Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the It Metrics topic
No spam. Unsubscribe anytime.
Commission frames annual IT report around industry metrics; staff cautions against public penetration-test details
Summary
The commission reviewed the planned annual report and agreed to include ITIL-aligned performance metrics. Staff warned that details from cybersecurity penetration testing are sensitive and recommended consulting the town manager's office about public disclosure, with the possibility of a closed-session briefing.
Commissioners reviewed an outline of the Technology and Communications Commission's annual report and identified a set of IT performance metrics to present to council. Staff recommended using industry-aligned metrics rather than raw ticket counts, and commissioners agreed to include those measures in the report.
Scott, a town IT staff member, said the department has revised metrics to align with ITIL standards and that 2025 data are available for the new measures. "The key metrics for IT is first contact resolution rate, mean time to resolve, the weighted service availability, our critical vulnerability remediation time, phishing test success rate, and the normalized intrusion attempts that we had," Scott said. Staff said these will be tracked year over year.
Commissioners also discussed whether to publicly mention a recent cybersecurity penetration test. Scott advised caution: "Generally, we don't want to put that in public sessions," he said, noting the potential security implications and suggesting the commission double-check with the town manager's office about whether to include the item or provide a closed-session briefing. Amanda suggested indicating that the commission had been briefed but placing technical details in closed session if necessary. The commission asked staff to confirm the town's preferred approach and to draft the public language accordingly.
The commission also discussed presenting examples of managed-services metrics (phishing attempts blocked, intrusion attempts, response times) to show the value of existing tools and contracts without disclosing operational details that could be exploited.
