Special Notice / Hearing: None__
Vote Required: Majority
To: Honorable Board of Supervisors
From: Jon Walton, Chief Information Officer, Information Services Department
Subject: Agreement for Active Directory services
RECOMMENDATION:
title
Adopt a resolution waiving the Request for Proposal (RFP) process and authorizing the County’s Chief Information Officer, or his/her designee, to execute an agreement with Microsoft to provide Active Directory services for the term of May 15, 2019 to December 31, 2019, in an amount not to exceed $189,000.
body
BACKGROUND:
Active Directory (AD) is a Microsoft technology used to manage computer and other devices on a network by allowing administrators to create and manage permissions and access to County’s network resources. Active Directory Domain Services (AD DS) is the cornerstone of every Windows domain network. It stores information about members of the domain, including devices and users, verifies their credentials, and defines their access rights.
While the County has a number of AD instances throughout the County, it is important to establish best practices in its administration through governance to ensure that potential security gaps are identified. Microsoft was chosen for their expertise in AD and will help facilitate the implementation of Microsoft’s recommended best practices.
DISCUSSION:
Microsoft’s professional services will assist the County by assessing and developing recommendations with respect to the County’s AD operations by conducting a series of workshops to determine the future direction of the County’s environment as well as performing a “Cybersecurity Risk Review” assessment.
Cyber Security has been the focal point of network operations with incidents such as the 2017 Equifax breach. The risks associated with ransomware are on a rapid rise. The results of the AD assessment will provide the County with a report documenting security gaps, provide recommendations based on its results, and produce a roadmap that will assist the County in improving its security posture. The assessment will incorporate Microsoft’s current best practice recommendations and align the County with industry metrics set by the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) and the National Institute of Standards and Technology NIST Cybersecurity Framework (CSF).
Microsoft has expert familiarity with their own proprietary product and, thereby, a waiver of the Request for Proposal process has been requested. The negotiations with Microsoft over the County’s standard terms and conditions have taken longer than anticipated. The increased cyber security risks require immediate execution of this agreement to protect the County’s information. Due to the urgent security needs underlying the requested services, ISD is seeking authorization to execute an agreement at the earliest Board meeting possible.
County Counsel has reviewed and approved the resolution as to form and will review and approve the agreement prior to execution.
Approval of this agreement contributes to the 2025 Shared Vision of a Collaborative Community by implementing a simplified domain/forest design to ensure a secure network environment while developing a future strategy for identity management for the County.
FISCAL IMPACT:
The term of the agreement will be May 15, 2019 to December 31, 2019 with a not to exceed amount of $189,000. Funding for this Agreement is provided in the FY 2018-19 Adopted Budget and will be provided for in future budgets.