IT Governance Discovery & Enagement Report

Lake County Public Library · Prepared by Cardinal Point Technologies

Engagement Leads

Grant Andres · Zak Konway

Discovery Period

December 1, 2025 – April 30, 2026

Prepared For

Carol Daumer Gutjahr, Library Director
John Brock, CFO

Document Status

DRAFT — Internal Working Document · Report Date: April 30, 2026

Confidential

Executive Summary

Over five months of active discovery across nine Lake County Public Library locations, Cardinal Point Technologies conducted a comprehensive IT Governance Needs Assessment following the departure of LCPL's IT Director. What the engagement revealed was an environment that had grown organically over many years — technically functional in many respects, but operating without documentation, without formal backup coverage, and with a significant number of systems that are either past end-of-life or approaching it. The institutional knowledge that held these systems together had walked out the door, and the risks that had been quietly accumulating were now fully exposed.

The environment as we found it is best characterized as a legacy-managed state: systems are running, staff are working, and services are being delivered — but the margin for error is narrow. Multiple hardware failures during the engagement period (Merlot-2 HDD, SAFE-2 degraded RAID, DNS outage) occurred in an environment with no backup safety net beneath them. Each was recoverable. A more severe or simultaneous failure may not have been.

🔴 Critical Risks

  • Server 2008 R2 / 2012 in production
  • On-prem Exchange / iMail past EOL
  • No confirmed backup strategy

🟠 High Risks

  • DNS single point of failure
  • No MFA on most systems
  • No formal security policies
  • Windows 10 EOL endpoints

🟡 Medium Risks

  • GPO replication not functioning
  • Network infrastructure EOL / unmanaged
  • Undocumented infrastructure

The recommended path forward is a phased, tiered modernization program executed under a structured vCIO engagement model. Tier 1 addresses the most urgent operational and security risks — backup, DNS, AD modernization, email migration, and network modernization — within the first ten months. Tier 2 builds the security and management layer on top of that foundation. Tier 3 delivers long-term operational maturity. The investment structure reflects the elevated engagement level of the current environment and scales as stability is achieved.

Confidential

1

About This Engagement

How We Got Here

In late 2025, the Lake County Public Library found itself at a critical juncture. The departure of the organization's IT Director left LCPL without strategic IT leadership, without documentation, and without a clear picture of the technology environment supporting nine locations across Lake County. The systems in place had grown organically over many years, and the institutional knowledge that held them together had walked out the door.

Cardinal Point Technologies was approached to step in as a virtual CIO — not simply as an outside advisor, but as an embedded strategic partner capable of understanding the environment, identifying the risks, and building a clear, fundable plan to modernize it. In November 2025, CPT and LCPL executed Service Order SO-LCPL-11042025-DISCOVERY, formalizing an IT Governance Needs Assessment. The engagement was subsequently extended through April 30, 2026, reflecting the complexity and scope of what we found.

Nine Discovery Workstreams

01

WS-01

Network & Infrastructure

02

WS-02

Servers & Active Directory

03

WS-03

Email & Collaboration

04

WS-04

Backup & Disaster Recovery

05

WS-05

Endpoint Management

06

WS-06

Security & Compliance

07

WS-07

Application & Service Catalog

08

WS-08

Staff Development & Knowledge Transfer

09

WS-09

DNS Architecture

Engagement Team

What This Report Provides

  • Current-state inventory and findings across all nine workstreams
  • Identification of unsupported, end-of-life, and undocumented systems
  • A prioritized IT roadmap with tiered recommendations
  • Hardware lifecycle plan aligned to realistic budget cycles
  • 3–5 year budget projection for IT investment
  • Recommended ongoing vCIO engagement model and formal service proposal

Confidential

2

What We Encountered Along the Way

The original discovery engagement was scoped as an assessment — a structured period of observation, data collection, and analysis. What we found was an environment that could not simply be observed from the outside. Critical systems were undocumented. Infrastructure that appeared to be functioning had silent failure modes. Staff were managing workarounds that masked underlying instability. CPT was regularly pulled from planned discovery workstreams to address active issues that surfaced during the assessment — issues that could not be deferred without operational risk to the library.

Completed During Engagement

Mail Server / HDD Failure (Merlot-2)

Hard drive failure diagnosed and resolved; mail continuity maintained

Website Migration & DNS Management

Website successfully migrated; DNS management transitioned

HVAC Access Issue — Merrillville

Credential and access issue resolved for facilities team

SMTP Infrastructure — Polaris & Book Scanner

Outbound mail relay stabilized for Polaris ILS and scanning systems

Degraded RAID — SAFE-2

RAID array degradation detected and addressed before data loss

DNS Outage — Emergency Response

April 9 outage resolved; root cause identified as SOA misconfiguration

🔄 In Progress at Time of Report

DNS Migration to Cloudflare (DNS-01)

