PA^b^0
y-^^
-7 0
* *
(0 z
<0 0<0 0
'^.^ ^^ 0^ ?-<re5
Agenda Report
May 4, 2026
TO: Honorable Mayor and City Council
FROM: Department of Information Technology
SUBJECT: AUTHORIZE THE CITlf MANAGER TO ENTER INTO A CONTRACT
WITH CARAHSOFT TECHNOLOGY CORPORATION FOR THE
IMPLEMENTATION AND ONGOING OPERATION OF MANAGED
ENDPOINT CYBERSECURITf PROTECTION AND MONITORING
SERVICES IN AN AMOUNT NOT TO EXCEED $968,124 FOR A
PERIOD OF FIVE YEARS
RECOMMENDATION:
It is recommended that the City Council:
1. Find that the proposed contract is exempt from the California Environmental Quality Act ("CEQA") pursuant to State CEQA Guidelines Section 15061 (b)(3), the "common sense" provision that CEQA only applies to projects that may have an effect on the environment;
2. Authorize the City Manager to enter into a contract, as a result of a competitive selection process, as specified by Section 4.08.047 of the Pasadena Municipal Code, with Carahsoft Technology Corporation for professional services to deliver Managed Detection and Response Services for five years in an amount not to exceed $968,124, which includes the base contract amount plus a twelve percent (12%) contingency to provide for any necessary change orders. Competitive bidding is not required pursuant to City Charter Section 1002(F), contracts for professional or unique services; and
3. Authorize the City Manager to approve no-cost amendments to the subject contract including durational extensions.
BACKGROUND:
The City's reliance on digital systems for public safety, community services, infrastructure operations, and internal functions has grown substantially in recent years.
At the same time, cities across the nation have experienced a steady rise in cybersecurity threats that can disrupt essential services, compromise sensitive information, and create significant financial and operational impacts. Ensuring continuity MEETING OF.5/4/2026AGENDA ITEM NO.5
Contract Authorization with Carahsoft Technology Corporation for MDR May 4, 2026
of operations now requires continuous monitoring and expert-guided response capabilities that extend beyond the capacity of internal staffing alone.
To strengthen the City's ability to identify and respond to emerging threats, the Department of Information Technology (DolT) sought a service model that provides around-the-clock monitoring of critical systems supporting every department, immediate review of alerts, and expert response support during potential cybersecurity incidents.
Managed Detection and Response (MDR) delivers these capabilities by supplying a dedicated team of cybersecurity specialists who continuously assess activity across the City's technological environment, distinguish legitimate threats from routine noise, and work with City staff to address issues that require action. This service helps fill operational gaps that cannot be fully met through existing staffing alone and reflects a best-practice approach widely adopted across municipal governments. As a managed service, MDR will be evaluated annually for performance and value. The City retains the ability to change providers or discontinue the service in future years while preserving full operational control and continuity of its MDR capabilities.
This investment also supports the City's broader risk management strategy and its ability to maintain strong cyber insurance coverage. Insurance underwriters now routinely assess organizations for continuous monitoring and rapid response capabilities as part of their minimum risk criteria, making MDR a key component for demonstrating the City's readiness and resiliency. Together with other cybersecurity investments made over the past several years, MDR strengthens the City's overall risk profile and contributes to a trajectory of securing higher cyber insurance coverage limits and reduced premiums by demonstrating robust cybersecurity practices and measurable improvements in risk reduction and system protection.
In September 2024, DolT staff submitted a competitive cybersecurity grant proposal in the amount of $225,000 through the State of California (State) to support these enhancements. Shortly thereafter, in December 2024, DolT received notice of award from the State. Pasadena was one of only 13 cities, among a total of 113 entities, to receive a grant award from a pool of over four-hundred grant applicants. On May 19, 2025, City Council adopted a resolution to accept the funding award and authorize the City Manager or his designee to execute all related program documents in connection with the grant award.
Following execution of all grant documents and confirmation of funding availability, DolT issued a Request for Proposals (RFP) for Managed Detection and Response (MDR) Services on November 6, 2025. The RFP was posted through OpenGov, the City's procurement platform, which generated notices to all vendors who have previously registered with the City for this particular commodity class. A total of 77 firms downloaded the RFP, and 15 proposals were submitted by the December 5, 2025 deadline, of which, 14 were responsive and considered for evaluation.
