City IT outlines vendor review process, data-service addendum and AI safeguards

City IT presented a centralized review process for all hardware and software requests and described contractual protections intended to keep city data under local control.

"This process helps departments get the tools that they need while also protecting, city systems, data, staff, and public resources," IT Director Juan Olmeda told the committee. Olmeda explained the process begins with an IT portal for requests, moves the request to a multi-disciplinary review committee (IT, cybersecurity, procurement, legal and PMO for large enterprise systems), and then proceeds to procurement and implementation if approved.

Staff described components of the vendor review: a minimum-technical-requirements screen, a technical-security questionnaire, a new AI-focused section to inventory and evaluate AI components, and checks for FedRAMP/GovRAMP or SOC 2 evidence. The data services addendum, staff said, explicitly states that "the City owns this data," restricts sale or licensing and limits hosting to the United States; it also requires a 24-hour vendor breach notice and 90-day exit access for data retrieval and secure scrub by the vendor.

Committee members pressed staff about whether earlier concerns with Flock equipment and data-sharing were specific to Bend; staff said they were not aware of a Flock data-sharing incident in Bend’s contract and said a vendor breach would be a contract violation subject to termination. Staff agreed to review contract language to add clearer notification and response expectations if a government entity seeks vendor-held city data.