Item No.
TO: HONORABLE MAYOR AND MEMBERS OF THE CITY COUNCIL
FROM: OFFICE OF THE CITY MANAGER
BY: ALVIN LAM, IT MANAGER
DATE: NOVEMBER 12, 2024
SUBJECT: APPROVAL OF CHECKPOINT FIREWALL SUBSCRIPTION AND
HARDWARE UPGRADE
EXECUTIVE SUMMARY
The City Council will consider approving the replacement of the Check Point Firewall (hardware) and software and license subscription for a three-year term agreement with Check Point Technologies Ltd. The current firewall (hardware) will be at end-of-life support by 2025. This upgrade includes multiple security features such as email security protection, Virtual Private Network (VPN) for staff and support contractors to use for remote access, Infinity Global Services (IGS) credits for I.T. staff to utilize for security training, and incident response planning. The hardware refresh will also provide the City with the capacity and capability to support 10 to 40 gigabytes of internet bandwidth for all future internet needs.
RECOMMENDATION
The City Council:
Authorize the City Manager, or his designee, to execute an Agreement with Check Point Software Technologies Ltd. at an amount not to exceed $635,000 for a three- year term.
BACKGROUND
The City’s Information Technology (IT) division has used Check Point security products such as their Firewall appliance for over 15 years. Check Point continues to be a reliable security vendor for the City. It continues to be a security leader in this industry, providing enhancements, and adding new security features over the years to adapt to the changing security landscape.
The City’s current firewall appliance (hardware) is over 7 years old and will have product life cycle support end by 2025. This is also the opportune time for staff to redesign and build the next-generation security firewall to support the City’s strategic goal and objectives in online services, placing more of the City’s core business applications on the
RENEW CHECKPOINT FIREWALL SUBSCRIPTION AND UPGRADE HARDWARE NOVEMBER 12, 2024
PAGE 2
2 cloud such as the Accela Permit System, the City’s Enterprise Resource Planning (ERP) systems, which may consist of Finance, HR, Utilities, Procurement, etc. To support these types of systems, the City needs to increase its internet bandwidth and internal core network infrastructure such as the Firewall to avoid a bottleneck in competing network resources.
ANALYSIS
Staff recommends upgrading the City’s Firewall and renewing the support agreement with Check Point, they have provided reliable and valuable Cyber protection to the City for over 15 years and continue to be the industry leader in this field. Below are a few samples of the Miercom 2024 Security Benchmark of the industry's top 5 Enterprise Security vendors. Check Point comes across as the top in Zero+1 day Malware prevention with
99.8% efficacy. (Zero+1 day means a new virus in the wild that is 1 day old can be detected and prevented before it can do any harm.)
RENEW CHECKPOINT FIREWALL SUBSCRIPTION AND UPGRADE HARDWARE NOVEMBER 12, 2024
PAGE 3
3 Another Miercom 2024 Security Benchmark shows: Check Point scored the best in detecting and preventing Phishing and Malicious URLs utilizing AI-based technology, below chart shows Checkpoint has zero missed detection.
Staff also recommend Check Point due to their entire suite of security products called Infinity Total Protection, which offers a single pane of glass to manage all the available products from one central portal. As part of this contract renewal, Check Point put together a customized package bundle that includes additional security features that staff has selected for our organization based on our current and future security needs. It is listed below, and it is labeled as “Special Benefits” in the proposal. These special benefits
RENEW CHECKPOINT FIREWALL SUBSCRIPTION AND UPGRADE HARDWARE NOVEMBER 12, 2024
PAGE 4
4 include but are not limited to: Email Security, Infinity Global Services (IGS) credits toward Security training for I.T. staff on the new Firewall, and various Security modules, Incident Response Planning, and Incident Response Support. Virtual Private Network (VPN) for staff and support contractors, and Internet bandwidth load-balancing software to keep our internet stable and reliable between two Internet Service Providers (ISP).
Upon procurement of the new Firewalls, installation, configuration, testing, and going live, this entire process should take approximately six weeks to complete.
CITY COUNCIL PRIORITIES
Fiscal Responsibility
Efficiency & Adaptability
FISCAL IMPACT
Approval of the recommended action will result in expenditures of $285,000 for Fiscal Year 2024-2025, $175,000 for Fiscal Year 2025-2026, and $175,000 for Fiscal Year 2026-2027, for a total of $635,000 within the three-year term.
