trying to go through my notes and see okay wait to release projects listed elsewhere um So I'd love to orient myself on This sheet. Yep To the projects that we've been following So there are more projects on the spreadsheet than there are here. Um, because I think The intention behind these was to this was I don't know maybe the more Permanent updates to provide to the community and that's why these were Selected for this executive summary level of town But to crosswalk you quickly if I may so the health care paper application Is project c. Yeah Um, and I think an important when and I wasn't at the testimony, but when pass was I think saying like things were over budget She was um Reflecting on the total budget for that project. So not just from a state fiscal year perspective So she was reflecting that things are over budget From the entirety over however many years the time frame it takes to complete But then when she said we finished Fiscal year 19 with a hundred thousand dollar balance I think there was some confusion perhaps about how over over budget in so many areas How did we end with a like a surplus and I think it's because she was speaking to Over budget in the context of the entire life of the project as opposed to just one state fiscal year Yes, which which is what I kind of managed to very tightly and we managed to each state fiscal year's appropriation Yeah, um as opposed to the life of the and so I think I think That's what I'm attempting to clear up here with the spreadsheet. So the crosswalk health care paper app is Is c enterprise content management is d on the spreadsheet Business intelligence is h document uploader is e CMS mitigation items Is not actually on the spreadsheet that I've handed out because I believe those items are factored into the diva operating budget And so it's not what I'm presenting to you here has to do with the divine design development Implementation of ie&e as opposed to the operating costs. So that's not reflected on my spreadsheet. So this spreadsheet are for the design and yes Not operational. Okay The online application is f On my spreadsheet and premium processing is k on my spreadsheet And I can um, it's helpful. Maybe we can just resubmit this table with the kind of crosswalk To the if that's helpful sure So there's a lot That is on your spreadsheet that Have we seen this? Have we seen reporting on these other um columns? I I'm feeling like Dan have we seen I don't know if you're I don't he doesn't have the spreadsheet so Dan we are looking at Line items for ie program support a chess independent verification and validation There's no funding for the customer portal phase three So I so I should say so I should I should clarify So when some of them on this spreadsheet are actually projects that are our wouldn't be here because they haven't started yet Right. They're a state fiscal year 20 or state fiscal year 21 And so So it's Yeah, so it's a it's a timing thing And then uh, some of the other um items that are highlighted have to do more with I like I'll point you to M on the spreadsheet government procurement that has to do it's the contract with 18 f which is basically It's a part of the general services administration of the federal government that we have a contract with that has been working with the state to kind of design our overall procurement strategy For ie and e and so the modular. Yes. And so Yeah, and so so that's It it does I get banned because I think he is seen I don't think he would be surprised by any of this Okay, but we can send it to him and confirm that Okay, I'm just going to post it. Okay. Thank you great Just uh, one of the things that stands out from the old Exchange days is the change of circumstance. So I think to senator brock's question I mean since very day one of launching the exchange We have been challenged by the change of circumstance. It's it's never worked. It's had a lot of attempts To have a work around And so is it is that the same one? Is that the same change of circumstance that we've talked about for the last five years? well, so it's It's the same requirement. So um, but the senator had asked sort of are there pieces on this that are sort of inter Cost interplay with the exchange and I think it is right So yeah, if I can just speak to it this way. So the change of circumstance Any system that we have has to be Has to um be ready to accept change of circumstance In our future planning The change of circumstance functionality that will replace the vermont health connect Change of circumstance process manual Process that that we have today is going to be in customer service portal phase three So right now we do have um an online Change review form that vermonters can go to a website And fill in a pdf file They can use the document uploader. So they're going to save it use the document uploader um And it will go into a workers queue through The new ecm electronic content management process In the state run on base solution That's already there and working We don't have the portal functionality where vermonters can just go to the portal And make a change in the portal right now. That's coming in in customer service phase three So that basically is another three million dollars That would should be added to the cost of building vermont health connect Because that was functionality that was supposed to be in vermont health connect to begin with Yes, and we now But there's always been they've always been matched, right? I mean their health clinic was Supposed to have all of this at some level, right? Well, I don't know about all of it Well, the integrated eligibility absolutely was the whole issue of changing circumstance was clearly the function To begin with And a lot of the customer service costs associated with this I mean I Get calls from consumers with some regularity about i've been on hold with vermont health connect for For three hours trying to tell them that I just had a baby or whatever the case may be And I can't get anybody to do anything about it. I get different answers from everybody I talked to You know, I'm sure you you've heard all of this as well For you will I've heard it too But that's one of the things that that are generated by questions is it seems very very difficult to pin a cost on On what it is that we're doing and also to get a clear understanding of how much are we spending on all of this stuff? You know, how much are we spent on vermont health connect? How much are we spending? Upon integrated eligibility at what and to what extent is the spending? on Integrated eligibility really a part of the vermont health connect. Okay to begin with and I have heard sarah say that She will come to the next report here And talk to us about the health connect overall cost as it relates to iad as well as the operational costs Yep Big picture. It'll be a bigger team than me because it's okay. Good. Okay, but you're hearing us loud and clear Yeah, I hear you loud and clear great Thank you When you're saying this is Was supposed to be part of health connect does that mean That the charges for that module should be assigned to that project instead of this or Okay, what do we let you finish your testimony So do you want to walk through each I'm trying do you want that level of detail now or I don't I think I would maybe just move on to the other folks unless you wanted to go through it So sarah, you know what I think would be helpful for the um for the line items That we have not been hearing reports on if you had started to tell us about those Why don't you finish telling us about those and then So that is going to be um Let's see A B So a is the ie uh program support which I talked a little bit about right? It's just that kind of um Overall infrastructure support for the iene program And so we can provide you more details about what's underneath this Because it is the largest number on the page. So those are not costs associated, right? No, they're not cost associated Yeah, it's yeah, so it's what it's not directly attributable to our project It's in this bucket B, um, I'm sure cast talked to you about the requirement from cms to do the independent Verification and validation i-v and v it's a cms required review for compliance and ensuring that the state Is achieving its you know deliverables and work plan Is this in effect using a third party independent reviewers such as a gartner that is correct And then there are reports that are generated by them On an ongoing basis That's correct by project. That's correct And as a matter of fact, we um share those reports with um Dan Smith You're aware of the healthcare paper application. Yeah, uh enterprise content management. Let's see The um f customer portal phase two online application. That's a project that um has started But that's a budget in state fiscal year 20 and 21 Change of circumstance is a schedule to start in state fiscal year 21 Uh, yeah 21 We've taught you are aware of business intelligence business rules management And I probably not great at describing what this is But it is something that uh has to do with expanding Integrated eligibility behind the health beyond healthcare programs to the economic services programs And so it's the kind of foundational work to be able to make that happen Sarah Yes With regard to h. Yeah So that's the business intelligence Have we made a decision on that project? I'm ready to talk about that one during your testimony. Yeah, okay. All right. Why don't you finish that? um, okay, uh j federal report development, um again Though it's not Called out individually here. Um, I believe you're aware of it. This has to do with the federal enrollment and tax reporting requirements, um That the state was