FROM: Joe Michael, Chief Information Officer
SUBJECT: Cybersecurity Modernization and Palo Alto Enterprise Security Platform Consolidation
RECOMMENDATION:
title
Recommend that the Board approve a three-year contract with Presidio Networked Solutions Group, LLC for services with Palo Alto Networks via a National Association of State Procurement Officials (NASPO) contract for a cost not to exceed $2,002,571.52; authorize the Chief Executive Officer to execute an agreement with Presidio Networked Solutions Group, LLC.
body
BACKGROUND:
Cybersecurity Modernization And Consolidation
SBCERA's cybersecurity program relies on a combination of security technologies and managed services to protect sensitive member information, critical systems, business operations, and technology infrastructure from an increasingly complex and evolving cyber threat landscape.
As cyberattacks continue to increase in sophistication, organizations are experiencing a growing number of threats that leverage artificial intelligence, automation, credential theft, ransomware, and advanced social engineering techniques. These increasingly interconnected attack methods require organizations to adopt more integrated, automated, and intelligence-driven approaches to cybersecurity.
The proposed agreement represents a strategic consolidation of SBCERA's cybersecurity program into a unified Palo Alto Networks security platform. The agreement renews existing Palo Alto security services, replaces several standalone cybersecurity products and managed service providers, addresses opportunities for improvement identified through recent cybersecurity assessments and audits, enhances SBCERA's ability to defend against increasingly sophisticated and AI-enabled cyber threats, and secures significant cost savings through enterprise pricing and early renewal incentives.
SBCERA currently utilizes Palo Alto Networks solutions for secure remote access, firewall protection, cloud security, threat prevention, security logging, and network security operations. The proposed three-year agreement includes the early renewal of these existing services prior to their expiration dates. By renewing these services early and combining them with additional cybersecurity capabilities under a single enterprise agreement, SBCERA will receive approximately 30 percent discounts on many services while locking in pricing and support throughout the three-year term.
In addition to renewing existing services, SBCERA will implement Palo Alto Cortex XSIAM, an advanced security operations platform that utilizes artificial intelligence, automation, behavioral analytics, and threat intelligence to identify, investigate, and respond to cybersecurity threats across the organization. Cortex XSIAM consolidates multiple cybersecurity functions into a single integrated platform, replacing several standalone products and service providers currently utilized by SBCERA, including managed detection and response services, security information and event management capabilities, vulnerability identification and management tools, and selected network monitoring solutions.
Audit And Security Improvements
Recent cybersecurity assessments and audits identified opportunities to strengthen security monitoring, centralized visibility, automated threat detection, and incident response capabilities. The proposed Cortex implementation is expected to address these improvement opportunities by providing enhanced monitoring, automated analysis, centralized security operations, and improved threat detection capabilities within a unified security ecosystem. By consolidating these services within the Palo Alto platform, SBCERA expects to improve operational effectiveness while reducing the complexity associated with managing multiple security vendors and disconnected security tools.
The implementation also supports SBCERA's ongoing efforts to strengthen cybersecurity governance, improve operational resilience, and enhance visibility across the technology environment. The integrated platform is expected to improve the organization's ability to identify, investigate, and respond to emerging threats while supporting continuous improvement of cybersecurity controls and operational processes.
Managed Security Services And Incident Response
The agreement includes Palo Alto Managed XSIAM services, which provide continuous security monitoring, managed detection and response, threat hunting, security operations support, and access to specialized cybersecurity expertise. These services augment SBCERA's internal Information Systems resources and provide advanced monitoring and response capabilities that would be difficult and cost-prohibitive to maintain solely through internal staffing resources.
The agreement also includes professional services necessary to support implementation, configuration, migration, integration, and deployment of the Cortex platform and related security services. These implementation services are a one-time cost that will be incurred during the first year of the agreement and are intended to facilitate the transition from existing products and providers while helping ensure successful implementation and adoption of the new security architecture.
Additionally, the agreement includes an annual Unit 42 Expertise on Demand retainer. Unit 42 is Palo Alto Networks' cybersecurity consulting and incident response organization. The retainer provides SBCERA with priority access to cybersecurity specialists in the event of a significant security incident. If retainer hours are not utilized for incident response activities, they may be applied toward proactive cybersecurity services such as tabletop exercises, incident response planning, security assessments, and cyber readiness activities, maximizing the value of the annual investment. The annual retainer cost remains consistent throughout the three-year term.
Financial And Operational Benefits
A significant portion of the proposed investment replaces cybersecurity products and services currently provided by other vendors. Through the implementation of Cortex XSIAM, SBCERA will retire existing managed detection and response services, security monitoring platforms, vulnerability management solutions, and selected network monitoring tools with an estimated annual value of approximately $188,180.
