G\T Y OF
PISMO BEACH CITY COUNCIL STAFF REPORT
A�syo Bt Agenda Item #9.G
Meeting Date: December 3, 2024
TITLE:
ThinkGard Agreement for Security Information Event Management (STEM) and Security Orchestration Automation and Response (SOAR) Services RECOMMENDATION:
Adopt a Resolution authorizing the City Manager to enter into an agreement with ThinkGard, LLC to provide security information event management and security orchestration automation and response services for Fiscal Years 2025 through 2027.
DISCUSSION:
For Fiscal Year (FY) 2025 the City's five-year Information Technology (IT) Master Plan recommends that the City increase resources for auditing logs, log management, managed detection and response solution, and cybersecurity awareness. To meet these recommendations, staff solicited bids from four cybersecurity vendors which had been awarded government purchasing contracts that City could piggyback on.
Request For Proposals Process
Staff conducted a solicited competitive request for proposals (RFP) process to protect the City's cybersecurity posture. By working directly with pre-identified cybersecurity vendors, the City avoided disclosing sensitive details in a public forum, ensuring that critical information remained secure. Additionally, the City's Purchasing Policy and Procedures Manual allows piggyback purchases, provided the original contract was awarded through a competitive bidding process. This approach ensured compliance with procurement requirements while prioritizing the City's cybersecurity needs.
ThinkGard was awarded a purchasing contract by The Interlocal Purchasing System (TIPS) in May 2022 for cybersecurity services. TIPS is a cooperative purchasing program led by the Region 8 Education Service Center (ESC). Region 8 ESC is commissioned by the Texas state legislature to assist school districts to increase the efficiency and effectiveness of school operations. All TIPS contracts follow a competitive procurement process that meet the City's Purchasing Policy and Procedures Manual requirements.
ThinkGard
After evaluating the four solicited bids, staff and the City's IT services contractor, Channel Islands Technology Integrators' Group (CITIG), determined that ThinkGard's SIEM and SOAR services and its additional co-managed services were the best value and fit for the City. In its demos and presentation, ThinkGard emphasized its desire to build a cooperative relationship with the City. Unlike other some of the other vendors, ThinkGard would allow IT staff complete access to the cybersecurity monitoring, logging, and correlating tools. ThinkGard will do so in a co-managed system, similar to how CITIG and the City co-manage the City's IT infrastructure. This allows IT staff to quickly verify any alerts and gradually increase in-house cybersecurity expertise.
Council Agenda 12-3-2024 9.G-1
SIEM solutions collect all external and internal data from devices and monitors and analyze them. The SIEM solution provided by ThinkGard will correlate and analyze network security events and identify any unusual or suspicious activity within the City's IT infrastructure. It will make management of security easier and provide a single point comprehensive view of the City's IT infrastructure security. It can detect threats that cannot be identified by traditional methods such as signature-based techniques. By communicating and reconfiguring parts of the City's IT infrastructure, a SIEM solution can take certain automated actions on the detected threats. The SIEM solution will meet the IT Master Plan's recommendation for auditing of logs and log management.
SOAR solutions streamline and automate various security processes to help manage and improve an organization's security posture. The SOAR solution provided by ThinkGard will enhances the City's ability to respond to and manage cybersecurity threats effectively and efficiently. It will connect and integrate the City's various cybersecurity systems and tools. The SOAR solution will be able to standardize and automate cybersecurity tasks helping to prioritize threats and automate future responses. If a response is required, it will provide IT with a unified perspective of the City's cybersecurity systems, including reports and case management. The SOAR solution will meet the IT Master Plan's recommendation for a managed detection and response solution.
Additional services provided as part of ThinkGard's co-managed solution include tabletop exercises and documenting the City's cybersecurity incident response plan. The tabletop exercises will be similar to the City's Emergency Operations Center (EOC) exercises.
These tabletop exercises will help the City test its cybersecurity incident response plan and involve departments outside of IT. These services will meet the IT Master Plan's recommendation for increasing cybersecurity awareness.