required to do related to vermont health connect um, the next one k premium processing that slated to begin state fiscal year 20 The worker dashboard state fiscal year 21 Um government procurement and we talked a little bit about what that is the contract with 18 f for kind of our procurement strategy um, and the last one master person index master data management, um, is a project that I believe was started and then is is paused right now It is paused and it's part of our future roadmap discussions with Secretary Quinn and his staff Could you tell me just to briefly a little bit about the 18 f and government procurement as to how What what that consists of? Is anybody more familiar with that than me here? Yeah, I think I can go into it further as we discussed in the first hour 18 f was hired to um Help us with agile procurement help us look at our procurement practices in the state to try to streamline in um Get vendors on site in a faster way and still be competitive with in the market So one of the things that they suggested and worked with us on was Building retainer buckets of vendors Inviting vendors in um to competitively bid on areas of work whether it was, you know, by the hour 185 an hour for website work or security work They would sign the terms and conditions with the state and be on standby To respond to statements of work by the state for work. That's $500,000 or less So part of the approach with IE was to build Deliverables that were $500,000 or less and to be able to go out to these retainer contracts Put out a statement of work and get a response back in a couple of weeks Rather than doing a full-blown RFP that could take, you know, nine months, 12 months, 18 months in some cases And get to work immediately and start working in smaller buckets trying to get a deliverable that directly affects responders It adds functionality in a in a smaller way And you know overall I would say in that bucket in the procurement bucket. We were very successful with working with them So that's kind of project by project list Um, okay Dan Have you had have you been able to look at this uh spreadsheet? Yes, I have he has yeah, so just with your It's not okay. So do you have any questions on this spreadsheet? We're going to move on from it at this point No, that it pretty much matches with the uh data that was presented to the Corrections and institutions committees now back with the original capital request Okay Thank you Thank you. So how long have you been working on this project? Um, I've been the cfo of hs for about four and a half years I've been in state government for 15 which It's a long time, but nowhere near my esteemed colleagues. I'm in awe of her So And so has your role changed at all um with the departure of cast? Um Long here today. So I don't think I've met with you guys before but I've um Been testifying in the institutions committees on the capital request as it relates to iene for as long as I've been in my role So that that hasn't changed and I was there supporting cast last year and so You know as the cfo the agency of human services We have about two and a half billion dollar operating budget Six different six different departments from corrections children and families Disabilities aging independent living. So that's kind of all under my purview and so the I.T. Projects with really the onset of romont health connect in the kind of major Efforts that we undertook probably now six seven eight years ago the Kind of financial impact of these large scale i.t. Projects has definitely changed the cfo's job, right? in terms of the responsibility for overseeing A large infusion of federal dollars and state dollars for the build out of these projects So that happened prior to it happens to require yes, but just in terms of the changing nature of this job Okay, but you know as you guys know agency had We still have 20 30-year-old legacy systems that we rely on intensely and so we're at the end of the life of those and so Yes, yeah Okay Thank you Boarding again, okay, so i'm going to cover this portion of the The event or the the testimony uh the business intelligence project No event no event The business intelligence project has been one that we've started with in the past a little bit I think it's been read for quite a while As you may recall we've had a number of issues that At first, you know, we called networking issues state network It looked like there was a you know Fairly big problem with the state network that was causing replication issues right in the end We found it was a bug with the software that was running on the romont health connect site and that And that stack of products specific to a certain version that really Only affected the the replication. So it was a extremely technical thing that You know, it took us a long time to figure out we had vendors in anyways were past that That was the transfer of data Since then We've been working on Over the past month three weeks The transition what it looks like with new leadership coming in at human services what the work is Looking at the the dates that we have set out for completing the bi project and ADS and ahs have committed to being able to finish this project in in february At the same time to cover ourselves We have executed a contingency plan to make sure that we're able to get out The delivery of 10 95s and federal reports if something was to go wrong, but Our boots on the ground or project management our Senior leadership teams in these agencies are all feeling confident that we can get this done in in february Or we're done with most of the highly technical work and right now It's looking at the data preparing the data building the reports testing the reports And based on the timelines that we've put together and the people that we've brought in who have Been really instrumental on Agile process and agile development and being able to plan out these things people that have the most experience Are showing that we can do these in In time for to meet the february deadline So for our first time in quite a while I feel I feel pretty strongly that we can we can make this deadline and that we're on the right track You know, I would say and I mentioned this to lory's deputy before lory took this role and before We knew that cast was leaving that you know I don't I don't give lory's side of the shop or which I called the mmy side a lot of attention Because they do projects really well and they've been successful and they continue to be successful So usually when you see a lot of involvement from me, it's because something's gone wrong in the past And so I'm feeling very confident in both the ads and the ahs side that we have the proper leadership in place to do this Okay, I thought 1095s were due by the end of january. So Am I just misremembering that they're due with that By the tax year so We've the contingency that we have in place right now Um, it's really not a contingency. It was like business as usual. So we have the vendor archetype Who is going to create these 1095s? What we're going to do Is while they're creating the 1095s, we're going to replicate it on the the state side To use the data that is migrated over to the data warehouse on the state side to Replicate the 1095 process And so that would be what we'll use to actually test the process to be able to create them in In the next tax year But the forms of remoders are getting are out of the legacy the last year system and then If I recall there was Questions or is it an oracle that's doing that this is the component that we were Worried about having to re-up with right because it was It's tricky that we didn't really want to update to the new oracle We couldn't really keep the old one, right? So so if we hit your deadline here of february Does that save us money? Like are we able to get out of that contract in a way that's going to save us money or Forgive me. I'm sort of half remembering the what we were talking about but I just remember there's a lot of interplay there in terms of both system Abilities and budgeting that was sort of a shocking number if we had to keep going very long Right. I do know that the the business intelligent project once stood up Saves the state gross and please kick me if i'm wrong about 600 000 a month in these other contracts that we have going on So, you know, we'll be avoiding that cost once the system has stood up And that's why we're so committed to this day as far as the contract date with oracle I'm not remembering the exact date on that. Well, so then thank you That is my memory was a shocking monthly figure. So if we stand this up in february Do we get to take that off the oracle off in march or is there a lag like it just helped me understand That relationship Yeah, in uh after december we're upgrading all of the oracle we're actually operating Right now But it won't go live until february at that point in time We will Be able to get once we get this done be able to turn off that what's called the ovie Especially is the business intelligence Software or the software that runs it could be immediate as soon as we're satisfied. Yep. Okay, and uh, and then also discontinue the use of the Okay, thank you. You can So we're not walked into a contract passed february No, the contract actually ends in february from now on And that's I mean, we're that's why you were yeah, we're moving resources. We're really sure we're moving resources around We're pulling resources from other departments. We're trying to put the absolute best and brightest on this That won't make sure that we have success in the end We're okay. I'm meeting with the the ads technicians shop between my deputy and I and darin You know, it feels like