REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
February 11, 2025
FROM
SHANNON D. DICUS, Sheriff/Coroner/Public Administrator
SUBJECT
Title
Agreement with Imprivata, Inc. for Single Sign-On Authentication Management Software and Self-Service Password Management Software
End
RECOMMENDATION(S)
Recommendation
Approve Agreement with Imprivata, Inc., including non-standard terms, for the use of its Single Sign-On Authentication Management Software and Self-Service Password Management Software, in a total aggregate amount of $598,060, commencing upon delivery and installation of the software and continuing for a period of three years.
(Presenter: Kelly Welty, Chief Deputy Director, 387-3760)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Operate in a Fiscally-Responsible and Business-Like Manner.
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item may result in a future request for additional ongoing Discretionary General Funding (Net County Cost). The Sheriff/Coroner/Public Administrator (Department) is not requesting additional Discretionary General Funding at this time; however, a request for additional funding may be included in a future budget report, if necessary.
BACKGROUND INFORMATION
The Department’s Technical Services Division (TSD) is responsible for all computer-related technology, data, and communications systems within the Department and provides direct end-user support, ongoing maintenance, enhancements, and upgrades to departmental systems. As a law enforcement agency, the Department is required by the Federal Bureau of Investigation (FBI) and the California Department of Justice (CA-DOJ) to authenticate users that need to access shared law enforcement networks and databases such as the Criminal Justice Information Services (CJIS) and the California Law Enforcement Telecommunications System (CLETS) across different platforms and devices. To maintain CJIS compliance, a Multifactor Authentication (MFA) system is required to be implemented across all systems and applications by agencies accessing CJIS. The goal of MFA is to prevent data breaches and ensure information is only being accessed by individuals who are authorized to view it.
These systems are crucial tools for any law enforcement agency to carry out its public safety duties. TSD continually enhances the Department’s systems to help meet the requirements mentioned above to improve investigative capabilities, protect information, provide secure data storage and timely access to accurate information.
Approval of the Agreement with Imprivata, Inc. (Imprivata) for Single Sign On/Authentication Management (SSO/AM) software and Self-Service Password Management Software (SSPW) will enable the Department to facilitate MFA verification to secure logins for its staff members when accessing CJIS related data networks.
The Agreement is based on the County standard IT contract template. Imprivata would not agree to all County standard terms. The non-standard and missing terms include the following:
1. The County is required to indemnify Imprivata against claims arising from all of the following: (1) the County’s violation of US export restriction laws and regulations relating to sales to nationals or residents of foreign nations; (2) designs, specifications or modifications originated or requested by County; (3) the combination of the software or any part thereof with other equipment, software or products not supplied by Imprivata if such infringement or misappropriation would not have occurred but for such combination; (4) County’s failure to install an update, where same would have avoided such claim; (5) County’s failure to comply with all applicable biometric and privacy laws, rules, regulations, orders, and County’s policies with respect to the collection, handling, and processing of employee and/or contractor biometric and personal information, including obtaining required consent(s) by all employees and/or contractors utilizing the software; (6) County’s failure to comply with applicable export and import regulations, including securing any necessary export or import license(s), obtaining local customs clearance and paying all duties, taxes and other charges.
• The County standard contract does not include any indemnification or defense by the County of a contractor.
• Potential Impact: By agreeing to indemnify Imprivata, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time limited, or expense limited could be brought against Imprivata without such limitations and the County could be responsible to defend and reimburse Imprivata for costs, expenses, and damages, which could exceed the total Agreement amount.
2. Imprivata’s maximum liability to the County is limited to the fees paid and payable by the County during the prior 12-month period, excluding damages for personal injury.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the Agreement amount leaving the County financially liable for the excess.
3. Payment terms are Net 30 from date of invoice. Late payments are subject to a charge of the lesser of 1.5% per month or the maximum allowed by law during such time as any payment is late as well as collection costs, including reasonable collection and attorney’s fees.
• County standard payment terms are Net 60 days with no interest or late payment penalties.
• Potential Impact: Failing to pay within 30 days of invoice date may result in a material breach of the Agreement, which could allow Imprivata to terminate the Agreement and seek other legal remedies, including charging the County interest at a rate of 1.5% per month, costs of collection and full payment of any contract amount through the end of the term, which could exceed the Agreement amount.
4. There is no termination for convenience without penalty. Upon any termination, the County is required to pay all amounts due and to become due under the Quote, and the County agrees to a non-cancelable payment obligation and non-refundable fees.
• The County standard contract gives the County the right to terminate the contract, for any reason, with a 30-day written notice of termination without any obligation other than to pay amounts for services rendered and expenses reasonably incurred prior to the effective date of termination.
• Potential Impact: Upon any termination by either party regardless of cause, the County is required to pay to full contract amount, which could result in payment liability where no funds are available due to lack of allocation or loss of funding.
5. There is no stated venue in the Agreement.
• County Policy 11-05 requires venue for disputes in Superior Court of California, County of San Bernardino, San Bernardino District.
• Potential Impact: Imprivata is located in Middlesex County, Massachusetts. Having no express venue in the Agreement means that Middlesex County, Massachusetts venue could be applied to disputes arising under this Agreement, which may result in additional expenses that exceed the amount of the Agreement.
While these are notable exceptions to County standard contract language, the Department recommends approval of this Agreement, including non-standard terms, to allow TSD to properly deploy, support, maintain, and report on sensitive information stored on Department platforms, as well as enhance the Department’s digital defense against cybersecurity threats and incidents. County Counsel and Risk Management have provided input on the proposed agreement with Imprivata.
PROCUREMENT
The Purchasing Department concurs that a non-competitive justification exists and supports this procurement to acquire a MFA software and services to secure the Department’s computer workstation logins, due to timing constraints to complete a Request for Proposal (RFP) and perform a Department-wide implementation of a MFA software to meet the United States Department of Justice, system security requirements to be in place by April 2025 in all the Department’s workstations.
County Policy 11-04, Procurement of Goods and Supplies, Equipment and Services requires the Department to seek Board approval for non-competitive purchases of equipment and services in excess of $200,000 annually. Additionally, County Policy 11-05 requires departments to obtain approval from the Board for the procurement of goods and services with non-standard terms and conditions.
The SSO/AM and SSPW as noted in Recommendation No. 1, including non-standard terms, will be used to accompany future Purchase Orders in accordance with County Policy 11-04.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455) on February 3, 2025; Purchasing (Jason Cloninger, Lead Buyer, 387-0321) on January 31, 2025; Risk Management (Gregory Ustaszewski, Staff Analyst, 396-9008) on January 31, 2025; Finance (Erika Rodarte, Administrative Analyst, 387-4919) on February 3, 2025; and County Finance and Administration (Valerie Clay, Deputy Executive Officer, 387-5423) on February 3, 2025.