The first year is a larger amount due to the purchase of a set of new Firewalls (hardware), the software products are subscription-based, and the equipment support and licensing are all included in the three-year agreement.
Staff budgeted $254,000 in the equipment replacement fund for Fiscal Year 2024-2025 (62-4-1380-0144). The difference of $31,000 in the remaining balance can be absorbed by I.T.’s operating fund (10-4-1380-0700), which was allocated for annual Firewall support and software renewal of the legacy system.
ATTACHMENTS
Attachment A: Check Point Infinity Total Protection Agreement-City of Downey
Docusign Envelope ID: ICB7ACD0-9718-4005-A904-76716D3A84FA October 25, 2024
City of Downey (the "Customer")
Check Point Infinity Total Protection Agreement - City of Downey Offering Description
We are pleased to ofFer the Customer (through a Check Point certified reseller) the Check Point Infinity Total Protection program detailed below
The program offers the Customer use of Check Point’s security technologies solutions described herein to protect its networks and workforce via an annual subscription based on the number of enterprise users. solely for the Customer’s internal needs
Offering Benefits
Check Point Infinity Total Protection provides the Customer with the following exceptional benefits The most advanced threat prevention technologies and security platforms available in the market, Single and simple procurement in predictable pricing.
Includes software, real-time subscriptions, hardware and services Flexible offering, allowing the Customer to consume technologies and services based on its needs Central managed console, delivering real-time security updates and total prevention across all business environments
The security technologies and products provided and/or which are available for purchase using the allowances under this offering are listed in attached Exhibits A and D
24x7 Direct Premium PRO support and real-time security updates (ThreatCloud), as listed in attached Exhibit B The offering terms and conditions are listed in the attached Exhibit C, •
•
•
•
•
•
•
Infinity Total Protection Program Pricing and Allowances:
Pric
Infinity Total Protection Subscription Price’
Year 1 Year 2
2 Year 3
$175,000
Total
$635,000
Components:
Product Allowance**
Harmony Allowance**
Infinity Global Services Points (IGS'
Special Benefit: Renewal of NGTX Direct Premium PRO
support for existing User Center 8674353**-'
Special Benefit: Renewal of NGTX Direct Premium PRO
support for existing User Centers 8005677 and 6785139**-' Special Benefit: CP-SASE-PA-COMP-Tl-Y
Quantjty: 30 per year:
Special Benefit: CP-SASE-IA-ESS-Tl-Y
Quantjty: 30 per year
Special Benefit: CPTS-IRT-PRO-PLAN-SMl-1
'Quantity: 1 per year:
Special Benefit: CPSB-MOB-50 (Quantjty: 1 per year:
Special Benefit: CPSB-SDWAN-9800-PLUS-1 Y
Quantjty: 2 ner year I
Unlimited Software Management
Next Generation Threat Prevention and SandBlast (NGTX)
including 24/7 Direct Premium PRO support across the entire I Included Infinity user center-**
' Customer acknowledges that its selected reseller and distributor shall be responsible for the shipping and delivery of the hardware products. Pricing does not include shipping, handling. duties and taxes, to be added to the purchase order if and as applicable
'' Allowances value is as per Check Points list price
'n Support and services are not included for the customer’s current install base *"' Only for the products listed under the following renewal product breakdown table, and subject to the products End of Support dates specified at https://www.checkpoint.com/support-services/support-life-cycle-policy/ Year 1
:55.000
;57.600
Year 2
$12.000
$57,600
to
Year 3
$12,000
$57,600
LO
Total
$279,000
$172,8®g
D5LO
Included Included
Included
Included
Included
Included
r
Included
mr
ATTACHMENT A
Docusign Envelope ID: ICB7ACD0-9718-4005-A904-76716D3A84FA Renewal Product Breakdown Table
The Business Terms
•
•
•
•
•
The term of this Infinity Total Protection agreement is 3 years, starting on the date of the last signature below The Infinity Total Protection price to the Customer for the 3-year term is US $635,000 The Customer will place yearly purchase orders for the Infinity Total Protection price to be invoiced and paid annually upfront. All prices and allowances under this agreement are in USD Customer shall have the right to opt out of this agreement after each Year by providing Check Point with prior written notice of its election at least sixty (60) days before the end of the current Year.
