The Office of Technology & Communications (OTC) briefed the Finance and Budget Committee on a summer digital-security incident, the city’s recovery and proposed 2026 technology spending that includes one-time and recurring cybersecurity investments.

OTC said the incident response required shutting down the city’s network to contain the threat, deploying national and state incident-response resources and resetting more than 3,000 employee accounts. OTC leaders credited prior investments — offline backups, endpoint detection and cloud platforms already in place — with enabling a faster recovery and said the Minnesota National Guard cyber protection team and federal partners supported city efforts.

“That decision, while disruptive, was the only way to fully contain the threat and prevent further spread,” the OTC presentation said. OTC also reported deploying advanced endpoint detection across workstations and servers and a structured check-in/check-out process for devices brought back onto the network.

Budget and investments: OTC requested $1,081,000 in new cybersecurity investments for 2026: a $700,000 one-time allocation and $381,000 in ongoing funding for enterprise digital-security tools, paid via a central services fund general-fund transfer according to the presentation. OTC also noted a $60,000 special-fund investment for a joint audit and planning effort on enterprise mobile-data management and proposed a one-FTE net reduction for 2026 as part of broader ongoing cuts.

Staffing and capacity concerns: OTC said it currently has about 10 unfilled positions and is down one FTE going into 2026 from prior years. OTC leadership described several critical vacancies in infrastructure, identity and access management, server/storage and service-management roles; the presentation argued those roles are essential for sustaining modernization and security work and that many operational tasks are being covered by a small number of staff working long hours.

OTC described a reorganization plan to shift toward a “demand-develop-service” model: demand teams gather business requirements, develop teams build and test solutions and service teams provide day-to-day support. OTC leaders said the service and infrastructure teams contain the majority of open FTEs and that delays in filling those roles slow modernization and prolong recovery timelines.

Modernization highlights: OTC said progress on modernization aided recovery — several departments already on cloud workforce and timekeeping platforms avoided paper-based reversion during the incident — and previewed planned work including a redesigned stpaul.gov, an enterprise reporting platform, Esri GIS addressing modernization and the newly launched Hey OTC service catalog and chatbot for staff support.

Council follow-up requests: Council members asked OTC to clarify funding sources for cybersecurity spending, especially the use of special funds and ARPA or other one-time sources versus ongoing central-service funding. OTC agreed to follow up with Office of Financial Services and to provide more detail on year-end spending projections related to the incident response.

What was not decided: The committee heard the briefing and asked follow-ups; there were no formal committee votes recorded during the presentation segment.

Ending note: OTC officials asked the council to prioritize filling critical, specialized roles and to consider recurring funding for security platforms because many security tools require ongoing support beyond a single-year purchase.