6 2
0 4
City Council
Staff Report
From: City Manager
Report Type: CONSENT CALENDAR
Lead Department: IT Department
Meeting Date: March 3, 2025
Report #:2412-3951
TITLE
Approval of Two Professional Services Agreements, C25193332 and C25193333 with EPI-USE America to Implement Identity Access Governance (IAG) Solutions, SAP Signavio/LeanIX, SAP Governance, Risk, Compliance (GRC) for a Total Not-To-Exceed Amount of $289,080, for a Period of One Year; CEQA Status - Not a Project.
RECOMMENDATION
Staff recommends that the City Council approve and authorize the City Manager or designee to execute two contracts with EPI-USE America, C25193332 and C25193333 to implement Identity Access Governance (IAG) Solutions, SAP Signavio/LeanIX, SAP Governance, Risk, and Compliance (GRC) for a term of one year, (February 24, 2025 to January 31, 2026), and for a total not-to-exceed amount of $289,080, including $262,800 for basic services and $26,280 for additional services (Attachment A and Attachment B).
BACKGROUND
City Council previously approved report #2412-39181 as item no. 5 on the January 21, 2025 consent calendar, authorizing the procurement of SAP Signavio/LeanIX, SAP Governance, Risk, and Compliance (GRC), and SAP Integration Suite of products. Two professional services agreements with EPI-USE America are required to help implement these tools into our SAP environment.
These tools are essential for enabling the City to meet critical compliance requirements, improving system management efficiency, and aligning with the recommendations outlined in the 2022 Baker Tilly Annual Risk Assessment report2. By establishing an automated framework for risk analysis, access monitoring, and governance of business processes, they will enhance 1 Staff report: https://cityofpaloalto.primegov.com/Portal/Meeting?meetingTemplateId=15920 2 FY22 Annual Risk Assessment – Baker Tilly, pp. 39-42:
https://www.cityofpaloalto.org/files/content/public/v/3/departments/city-auditor/reports-and-publications/fy22- annual-risk-assessment.pdf
6 2
0 4
the City’s compliance and security measures. EPI-USE America will support the preparation and implementation of these solutions.
ANALYSIS
Staff executed an exemption to competitive solicitation to execute these agreements with EPI- USE America due to the vendors current experience hosting and supporting the City’s current Enterprise Resource Planning (ERP) environment (PAMC: 2.30.360(b)(2)).
EPI-USE will provide staff with the following:
SAP Cloud Identity Access Governance (IAG) Implementation Timeline (10 weeks):
1. Project Kick-off, Requirement Gathering, Realization and Unit Testing– 4 Weeks
2. Integration and UAT testing support – 2 Weeks
3. Cutover and Production master data preparation – 1 Week
4. Post Go-live support and KT – 1 Week
5. Optional – Privileged Access Management (Realization & Testing)– 1 Week GRC Implementation:
1. Project Planning/Onboarding - 1 Week
2. Discovery Workshops - 4 Weeks
3. Standards & Conventions/FactSheets - 2/90 Minute Workshops
4. Process Modeling/LeanIX Configuration - 2/60 Minute Workshops
5. Rollout & Training - 90 Minute Training Class (number of classes TBD until team is identified. Admin and Users each get a 90-minute training class).
6. Deliverable Review - 1/90 Minute Meeting
7. Next Steps - 1/60 Minute Meeting
While the Information Technology Enterprise Division has expertise in managing SAP related projects, the complexity of this effort—particularly in implementing, configuring, and ensuring the solutions of these tools have been configured to meet vendor’s specifications—requires specialized expertise that exceeds current in-house capacity. This approach allows City staff to focus on leveraging strengths in project management and business stakeholders’ engagement while gaining access to advanced technical implementation expertise through the consultant.
FISCAL/RESOURCE IMPACT
Funding for these Professional Services Agreements are within budgeted levels adopted by the City Council in the Information Technology Department, no additional funding is requested.
The Information Technology Department (ITD) is funded by an Internal Service Fund (ISF) that allocates costs to other funds across the City to provide technology related services to other City departments and funds. Approximately 45% of the services provided are for the General 6 2
0 4
Fund with the remaining 55% for other funds such as Enterprise, special revenue, and other internal service funds.
STAKEHOLDER ENGAGEMENT
The services were coordinated with internal stakeholders and the service provider.
ENVIRONMENTAL REVIEW
The approval of these contracts is exempt from review under the California Environmental Quality Act (CEQA) under CEQA Guidelines section 15061(c)(3) because it can be seen that there is no possibility that the activity in question may have a significant effect on the environment.
ATTACHMENTS
Attachment A: EPI-Use America Inc. Contract C25193332
Attachment B: EPI-Use America Inc. Contract C25193333
APPROVED BY:
Darren Numoto, Chief Information Officer