Purchase orders under this agreement shall be placed through a designated Check Point authorized reseller. The Customer agrees to purchase the above offering from an authorized reseller according to the discounted price set forth above. If the Customer is unable to purchase the Infinity offering for that price (or lower) from an authorized reseller, Check Point will negotiate with its distributor a discount from Check Point’s list price so that that Customer may purchase this offering from a reseller at the agreements discounted price. For the avoidance of doubt, Check Point will not be involved in determining the price of the Infinity Total Protection offering to be sold from the authorized reseller to the Customer and such price will be determined solely by the authorized reseller.
By signing this agreement. the Customer commits to the full 3-year Infinity Total Protection price specified above.
Allowances
o The Customer’s allowances are specified in the table above. Such allowances can be used only for acquiring Infinity products and services as specified in the attached Exhibits A and D. The list price for these will be deducted from the applicable allowance budget until fully used. The list price is defined as the price of the applicable SNBT/NGTX bundle in Check Points product and service catalog at the time the product or service is ordered. o The Customer may utilize the applicable allowance allocated for each year of the term only during that specific year to acquire the applicable products and services per its needs. Any unused portion of the annual allowances will not be carried over to subsequent years
o Any product and/or services acquired exceeding the applicable annual allowance will be considered outside the scope and coverage of this Infinity Total Protection agreement and will need to be purchased separately, The Customer will be entitled to special benefits as stated in the table above All Infinity products and licenses are placed in a dedicated user center. The Customer may not transfer products and licenses from existing user centers to the dedicated Infinity user center and vice versa All shipping, handling. duties and taxes costs associated with the products and services provided herein will be borne by Customer and added to the purchase order if any as applicable The products offered under this Infinity Total Protection agreement are covered with Check Point’s Direct Premium PRO Support SLA, as per the attached Exhibit B
This agreement will only become effective upon signing thereof by Check Point’s authorized personnel •
•
•
•
•
•
By signing below the Customer acknowledges and agrees to the terms stated above and in the attached exhibits ChI Technologies Ltd
By:
Name:
mN/@@Tile: vp, Genera1 Counse1
Date:
City of Downey
By :
Name:
Title
Date:
bIrD
+t::Ie A +.
City of Downey
By, J-oh t’\
Name
Title:
Date: lq-}\-ZJt'
City of Downey M+O\
By:
Name
Title
Date
Docusign Envelope ID: ICB7ACD0-9718-4005-A904-76716D3A84FA Exhibit A - Security Technologies and Products included in Check Point Infinity Total Protection Security Technologies
The Customer may choose any of the software, subscriptions and hardware offering from the below list according to deployment and architecture plan. Check Point reserves the right to add or remove products from this list, per its most updated product catalog as in effect at the time products are purchased Security Software for products and services under the covered User Centers:
Management Software:
• Network Policy Management, Endpoint Policy Management, Logging and Status, Monitoring, SmartWorkflow, SmartProvisioning, User Directory, Management Portal. Global Policy, Virtual Management Domains.
SmartEvent, Compliance blade
Additional Software:
• Identity Awareness. Virtual Systems (VS), and Mobile Access Security Subscriptions:
• Next Generation Threat Prevention & SandBlastTM Zero Day protection. Includes subscriptions for IPS. DNS Application Control. URL Filtering, Anti-Mrus, Anti-Bot and Anti-Spam as well as SandBlast Zero-day protection
Harmony Products:
To be selected and acquired through the Harmony Allowance:
•Harmony Endpoint - delivers advanced threat protection for known, unknown and zero-day malwares, Sandbox Emulation and Extraction. enhanced by automated endpoint forensics analysis, access control. Web Protection and data protection capabilities
