TO:
Honorable Mayor and Members of the City Council
THROUGH:
Bruce Moe, City Manager
FROM:
Terry Hackelman, Information Technology Director
Gwen Eng, Purchasing Manager
Tatyana Roujenova-Peltekova, Senior Management Analyst
SUBJECT:Title
Consideration of Waiving Formal Bid Requirements Pursuant to Manhattan Beach Municipal Code Section 2.36.150 and Adopting a Resolution Approving a Three-Year Agreement with Savant Solutions, Inc. for Managed Detection and Response Services and Managed Risk Security Services in the Amount of $205,041 (Information Technology Director Hackelman).
a) WAIVE FORMAL BIDDING
b) ADOPT RESOLUTION NO. 20-0134
Line
_________________________________________________________
Recommended Action
RECOMMENDATION:
Staff recommends that the City Council:
a) Waive formal bid requirements pursuant to Manhattan Beach Municipal Code (MBMC) Section 2.36.150 (cooperative purchasing); and
b) Adopt Resolution No. 20-0134 approving a three-year agreement with Savant Solutions, Inc. for Managed Detection and Response Services and Managed Risk Security Services with a total value of $205,041.
Body
FISCAL IMPLICATIONS:
The total three-year cost for Savant’s Arctic Wolf Managed Detection and Response Services and Managed Risk Security Services is $205,041. The year-one amount of $73,147 is included in the Information Technology Fiscal Year 2020-2021 budget; subsequent years’ funding will be provided in future budgets.
BACKGROUND:
Cybersecurity involves protecting systems, networks, applications, and data storage from digital attacks. Cyber attacks typically focus on accessing, changing, or destroying sensitive information to extort money, interrupt business operations, or to obtain data to be used for criminal purposes (i.e. identify theft, financial fraud, etc.). A successful cybersecurity model includes many layers of protection that addresses technology, people, and processes. As such, implementing effective cybersecurity measures is particularly challenging today.
Cybersecurity models and tools have evolved from basic monitoring, logging, scanning, and reporting to include sophisticated Monitored Detection and Response (MDR) service. The MDR vendors provide tools and expertise to improve the way that an agency goes about detecting threats, responding to incidents, and monitoring IT assets. This service model helps identify and block suspicious activity and proactively quarantines any affected devices. The MDR services ensure that the City’s IT infrastructure is monitored 24 hours a day to identify and prevent malicious attacks. In addition, the MDR services send alerts that allow the City to quickly respond when an attack is identified, and provide access to cybersecurity expertise to help the City mitigate the attacks.
Over the years, the City has implemented a cybersecurity program to reduce the possibility of unauthorized access by external entities to the City’s secured information. The City’s cybersecurity program includes staff training, annual vulnerability assessments, and a host of monitoring and scanning solutions. The implementation of the MDR services augments the existing cybersecurity efforts, and provide an additional layer of protection that aligns with industry best practices.
DISCUSSION:
Whenever practical and in the City’s best interest, the City “piggybacks” onto advantageous contracts issued by other public agencies. Piggybacking is the extension of pricing, terms, and conditions of one agency’s contract to other governmental agencies at the mutual consent of all parties. This is permissible under the City’s Municipal Code, Section 2.36.150.
In this case, Savant Solutions, Inc. has offered the City pricing from a September 2020, City of Poway, CA., contract. The City of Poway had competitively solicited proposals and received eight responses with annual pricing ranging from $23,000 to $154,952 (note that the lowest priced vendor did not meet specifications). After thorough analysis, the contract was awarded to Savant Solutions, Inc. for Arctic Wolf Managed Detection and Response and Managed Risk Services based on their experience, comprehensive solution, cost, and customer support.
The City of Poway IT infrastructure is similar in size and scope to the City of Manhattan Beach. The City of Poway is an early public sector adopter for using MDR services, and they have utilized this type of service for nearly three years. As a result, the City of Poway brings significant expertise regarding MDR solutions allowing them to run a comprehensive procurement and evaluation. The City of Manhattan Beach can take advantage and piggyback on Poway’s extensive MDR efforts providing the possibility for immediate MDR services implementation contingent on the City Council approval.
The proposed agreement is for three years of MDR services and it may be canceled by the City at any time without cause if necessary. The Savant Solutions scope of work includes the Arctic Wolf Managed Detection and Response and Managed Risk Services. Arctic Wolf is a leading cybersecurity service provider and is recognized by industry analysts such as Gartner and Forrester as one of the top vendors providing next-generation cybersecurity services.
One of the biggest benefits to the Savant/Arctic Wolf solution is the ability to manage both servers and end-user devices with on-premise sensors and client software. Arctic Wolf also provides a certified security team acting as an extension of the Information Technology staff and working together on threat and vulnerability management. Savant/Arctic Wolf currently provides similar services to numerous California municipalities and special districts, so they are familiar with municipal technology environments. The implementation of Savant MDR solution is of utmost importance in the cybersecurity effort that brings another layer of protection to the City network.
In conclusion, staff recommends that City Council: a) waive formal bid requirements pursuant to MBMC Section 2.36.150 (cooperative purchasing), and b) adopt Resolution No. 20-0134 approving a three-year agreement with Savant Solutions, Inc. for Managed Detection and Response and Managed Risk Security Services with a total value of $205,041. If the City Council approves the proposed contract, the services will be implemented within two months.
PUBLIC OUTREACH:
This bid was advertised on the City of Poway website as well as eBidBoard.com, a public bid notification board.
ENVIRONMENTAL REVIEW:
The City has reviewed the proposed activity for compliance with the California Environmental Quality Act (CEQA) and has determined that the activity is not a “Project” as defined under Section 15378 of the State CEQA Guidelines; therefore, pursuant to Section 15060(c)(3) of the State CEQA Guidelines the activity is not subject to CEQA. Thus, no environmental review is necessary.
LEGAL REVIEW
The City Attorney has approved the agreement as to form.
ATTACHMENTS:
1. Resolution No. 20-0134
2. Agreement - Savant Solutions, Inc.