City Council
Staff Report
From: City Manager
Report Type: CONSENT CALENDAR
Lead Department: IT Department
Meeting Date: June 8, 2026
Report #:2603-6190
TITLE
Approval of Purchase Order C27197380 with Optiv Security, Utilizing a State of California Department of General Services Software Licensing Program (SLP) SLP-24-70-0184Z Contract, to Procure Varonis Systems for a Three-Year Term with an Annual Amount of $154,043 for a Total Not-To-Exceed Amount of $462,129. CEQA Status - exempt under CEQA regulation § 15061(b)(3).
RECOMMENDATION
Staff recommends that City Council approve and authorize the City Manager or their designee to execute Purchase Order C27197380 with Optiv Security, utilizing the above-noted State of California Department of General Services Software Licensing Program SLP-24-70-0184Z1 contract to procure Varonis Systems over a three-year term (August 18, 2026 to August 17, 2029) with an annual amount of $154,043 and a total not-to-exceed amount of $462,129.
BACKGROUND
The City began using Varonis on August 18, 2023, under a three-year purchase order with annual payments of $146,000 and a total amount of $438,000. That purchase order also utilized a cooperative contract.
Varonis is currently deployed across the City’s hybrid IT environment to provide centralized visibility and monitoring for Active Directory, the City’s file storage servers, and Microsoft 365, including email, SharePoint, and OneDrive. The City stores and processes critical and sensitive information, including personally identifiable information, financial records, human resources data, and public safety-related information. Because these systems span both on-premises and cloud environments, the City has an ongoing need for tools that provide centralized visibility and consistent security controls across platforms.
1 Software License Leveraged Procurement Agreement:
https://caleprocure.ca.gov/PSRelay/ZZ_PO.ZZ_CTR_SUP_CMP.GBL?Page=ZZ_CTR_SUP_PG&Action=U&SETID=STAT E&CNTRCT_ID=SLP-24-70-0184Z
This renewal supports the City’s ongoing investment in secure and reliable technology infrastructure and is intended to maintain the City’s current cybersecurity capabilities without interruption.
ANALYSIS
Renewal of Varonis is recommended because it is a critical cybersecurity tool that supports the City’s ability to safeguard sensitive data, monitor user activity, and manage access permissions across key systems. Varonis provides centralized visibility, threat detection, and access governance across Active Directory, file storage servers, and Microsoft 365. These capabilities are not natively available in a single solution and are important to the City’s ability to manage risk in a hybrid IT environment.
Varonis enables the City to identify who has access to sensitive data and how that data is being used, monitor activity across Active Directory, file storage, and Microsoft 365, and generate real-time alerts regarding suspicious behavior, including potential ransomware activity. The platform also helps identify and remediate excessive, outdated, or otherwise inappropriate permissions. Without Varonis, the City would have limited ability to proactively detect unauthorized access, investigate abnormal activity, or reduce unnecessary exposure of sensitive data.
Renewal also supports the City’s cybersecurity and compliance obligations. The tool aligns with core NIST Cybersecurity Framework functions, including Identify, Protect, Detect, and Respond.
It also supports the City’s operational and audit requirements by maintaining detailed audit trails for data access and permission changes, which is important for compliance-related activities, including CJIS-related controls, state and local regulatory requirements, and public records obligations. This is also in alignment with the cybersecurity risk assessment recommendations included in the various information technology assessments completed by Baker Tilly, the City’s Auditor.
This procurement leverages cooperative contract SLP-24-70-0184Z, under which the California Department of General Services conducted a competitive solicitation and awarded Optiv Security as an approved vendor, allowing eligible public agencies to use the competitively solicited terms. The vendor offered a flat annual rate of $154,043 with no annual escalation, for a total not-to-exceed amount of $462,129 over three years. In addition to utilizing cooperative pricing, City staff negotiated below the cooperative contract price sheet rates, generating additional cost savings while maintaining the required maintenance and support coverage.
Renewal is also financially prudent when compared with the potential cost of a cyber incident.
Failure to renew may increase the City’s exposure to data breaches, ransomware incidents, compliance gaps, and reduced audit visibility. A significant cyber incident could result in incident response and remediation costs, legal liabilities, regulatory penalties, operational downtime, and service disruption.
FISCAL/RESOURCE IMPACT
The annual amount for this purchase order is $154,043, for a three-year total not-to-exceed amount of $462,129. Costs begin in FY 2027; funding for this contract is included in the FY 2027 Proposed Budget and is subject to City Council approval, consistent with how multi-year technology support contracts are funded in future years.
ITD is supported through an internal service fund model. Approximately 49% of ITD’s costs are funded by the General Fund, with the remaining 51% supported by enterprise and special revenue funds. As a result, the cost of this contract will be supported through ITD’s internal service fund structure and allocated consistently with that funding model.
STAKEHOLDER ENGAGEMENT
Staff coordinated with internal City stakeholders to confirm that the renewal scope aligns with Citywide cybersecurity and operational requirements. Staff also worked closely with the vendor on the renewal quote to validate licensing needs, confirm service expectations, and ensure continued support for secure access to City applications, data, and services.
ENVIRONMENTAL REVIEW
The approval of this contract is exempt from review under the California Environmental Quality Act (CEQA) under CEQA Guidelines section 15061(b)(3).
ATTACHMENTS
Attachment A: Varonis Quote no. 4613705-2
APPROVED BY:
Darren Numoto, Chief Information Officer; Lisa Bolger, Assistant Director Information Technology/CTO