Harmony Mobile – offers comprehensive, enterprise-grade mobile security that protects iOS and Android devices, apps, and the networks they depend on from advanced mobile threats Harmony Browse defends users against web-based threats, delivering unrivaled protection against zero-day threats without impacting network performance
Harmony Email & Collaboration – delivers all the protections you need, with the highest caliber security, for any email solution and Office 365 and G Suite productivity apps in a single, efficient. and cost effective solution •
•
•
Hardware Products:
Network Security Based on Threat Prevention & SandBlast (SNBT / NGTX) Configurations* Small Business and Branch Offices Appliances
o 1530, 1535, 1550, 1555, 1570,1575. 1590, 1595. 1600. 1800, 1900. 2000, 3600. 3800 Quantum Force perimeter
o 9100, 9200, 9300. 9400, 9700, 9800, 6200, 6400. 6600. 6700, 6900, 7000 Quantum Force Maestro
o 9100, 9200, 9300, 9400. 9700, 9800, 19100, 19200, 6200, 6600, 6700, 7000. 16600. 28600 Quantum Force High End Enterprise and Data Center
o 19100, 19200, 29100, 29200, 16200, 26000, 28000, 16600, 28600 Industrial. loT and Critical Infrastructure Appliance
o 1 570R, 1570RWLTE. 1595R. 1595R5G
Quantum LightSpeed Appliances
o MLS200, QLS250, MLS400, QLS450, QLS650, QLS800
Maestro Orchestrators
o MH0140. MH0175
Open Server for security gateways - Supporting a wide range of servers and devices certified by Check Point for security gateway and Threat Prevention & SandBlast Zero Day Protection (SNBT / NGTX) capabilities •
•
•
•
•
•
*Check Point may update the product list from time to time based on catalog updates for new or old appliances Security Manaqement & Malware Analysis Appliances
• Security Management Appliances
o Smart-1 600. Smart-1 6000
• Malware Analysis Appliances - SandBlast Zero-Day Prevention on premise o TE250X. TE2000X
Docusign Envelope ID: ICB7ACD0-9718-4005-A904-76716D3A84FA Hardware Accessories (as supported per security appliance) Networking
Check Point Security Appliances support 1 GbE copper, 1 GbE fiber, 10 GbE fiber, 40 GbE or 100/25 GbE network interface cards as well as fail-open network 1/O modules of 1 GbE copper and 10 GbE fiber
Network Transceivers of 1 (;bE, 10 GbE, 25 GbE. 40 GbE, 100 GbE (all with short and long range0 options)
Fiber channel SAN Card
•
0 0
Storage
HDD (320 GB, 500 GB, 1 TB, 2 TB)
SSD (240 GB, 480 GB)
0 0
Memory RAM upgrade kits
8 GB, 16 GB. 24 GB. 32 GB. 64 GB, 128 GB. 256 GB0
Lights-Out Management (out of band remate management)
Power Supplies
o AC. DC
Rack Mount Options
Sliding Rails and rack kits
Shelf rack mount (for half U security appliances)
0 0
Docusign Envelope ID: ICB7ACD0-9718-4005-A904-76716D3A84FA Exhibit B - Security Services Offered
Check Point Infinity Total ProtectIon includes the security services required to support a mission critical security environment
• Real Time Security Updates (ThreatCloud)
• Software Updates
• 24x7 Support & Maintenance
• Hardware Maintenance
Support is provided according to Check Point’s Direct Premium PRO Support SLA as described here https://www .checkpoint.com/support-services/support-plans/ PRO support services are provided only for user centers in which all the products and services are fully covered by PRO support. In case a user center includes any unsupported products and services, in order to maintain the PRO support for the entire user center. Customer shall request Check Point to remove the specific unsupported products and services within 60 days from the expiration of its PRO support term. In case Customer fails to submit such request within the said timeframe, the entire applicable user center may not be covered by PRO support.
The support term of any product or service purchased under this agreement will not exceed the agreemenf s term
Docusign Envelope ID: ICB7ACDO-9718-4005-A904-76716D3A84FA Exhibit C - Terms and Conditions
1 End User License Agreement – Installation and use of Check Point products and services are subject to the applicable Check Point license agreement (EULA), as available at Check Point website 2 Software License – Entitlement to support and services for all software products (e.g: OpenServer licenses), including for software licensed on perpetual basis (if any), is valid only during the applicable license term or until expiration/termination of your Infinity offering, whichever is earlier. Upon their expiration, the software licenses will remain within the Infinity User Center and will be available for renewal, in accordance with Check Point’s support life cycle policy.
