REPORT TO COUNCIL
SUBJECT
Title
Reject All Proposals Received for the Virtual Chief Information Security Officer (F19-104)
Report
REPORT IN BRIEF
Approval is requested to reject all proposals received in response to Request for Proposals for Virtual Chief Information Security Officer (vCISO) Support based on proposals exceeding the available budget.
EXISTING POLICY
Section 2.08.140(b) of the Sunnyvale Municipal Code permits the City Council to reject bids or proposals received in response to formal competitive bid solicitations. This Code section also provides that if all proposals are rejected, the City has the discretion to re-advertise.
ENVIRONMENTAL REVIEW
The action being considered does not constitute a “project” within the meaning of the California Environmental Quality Act (“CEQA”) pursuant to CEQA Guidelines section 15378(a) as it has no potential for resulting in either a direct physical change in the environment, or a reasonably foreseeable indirect physical change in the environment.
BACKGROUND AND DISCUSSION
As part of the Fiscal Year 2018/19 budget, the Information Technology Department (ITD) increased the operating budget by $150,000 a year for contract services to provide a vCISO agreement. The vCISO agreement will consist of a team of consultants that will: provide extensive IT security experience to quickly deliver results; recommend policies and best practices; establish threat priorities and solutions; monitor and identify threats and risks; train staff on tactics; and ensure the City aligns with regulatory and required IT security standards.
A Request for Proposals (RFP) was issued on March 8, 2019. Three proposals were received. After the written proposals were evaluated by staff from the Information Technology Department, two proposers were invited to the interview: Hacking Solutions and CISOSHARE. After the interview and presentation, Hacking Solutions was unanimously selected as the superior solution for this support. Purchasing and ITD staff reviewed the cost proposal submitted by Hacking Solution in the amount of $2,612,356, and identified the scope as being too broad in addition to acknowledging that needs within the City’s current environment had changed. For market comparison, the cost proposal from CISOSHARE was evaluated and also determined to be substantially beyond the approved budget with a proposed scope that is too broad.
Staff decided not to negotiate with either proposer due to the substantial difference in anticipated scope and proposal fees that would meet the City’s need. Rejecting all proposals will allow staff to re-bid the project with a more defined scope of work and tailor it to the current City security infrastructure while anticipating keeping the project within the approved operating budget.
FISCAL IMPACT
There is no fiscal impact from rejecting the proposals. If proposal pricing remains high when staff rebids the project, a Budget Modification may be necessary, or staff may need to revisit the overall approach.
PUBLIC CONTACT
Public contact was made by posting the Council agenda on the City's official-notice bulletin board outside City Hall, at the Sunnyvale Senior Center, Community Center and Department of Public Safety; and by making the agenda and report available at the Sunnyvale Public Library, the Office of the City Clerk and on the City's website.
RECOMMENDATION
Recommendation
Reject all proposals received in response to Request for Proposals (RFP) F19-104 Virtual Chief Information Security Officer.
Staff
Prepared by: Gregory S. Card, Purchasing Officer
Reviewed by: Timothy J. Kirby, Director of Finance
Reviewed by: Kathleen Boutté Foster, Chief Information Officer
Reviewed by: Teri Silva, Assistant City Manager
Approved by: Kent Steffens, City Manager