REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
January 23, 2024
FROM
SHANNON D. DICUS, Sheriff/Coroner/Public Administrator
SUBJECT
Title
Agreements for Cybersecurity Software and Professional Services
End
RECOMMENDATION(S)
Recommendation
1. Approve Subscription Services Agreement, including non-standard terms, with Varonis Systems, Inc., for data auditing, classification, and protection software, to accompany future purchases for periods as specified in relevant purchase requests.
2. Approve Master Services Agreement, including non-standard terms and incorporated Statement of Work, with Lodestone Security, LLC, for technical security testing and cybersecurity consulting services in a total amount not to exceed $45,000 for the one-year period effective January 24, 2024 through January 23, 2025.
3. Authorize the Purchasing Agent to issue a non-competitive Purchase Order to Nth Generation Computing, Inc., a value-added reseller, for Varonis software, installation, licenses, and subscription services, under the Subscription Services Agreement in Recommendation No. 1, in a total aggregate amount not to exceed $1,802,900 for the three-year period effective upon the live operation of the software, estimated to be February 2024.
4. Authorize the Purchasing Agent to execute change orders to the Purchase Order with Nth Generation Computing, Inc., a value-added reseller, as specified in Recommendation No. 3, so long as the total aggregate amount of such change orders does not exceed $180,290 (10%), and the change orders do not amend the Purchase Order term.
(Presenter: Ernie Perez, Deputy Chief, 387-3760)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Operate in a Fiscally-Responsible and Business-Like Manner.
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item may result in a future request for additional ongoing Discretionary General Funding (Net County Cost). The Sheriff/Coroner/Public Administrator (Department) is not requesting additional Discretionary General Funding at this time; however, a request for additional Proposition 172 or Discretionary General Funding will be included in a future budget report, if necessary.
BACKGROUND INFORMATION
The Department’s Technical Services Division (TSD) is responsible for all computer-related technology, data, and communications systems within the Department and provides direct end-user support, ongoing maintenance, enhancements, and upgrades to departmental systems through four working groups: System Support/Development, Operations Infrastructure, Service Desk, and Administration. Advancements to law enforcement technology require that TSD continually enhance current systems to help improve investigative capabilities, protect information, provide secure data storage, and have timely access to accurate information.
In April 2023, the Department encountered a disruption in network connectivity resulting in service interruptions to software and infrastructure systems. As the Department is legally mandated to protect private health information and personally identifiable information, the software and services noted in the Recommendations will be utilized to enhance the Department’s cybersecurity and reduce network vulnerabilities.
Varonis Systems, Inc.’s (Varonis) software will be used by TSD to assist with security, auditing, reporting, and identification of stored data, while also providing security recommendations based on inconsistent access permissions, overexposed sensitive and classified data, and at-risk information. The Subscription Services Agreement (SSA) with Varonis is the standard commercial agreement, which includes terms that differ from the standard County contract as follows:
1. Varonis may assign the SSA without notice and without the County’s approval to any of its affiliates and/or subsidiaries and/or as part of reorganization, merger, acquisition or other similar change of contract transaction.
• The County standard contract requires the County to approve any assignment of the contract.
• Potential Impact: Varonis could assign the SSA to a third party or business with which the County is legally prohibited from doing business due to issues of Federal debarment or suspension and conflict of interest, without the County’s knowledge. Should this occur, the County would be out of compliance with the law until it becomes aware of the assignment and terminates the SSA.
2. Varonis’ maximum liability to the County under the SSA is limited to the fees received by Varonis for the subscription services during the 12-month period before the event that gave rise to the claim, excluding Varonis’ gross negligence, willful misconduct, or fraud, and claims that arise out of Varonis’ indemnification obligations.
• The County standard contract does not permit the contractor to limit its liability in the performance of a contract.
• Potential Impact: Claims could exceed the liability cap and the SSA amount leaving the County financially liable for the excess.
3. The term of the SSA is indefinite beginning on January 24, 2024, and continuing for the periods specified in relevant purchase confirmations.
• County Policy 11-06SP does not permit indefinite or automatically renewing terms unless approved by the Board of Supervisors (Board).
