|
Agenda Item
ASR
Control 19-000819 |
||
|
MEETING DATE: |
08/27/19 |
|
|
legal entity taking action: |
Board of Supervisors |
|
|
board of supervisors
district(s): |
2 |
|
|
SUBMITTING
Agency/Department: |
John Wayne Airport
(Approved) |
|
|
Department contact
person(s): |
Barry A. Rondinella (949) 252-5183 |
|
|
|
Scott Hagen (949) 252-5241 |
|
Subject: Approve Contract for Managed
Security Services
|
ceo CONCUR |
|
Clerk of the Board |
||||||||
|
Concur |
Approved Agreement to Form |
Discussion |
||||||||
|
|
|
3 Votes Board Majority |
||||||||
|
|
|
|
||||||||
|
Budgeted: Yes |
Current Year Cost:
$379,500 |
Annual Cost:
FY 2020-21 $301,350 |
||||||||
|
|
|
|
||||||||
|
Staffing Impact: |
No |
# of Positions:
|
Sole Source:
No |
|||||||
|
Current Fiscal Year Revenue: N/A
|
||||||||||
|
Prior Board Action: N/A
|
||||||||||
RECOMMENDED ACTION(S):
|
1. |
Authorize the County Procurement Officer or authorized Deputy to execute the Contract with Mosaic451, LLC for managed security services, effective September 1, 2019, through August 31, 2022, in an amount not to exceed $943,225, renewable for two additional one-year periods. |
|
2. |
Authorize the County Procurement Officer or authorized Deputy to approve Amendment Number One to extend an interim Contract with NTT Security (US) Inc. through December 31, 2019, in an amount not to exceed $100,000, for a new total contract amount not to exceed $150,000. |
|
3. |
Pursuant to Contract Policy Manual Section 3.3-113, authorize the County Procurement Officer or authorized Deputy to exercise a contingency contract cost increase, not to exceed a total of 10 percent of the contract amount, as identified in Recommended Action #1 above, for the first year of the contract, for the entire term of the Contract, including renewals, and within the scope of work set forth in the contract. The use of this contingency contract cost increase is subject to approval requirements established by the County Procurement Officer. |
SUMMARY:
Approving and executing a contract with Mosaic451, LLC and approving an extension of the contract with NTT Security (US) Inc. will provide critical network security services for the John Wayne Airport Information Technology Network.
BACKGROUND INFORMATION:
The proposed Contract will provide John Wayne Airport (JWA) with state-of-the-art Information Technology (IT) security monitoring for JWA’s information systems on a 24 hours a day, seven days a week, 365 days per year basis. Protecting and maintaining the security of JWA’s information systems from nefarious activity requires continuous active monitoring and highly specialized expertise.
Mosaic451, LLC (Mosaic) has a fully-staffed, domestically located, Security Operations Center (SOC). Through its SOC, Mosaic will provide the following security services for JWA’s IT systems: intrusion detection, firewall log archival, monitoring, recovery services and emergency response services with forensic support.
In November 2018, JWA began initial discussions with Orange County Information Technology (OCIT) regarding Managed Services for the JWA network. This strategic direction will determine the term of this proposed contract.
OCIT established the County’s 24 hours a day, seven days a week, 365 days per year SOC in March of 2019. The current JWA network core will need to be refreshed before JWA can take advantage of the SOC. The network design of the refresh is nearing completion. As the network refresh phases are completed, staff plans on moving the upgraded services under OCIT-managed network services, which will include complete network security monitoring from the County’s SOC.
In response to OCIT’s requirement for updated network hardware, JWA initiated an effort to develop a new contract to maintain critical security monitoring services. In February 2019, JWA requested a quote from the incumbent provider, Optiv Security, Inc. (previously Accuvant Inc.). The incumbent provider informed JWA that it could now offer these services directly and would no longer bid services from the current subcontractor NTT Security (US) Inc. (NTT). Recognizing the need to understand the competing services from each of the vendors, update the statement of work for new Cybersecurity requirements and develop a Request for Proposal (RFP), JWA administratively issued and executed a two-month, not to exceed $50,000 contract (MA-280-19011678) on May 23, 2019, with NTT, the subcontractor and JWA’s current provider, extending services from June 30, 2019, through August 31, 2019.