Conclusion and Recommendation
Staff recommends that Council adopt a Resolution (Attachment 1) authorizing the City Manager to enter into an agreement (Attachment 1.A) with ThinkGard for SIEM and SOAR services for Fiscal Years 2025 through 2027.
FISCAL IMPACT:
The fiscal impact of adopting the subject Resolution is an additional $129,860 over three years, or an ongoing $42,120 per year for three years and a one-time payment $3,500.
The Technology Services Fund FY 2025 budget includes $65,000 per year to support this cost. Details of the budget and the cost per year are listed in Table 1 below. If approved, staff will budget the second and third years of the agreement in FY 2026 and FY 2027.
Council Agenda 12-3-2024 9.G-2
Table 1: Budget and Proposed Agreement Costs
Item Amount
FY 2025 Budget (ongoing) $65,000
Agreement Year 1 $45,620
Agreement Year 2 41,120
Agreement Year 3 41,120
Total Agreement Costs $129,860
ATTACHMENTS:
1. Resolution
1.A Exhibit A: Agreement and ThinkGard Quotation
Prepared by:
Jason Takagi, Information Technology Manager
Submitted by: Nadia Feeser, Administrative Services Director City Manager Approval:
Council Agenda 12-3-2024 9.G-3
Attachment 1
RESOLUTION NO. R-2024-XXX
A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF PISMO BEACH,
CALIFORNIA AUTHORIZING THE CITY MANAGER TO ENTER INTO AN
AGREEMENT WITH THINKGARD, LLC TO PROVIDE SECURITY INFORMATION
EVENT MANAGEMENT AND SECURITY ORCHESTRATION AUTOMATION AND RESPONSE SERVICES FOR FISCAL YEARS 2025 THROUGH 2O27
WHEREAS, the City's Information Technology (IT) Master Plan's cybersecurity recommendations included increasing IT resources for auditing logs, log management, managed detection and response solution, and cybersecurity awareness; and WHEREAS, staff solicited bids from four different cybersecurity firms for these services; and
WHEREAS, ThinkGard's security information event management (SIEM) and security orchestration automation and response (SOAR) services and its co-managed security services will meet the IT Master Plan's cybersecurity recommendations; and WHEREAS, ThinkGard was awarded a competitively procured cooperative government purchasing contract in 2022 by The Interlocal Purchasing System that meets the City's Purchasing Policy and Procedures Manual requirements for piggy-back purchasing; and WHEREAS, the Technology Services Fund FY 2025 budget has sufficient funding to support the cost of the first year of the agreement, and staff will budget the second and third years of the agreement in FY 2026 and FY 2027.
NOW, THEREFORE, BE IT RESOLVED that the City Council of the City of Pismo Beach hereby authorizes the City Manager to enter into a 3-year agreement with ThinkGard (Exhibit A) to provide security information event management and security orchestration automation and response services in the amount of $129,860 over three years, or an ongoing $42,120 per year for three years and a one-time payment $3,500 in the first year, starting in Fiscal Year 2025.
UPON MOTION OF Council Member , seconded by Council Member the foregoing resolution was adopted by the City Council of the City of Pismo Beach this V day of December 2024, by the following vote:
AYES:
NOES:
ABSENT:
ABSTAIN:
RECUSED:
Approved: Attest:
Council Agenda 12-3-2024 9.G-4
Attachment 1
Ed Waage, Mayor Erica Inderlied, City Clerk
IN WITNESS WHEREOF, I have hereunto set my hand and affixed the official seal of the City of Pismo Beach, California, on
Erica Inderlied, City Clerk
Council Agenda 12-3-2024 9.G-5
Attachment 1.A
11/22/24,8:58AM City of Pismo Beach,CA-STEM/SOAR rThKii n kG a rd
City of Pismo Beach, CA - SIEM/SOAR
Quote created: November 19,2024 Reference:20241119-222724748 City of Pismo Beach,CA Jorge Garcia
760 Mattie Rd [email protected]
Pismo Beach,California 93449 805-773-4657
United States
Jason Takagi
[email protected]
805-773-4657
Comments
This proposal for City of Pismo Beach includes pricing for ThinkGard's co-managed SIEM/SOAR Cybersecurity Services.
