The security vulnerability review was a budgeted item in the 2015 plan, as requested by A&F at its November 2014 meeting.  This is at Minute 9, pp. 7-10; the amount A&F suggested for the budget was $10-30K, and $20K was used as an estimate in the 2015 budget.  This was also reported to the Board in the January 2015 A&F Report (Document #14) near the bottom of the first page.

The contract was signed after being reviewed and approved by counsel.  The amount for the vulnerability assessment is $12K, with an option for a second phase, a review of our operations and best practices with recommendations, of about the same magnitude.  Meetings have already begun, and the vulnerability assessment will begin Friday and continue into next week.