Board weighs $1.2M staff-augmentation and monitoring contracts after cybersecurity questions

The Santa Fe Public Schools Board on June 11 discussed two IT contracts the district had placed on the consent agenda, with trustees raising questions about outsourcing, contingency costs and vendor accountability.

Deputy Holiday introduced Patricia Nordby, the district's executive director of technology, to explain contract number 262789522-1, described in board materials as a staff-augmentation agreement. Nordby said the agreement covers "network senior engineer, network engineer, network administrator, security analyst, project support technician" and summer interns, and she confirmed the contract figure is "not to exceed 1.2."

Board member Blair pressed for clarity on how the two IT Connect agreements relate, asking whether the district already pays for full-time FTEs and why specialized roles are outsourced. Nordby replied the district does have FTEs but cannot match private-sector wages for specialized skills, and that the augmented staff are directed and managed by district leadership.

Blair said he was concerned about outsourcing key security functions, noting combined contract costs "to almost one and a half million dollars" and the problem of vendor responsiveness in a major cybersecurity incident. Blair described a prior ransomware recovery experience and said the vendors "were crickets. They washed their hands as quickly as they could because they didn't want to get caught up in any liability issues." The board member said the experience motivates a longer-term goal of hiring a full-time CISO and reducing reliance on contractors.

Nordby sought to reassure the board that contractors are integrated into the district's team: "the contracted staff become part of the Santa Fe Public Schools Network Security Team," she said, and noted that several former contractors (13 staff members) have transitioned to district employment over time. She also described the monitoring contract as providing continuous remote security monitoring, firewall management and on-call support, and cited an Amy Biehl outage that required more than 20 hours of vendor work to resolve.

Board members requested historical context on contractor-to-employee conversions and suggested tracking a multi-year plan to bring more IT functions in-house where feasible. After discussion the board approved the consent agenda, including the IT contracts that had been pulled for review.

What happened next: The consent agenda, with the IT items discussed, was approved by voice vote. Board members asked staff to return with more detail in a future meeting on staffing history and paths to reduce dependence on outside contractors.