Consolidating cybersecurity services under a single Palo Alto enterprise agreement combines renewal of existing Palo Alto services with the implementation of new Cortex XSIAM capabilities, managed security services, and incident response resources. Through early renewal and enterprise bundling, SBCERA will receive $719,369.96 in pricing reductions compared to standard pricing over the three-year term, reflecting a 30% reduction from standard pricing.
The Cortex XSIAM platform, associated managed security services, and Unit 42 incident response retainer represent approximately $468,059.12 annually. After accounting for the elimination of existing vendor costs, the net increase to SBCERA's cybersecurity investment is approximately $279,879.12 annually while providing expanded security monitoring, automated threat detection, vulnerability management, managed response services, breach response capabilities, and enhanced cybersecurity protection within a single integrated platform.
The total investment for the three-year agreement is $2,002,571.52. The agreement includes renewal of existing Palo Alto security services, implementation of the Cortex XSIAM platform, managed security operations services, professional implementation services, and the Unit 42 incident response retainer. Consistent with the agreement terms, the investment will be paid during the first year while providing three years of software subscriptions, managed services, support, implementation services, and cybersecurity incident response coverage.
Summary table:
|
|
Year One |
Year Two (Prepaid) |
Year Three (Prepaid) |
Total |
|
Existing Palo Alto Services (Prisma) |
$ 137,107.84 |
$ 137,107.84 |
$ 137,107.84 |
$ 411,323.52 |
|
New/Consolidated Services (Cortex) |
$ 422,402.12 |
$ 422,402.12 |
$ 422,402.12 |
$ 1,267,206.36 |
|
Unit 42 Retainer |
$ 45,657.00 |
$ - |
$ - |
$ 45,657.00 |
|
Implementation cost (one-time) |
$ 278,384.64 |
$ - |
$ - |
$ 278,384.64 |
|
Total |
$ 883,551.60 |
$ 559,509.96 |
$ 559,509.96 |
$ 2,002,571.52 |
Procurement
The proposed agreement will be procured through the National Association of State Procurement Officials (NASPO) ValuePoint cooperative purchasing contract currently utilized by SBCERA for existing Palo Alto Networks services. Utilizing the existing NASPO contract provides procurement efficiency, competitively established pricing, and continuity with SBCERA's existing contractual agreement.
As part of the procurement review process, SBCERA compared pricing and service delivery options among several NASPO-capable resellers, including Netsync, SBCERA's current Palo Alto reseller; Carahsoft Technology Corporation, SBCERA's current NASPO provider; and Presidio Networked Solutions Group, LLC, another existing SBCERA technology vendor. For vendors participating under the same NASPO cooperative purchasing contract, pricing is established by the contract and remains consistent across vendors.
SBCERA also engaged directly with Palo Alto Networks throughout the evaluation process. While Palo Alto Networks does not formally endorse specific resellers, discussions with Palo Alto representatives consistently reflected positive feedback regarding Presidio's technical capabilities, customer support, and delivery of Palo Alto solutions.
Following the evaluation, SBCERA selected Presidio Networked Solutions Group, LLC to provide the proposed services. The decision was based on recent challenges experienced with contract renewals and contract administration through Carahsoft, including delays and difficulties accommodating contract modifications requested by both SBCERA and Palo Alto Networks. Presidio demonstrated a higher level of responsiveness, collaboration, and customer engagement throughout the evaluation process and is expected to provide improved contract management and customer support while maintaining the same NASPO-contracted pricing.
Strategic Plan Alignment
The proposed agreement directly supports SBCERA's Information Systems Strategic Plan by advancing cybersecurity modernization, operational resilience, and technology risk management initiatives. The solution strengthens SBCERA's ability to protect sensitive member and organizational data through the adoption of integrated, AI-enabled security technologies that provide enhanced threat detection, automated response capabilities, and centralized security operations.
The agreement also supports the strategic objectives of improving operational efficiency and reducing technology complexity by consolidating multiple cybersecurity products and service providers into a unified enterprise platform. This consolidation improves visibility across SBCERA's technology environment, streamlines vendor management, and enables more effective use of Information Systems resources.
Additionally, the implementation of Palo Alto Cortex XSIAM and related managed security services addresses cybersecurity control improvement opportunities identified through recent assessments and audits, further supporting SBCERA's commitment to maintaining a secure, resilient, and well-governed technology environment.
The proposed investment positions SBCERA to respond more effectively to an evolving cybersecurity landscape while leveraging existing technology investments, achieving significant cost savings through enterprise pricing, and enhancing the long-term sustainability of SBCERA's cybersecurity program.
BUDGET IMPACT:
Costs for this item are included in the current year administrative and/or non-administrative budget.
STRATEGIC PLANNING GOAL/OBJECTIVE:
Operational Excellence & Efficiency
STAFF CONTACT:
Joe Michael
ATTACHMENTS:
Exhibit A: Presidio Palo Alto Renewal and Cortex Proposal