Gig Harbor ITS review recommends governance framework, dedicated IT fund and co-managed cybersecurity

Gig Harbor officials heard an ITS staffing assessment on Jan. 29 that recommends an IT governance framework, a consolidated asset inventory, a possible dedicated IT fund, and a service-delivery review to determine what should remain in‑house or be co‑sourced.

City ITS Manager Logan Rosenstuhl said the assessment was commissioned before his arrival to establish whether the city was "right-sized" for IT needs. Consultants told the council Gig Harbor’s IT staffing (about three full-time equivalents at the time of the assessment) is near peers but that governance, asset tracking and cybersecurity posture should be strengthened.

"We're a glamorous team of one," Rosenstuhl said of current staffing constraints, adding that temporary help was expected and active recruitment for an infrastructure position would resume. Consultants recommended the city develop an IT governance framework to align investments with strategic goals, clarify authority for purchases and build a predictable funding model. They also advised creating an IT asset inventory and a multi-year replacement plan for devices and software.

Cybersecurity and staffing trade-offs: Rosenstuhl said an earlier penetration test produced satisfactory results but acknowledged that a small in‑house team has limits. He recommended augmenting internal tools and moving toward a co‑managed cybersecurity model to provide 24‑hour monitoring and rapid response. "It is nearly impossible for a team of two or three people to ingest the necessary information and data every day to stay on top of everything," he said.

Funding and structure: Consultants noted a mix of funding sources for IT (general fund and departmental contributions) and suggested the city consider a dedicated IT fund to centralize tracking and forecast long-term costs. The study identified options for recruitment and retention, including salary adjustments and professional-development support the city has recently undertaken.

Council members asked about the balance of in‑house work and outsourcing, and how many staff are needed for cybersecurity. Consultants and Rosenstuhl said many peer cities use some co‑sourcing for cybersecurity tools and monitoring; the council asked staff to continue recruitment and to return with cost implications for any structural changes or new staffing.