daily we're paying a lot of attention to this make sure we get this data Well, I guess if we Part of the contingency do we have an option of a month a month sort of arrangement if we find we're a few weeks over or Well, would we anticipate if we don't hit february? You know Sign up for even another year or another two months. What do you do you have a sense of that? What would you look at? I think you're right. We would end up going to a month a month sort of arrangement We'd have to extend existing market type contract And and push out the Oracle upgrade project And that's where those large costs come because we have for those additional months that we would be at hiring the vendor And having optimum host Implicative environments because during the cover there's a lot of twice as many and each environment has Just to give you an idea of scale around 220 servers in it You know, we're it's all it's a lot of right a lot extra hosting that we wouldn't need Thank you Dan do you have any questions on business intelligence? No, I the only comments I would have would be on the financial side at this point Would you like to share those questions? Okay, I didn't want to jump in earlier and and again first I'd like to apologize for not being there in person And also say if I was in person, hopefully this wouldn't come across possibly as harsh, but Uh going back to the original question of how much is ie really going to cost The approach that ahs and ads is taking now Is an approach that unfortunately means you can't answer that question. You can't look forward and say This is the final cost of ie Back in 2015 when ahs was looking at a contract To say you know to some vendor go out and build ie for us That brings the comfort of saying yes ie will cost x amount of dollars But unfortunately for that comfort it's based on invalid assumptions and the net cost would have been far greater And again, we can go back and look at vermont health connect as an example of that We thought we knew it from on health connect. That's going to cost it ended up costing far more and did less than was expected The advantage of the approach that's being taken now is that It's being done in a piecemeal fashion every year Ahs and ads and the legislature is going to have to look at The list of what must be done and cms mitigation items is an example of that And the list of things that we'd like to have done And the um change of circumstance improvements is an example of that Look at the cost involved and say is it worth going forward The plus side of that is the overall program risks are much less The negative side is you're never really going to be able to put a handle on how much the thing is going to cost It's going to be a year to year exercise And say what must we do? What do we want to do? Can we afford it and do we want to afford it? So without beating that to death I'd say that is one of the downsides Uh, it's it's going to be a lot of work and it's going to be a year to year Challenge to figure out what the next year's projects are going to be The only other thing I'd say is uh the question of Vermont health connect versus ie of how much is in each bucket Is almost impossible to answer because there is no clear line between those programs The ie and vermont health connect from the beginning have been very tightly coupled very closely intertwined And being able to put your finger on how much have we spent on ie and how much have we spent on vermont health connect? Uh, you'll drive sarah crazy with that kind of question But all we can try to do going forward is say for each system As closely as we can define them. What are the benefits to each? So, you know in in the next year or so the the customer portal phase three Yes, it's a change to vermont health connect Yes, we could probably do without it and can continue along with the way things are done now But it's probably worth the states and cms's money to make the process better for everybody involved And I will stop rambling there. That's my take on the financial It's just going to be a long process We won't know what ie is going to cost until we've said we're spending enough money. We're done Well, I understand that the modular approach has its certain advantages and the pluses I'm fully on board with the same time. I think we have an obligation to accountability And when we establish what essentially is a never-ending chain of costs We never will know how much we're spending and it's very difficult then to look back over a three four five year period To be able to evaluate did we do the right things? Have we spent the correct amount of money? What have we spent and for what I I just can't stand I can't buy the fact that we can't quantify this We may quantify it differently. I'm sorry I'm sorry and and I have to agree with you as we look back to 2013 through say 2016 It's it's unfortunate. We can't look back and have a better handle on what was spent for what what did we get out of it? But I think that's the reality of it I think in the current process from about say 2017 on We will have a much clearer picture and and again You know the the project breakdowns and the costs and estimates Going forward We will have a much better handle on what we are spending on what and what are we getting for it? But yeah looking looking back to the beginning. It's It's rough. It's it's Going to be an impossible question to answer For me some of these things are about smarter spending right so Whether and I don't have the cost in front of me. So I'm just going to use Some general numbers if we're talking about business intelligence and it costs us, you know Three million dollars, right? How long does it take to get the ROI on that from what we're paying optimum? What's the value behind that to the citizen of Vermont, right? With the document uploader. What was the cost of that and what's the value to the citizen of Vermont? so if we look at this from a different perspective if you look at it like I think we may be trying to look at it like what is the entire cost of integrated eligibility It's a really large number But if you break it down by the modules that we're delivering at the time and say What's the value to the citizen of that that we're actually getting right now and long term? Whether we complete all of the integrated eligibility things or not What's the value of implementing that piece to the citizen and to us? I think if we look at it that way you can break it down by cost and say Is three million dollars worth it to us to to add that amount of value to the to the to the vermoner Is document uploading making it easier for us? Making it easier for the vermoner to be able to upload documents so we can turn around and process that faster on the back end with less resources worth the price Compared to trying to come up with a 200 million dollar number saying it's going to do all of these things and trying to wrangle it all in one big number I think that's really difficult But I think if we look at it in smaller chunks kind of like how we're building it out And look at the value story behind each one you can kind of break it down a little simpler or at least that's the way I'm Looking at it in my mind You can measure each little cut But what you really want to know is how much blood did you do? Did you spill? And I can't accept the fact that we don't know and can't figure it out I just I from a basic fundamental system of government accountability. I I simply cannot accept that Are we done with the business intelligence piece for right now? I think we are done with the business intelligence piece for right now Okay, so a little more about how we plan for the transition of cast leaving on october 18 So when cast gave her notice about leaving the beginning of october We immediately went to a structure To that would align With the way cms had actually been structuring just this past summer they released a new organizational structure Where our state representative? Was going to be responsible for all three programs. So m m is I e and e and h it And we looked at that and said is there an opportunity to bring The executive sponsorship and the leadership team that We had in m m is and shared that leadership team With the i e and e programs to help move these programs forward And we quickly Decided that that might not that would be a really good structure We have foundational teams in the m m is program already built We have teams that are responsible for cms certification And if i'll explain a little bit about certification certification is When you're allowed to get enhanced funding for your maintenance and operations costs So in m m is that's Certification is something that we're really used to in the last three years. We have certified pharmacy benefit management solution and And we also have certified a care management solution, which is the first solution in Across the country that cms is ever certified We've also next thursday. We're hosting cms to certify our provider management module So just in the last two or three years We've certified Three modules In our m m is program So long story short bringing i e and e into the m m is we're going to be able to share a really strong leadership team We're going to also be able to share all of these foundational teams that we've already built And we'll be able to streamline the processes. We have leads in every one of these teams a recent example is um The the reports that john and his team are um are Building we have already shifted over to our qa and testing team and they're starting to test them If we hadn't combined these teams um We would have had staff In the i e and e program that would have had to leave their day jobs to do