Approved $6,450 · Signed April 16, 2026 · Actively in progress

EZProxy — Outage Response & Remediation

~4–6 hours remaining; informal approval from CFO

VPN / Firewall Cutover — ENA

~2–4 hours remaining; pending AT&T segment resolution

Backup / DR — Strategy & Implementation

Parts on order; Veeam/NAS hardware delivery expected July 2026

E-Rate FY2026 — Network Modernization

Vendor selected (Zayo); pending E-Rate award notification

iMail Backup Configuration

In progress; prerequisite to EMAIL-01 migration

Hardware — Server Cleanup & Consolidation

Active and ongoing through the engagement period

Software Compliance & Licensing Audit

Identified; scoping in progress

Confidential

3

Discovery Findings — Key Workstreams

The following summarizes critical findings from the highest-priority workstreams assessed during the discovery period. These are observations that directly inform the roadmap. Each workstream finding maps to one or more actionable roadmap items detailed in Section 5.

WS-03: Email & Collaboration

LCPL's email runs on on-premises IPSwitch iMail v12.5.5.115 with 205 active users. iMail is past end-of-vendor-support — no patches, no security updates. No Microsoft 365 tenant exists. The November 2025 Merlot-2 HDD failure was a near-miss: had the full RAID array failed, mail data would have been permanently unrecoverable. Proofpoint SPAM filtering is in place but cannot compensate for the underlying platform's EOL status.

Roadmap: EMAIL-01 — iMail → M365 Migration (Tier 1) · IMAIL-01 — iMail Backup (prerequisite)

WS-04: Backup & Disaster Recovery

At engagement start, no formal backup strategy existed for any LCPL system. No RPO or RTO targets had been defined. No disaster recovery plan had been documented. Two hardware failures during discovery — Merlot-2 HDD and SAFE-2 RAID degradation — both occurred without any data protection layer. Recovery was possible in both cases, but the margin was narrower than acceptable. CPT scoped a Veeam/Dell/NAS solution; hardware is on order with July 2026 delivery expected.

Roadmap: BACKUP-01 — Backup & DR Implementation (Tier 1 · In Progress)

WS-05: Endpoint Management

LCPL operates a mixed Windows 10 and Windows 11 environment across nine locations. Windows 10 reached end-of-support October 14, 2025 — a significant portion of the fleet receives no security patches. No standard workstation build exists. No centralized software deployment. No hardware lifecycle tracking. RMM coverage is currently partial; full endpoint inventory is pending deployment completion across all locations.

Roadmap: ENDPT-01 — Endpoint Standardization Program (Tier 2 · Requires AD-01)

WS-06: Security & Compliance

No formal IT security policies exist at LCPL. No acceptable use policy, no data handling policy, no incident response plan. MFA has not been deployed on most systems — a single compromised credential provides full domain access. CIPA compliance, required for E-Rate eligibility, has not been formally verified or documented. Symantec endpoint protection is confirmed in place. GPO replication failure means Group Policy security settings may not be applying consistently across the domain.

Roadmap: SEC-01 — MFA Rollout · SEC-02 — Security Policy Development · SEC-03 — CIPA Compliance

WS-08: Staff Development & Knowledge Transfer

LCPL's internal IT team consists of four Tier 1 staff and one individual with limited Tier 2 capability in legacy technologies. No formal role definitions, no cross-training program, and minimal documented procedures exist. The institutional knowledge previously held by the former IT Director was not transferred prior to departure. CPT's goal is to progressively build the internal team's capability to own more of day-to-day operations over time — cross-training is built into every CPT-led project as a requirement, not an afterthought.

Roadmap: STAFF-01 — Knowledge Base Establishment (Tier 1) · STAFF-02 — Structured Cross-Training (Tier 3)

WS-09: DNS Architecture

LCPL's DNS ran on a primary/secondary configuration (DONUTS1/DONUTS2). The April 9, 2026 outage revealed a critical flaw: the SOA expiry value was set to 3,600 seconds (one hour) — appropriate for test environments, not production. When DONUTS1 went offline due to a bad cable, DONUTS2 stopped serving DNS exactly one hour later as designed. Industry standard SOA expiry is 604,800–1,209,600 seconds (1–2 weeks). The root cause was a misconfiguration baked into the original setup and undetected until failure. DNS-01 migration to Cloudflare was approved April 16, 2026 at $6,450 (signed).

Roadmap: DNS-01 — Cloudflare Migration (Tier 1 · Approved · In Progress)

Confidential

4

IT Roadmap

Every project below flows directly from a specific finding in Section 4. The tier structure reflects the sequence in which initiatives should be executed to reduce risk systematically and build effectively on each other. DNS-01 and BACKUP-01 are the only projects with signed SOWs at time of report publication. All other project-based items will receive individual SOWs with detailed scope, timeline, and pricing prior to execution.