3 Fair usage – Use of the services are subject to Check Point’s fair usage restrictions which may limit the service capacity based on the Customer’s organizational size, user count and business 4 Existing Check Point Customers – The service and support for existing Customers cover only the products installed as part of the Check Point Infinity Total Protection. Existing install-base will continue to require separate support and services,
5.Sizing and Quantities of Hardware and Software – Per Check Points discretion, hardware quantity and software requirements will be agreed upon based on the Customer’s current traffic, needs and projection traffic growth for the term of the agreement,
6 Auditing – Check Point reserves the right to audit the Customer’s records to verify compliance with the terms of this offering
Docusign Envelope ID: ICB7ACD0-9718-4005-A904-76716D3A84FA Exhibit D - SKUs and Descriptions
Product
CPAP-SG9800-
PLUS-SNBT
CPAC-240/1 OOF-D-
INSTALL
CPAC-RAM64GB-
9700/9800-INSTALL
Descriotion
9800 Plus Appliance with 2 Virtual Systems and SandBlast subscription lackage for 1 year
2 Port 40GBase QSFP+ / 100GBase QSFP28 interface card for 9000/1 9000/29000 appliances
64GB Memory uoqrade kit for 9700-9800 appliances
er for 1000 Base-T RJ45 (Copper)- for 9000/1 9000/29000 appliancesCPAC-TR-1 T-D
CPAC-TR-1 OT-D 10G Base-T Copper transceiver for 9000/1 9000/29000 appliances SFP+ transceiver for 10G Fiber ports- long range (10GBase-LR)- for 9000/1 9000/29000 appliancesCPAC-TR-lOLR-D
CPAP-SG3600-SNBT
Year 1 Contingency
Allowance
Year 2 Contingency
Allowance
Year 3 Contingency
Allowance
3600 Base lliance wIth SandBlast subscription package for 1 year H on
CP-HAR-EC-COMP
EMAIL-1 Y
Description
Harmony Email and Collaboration Protect (Ema
Description
Direct 24x7 Premium PRO S
Subscription
INFINITY-SERV-Q
Description
Next Generation Threat Prevention and Sandblast (NGTX
Renewa Description
le for 13600 Base Appliance with SandBlast subscriptionCPAP-SG3600-SNBT CPSB-MOB-50 Mobile Access Blade for 50 concurrent connec Next Generation Security Management Software for 5 gateways (SmartEvent and Compliance 1 year
Next Generation Security Management SmartEvent dedicated Server for 5 latew
Harmony SASE Private Access - Complete package for 20499 users. yearly ltionSU
CPSM-NGSM5
CPSM-NGSM5-
EVNT
CP-SASE-GW-Y.
LICENSE
CP-SAS E-IA-ESS-
T1 -Y-LICENSE
CP-SASE-PA-COMP
T1 -Y-LICENSE
SASE Gateway instanceHarmo sub
Harmony SASE Internet Access - Essentials package for 10-499 users, yearly ltionsubs
Special Benefits Description
CPTS-IGS-RET-1 -1 Y
CP-SAS E-PA-COMP.
T1 -Y
CP-SASE-IA-ESS-
T1 -Y
Infi Global Services Credi
Harmony SASE Private Access - Complete package for 1 499 users, yearly ltionSU
Harmony SASE Internet Access - Essentials package for 1499 users, yearly subScriDtion
Docusign Envelope ID: ICB7ACD0-9718-4005-A904-76716D3A84FA
CPTS-IRT-PRO-
PLAN-SMI -1 The Incident Response PRO Plan 1 includes 1 proactive service that does not exhaust hours included in the plan. The customer can choose one of the following services; IR Readiness, CIS Controls, IR Plan Review, Attack Surface Mapping, and Threat Profiling. The hours included in the plan can be used for reactive services (incident/breach) or other proactive services that are not chosen/included in the plan. Customers will receive detailed incident reports and descriptions of work performed by the Check Point Incident Response Team at the conclusion of all supported incidents
CPSB-MOB-50
CPSB-SDWAN-9800-
PLUS-1 Y
Mobile Access Blade for 50 concurrent connections
Quantum SD Wan s ltion for 1 year for 9800 Plus appliance Software
Management
CPSM-NGSM5
CPSM-NGSM5-
EVNT
Next Generation Security Management Software for 5 gateways Next Generation Security Management SmartEvent dedicated Server for 5 latewavs (DerDetual
Next Generation Security Management Log dedicated sofware for 5 gateways lerpetualCPSM-NGSM5-LOG
CPSB-DMN-10 10 domains package for Multi<iomain Security Management Endpoint Management pre-defined system for unlimited number of endpoints and connection pointsCPSM-PUO03-E
CPSB-VS-10
10 Virtual Systems package. It enables to virtualize any gateway, with Software Blades for customized protections against evolving network threats. while delivering a lower total cost of ownershi
CPSB-MOB-U
Mobile Access Blade unlimited. The solution provides enterprise-grade remote access via SSL VPN for simple, safe and secure mobile connectivity to email, calendars, contacts and corporate applications
CPSB-EVS-COMP-5-
IY SmartEvent, SmartReporter and Compliance bundle for Smart-1 for 5 latew avs Infinity Global Services: https: Wigs.checkpoint.com/