the testing on these reports So i it's going to be more efficient. We're using experience resources And um, I think it will make a big difference The projects will continue to align with the cms guidance and will proceed in a blend of waterfall modular etc processes So i'm hearing you say this will be more efficient. Will it be equally or more effective? I say yes okay, and uh Are we Are we Have you Are you now doing your old job and cast this job at the same time like is that like So cast this job was she was deputy commissioner and she had responsibility for the i e and e program And she also managed that um, she oversaw the health access eligibility unit And 140 employees there And she also had different other responsibilities In diva she was responsible for performance improvement and other things My main responsibilities to answer your question. I'm going to be doing The job I did before and I'm also going to be the executive sponsor over i e and e But the reason why I can do that is that I'm an executive sponsor I have an incredible team And I have incredible relationships built You know and I have the relationships built across the agency so That's helpful And do you do you know is that position um his cast is the remaining aspects of cast's position I expected to be filled. Do you have any insight into that? I don't really at this point. Okay I haven't heard that we're not filling it But the piece that we are interested in which is integrated eligibility you are taking I do that In addition to what you were doing Yes, I am Okay, and you have the capacity within your existing teams To do that is what I'm doing. Yes Are there staff that transfer over to you and you have now There is how many? Uh, I can get back to you with that number. We're still trying to figure this out. Um, Okay What you know, we have lots of pro project management staff That we've been meeting with regularly. We have product owners that we meet with regularly, but account of how many of them That we'll be transferring over from ie any Into this, you know broader team I don't have a cow specifically It's a gray area because our teams are so so meshed together In the roles and working together, it's you know Was there overlap previously between the two projects? I can hear dna most of that But what were there Overlap people that overlapped between the two? Um, there are some projects that overlap mmis has been launching tm sis And I won't bore you with details because it is a lot of detail in that but We had to rely on would like to make a call. Please hang up and try again The um, we had to rely on staff The health access eligibility unit director thawney Los calio She she would be working on that tm sis project with us. So we had overlap between projects But we didn't really have integration. I think it's probably the way to describe it Do you anticipate I've heard you say More efficient. I've heard you say you believe that this will be equally effective Do you anticipate adding staff reducing staff Well, I can tell you in Excuse me in the last three weeks. We've been able to Use a Project manager that had some bandwidth that was working on an mmis project And we've moved them over to an ecm project So I think overall it's going to be a fit more efficient. It should be less costly You know because we're we're working across both programs and we can Use the ebb and flows in project work And move them over to other projects that need resources So where is that cost savings going to come from if it's less costly? Do you anticipate? So I think you'll see it most in the the program the IE program support you'll you'll you'll see You should see less cost there And less cost in the mmis program support if we can leverage it either way, right? Okay, is that contracted services or those like it's a blend Yeah, we use contracts for staff aug and we also use standpoints Well over your time But this has been Helpful, I appreciate you Working so hard to provide us an update in such a short amount of time that you've been grasping with this Do you want to walk us through the rest? Very quickly. So I think um, I touched upon our um, certification successes. So Again care management. We certified this And we we actually got the letter in october of 2019. We were able to go back and collect Enhanced funding at 75 percent back to 1117 with this certification. So that that's a big win financially Again, we're hosting cms next week thursday We're going to certify this provider management module and hot off the press this morning. We learned that Puerto Rico is actually coming to us on December 5th staff working on an mmis launch of the provider management They're coming um, december 5th to talk to us about How we were able to launch this provider management module in less than a year And they want to talk to us about how They can replicate some of that I said it'll be a rude awakening being here in december So there's just the success of the project there, you know, we were Okay This was a legislative mandate because it was taking us so long over 120 days to enroll a provider when we Launched this project and now we're enrolling providers in 18 to 23 days So we're going to continue to employ this modular approach for ie any projects in 2020 We've launched the premium processing project That's also legislative man legislatively mandated and that brings that Since the premium billing back to the issuers And that is currently on time on budget and on scope We have customer portal phase two Which has just launched in the last week and a half I think And that's um the online application project So that's where they'll be able to enter this portal for monitors will and they'll be able to Um electronically apply for healthcare coverage And we're on time on budget and on scope Thank you very much for coming in. Um, I'm sure you've been working hard to So I'm not sure that we're going to meet in december we may meet in december, but it sounds like You all I heard about six weeks So you might appreciate, um Not coming back to talk to us until january that would probably be very appreciated. Okay And so at that time, um I want to be clear that we send these folks off with um, very clear idea of what we want them to testify on based on Based on dan's comments your concerns As I said right now I've got This question here from on health connect from on health connect costs and how they relate to ie any And I'm hearing Dan say that that's going to be really challenging So do we want to Do you have recommendations? Sarah on based on our questions on what might be more helpful So I think and I'm just trying to Go back in history a little bit because we had probably it was three years ago Maybe now we did kind of testify this committee didn't exist then right so to two different legislators Um, so I'm right now I think my approach would be similar to what we did the last time and there's actually if you look in the november 1st report There is on page 19 There is some financial information Surrounding kind of what we've spent on vermont vermont health connect and ie and e from the from the kind of dawn of these projects And so there is the accounting for it at a very high level what we've spent But dan, you know his comments were very on point in that it's it's hard to determine Where vermont health connect ends and integrated eligibility and enrollment begins But I think in my mind, I understand your question and I will you know Do my best to answer it with the information that I have well to me the The issue is the functionality and the functionality that was allegedly built into vermont health connect Uh From the time that it was initiated up until now how much have we spent to deliver that particular functionality Not to maintain it but to deliver it So we have the original development cost in vermont health connect, which presumably would be able to quantify We have the amount of money that we have spent over and above normal operational needs To hire contractors temperate employees and other workarounds to do things if vermont health connect was alleged To have been done. It was part of the original specification that wasn't done And still to this date has not been done. We should be able to quantify that We know that there's certain aspects of what we're doing here in integrated eligibility that was specifically part of that original vermont health connect deliverable And we should be able to quantify at least what we've spent to date and what we have budgeted Uh, such as the phase three change of circumstance, which was part of the original vermont health connect We should be able to quantify that So those are specifics That we should be able to come up with both an actual to date and a budget to get the total amount for that So I was agreeing with you. I'm not I think it's the the whole conversation around the deliverable and what vermont health connect was that I can't speak to The accounting I can talk to you about the accounting for it So do you feel comfortable with what you're hearing senator brock say he like to understand Yes, but I will tell you I will be reaching out to probably both of you and the joint fiscal staff and dan Smith leading up to the meeting Yep, because it's a it's a it's a combination, right? There's the accounting for it, but it's the it's the other stuff that's It's hard to pull apart. Okay. And it's well, I mean, I think originally what would what we're saying here is with this modular approach In many cases you are Taking what historically has been a capital expenditure and you're really operationalizing it Because it becomes an ongoing decision point on a year versus year basis as to what you're going to do