Non-Competitive Contract with Ernst & Young LLP for the Provision of an Integrated Risk Management Solution

An Integrated Risk Management solution will ensure that the Office of the Chief Information Security Officer can effectively address Council's direction in agenda item GL30.12 to report instances of non-compliance with cyber risk assessments and the City's Cybersecurity Confirmation Program in a timely and effective manner. The Integrated Risk Management solution is required to enhance cyber risk oversight, governance, and compliance across the City, its agencies and corporations. Due to the increase in complexity and frequency of cyber threats, building a robust Cyber Risk Assurance program that includes a comprehensive, Integrated Risk Management solution to manage cyber risk effectively and holistically is crucial. The Integrated Risk Management solution will create a culture of cyber security, and improve decision-making. Due to the time constraints of having these services begin immediately, a competitive procurement process cannot be conducted. The total potential amount of this engagement is $1,900,000 net of all taxes and charges, and the total potential cost is $1,933,440 net of Harmonized Sales Tax recoveries. City Council approval is required in accordance with Municipal Code Chapter 195- Purchasing, where the current request exceeds the Chief Procurement Officer's authority of the cumulative five-year commitment for each supplier, under Article 7, Section 195-7.3 (D) of the Purchasing By-Law or exceeds the threshold of $500,000 net of Harmonized Sales Tax allowed under staff authority as per the Toronto Municipal Code, Chapter 71- Financial Control, Section 71-11A.

2. City Council direct that the information in the confidential attachment remains confidential as it includes information relating to the security of City assets.