TO: Board of Supervisors
FROM: Meg Ragan, Chief Technology Officer - Information Technology Services
REPORT BY: Julia Bordona, Staff Services Manager
SUBJECT: Budget Amendment and Waiver of Competitive Bidding requirements for the Purchase of Security Platform
RECOMMENDATION
title
Approve a Budget Amendment to increase appropriations by $250,000 for the purchase of Security Platform and related implementation, offset by available fund balance; and approve a waiver of competitive bidding requirements and sole source award. (Fiscal Impact: $250,000 Expense; Information Technology Services Fund; Not Budgeted; Discretionary)
[4/5 Vote Required]
body
BACKGROUND
Napa County Information Technology Services (ITS) is responsible for supporting and protecting the County's enterprise technology environment, including systems that manage sensitive, confidential, financial, health, and criminal justice information. As the County's technology environment continues to evolve, maintaining effective security controls requires an ongoing investment in the processes, technologies, and governance practices used to manage access to County systems and information.
Recent independent assessments conducted under multiple regulatory and cybersecurity frameworks, including HIPAA Privacy and Security, Criminal Justice Information Services (CJIS), Payment Card Industry (PCI), and the National Institute of Standards and Technology (NIST) Cybersecurity Framework, have provided valuable insight into opportunities to further strengthen the County's enterprise security posture. A common theme across these assessments was the importance of advancing identity governance capabilities to support consistent oversight, periodic access reviews, documentation, and reporting across enterprise and departmental systems.
The County currently maintains established identity and access management controls across its technology environment. These controls have evolved alongside individual systems, departmental business requirements, and regulatory obligations. As the number and complexity of County applications and enterprise systems continue to increase, a more integrated approach to identity governance represents the next logical progression in the County's cybersecurity strategy.
Advancing toward a centralized enterprise identity governance framework will build upon existing security investments by improving visibility into user access, standardizing access review processes, reducing reliance on manual administrative activities, and strengthening the County's ability to document and demonstrate the effectiveness of its access management practices. This approach will also support greater consistency across departments while recognizing the distinct operational and regulatory requirements of individual systems.
Identity governance is a foundational component of modern enterprise cybersecurity and supports the County's broader responsibilities for protecting information, maintaining reliable operations, and meeting applicable regulatory requirements. The consistency of themes identified across multiple independent assessments reinforces the value of approaching identity governance as an enterprise-wide initiative rather than through individual system or departmental improvements.
Investing in this next phase of enterprise security will position the County to continue strengthening its cybersecurity posture, support future regulatory assessments, improve operational efficiency, and establish a more scalable and sustainable approach to managing access across County systems and information.
To support the next phase of the County's enterprise security strategy, the Chief Information Security Officer recommends implementation of the SailPoint Security Platform, an enterprise identity governance and administration solution. SailPoint will build upon the County's existing security controls by providing a centralized, automated framework for managing and overseeing user access across enterprise information systems.
These capabilities will enhance visibility, accountability, and consistency while supporting the County's ongoing regulatory and cybersecurity responsibilities.
Implementation will follow a phased, enterprise-wide approach, initially prioritizing systems with significant regulatory, security, and operational requirements. This strategy will allow the County to establish a foundational identity governance framework that can be progressively expanded across additional County systems and applications, aligning with future technology modernization efforts.
By introducing greater automation and centralized oversight, the County will reduce reliance on labor-intensive administrative processes, improve operational efficiency, and establish a more scalable and sustainable approach to identity governance. This investment represents a natural progression in the County's enterprise cybersecurity program, strengthening the protection of County systems and information while supporting long-term operational resilience and regulatory readiness.
Requested Actions:
1. Approve a Budget Amendment increasing Computer Software & Licensing account in the Information Technology Services budget (Fund 4200, Subdivision 4200010, Account 53415 by $250,000, offset by use of available ITS Fund Balance; and
2. Approve a waiver of competitive bidding requirements and sole source award to Sail Point.
FISCAL IMPACT
|
Is there a Fiscal Impact? |
Yes |
|
Is it currently budgeted? |
No |
|
Is it Mandatory or Discretionary? |
Discretionary |
|
Discretionary Justification: |
This purchase is necessary to address identity and access management gaps identified through multiple independent regulatory and cybersecurity assessments. Implementing an enterprise identity governance solution will strengthen oversight of user access to sensitive County systems, automate and standardize access reviews, and provide consistent, auditable documentation needed to support the County’s cybersecurity and compliance requirements. |
|
Is the general fund affected? |
No |
|
Future fiscal impact: |
Beginning in FY 2027-28, the anticipated ongoing annual software licensing cost is approximately $150,000 and will be incorporated into the ITS operating budget and allocation process, subject to future contractual terms and annual budget approval. |
|
Consequences if not approved: |
If not approved, implementation of the identity governance solution would be delayed, extending the County’s reliance on decentralized and largely manual access-management processes and delaying remediation of findings identified through multiple regulatory and cybersecurity assessments. The County would continue to face the associated compliance, cybersecurity, operational, and financial risks until an enterprise-wide solution can be implemented; for example a PCI security incident where access was improperly assigned and never reviewed could cost the County hundreds of thousands of dollars in fines |
|
Additional Information |
Strategic Initiative: Innovation and Learning |
ENVIRONMENTAL IMPACT
ENVIRONMENTAL DETERMINATION: The proposed action is not a project as defined by 14 California Code of Regulations 15378 (State CEQA Guidelines) and therefore CEQA is not applicable.)