Tier 1 — Immediate (0–10 Months)
Tier 2 — Near-Term (10–24 Months)
Tier 3 — Strategic Enhancements (24–36 Months)

Confidential

5

vCIO Engagement Model & Deliverables

A virtual CIO engagement from Cardinal Point Technologies is not a help desk subscription or a break-fix contract. It is a strategic leadership relationship. CPT functions as LCPL's IT leadership layer — responsible for the direction of the technology environment, the integrity of the roadmap, the management of vendors and projects, and the progressive development of LCPL's internal IT capacity. For an organization the size of LCPL, a fractional CIO model provides access to senior-level IT strategy and execution expertise at a cost calibrated to what the library actually needs.

Strategic Planning & Roadmap Stewardship

  • Ownership and ongoing maintenance of the LCPL IT Roadmap
  • Annual roadmap review aligned to budget planning calendar
  • Technology trend monitoring for public library environments
  • Initiative prioritization updates as the environment evolves

Stakeholder Advisory & Governance

  • Monthly standing meetings with Library Director and CFO
  • Board-ready IT reporting on a quarterly basis
  • Budget planning support — capital and operational forecasting
  • Policy development and governance documentation

Vendor & Contract Management

  • Oversight of all IT vendor relationships (ENA/Zayo, AT&T, Comcast)
  • Contract review, renewal tracking, and negotiation support
  • E-Rate program continuity with AdTec and network vendor
  • New vendor evaluation as needed

IT Operations Oversight

  • Internal IT staff oversight and mentorship
  • Tier 2/3 escalation coverage beyond internal staff capability
  • Incident management and post-incident review
  • Change management coordination for significant modifications

Reporting & Accountability Cadence

1

Monthly IT Status Report

Delivered within first two weeks of following month. Open project status, incident summary, roadmap progress, vendor activity, upcoming decisions.

2

Quarterly Business Review

Formal meeting with Carol, John, and relevant stakeholders. Roadmap progress, budget actuals vs. forecast, strategic priorities, risk posture update.

3

Annual IT Report

Board-ready document summarizing year's IT activity, investments made, risks mitigated, and strategic plan for the year ahead. Supports annual budget cycle and board reporting.

Confidential

6

Hours Summary — Discovery Period

All data sourced directly from Syncro via per-ticket timer pull, current through April 17, 2026. September and October 2025 entries are pre-engagement timers logged prior to formal SO execution. The 241.62 hours invested represent the actual labor cost of the discovery engagement across the CPT team.

Engagement Totals by Technician

143.6h

Zak Konway

59.4% of total engagement hours

85.5h

Grant Andres

35.4% of total engagement hours

241.6h

Grand Total

Across all technicians and tickets

Monthly Distribution

Hours by Ticket

Confidential

7

Service Proposal

This section transitions the engagement from the discovery period into ongoing vCIO services and scoped project work. The proposal reflects the operational reality of the LCPL environment as understood after five months of active discovery. All project-based items are scoped and billed separately via individual SOWs presented for approval prior to execution.

Phase 1 — vCIO Retainer

$8,750 / month
Term: 8 months from engagement start
Total Commitment: $70,000

Phase 1 pricing reflects the elevated engagement level of an environment actively transitioning from no IT governance to a managed state. RAID failures, DNS outages, EZProxy failures, VPN cutovers — CPT direct involvement will be required alongside proactive roadmap execution throughout this period.

Phase 2 — vCIO Retainer

$7,200 / month
Term: Month-to-month following Phase 1
Annual Value: $86,400

After eight months, CPT expects the environment to reach a materially more stable baseline. Tier 1 projects complete. Staff operating documented procedures. Knowledge base established. Unplanned reactive work significantly reduced. Phase 2 pricing reflects that matured posture.

Project-Based Services — Current Estimates

Confidential

8

Agreement Terms & Acceptance

Proposal Details

Key Terms

Retainer Commencement

vCIO retainer commences on [DATE] and supersedes the discovery SO upon execution.

Payment Terms

Monthly retainer invoices due upon receipt. Project invoices: 50% at SOW execution, 50% upon completion.

Cancellation

Either party may terminate the retainer with 30 days written notice. Projects billed per individual SOW cancellation terms.

Annual Review

Rate and scope reviewed annually with 60 days written notice of proposed adjustments before anniversary date.

Limitation of Liability

CPT's liability is limited to the cost of remediation. Not liable for incidental, consequential, or punitive damages.

Client Acceptance

By signing below, the undersigned authorized representative of Lake County Public Library accepts the terms of this engagement proposal and authorizes Cardinal Point Technologies to proceed.

Signed By: Carol Daumer Gutjahr
Title: Library Director
Email: cdaumer@lcplin.org
Date: ___________________
MSA Number: [MSA NUMBER]


Accepted By: Cardinal Point Technologies
Prepared By: Grant Andres · Zak Konway
Contact: gandres@cardinalpoint.tech


This agreement, together with any applicable MSA, constitutes the full agreement between the parties. All services are performed on fully licensed, supported operating systems and hardware. LCPL is responsible for maintaining compliance with all software and hardware licensing requirements.

Confidential

9