versus You know it may be just in terms of thinking ahead that the way we account for things may may may need to be different May need to be changed because of that But it's hard for me To think for example that if you're a private company If your it chief comes to you and says I don't know what we're going to spend To do this function and I never will know and there's no way that I can tell you that would not be an acceptable answer No private company would operate that way and I don't think government should Okay So we have uh, two items three items actually One is uh, committee discussion and markup with becky, uh, we are over we are how are you for time because we are over time Um What time is your other meeting is it? So we should we should go through the memo first So we want to we want to go through this memo. Um, I also would like to um talk about If we don't meet in december how we could move would you like to walk through this? What would make what would make this easiest for you? Yeah, I can I can generally walk through the structure and then um, I think Go over the bullet points Okay, so becky wasterman legislative council um, so the memo is now separated out into um, three parts the first is the introduction um And this is just saying how often the committee met and um, what witnesses testified at committee meetings during that time Um, it's pretty general. So I didn't know if you wanted to specifically list all the witness names here So that's a question for you all I had the one note that I have as I mentioned here the chief auditor and I think we actually met with a state auditor We did not meet with Did we never meet with um tanya? Yeah tanya moorehouse. Did she come in? She was on the On the list on the website But I know maybe maybe it was just a written testimony I'll check that Um so in the Second section it's recommendations that the committee would be sharing with Other committees of jurisdiction and then the third section is the status of it projects And I think that's the section that probably needs the most detail Um, so in terms of recommendations We've been compiling over the last couple meetings a number of bullet points So I can just start to go through them all The first is to recommend the committees of jurisdiction Um, that they address workforce development initiatives in the it profession And so what was discussed was including reviewing state employment needs the promotion of the profession secondary and post-secondary training and deficiencies in pay this um Are we talking about State workforce development needs when you're kind of in this outline or in this bullet It's including reviewing state employees Because I think we should it's sort of mixed together here, but I mean we've heard from Employers that this is a challenge. We've heard from municipalities that this is a challenge and we've heard from our own people that this is a challenge so So generally Yeah, right. I mean when we're talking about deficiencies of pay, I assume that's our own You know state government challenge I don't know, you know I'm making sense here. I'm so it makes sense to just cross out state in front of employment needs because it's it's really both Are you saying it's both the public and private sector? Well, I'm asking that As we've done in the and the economic development committee which deals with these workforce issues in the senate This this is a recognition that it is a statewide issue Not solely a state government issue. So I I think it's appropriate that We do it more generally, but the deficiencies in pay is specific to state That's right. That's what I'm trying to say. You're right. And and so it's just a bit jumbled here And I think it's I think it is we want it to For my needs, we want to encourage the committees to look at the whole suite of it Clearly when they look at state governments, it needs the pay issue is a big one And and I guess I would also like to suggest that Secondary and post-secondary training To me, I want to be sure maybe this is already happening that for instance, Vermont technical college Is a way of this that are that are You know that our voc ad programs are Engaged in this and so I don't you know, maybe they are they probably are but it seems like we would want committees to check in that Maybe maybe that's too specific awareness and trading Yeah, I mean It's not just it's not just Uh Yeah, I mean here the training I think of those as sort of state programs But it's kind of a curriculum. It could be a curriculum. You know, I think it's just more broad So without yet another bullet perhaps just on education sort of the a review of what Offerings there are in the state In terms of program like training and programs. So maybe mapping out the Well, it is the pipeline. No, I think that's that's right. Um Well, maybe it is a different bullet because it's more likely to go to different different committees You know, it's all interwoven, but you would want it seems to me we would want our education committees to Have this kind of discussion like there's this huge need There are good jobs available are our we want to know if our programs are kind of aimed at that. I mean, is that too silly? No, it's not. I mean, and we we've certainly done it with other with other professions And we have a suite of things that we say we know that we have critical needs and and in construction in nursing Yeah, nursing and some of the healthcare allied healthcare professions and so on and just to make sure that information technology and information Security Are among the critical needs that we have in brahman and that we have workforce development programs that recognize those needs and And and and focuses on the pathway to fulfilling them Do you have it? Great. Okay. Let's go to the next So the next one is a review of both federal and state statutory provisions on cyber crimes To determine any deficiencies and last time there was also a discussion of requesting an opinion from the ag's office about Whether any statutes need to be modernized I'm okay with that. Um, I I think what I've heard from other testimony in the meantime is that those things are Generally addressed already I'm not sure if we necessarily need to call it out or just kind of an ongoing thing I'm happy to pull the bullet if you want to pull the ball Anybody else have any Feeling I really I want to read The statutes regarding cyber crimes. I haven't I've spent a long time. So I've read them just to Is that an understanding as to whether or not See the issue based on what we've heard here this past year To me it's an excellent question, but we've kind of heard that It's not a big gap Great The next bullet has to deal deals with the risk assessment process So developing an it risk assessment process within state government to ensure that the state prioritizes the um IT risks that it faces responds effectively to those risks and has a process in place to raise inadequate inadequate risk response to the legislature for that action And there would be a couple entities involved in that process including eds other executive branch agencies the legislative committees of jurisdiction and the state auditor and I had This came from senator brock and I had paraphrased it to fit into the structure of the memo and there was um a note in there about the state auditor's Ability to perform this mission whether or not they have enough resources So I put that footnote in there, but I didn't know if you wanted to include that in the memo No, I think that We would I would want to include that in the memo Well, if we don't include it in the memo that I think we need to include that we want I think we need the word auditing in here Well, yeah, the state auditor is their independent officer. I think that's that's correct The only question is whether not this resource issue ought to be included. And I think I would I just think we ought to consult with hoffer before we put it in there I'm sure we're all on the same page. Yeah, I do think I think you could ask the same question of what we're asking the agency digital server You know to me The question is baked into anything we're asking so I don't know that it needs to be called out especially here, but My experience with auditor hoffords. He's more than capable of raising that concern When he's given new tasks, but so then maybe we Want to rather than be concerned. We want to work with the auditor to have this function happen So the bullet point Is saying that this process should include all those entities so it would be including the auditor in there So take out the footnote. Um, the next bullet deals with proposing legislation. Um, so this would be Uh Creating an annual reporting requirement to the legislature on level three four and five cybersecurity incidents by system and require state agencies and entities Accessing state collected or generated data to develop data backup protocols and there was some discussion last time about whether this would Be needed and also Um, how this legislation would be proposed Because this committee can't can't do that. So what we were really talking about I think and you had raised the issue was that if some horrible incident occurs Should the legislature at some subset of it Be notified about it and if so at what frequency and I think one of the goals was not to provide A reporting mechanism that was overly onerous But that Knowing that we've had some kind of problem is something that we ought to be aware of and I am aware that uh In speaking with representative briglin from house energy and technology that he intends to put forward a cyber security bill. So Yes, we pretty yes So we should That Do you mean to say an annual