y^^
0 z
Si °0
fl.^^
TO:
DEPARTMENT OF INFORMATION TECHNOLOGY
MEMORANDUM
HONORABLE MAYOR AND CIT/ COUNCIL
FROM: SERJIK ARZOUMANIANS, ACTING CHIEF INFORMATION OFFICER DATE: JUNE 8, 2026
SUBJECT: PROPOSED CONTRACTWITH CARAHSOFT TECHNOLOGY CORPORATION FOR
IMPLEMENTATION AND ONGOING OPERATION OF MANAGED ENDPOINTCYBERSECURITI'
PROTECTION AND MONITORING SERVICES
Executive Summary
On May 4, 2026, the Department of Information Technology (DolT) submitted a City Council agenda report to authorize the City Manager to enter into a contract with Ca rah soft Technology Corporation (Carahsoft). As a result of a competitive selection process, as specified by Section 4.08.047 of the Pasadena Municipal Code, Carahsoft's proposed solution for professional services was selected to deliver Managed Detection and Response (MDR) Services for up to five years in an amount not to exceed $968,124, which includes the base contract amount plus a twelve percent (12%) contingency to provide for any necessary change orders.
At the meeting, concerns were raised over Carahsoft's holding of contracts with the United States Department of Homeland Security (DHS), inclusive of the Immigration and Customs Enforcement (ICE) Division. Given those concerns, the agenda item was held and referred to the Economic Development and Technology (ED Tech) Committee for further discussion addressing those concerns.
The EDTech Committee reviewed the staff recommendation to authorize entering into a contract with Carahsoft at their regular meeting on May 19, 2026. The Committee agreed the item should return to the City Council with several clarifications to enhance transparency and ensure that Council has the necessary context to make an informed decision. These clarifications relate to: (1) identifying Carahsoft and its subcontractor Quzara LLC (Quzara) and their respective roles; (2) providing a clearer picture of Carahsoft's DhlS and ICE federal contract counts; (3) providing information on any contracts Quzara has with DHS and ICE, (4) explicitly stating that data protection requirements are embedded in the proposed contract; and (5) briefly summarizing the broader ethical procurement considerations discussed.
Following the discussion and staff agreementwith the additional clarifications to be provided, which are outlined below, the Committee was comfortable moving the contract forward for Council approval.
Key Clarifications to Supplement the Staff Agenda Report
1. Roles of Carahsoft and Quzara
06/08/2026
ITEM 20
Contract with Carahsoft Technology Corporation for MDR Services June 8, 2026
Carahsoft serves as a reseller, while Quzara is the actual service provider responsible for delivery of all monitoring and response services of the MDR solution. The City would enter into both a procurement contract with Carahsoft and a services agreement with Quzara, which together become part of the public record.
Carahsoft does not develop or operate the underlying MDR technology or any associated services and has noaccesstoany City information within the MDR services delivered; it functions only as a distribution and procurement partner for the service provider.
2. Carahsoft's DHS and ICE Contract Portfolio
To address and provide context for community concerns raised, Carahsoft's federal contracting footprint is substantial:
Approximately 32,000 active federal contracts
224 contracts with the DHS
4 contracts with ICE
This information illustrates that ICE related work represents an extremely small fraction of the company's overall federal contract portfolio.
3. Quzara's Federal Government Contract Portfolio
To ensure clarity and transparency for the proposed service provider relationship, Quzara's federal contracting footprint contains 24 active contracts, including:
22 with the Department of Treasury
1 with the General Services Administration
1 with the International Boundary and Water Commission: U.S.-Mexico No contracts with DHS or ICE
4. Data Protection Requirements
The contract with Carahsoft and services agreement with Quzara incorporate the City's standard data protection clauses, which includes, "Vendor has no rights to use Organizational Data for any purpose other than to deliver the services contracted, unless otherwise authorized in writing by the City." This requirement is embedded in the Request for Proposals (RFP) document, which is attached and becomes part of the final executed contracts.
The services agreement with Quzara also includes language strengthening the contractual data protections, "The City retains all rights, title and interest in data and information input, uploaded, transmitted, or otherwise provided by or on behalf of the City into the vendor provided solution ("Organizational Data"). All Organizational Data shall remain the sole and exclusive property of the City. Vendor has no rights to use Organizational Data for any purpose other than to deliver the services contracted, unless otherwise authorized in writing by the City." This clarification addresses questions raised about data exposure and inter-agency sharing.
5. Context: Ethical Procurement Considerations
The Committee engaged in a wider discussion about how the City could evaluate the ethical conduct of vendors, focusing especially on their connections with DHS, ICE, or companies providing Contract with Carahsoft Technology Corporation for MDR Services June 8, 2026
surveillance technology. Key points included:
The difficulty of drawing bright lines, as most large technology companies offer a wide variety of technology solutions across all industries.
The need for a more structured policy framework before potentially incorporating such considerations into procurement scoring.
Ongoing work aligned with Council's April 6, 2026, direction to collect vendor DHS and ICE contracting information over 12 months without impact on contractor selection to allow for a fully informed evaluation of further actions.