• Potential Impact: There is no end term to the SSA and the County is indefinitely bound to the terms and conditions of the SSA until all purchase confirmations expire or until terminated by either party due to material breach of the SSA and a failure to cure such breach within a 30-day notice period.
4. The County may not terminate the SSA for convenience.
• The County standard contract reserves the right to terminate the contract for convenience with 30 days’ notice.
• Potential Impact: The County may only terminate the SSA for cause in the event of an uncured material breach by Varonis. Any attempted termination by the County without cause may result in payment liability for the full SSA amount, where no funds are available due to lack of allocation or loss of funding.
Additionally, TSD will utilize Lodestone Security, LLC’s (Lodestone) professional services as a cybersecurity expert to conduct technical security testing and provide consultation for the purposes of strengthening the Department’s network infrastructure and enhancing the Department’s digital defense against cybersecurity threats and incidents through offensive security. The Master Services Agreement (MSA), including non-standard terms and incorporated Statement of Work, is Lodestone’s standard agreement and includes terms that differ from the standard County contract as follows:
1. Payment terms are Net 45 with late payment interest accruing thereafter at the lesser of 1.5% per month or the highest lawful rate.
• County standard payment terms are Net 60 days with no interest or late payment penalties.
• Potential Impact: County standard invoice processing time is 60 days or more. Failure to pay within 45 days of an invoice may result in a material breach of the MSA and allow Lodestone to terminate the MSA and seek additional legal remedies including, but not limited to, charging the County additional interest and the costs of collections and attorney fees, which may exceed the MSA amount.
2. In the event of a dispute, the MSA requires that the County waive its right to a jury trial, and states that the prevailing party in the dispute shall be entitled to recover reasonable attorney fees and costs.
• The County standard contract requires that the parties use their best efforts to settle a dispute through negotiation and that neither party shall be responsible for the other party’s attorney fees and costs, except for indemnity obligations.
• Potential Impact: The County may be required to pay Lodestone’s reasonable attorney fees and costs in a legal action, while waiving its right to litigation via a jury trial.
While these are notable exceptions to the County standard contract language, the Department recommends approval of this Item to allow TSD to properly support, maintain, and report on sensitive information stored on Department platforms, as well as enhance the Department’s digital defense against cybersecurity threats and incidents. County Counsel and Risk Management have provided input on the proposed agreements with Varonis and Lodestone.
PROCUREMENT
To ensure legal mandates and compliance regulations are met in an expeditious manner, along with the need for immediate and continual testing of network vulnerabilities due to the Department’s April 2023 network connectivity disruption, the Department recommends the non-competitive procurement of Varonis software through Nth Generation, a value-added reseller and part of Varonis’ partner community. Nth Generation offers skilled and experienced staff in the installation of Varonis software and requires no exceptions to the County’s legal requirements. Varonis software offers specialized security, auditing, reporting, and identification of stored data features, which makes Varonis the industry leader in cybersecurity protection software. Lodestone provides professional services as a global cybersecurity firm with specialized expertise in incident response, digital forensics, offensive security, risk management, threat detection, and breach response.
Purchasing concurs that a non-competitive justification exists and supports this procurement to secure specialized cybersecurity detection software and services to protect the Department’s digital infrastructure from future intrusions.
County Policy 11-04, Procurement of Goods and Supplies, Equipment and Services requires the Department to seek Board approval for non-competitive purchases of equipment and services in excess of $200,000 annually. Additionally, County Policy 11-05 requires departments to obtain approval from the Board for the procurement of goods and services with non-standard terms and conditions.
The SSA and MSA as noted in Recommendation No. 1, including non-standard terms, will be used to accompany future Purchase Orders in accordance with County Policy 11-04.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Richard D. Luczak, Deputy County Counsel, 387-5455) on January 4, 2024; Purchasing (Michael Candelaria, Lead Buyer, 387-0321) on January 10, 2024; Innovation and Technology (Robert Pittman, Chief Information Security Officer, 388-5501) on January 11, 2024; Risk Management (Gregory Ustaszewski, Staff Analyst, 386-9008) on December 28, 2023; Finance (Erika Rodarte, Administrative Analyst, 387-4919) on January 4, 2024; and County Finance and Administration (Robert Saldana, Deputy Executive Officer, 387-5423) on January 4, 2024.