Summary#
Montréal city council unanimously adopted an orientation to endorse a three-year, direct-award contract with Levio Conseils inc. for phishing-test services under the project Modernisation des services de cybersécurité. The agglomeration council makes the final decision at a later meeting. City staff say the campaign aims to raise municipal employees’ cybersecurity awareness.
- The contract covers designing phishing-test scenarios, running the tests and compiling results.
- The city’s orientation would authorize the director of Cybersecurity to sign documents related to the contract and charge the expense according to the file’s financial information.
- Levio had already received the contract, and a purchase order had been issued for the first year, from August 4 to December 31, 2025. The full contract is for three years.
- The city sought prices from at least two Quebec suppliers. Levio submitted the only compliant bid; In Fidem did not submit a bid.
What it means for you#
- Municipal employees: The tests are part of a campaign conducted among city staff. City staff say the services will measure employees’ ability to detect phishing attempts and help identify risky behaviours.
- Residents, businesses and service users: City staff say the campaign is limited to municipal employees and will not interrupt services. The decision does not directly change public services or impose a new duty on residents or businesses.
Money#
The contract costs $129,346.88, taxes included ($118,110.94 net of tax rebates).
- The city will charge the expense to the operating budget of the Service des technologies de l’information (Information Technology Department). The cost is allocated through the rate for general administrative expenses shared with the agglomeration.
- The listed annual amounts, taxes included, are $41,678.44 for 2025, $43,115.63 for 2026 and $44,552.81 for 2027.
What is unclear#
- The materials do not specify the exact dates covered by the full three-year term beyond the first-year purchase order.
- No publicly available information on the expected number or frequency of tests, or how employees will be told about or assessed through them.
Case for#
- City staff say the tests are intended to help measure employees’ ability to spot phishing and strengthen human and technical controls.
- The city received one compliant bid after seeking prices from at least two suppliers; the other supplier chose not to bid.
Case against#
- Only one compliant bid was received, so the materials provide no comparison with another supplier’s price or offer.
- The materials do not describe how test results will be used or what safeguards will apply to employee information.