reporting requirement or uh at time of incidents or Period I can leave it more more general. Yeah, so Somewhere in between is where I would actually be comfortable. Me too. So maybe just say a reporting requirement At least annually Or by annually. So what we've heard is that At the time of the incident Could be Could be challenging Because sometimes they're taking some time. They they really can't report to us, right, right? Well And the other thing is the the specificity of the level three four five cyber security incidents Makes the question is that a footnote because you know, what most people won't have a clue of what we're talking about Uh, but I think because what we've talked about is, you know, that there are these issues that happen all the time We could be overloaded and I think secretary quinn has actually Three four and five are more serious, right? Right, what's a two? Tell me what's a two? Um, something that may affect a small Small group of maybe stay employees how small Left to be determined by me. I don't I don't want to put a I don't want to put a 10 people I don't want to put a 15 people. I think it depends. There's a lot that goes into it depends on the type of data Is it just pii like what is involved? Okay, if it was Uh, something that was going to make the news even if it was just eight people I would raise that to a you know higher level So essentially really it's a periodic reporting requirement of significant security incidents So should we ask the news guy? What's a level three depends on whether it's a slow news day Exactly Uh, okay So well, I think this will get some discussion in committee. Yes Are you good with that Becky? Okay So the next bullet is another recommendation to the committees of jurisdiction about Understanding the administration's prioritization of risk in the system and that would include Which it systems are at greatest risk for theft of vermonder's data and which systems Disruption would pose the greatest threat to public safety. I would say I would add to that the greatest threat to public safety Or to the operations of government And for systems I think should have an apostrophe So The next would be to fund a third party assessment of cyber security risks posed by local governments of the state system and develop parameters with BLCT in conjunction with the secretary of state's office and ad s I'd like to I think that's smart, but I also think I wonder if this We also just need to understand the cyber security risks posed by local governments Not only this sort of hinges it to our own systems you know when when the town of bradford gets hit with a $2 million ransom request You know that we're going to need to be we're going to be engaged So it's not only the intersection to the state systems that I think is a state interest That makes sense. I'm I'm not quite there with you. You don't agree or no, I don't understand Well, this says the cyber security risks posed by local governments to the state systems And I think that It's clear that municipal systems have their own risks just to their own systems So you'd like an assessment overall of the municipal Systems And so what would we do with that assessment? Well, I think that We ought to be looking for ways where the state Centralizes some municipal IT functions and and makes it easier for them and makes it more secure for the our communities overall Yeah, yeah, I mean I'm pretty far out of my knowledge base here, but That could be a pretty big chunk. And I I just wonder whether or not That the state should do what the federal government does so for its agencies a lot of cases and that is Define a set of best practices As well as the ability for them to decide whether they're going to do it or whether they're not But in some cases where it affects the state systems, that's where I think we may we may make certain Things mandatory in order to interact with state systems, but beyond that I think the municipalities I'm not sure that the notion of doing a risk assessment for all the municipalities in the state That's a that's a big chunk and potentially a big number So I don't uh, okay somewhere in between there is I'm not sure we need to do an across-the-board risk assessment. I think it could be just an analysis of You know, what is the landscape that we could be faced with I mean You've heard we've all heard the news reports of significant cities, right that that have found themselves in deep hot water And So I you know, I agree with you that we don't need a town-by-town risk assessment But I don't want to tie this just to the intersection of state systems because I think that these are community systems that I don't know Well The The bigger towns like the burlington have the budget to do this sort of an assessment themselves the smaller towns Which would be the hardest to assess also have the smallest budget And likely to pose the the largest Potential risk of that particular system per capita, you know So I have a question actually uh secretary quinn when Uh Jill Rameck was testifying earlier We noted that there was a small percentage of municipalities that said they get their IT services from the state of Vermont Is that true? I don't have enough information to answer that. Okay. I think it's in the IT service. Okay, so um But do you provide any municipal services through ads? No, it's just internal Do we across state government vcgi? or Center for geographic information they provide some services to regional planning. Yeah okay Agencies may provide some Help desk type support on systems that directly interact, you know, they may have forgot their password Those types of things but Okay, so what if we just leave it as is but then sort of say also explore sort of these issues at the Our need to understand the potential impact of municipal Cybersecurity issues. So I something like that. I've moved under the IT I have a bullet a new bullet from our previous discussion around the possibility of state So it's like state services that could be offered to municipality. So maybe we'll stick that. Okay. Um, I do think um You know the notion of doing some sort of polling Could be interesting. I don't know if there's I think this is fine. I think this is fine as it is It's right as it is because we can add more These can get fleshed out a bit more. Yeah Let's have I was going to say maybe we could kind of shorten it a little bit Fund a third-party assessment of the cyber security risk landscape of for City at local and state governments So it's more broad and then you depend on the committee to Take more testimony and yeah, no great I guess I don't want to you know to appear as if we give them a blank check for a two million dollar risk assessment Cash our checks Good Becky you good on that Hope you like the rest of it. You can't measure it anyway. Okay. Be good So the next bullet is uh require new IT project funding proposals to report on the compatibility between existing and proposed technologies So uh secretary quinn is this required Um, if there's a if there's a funding proposal for a new IT project There has to be a report on whether there's compatibility between existing and proposed technologies So in statute now The agency of digital services is responsible for choosing the technology solution. Yeah Which puts it all in my agency, right? So the compatibility is looked at by our enterprise architecture. I don't think it necessarily needs to go into law I mean, there's only one IT group. So the compatibility Um is is looked at as part of the process and we don't We wouldn't let someone go forward with something if it didn't make sense for the state as far as compatibility to other systems Unless if the business case is there where we had to do something because of a mandate For some of the reasons, but we're looking to build best practices here to not rely on what a good job you do, which is Right, but I guess what I'm saying is it's in law already by giving ads the It is in law Already ads are responsible for the technology solutions. So you have to report on that To the legislature. So this is specifically you're doing with a funding proposal. Yeah, I guess Okay All right, then let's take that out Take it out. Okay Okay The next would be the creation of a joint cyber security council to plan and oversee cooperation and communication on cyber security issues between the three branches of government So I would like to leave that in I know that the three branches are working and I would love for them to You know, maybe just explain it just to continue Forward into the session with that. Yeah well, um I think this makes sense, but I wonder if we could come a little short of sort of urging the creation, but rather like Just just sort of I think this is a good conversation for the committees to have I'm not comfortable saying that we should create a joint commission And so consider creation. Yeah, I don't know formalize Yeah, that's for the three branches to cooperate on these things collaborate Yeah, thank you share information I was going to add on to that if it if it is the creation of something It might make sense to put it into the bullet point Relating to the cyber security bill Because it would have to be created in legislation, although it sounds like now you don't want legislation on it I I mean, I think we need a plan To to do all of these things. I'm just I'm a little uncomfortable being saying We've met and discussed it and we think there needs to be a joint cyber security council Yeah Keeping it a little bit more loose like formalize it. I'd be okay with like a joint demo from all the heads of the it teams of all three branches and hey, here's what our best practices are I think they're