TO: Board of Supervisors
FROM: Meg Ragan, Chief Technology Officer - Information Technology Services
REPORT BY: Julia Bordona, Staff Services Manager
SUBJECT: Budget Amendment and Authorization of Capital Asset, and Sole Source Award for Firewall equipment
RECOMMENDATION
title
Approve a Budget Amendment to increase appropriations by $232,489 for the purchase of replacement firewall equipment and related implementation, offset by available fund balance; establish purchase as a capital asset; and approval of a waiver of competitive bidding requirements and sole source award. (Fiscal Impact: $232,489 Expense; Information Technology Services Fund; Not Budgeted; Discretionary)
[4/5 Vote Required]
body
BACKGROUND
Maintaining robust perimeter security and reliable network availability is essential for protecting organizational assets, operational uptime, and secure access. Because the County’s firewalls serve as the core of our security posture, they are systematically replaced on a standard seven-to-nine-year lifecycle to keep pace with evolving threat vectors, maintain peak hardware reliability, and prevent operational obsolescence.
Our primary internet firewalls represent the central gateway for County activity that connects to the outside world, serving as the foundational defense against external cyber threats while enabling reliable operational connectivity, both inbound and outbound. Beyond perimeter filtering, these units actively manage and secure everyday workflows from cloud services like Microsoft 365 and Tyler financials to essential third-party business integrations, support, and encrypted remote access. Staff productivity depends on secure, uninterrupted internet connectivity. These firewalls are not merely operational infrastructure; they are the main connectivity assets critical to overall risk management and enterprise continuity. Upgrading this hardware ensures we maintain advanced threat protection, secure remote access, optimized throughput, and vendor support across all business-critical workflows.
ITS is requesting authorization to purchase $232,489 in capital assets and the associated implementation costs to replace the County’s existing primary internet firewalls with (2) two Palo Alto Networks PA-3410 next-generation firewalls. The three-year solution includes the firewall hardware, associated security licensing and subscriptions, premium support, and professional services necessary to implement and transition to the new environment. ITS is also requesting the associated budget adjustment to increase appropriations and use available ITS Fund balance to fund this one-time investment in FY 2026-27.
The timing of this purchase is a deliberate risk-mitigation strategy designed to protect ongoing operations. Procuring the new firewalls now enables a parallel build environment, allowing the technical team to stage, mirror, and rigorously test complex policies, security rules, and third-party integrations alongside the active production network. Deferring procurement creates an unnecessary compression of the implementation window, and a rushed deployment increases the risk of configuration errors and unplanned outages to core platforms. Moving forward with this purchase ensures an orderly, secure transition, giving ITS the required timeframe to validate configurations thoroughly while minimizing risk to daily business operations.
From a financial perspective, retaining our legacy firewalls has become increasingly cost-prohibitive due to shifts in the vendor’s licensing structures. Palo Alto Networks’ current licensing models incur significantly higher renewal costs for older-generation hardware. By continuing to renew subscriptions on aging equipment, the County is effectively paying a premium for diminishing returns on depreciating assets. Investing in the new Palo Alto 3410 series optimizes our total cost of ownership by migrating our infrastructure to a modernized, consolidated licensing tier.
Additionally, staying current with next-generation security technology is a critical requirement for safeguarding public trust, ensuring compliance, and protecting sensitive County data. The modern cyber threat landscape-characterized by sophisticated ransomware and AI-driven attacks targeting the public sector, is evolving faster than legacy hardware can effectively inspect it. The proposed 3410 models provide Napa County with the advanced computational power necessary to execute real-time, machine-learning-based threat prevention without creating bottlenecks in our network performance.
Using available ITS Fund balance allows the County to make this planned infrastructure investment without incorporating the full initial acquisition and implementation cost into departmental allocations. This approach is intended to minimize the impact on departmental costs while addressing the County’s infrastructure needs in a timely manner. Deferring the firewall replacement until FY 2027-28 would require the full $232,489 cost to be incorporated into the next budget cycle, potentially placing additional pressure on departmental allocations. Proceeding with the purchase at this time is deliberate and a strategic decision to address critical infrastructure needs while helping mitigate future cost increases to departments.
Finally, this proactive hardware refresh transforms an escalating operational expense into a strategic capital investment. The proposed purchase provides predictable support and security subscription costs for the initial three-year period while positioning the County on current-generation infrastructure for the next hardware lifecycle. This investment ensures Napa County remains proactive rather than reactive while supporting the secure, reliable, and resilient delivery of essential public services.
Digital Scepter currently provides the County’s Palo Alto equipment and support and has extensive knowledge of the County’s existing firewall environment, including security segmentation and encrypted tunnel configurations. Digital Scepter also served as the primary contractor for previous firewall migrations and developed the custom configuration scripts currently used within Napa County’s environment. This existing institutional and technical knowledge provides significant value for the upcoming firewall replacement and migration. Continuing with Digital Scepter reduces the need for a new vendor to independently assess and recreate the County’s existing configurations and minimizes the operational risks associated with transitioning this work to a vendor unfamiliar with the County’s environment. A change in vendors could increase implementation time, introduce configuration risk, and potentially extend outage windows during migration.
Given Digital Scepter’s prior involvement in designing, configuring, and migrating the County’s existing Palo Alto environment, a sole source award is recommended to maintain continuity, reduce implementation risk, and support an efficient migration of this critical security infrastructure.
Requested Actions:
1. Approve a Budget Amendment increasing Capital Asset Equipment account in the Information Technology Services budget (Fund 4200, Subdivision 4200002, Account 55400) by $232,489, offset by use of available ITS Fund Balance;
2. Authorize the purchase of Firewall equipment, associated implementation costs and three-year licensing and support, and establish the purchase as a capital asset in the amount of $232,489; and
3. Approve a waiver of competitive bidding requirements and sole source award to Digital Scepter
FISCAL IMPACT
|
Is there a Fiscal Impact? |
Yes |
|
Is it currently budgeted? |
No |
|
Is it Mandatory or Discretionary? |
Discretionary |
|
Discretionary Justification: |
Approval of this purchase will replace end-of-life firewall equipment that serves as a critical component of the County’s network security infrastructure. The replacement will support continued system reliability, security, and protection of County systems and data. |
|
Is the general fund affected? |
No |
|
Future fiscal impact: |
The replacement equipment is expected to reduce maintenance requirements and emergency repairs. Ongoing costs will be limited to standard maintenance, and any applicable manufacturer support or warranty renewals after the initial 3-year period. |
|
Consequences if not approved: |
If not approved, the County would continue operating end-of-life firewall equipment, increasing the risk of hardware failure, security vulnerabilities, and reduced vendor support. Delaying replacement could also increase the potential for service disruptions and limit the County’s ability to respond effectively to evolving cybersecurity threats. |
|
Additional Information: |
Strategic Initiative: Innovation and Learning |
ENVIRONMENTAL IMPACT
ENVIRONMENTAL DETERMINATION: The proposed action is not a project as defined by 14 California Code of Regulations 15378 (State CEQA Guidelines) and therefore CEQA is not applicable.)