Waukesha IT Board approves MSA with TDI Vertical for SIEM monitoring, authorizes 50‑hour prepaid block

The Waukesha City IT Board unanimously approved a master services agreement and accompanying statement of work with vendor TDI Vertical on Jan. 7 to provide managed monitoring for the city’s Azure Sentinel security‑information‑and‑event‑management (SIEM) environment.

Chris, an IT staff member who presented the item, said TDI Vertical — a firm formed in part by former staff from a company called Netrix — would monitor alerts from the city’s SIEM and create tickets in the vendor’s SOC system so analysts can determine whether further investigation or threat‑hunting is required. He said the arrangement is intended to provide coverage while the city backfills a senior systems engineer vacancy.

Key contract features discussed included a prepaid 50‑hour block of time under a time‑and‑materials arrangement, a 30‑day cancellation clause with refund of unused prepaid hours, and the SOW’s clarification that it governs the operational work and references the MSA. Chris said the agreement had been redlined by the city attorney (Brian Running) and that the vendor accepted many of those changes.

Board members raised several operational and legal questions: how tickets are generated, whether the vendor actively watches dashboards or only responds to incidents, whether mitigation actions require city authorization, and billing increments (the SOW listed one‑hour billing increments). A committee member expressed concern about Section 5 of the MSA in a pre‑redline version, saying it appeared to give broad install and liability language; Chris replied that the SOW contains language that can override the MSA and that Brian had corrected many items in redline.

Chris said he would fund initial work from existing consulting/professional‑services budget (he cited an available consulting budget of about $30,000 annually) and that vacancy savings from the unfilled position would help offset ongoing costs. Board members asked staff to seek clarification from the vendor about billing increments and to pursue filters so low‑severity alerts do not consume prepaid hours unnecessarily.

Board action: Mr. Hansen moved to approve the TDI Vertical master services agreement and cybersecurity scope of work and to authorize the IT director to execute purchase orders for additional services as provided in the SOW; Mr. Brooders seconded. The motion passed on a unanimous roll call.

Next steps: staff will finalize the contract language for council review and confirm operational details with TDI Vertical (billing increments, ticket creation, and mitigation authorities). Chris said the city will start with time‑and‑material coverage drawn from a 50‑hour prepaid block and will reassess when the IT position is filled.