working on Yeah, yeah So what so does you wanted you were suggesting we include it somewhere else If you were going to keep it as is it's it looks to create a council would be something you would have to do in law So I thought it might fit into the bullet point on Recommending to it sounds like the house energy and technology is thinking about doing a cyber security bill So it might be something that would fit into that bill if it is something you would like in law Yes That's probably where we would But for now, I'll just keep it more informal. I think that's fine. And we wanted to make it consider as opposed to create Is that right Half from yesterday in the sunset advisory commission getting rid of IGK We don't want to create more Okay, are you good? Yeah, okay next is um assessing and reporting on vulnerability is that legislators post to the state systems and I'm recommending some sort of periodic training for legislators on cyber security So I would like that to be an end goal That there is a recommendation on periodic training for legislators on cyber security So is that really a direction to the actually don't know what they're called now that they're in the The new legislative IT department to do this Who we would be asking to assess and report on the vulnerabilities Assess and he's already done that and it's a risk. So I think we should just Say that we recommend periodic legislative training on cyber security required Yeah required. Yes. Yes, recommend required Legislative yeah The periodic is sort of big But I'm not sure we need they are already assessing and reporting on And yeah, okay Uh, but one of the things Kevin said was that uh For privacy reasons couldn't really share any of the info. So do we need to come up with something that says If you're posing a risk to a system, you are no longer expecting a right of privacy um So that that can be specifically addressed So training to include procedures that legislative IT Takes to contain you Ensure system security. Yeah So maybe that's a question that I think Kevin has policies already on that. So maybe that's just a question of if he has that in his policies already um, and then if he does to and to Let legislators know that in the training. Yes And but for instance, he he talked about does he have the right to Say, you know, Sam Pearson, you've been a repeatedly bad actor. Your access is now Truncated and limited in some way. That's what he was asking us and he didn't feel that he had the authority now if I remember And so the quick is that sort of what you're getting at like We would need to set that up for ourselves And basically who does have that authority to pull the plug on the sitting legislator Does the pro tem and the speaker does the ethics committee have that respect? Does anybody have that right now? It could be in a rule. I could look in our rules to see if there's something that would be applicable Yeah, I think that would be helpful to know that. So could we just note that and say explore, you know explore policies to Figure out how to sell ourselves on the wrist Use your speaking spell You can have an anti sketch Yeah, I guess I'm just wondering what What is the the penalty that you're taking off of this system? So access or no access. Yeah, like they have no Ledge, I mean, I don't know So it's a question that you wouldn't be able to have like a legislative email address anymore I don't that wasn't what I heard it was more about what networks you were allowed on Well, I don't think we need to answer this the point is to have that conversation they need to Figure out we need to have a training and we need to have a protocol for You know handling Our internal risk behavior or something like that and I guess there's a quite the question that beckard raised is Is there anything in the rules right now? I don't know that there is That's something I can look into. Yeah The next is evaluating the need and costs for a legislative expert and this is similar to what Dan Smith does and this could either be an individual or a firm Um, that would provide some cyber security technical assistance to the legislature Yeah, because it's us You know, saying john's doing a good job At jeff, you know, I feel like it would be we technical assistance Last bullet is consider funding an innovation fund with an ads for the purpose of addressing one time cyber security upgrades or fixes so I've put this in here because I believe that most of ads I think all of your funding is built back, right? It's all like yeah like 0.001 percent. It's general fund right directly Right So that's hard for you to break proactive. Is that whatever? So it's hard to so we can see 200 case management systems out there But it's hard for us to build something in advance and say hey come here We have to wait till there's a project started and then try to build it into an enterprise solution As you know, things are trying to happen. Can we describe this right here with this? No We have not described it well. Is that what you said? No, I mean an innovation fund and One time security money is One time money Overall honestly really doesn't help me out that much because of the models that it has moved to they're all subscription based so whether we're buying an endpoint protection that's going to help desktop Stay secure those are yearly costs. Those aren't they're very few one-time costs We did that with the the hardware that we bought last year. There was baa money one one time baa money that worked But again, we're gonna we're going to come back into That five or six years from now. So what would we change this to create an annually? Do you want to focus on cyber security or innovation? I say I was gonna say consider funding an innovation fund within the agency of digital services for the purpose of um systems upgrades and So for Yeah So it's not tied to a specific system is upgraded would be that or would be Would the focus be on standards Modernization standards established by the agency of digital services that should be applied throughout state government With particular emphasis on cyber security And just specifically provide a fund for that purpose But somewhere it's separate But but somewhere I mean it's it's I would think would be standards driven What you're doing you're trying to do something that would apply as standard and here we talk about cyber security across state government and the problem that you have in implementing right now is You typically can't do anything unless a particular agency or organization is going to upgrade that particular system So it makes it very very difficult to apply something across the board. Is that Yeah, I think what you're saying. Yeah, I think I think you're right, you know, we have standards that are Um that we're going to be talking about with judiciary and the legislature in the next couple weeks We have a meeting set but in that are some goals really there's standards But we know that there's some of them that we don't make and there's money That are that's needed in order to get to that standard So that line of thinking yet we would use money to to fund us getting to that standard Right, you know the different technologies that are needed, but it's not none of they're not one time things That's the struggle There's nothing in your Creation statute that prohibits you from getting a budget line at them, right? Does that bother you I mean, I'm sympathetic to this and I The secretary works for the governor and the governor presents a budget so Where would this go like who would which committee would Yeah, we're just talking about money. Yeah, that's where it's so we want to look at also General fund appropriation Well, I think let's leave it here and let let let let this conversation I think it'll percolate out And but the with the changes that So one of the questions I have is That we started with um is who is this going to so There's a lot of talk of the committees of jurisdiction, but at this point it almost seems like it's a lot of the committees so it's you know appropriations Um energy and technology gov ops potentially economic developments I say institutions Uh, yeah education so is it Do you want to specify the committee still? Yeah, I think so and I think I'd like to try and Maybe break it up by committee Okay, does that make sense? I mean because right a separate one to different or just no, I think just within the mellow Okay So, you know separate active within the mellow which committees this this would be going to yeah Because people will then be able to see the other things and go wait a minute. That should have been with us Or not or thank god, it's well one thing is doing that will Make this longer I one thing I would love to do is to keep this no more than than two two pages Yeah To get to the point rather produce a long report that nobody's going to read I think we've pulled a couple things off of here. We've pulled Two and a half items off of here And we've had I think in the introduction We I guess we haven't specifically talked about what systems we've examined but My question is whether item three is is even necessary Because we don't know three. Yeah, we don't really say anything Well, that's because that's well, and I think Becky had said that that we may need to I think that was a Just a placeholder for right now and so the committee wants to add something I can I can add in more detail Uh, so I think that I would like to work with Maybe jfo on the integrated eligibility here on recommendations for integrated eligibility Going into the session like here are the items that we are watching going into the session Um I would like to Note Note that we have a tri branch working group Doing