To: Sonoma County Board of Supervisors
Department or Agency Name(s): Information Systems
Staff Name and Phone Number: Steve Lindley, 565-8599
Vote Requirement: Majority
Supervisorial District(s): Countywide
Title:
Title
SIEM and 24/7 Cybersecurity Monitoring
End
Recommended Action:
Recommended action
Authorize the Information Systems Director to execute the Agreement with Blue Karma Security to implement 24/7 cybersecurity monitoring and response services, including the implementation and configuration of a Security Information and Event Management (SIEM) logging and alerting platform. The agreement will be for an initial three-year period from April 1, 2023, through March 30, 2026, for an annual not-to--exceed amount of $411,458.
end
Executive Summary:
The County of Sonoma is looking to improve its ability to better detect and more quickly respond to cybersecurity attacks against the County’s network and roughly 7,000 endpoints. The proposed agreement achieves this goal by implementing Security Operation Center (SOC) and Managed Detection and Response (MDR) services to actively monitor, detect, and immediately respond to cybersecurity attacks against the County 24 hours a day, 7 days a week, 365 days a year. The proposed agreement extends these same protections to County laptops when employees work remotely and to cloud technologies (i.e. Microsoft 365), which further supports the County’s telework initiatives.
Discussion:
ISD conducted a Request for Proposals (RFP) in 2022. Blue Karma is the successful supplier to be selected from this solicitation. The overall goal is to improve the County’s ability to better detect and respond to cybersecurity events. To achieve this goal, the County of Sonoma would like to implement Security Operations Centers (SOC) and Managed Detection and Response (MDR) services that will monitor the County’s network 24/7 for cybersecurity attacks, notify the County of any suspicious activity that is discovered, and take action to stop attacks while they are in progress. These services include a centralized logging platform, known as a Security Information and Event Management (SIEM), that will allow the County to reconstruct events and timelines of attacks, should an attack occur.
The United States Department of Homeland Security administers a Homeland Security Grant Program. The California Office of Emergency Services (CalOES) administers this grant on behalf of the State of California and its regional Operation Areas, as the State Homeland Security Grant Program (SHSGP). The Department of Emergency Management (DEM) administers the State Homeland Security Grant Program on behalf of the Sonoma County Operational Area. SHSGP funds are received annually for the Operational Area for the purchase of specialized equipment for fire, law enforcement, and public safety agencies and other local jurisdictional emergency management preparedness needs. Equipment purchased with SHSGP funding enhances the capabilities of local governments and stakeholder agencies to plan for and respond to large scale emergencies, disasters, and other hazardous events. DEM received the 2020 Homeland Security Grant Program (HSGP) Subaward #2020-0095 from CalOES on October 23, 2020. ISD was allocated $29,645 in funds from the FY2020 grant for Cybersecurity. The Department of Emergency Management received the 2021 Homeland Security Grant Program (HSGP) Subaward #2021-0081 from CalOES on October 27, 2021. ISD was allocated $100,000 in funds from the FY2021 grant for cybersecurity. The Department of Emergency Management has been working with ISD in close partnership to capture these grant funds under this solicitation.
Strategic Plan:
This item directly supports the County’s Five-year Strategic Plan and is aligned with the following pillar, goal, and objective.
Pillar: Organizational Excellence
Goal: Goal 2: Increase information sharing and transparency and improve County and community engagement
Objective: Objective 1: Safety Net departments will begin tracking data using results-based accountability (RBA) for key programs to establish common outcome measures, such as increased service access and utilization by communities of color, or decreased homelessness
Prior Board Actions:
NA
Fiscal Summary
|
Expenditures |
FY 22-23 Adopted |
FY23-24 Projected |
FY 24-25 Projected |
|
Budgeted Expenses |
$81,165 |
$411,458 |
$411,458 |
|
Additional Appropriation Requested |
|
|
|
|
Total Expenditures |
$81,165 |
$411,458 |
$411,458 |
|
Funding Sources |
|
|
|
|
General Fund/WA GF |
|
|
|
|
State/Federal |
$81,165 |
$48,480 |
|
|
Fees/Other |
|
|
$411,548 |
|
Use of Fund Balance |
|
$362,978 |
|
|
Contingencies |
|
|
|
|
Total Sources |
$81,165 |
$411,458 |
$411,458 |
Narrative Explanation of Fiscal Impacts:
Annual total, $411,458.00, to be paid with each extension as a lump sum payment. Federal Homeland Security Grant Funds will be utilized in year one to offset cost by $129,645. The balance of FY 23-24 costs will be funded through available Replacement Fund A fund balance sourced through Strategic Funds. In subsequent years, costs will be incorporated into the ISD’s baseline rates.
Narrative Explanation of Staffing Impacts (If Required):
None
Attachments:
Supplier Master Service Agreement
Exhibit A - Scope of Work
Exhibit B - FEMA Rider
Exhibit C - Insurance Requirements
Related Items “On File” with the Clerk of the Board:
None