On June 21, 2019, JWA issued an RFP for firms to provide Managed Security Services. The RFP was posted to BidSync on June 21, 2019, and proposals were due on July 2, 2019. JWA received proposals from NTT and Mosaic.
Evaluation
Committee Proposal Review:
The proposals were evaluated based on the following criteria:
|
Description |
Weight |
Points |
|
Overall Responsiveness |
15% |
100 |
|
Qualifications and Experience |
20% |
100 |
|
Proposed Solution |
35% |
100 |
|
Proposed Cost |
30% |
100 |
|
Financial Viability and Background Data |
Pass or Fail |
|
RFP panel members that consisted of JWA staff with subject matter expertise met to review the proposals on July 11, 2019, and July 16, 2019, and their scores are summarized in the Table below:
|
|
NTT Security (US), Inc. |
Mosaic451, LLC |
|
Member #1 |
55 |
83 |
|
Member #2 |
51 |
90 |
|
Member #3 |
55 |
90 |
|
Overall Score |
161 |
263 |
Mosaic has the experience and qualifications to complete the tasks as required in the RFP. Their proposal outlines the firm’s experience in conducting managed security services at various locations including San Francisco International Airport, Bonneville Power Administration and the Arizona Department of Transportation. Mosaic is offering to utilize a highly rated and mature platform developed by IBM called QRadar for device event log correlation and analytics.
JWA staff has conducted due diligence regarding the recommended contractor. Reference checks were satisfactory and completed with San Francisco International Airport, Arizona Department of Transportation and Bonneville Power Administration regarding similar projects. Mosaic’s experience and overall responsiveness, technical expertise and approach to completing tasks contributed to its high score from the RFP review panel.
Mosaic's proposal includes a requirement for up to a 90-day implementation period. The proposed Contract includes a one-time charge of $34,500 in the first year for installation and setup of required monitoring equipment and software. The proposed Contract also includes expanded coverage of network security monitoring beyond Payment Card Industry requirements for the following areas: 1) Baggage Handling System, 2) ID/Access Control Network 3) Incorporate changes for network upgrades and 4) Voice Over IP phone system. The contract with Mosaic does not currently include subcontractors or pass through to other providers. See Attachment D for Contract Summary Form.
JWA seeks Board of Supervisors' (Board) approval to award a three-year Contract with Mosaic to maintain a long-term secure network environment. Additionally, to provide ample time to establish concurrent network monitoring in the transition to the new contractor, JWA seeks Board approval of a 120-day extension of the interim contract with NTT. The Contractor's performance has been confirmed as at least satisfactory. JWA has verified there are no concerns that must be addressed with respect to the Contractor's ownership/name, litigation status or conflicts with County interests.
Compliance with CEQA: This action is not a project within the meaning of CEQA Guidelines Section 15378 and is therefore not subject to CEQA, since it does not have the potential for resulting in either a direct physical change in the environment, or a reasonably foreseeable indirect physical change in the environment. The approval of this agenda item does not commit the County to a definite course of action regarding a project since the action authorized herein may lead to negotiation of an agreement. This proposed activity is therefore not subject to CEQA. Any future action connected to this approval that constitutes a project will be reviewed for compliance with CEQA.
FINANCIAL IMPACT:
Appropriations for this contract are included in the FY 2019-20 Budget for Airport Operating Fund 280 and will be included in the budgeting process for future years.
The contract contains language allowing JWA to terminate the contract without penalty for cause or after 30 days' written notice without cause.
STAFFING IMPACT:
N/A
ATTACHMENT(S):
Attachment A - Contract Extension (MA 280-19011678) with
NTT Security (US) Inc.
Attachment B - Contract (MA 280-20010115) with Mosaic451, LLC
Attachment C - Scoring Summary and Rater Score Sheets
Attachment D - Contract Summary Form