Contract Authorization with Carahsoft Technology Corporation for MDR May 4, 2026
A cross-departmental team composed of staff from DolT and the Water and Power Department reviewed and scored the proposals based on the criteria listed in the RFP, as shown below:
Evaluation CriteriaWeight
Implementation Approach, Operations, and Co-
Management
30%'0
Detection and Response Capabilities25%
Experience, Organizational Qualifications and
Compliance Alignment
20%
Cost Proposal20%
Small or Micro-Business5°/c'0
Total100%
Requirements of the grant prohibited the use of local preference as a facet of the evaluation process. Using the evaluation procedures and criteria stated in the RFP, the proposals were scored and ranked as follows:
RankProposerLocation
Score
(100 max)
1Carahsoft Technology Corporation | Reston, VA83.49
2Bulletproof Solutions, Inc.Waltham, MA83.01
3CDW Government LLCVernon, IL80.04
4NuHarbor Security IncColchester, VT77.57
5Long View SystemsDenver, CO73.77
6Global Solutions Group, Inc.Madison Heights, Ml72.93
7SecurityHQNew York, NY71.27
8Information Management
Resources, Inc. (IMRI)
Aliso Viejo, CA70.74
9AMTechnology LLCBowie, MD69.37
10ALINEDSRound Rock, TX68.10
11 I Golden Five LLCSimi Valley, CA66.47
12Stellar Services Inc.New York, NY63.76
13 | Lumifi CyberScottsdale, AZ61.43
14M2 tech LLCFremont, CA56.37
Attachment A contains the scoring summary of each criterion for the proposals.
The three top-ranked proposers advanced to the finalist stage, where structured reference checks and in-depth presentations were conducted. Based on the scoring above, staff recommends entering into a five-year contract with Carahsoft Technology Contract Authorization with Carahsoft Technology Corporation for MDR May 4, 2026
Corporation for an amount not to exceed $968,124. The amount includes one-time implementation costs, ongoing MDR sen/ices for five years, and a twelve percent contingency allowance.
The proposed contract would be set up as follows:
Base Implementation Amount $21,060
Ongoing MDR Services (5 Years) $842,064
Contingency Allowance (12%) $105.000
Contract "Not To Exceed" Amount $968,124
The recommended solution provides the City with modern enterprise-tevel monitoring and response capabilities essential for reducing cybersecurity risk and maintaining reliable operations. Implementation is expected to be completed within three to five months, with MDR services continuing through the five-year contract term.
There is currently one open purchase order contract with Carahsoft Technology Corporation to provide employment verification for Workforce Innovation and Opportunity Act (WIOA) program participants for the Career Services Division of the City Manager's Department.
COUNCIL POLICY CONSIDERATION:
The proposed contract supports the City Council's strategic goals to ensure public safety and maintain fiscal responsibility and stability by improving resilience against cybersecurity threats and maintaining continuity of critical City operations through enhanced enterprise-level security controls and monitoring capabilities.
ENVIRONMENTAL ANALYSIS:
The proposed contract is exempt from the CEQA pursuant to State CEQA Guidelines Section 15061 (b) (3), the "common sense" provision of CEQA (formerly the general rule), which applies to projects which may have the potential for causing a significant effect on the environment. The proposed action will not result in any new development or physical changes.
Contract Authorization with Carahsoft Technology Corporation for MDR May 4, 2026
FISCAL IMPACT:
The maximum cost of the proposed contract, including contingencies, will be $968,124 over five years. Funding for this action will be addressed by the utilization of State grant funding in the amount of $163,000 for the first year of expenses and annual and future budgeted appropriations in the DolT Administration operating account. As an internal sen/ice department, DolT is funded through fixed rate charges to City departments. As a result, a portion of this contract will impact the General Fund, with the exact amount varying based on department utilization and annual rates. It is anticipated that approximately $21,060 will be spent during the current fiscal year and the remaining amount on the contract will be spent over the next five fiscal years. There are no indirect or support costs anticipated as a result of this contract award.
Respectfully submitted,
Ml
35^JfK ARZCS^JfK ARZOUMANIANS
Acting Chief Information Officer
Department of Information Technology
Prepared by:
t^
Michael Royer
IT Security Officer
Department of Information Technology
Approved by:
.^<
MATTHEW E. hTAWKESWORTH
Interim City Manager
Attachment A: Summary of Proposal Scoring