some cyber security Work So is that the same as the bullet above about formalizing A method for the the three branches to work together No, it's not, um I think we want to check in with the tri branch working group We recommend periodically checking in with them on any outstanding Or new cyber issues Neither of them are looking at me Kevin's not here Does that seem reasonable? Certainly report Okay, great and Then here in this this is where Becky I'm thinking Putting in Looking at And I don't know if this is the place but this is where I'd put it state level suite of secure services for municipalities We need to understand I think To what level maybe this is above and not the status of information To what extent bgs is offering this already Um Yeah, that was buildings and general sources procurement Oh And maybe we shouldn't limit ourselves because it might come from other places too So we have the list of Interactions, so who's providing Any Municipal Is this under IT projects? No, I don't think it is Okay, I think this is going to go up to the bullet So, um, consider Do you want to take a stab at it? Well, I it I'll take a non Specific wording status, but to me we want to understand what there is And explore if there are you know opportunities or we should we should think about opportunities So-called suite So of municipal IT services that would provide greater security to vermonters Data and and So it's an it's an explorer. It's understand the universe and explore Who is that? Is that gobs? Same reason I'm glad you agree Are there other IT project recommendations that we have Looked at here that we should be making I think I think the integrated eligibility is going to be significant. So What what's the timeline? I mean we all have bill drafting requests and stuff So what is your expectation of when we send this out? So we talked about committee bills Can be drafted till like March, right? Yeah So I think we have to check the deadline, but it's not in december What I would like to do is not meet in december But I would like to send this to committee chairs Before the session and then probably again once the session starts. So I'd like us to finalize it Um, if we need to do that virtually Is that okay? Sure. Yeah, so Becky So and working we need that. Uh, we'll need to work with jfo on that Um, and if there are any folks in the audience who have specific, um thoughts I'd like to share now Or So now would be easiest Um, yes Us which is why in particular would is the secretary of state included We um, it seems the agency of difficult services Entity that's most relevant for this issue, but you guys because elections you've got taxes As we discussed earlier you've got environmental conservation you've got all these other So your recommendation would be ADS and My recommendation was being led by ADS and and Whoever they feel they need to talk to amongst the other agencies So this is looking at that having having paying to have an assessment done So funding an assessment and the parameters of that assessment being set Yeah, by you Okay, yeah you and ADS jointly Yeah, I mean that and not the secretary of state. That's what you're saying. Well, it seems the secretary of state is just pulling out one particular element So So I am not Sure, if there are other aspects on here that have So secretary of state has their own cyber security They're responsible for the security of their systems. That's right work We work pretty closely with them. I'm sharing back and forth because They they traverse their network A lot of their systems Okay, so do you feel like this is Yeah, that was adding ADS would be fine. I mean because there's a treasurer's office. There's Secretary of State's office. There's multiple other So is that all going to be included if we have ADS and The lcj you can yeah, we'll make the recommendation and work with those other people Have them in yes, they decide to opt out. I don't have a lot of have a lot of say So I think my last question is that This bullet point on the third party assessment is I think the only other one that looks like it is like a direct Action that you're asking and it's on cyber security. So I mean it would take legislation to fund it. So should this go with the other bullet point on legislation? Yes Do you have any ballpark sense of what that type of an assessment does anybody have any ballpark sense of what that type of an assessment would be? Okay, Karen do you I don't We're doing a network assessment right now or we're growing up For bits on a network assessment right now. So depending on when those come back um, maybe it would give you An s now that would be to give you a number that would be the closest thing Okay, but it depends on how in depth if you're talking about particular systems or if you're talking about each application or having assessments done That's way different than having a perimeter assessment done. Okay, but probably millions of dollars based on the number of applications Pretty costly. Yeah kind of thing depending on how it's designed, which is why when lean towards the notion of best practices and means for self-assessment of The systems that took in this pally might have fits with good practices for for cyber security The eight the part of dhs that did some work for the state is that An organization that might be of help in in in in this issue in terms of an assessment um We can ask We were we were moved up on the prioritization list because of a few different reasons For that, but I think they have quite a lot of work right now. So i'm not i'm not sure but we can certainly ask them Yeah Well, that was free that saved us about 80 86 thousand for that perimeter assessment. Okay, does anybody else Here today want to offer any specific thoughts on the Okay, so becky what I would like to do is See when you think you can do a fresh draft of this by Then I'd like to set a time a day for when Any suggested edits are to you. Okay, and then Which will come through myself and senator brock as well And then have a final day that the committee will be able to look at this So if we are looking at do we have a calendar in here? We'll look at I'm gonna look on my phone Are you able to do that becky? Um, yeah, I can That's scheduling here now or is that something you need to send this out by I'm just thinking if I get it edited probably by Tuesday. Great Okay, so if you send that out by Tuesday Let's make sure that it goes to Jfo vlct Today Judiciary legislative And administrate AdS And Yeah, no, I think that's fine So it's coming out of the 19th You'll send it to us and to those folks And If we have all edits to you by the 22nd Would you be able to have a finalized before Thanksgiving? So that next week is Thanksgiving Um, I'm I'm not in the office. You're not in the office. Okay So uh, December 3rd Anybody want to flag any issues there before December 3rd? Okay, so December 3rd. We'll have a final and then we will get that out to the speaker the pro tab and Um, the committees all of the chairs Yeah, yes. Okay. Great. What exactly are we going to do on December 3rd just so we have the memo Becky will have Becky will have the last draft done Yes, great. Thank you, Becky. Um That's good. We have two other items. Um one really quickly. Um is uh committee scheduling during the session So I feel like we have to do the third session Okay, I will my preference will be to set out a doodle poll Of date and time and I'm guessing that mornings are going to get really competitive Yeah, I mean you're going to run into what we ran into last year. I don't know how We can do it any better than the two of you trying to figure it out. Okay, great fine And then there will be some days where the same misery that I mean And then the last item, um, I just want to make sure you all are aware we've had we have arranged for You got this Norwich actually Brought this forward Cyber security awareness training for officials and senior management this class is specifically intended for elected officials and others who have to provide oversight for cyber security It's a four-hour class being presented by FEMA Texas A&M number of others It's going to be offered to legislators and judiciary first Now there are two classes This is taking place on the 60th Yeah, so there'll be a morning class and an afternoon class Mike is going to receive and coordinate all of the rsvp's for this Judiciary I think may have up to 10 that go or you know, I've spoken to the speaker Some broccoli speak to the pro tab We're hoping to see a decent turnout from legislators And then we will be offering this to vlct For town town administrators or folks that are that have to make decisions The plan right now is to have mike send this out to all members on monday With the map this is at norwich that this is taking place And then an opening to judiciary on monday And then on wednesday Have vlct comments, so we'll work on the specific I will give you the specific words for the email So we'll have two days and our colleagues will have a couple of days to hold Head start Yeah Yeah, and let's make sure that they may be interested out for me but mike on monday until We've had an acknowledgement back from the pro tem because although the speaker has it and is aware of it the pro tem is not So you'll make him aware of that today Okay, great Um Any questions on this from anybody Good karen both planted a good tree there. Yes. Yes. The dame it might be tricky for me And I think it's a pretty good opportunity Especially for our colleagues to go I think it's I I personally have been fairly alarmed at what we don't know So Okay Yeah Okay, I think that's it. Thank you very much. So we started late and we're ending late