All applicable taxes will be assessed at time of billing.
The Interlocal Purchasing System(TIPS): https://www.tips-usa.com/TIPS ThinkGard contract number:220105
Audra Kincart-Account Executive ThinkGard
https:H21646602.hs-sites.com/ChILY3ULxN 1/8 Council Agenda 12-3-2024 9.G-6
Attachment 1.A
11/22/24,8:58 AM City of Pismo Beach,CA-SIEM/SOAR Products & Services
Item & Description SKU Quantity Unit Total
Price
Security Information Event ANY-ST- 1 $42,120.00 $42,120.00/year Management(SIEM)&Security 750G.01 /year for 3 years Orchestration Automation&
Response(SOAR)Services-
"Standard"(750 GB Consumption)
Includes the following support and mainte-
nance services
-SIEM&Log Management Review: Network,
system,&cloud visibility in one central loca-
tion.Central repository of all alarms and noti-
fications within the organization.
o ThinkGard identifies potential critical is-
sues.
o Creation of investigations for incident mon-
itoring and response
o Continuous endpoint monitoring&proac-
tive querying
-Executive reporting is provided at defined in-
tervals based on the customer's need.
Includes SIEM analysis to reflect trends ob-
served.
-Create unique dashboards within deploy-
ment.
-Review of data presented from behavioral
analytics and machine learning.Through this
and ThinkGard's own threat analytics,will pro-
vide highly accurate reporting on viable
threats.
-ThinkGard builds custom workflows for re-
sponse¬ifications to potential security&
infrastructure incidents.
o Custom tuning of events and alarms,with
alerting in real time,to protect environment.
o Orchestration and automation of actions
https://21646602.hs-sites.com/ChILY3ULxN 2/8 Council Agenda 12-3-2024 9.G-7
Attachment 1.A
11/22/24,8:58AM City of Pismo Beach,CA-STEM/SOAR Item & Description SKU Quantity Unit Total
Price
based on threat data analyzed by ThinkGard's
security team.
o Continued reporting of notifications based
on deployments and threat landscape.
-In the event of an incident,ThinkGard pro-
vides threat-hunting expertise.Will search
and analyze data to provide a timeline of the
compromise and evidence for incident re-
sponse.
24x7x365 real time response
The client will have same level of access to
the system and solution as ThinkGard teams.
-Incident Response Management can be
added for an additional fee
-Creation of Incident Response Plan upon re-
quest
-Conducting tabletop exercises(per request)
with IT staff to prepare in the event of an inci-
dent
This quote INCLUDES product pricing for:
AT&TAlienVault SIEM-SOAR.This product li-
censing is owned by the customer,not
ThinkGard.
(Consumption Tier:750 GB Monthly)Standard
Plan:(3-Year Agreement) I Consumption Tier:
750 GB(Monthly)
• Includes 4 sensors
•Search Event Storage:30 Days
•Cold storage of logs:duration of contract
Notifications:
o Email
oAWS
o SNS
o Slack
o Data Dog
Includes:
https://21646602.hs-sites.com/ChILY3ULxN 3/8 Council Agenda 12-3-2024 9.G-8
Attachment 1.A
11/22/24,8:58AM City of Pismo Beach,CA-STEM/SOAR Item & Description SKU Quantity Unit Total
Price
o Built-In Compliance Reports
o Federation Ready
o Advance AlienApps mediation.
CyberGard Implementation Services CG-IMP 1 $3,500.00 $3,500.00 A one-time fee that includes implementation,
deployment,and optimization of all proposed
CyberGard solutions and services.
Annual subtotal $42,120.00
One-time subtotal $3,500.00
Total $45,620.00
Signature
Before you sign this quote,an email must be sent to you to verify your identity. Find your profile below to request a verification email.
Jorge Garcia
Verify to sign
[email protected]
Nolan Griffin
[email protected] Verify to sign
This quote expires on December 6,2024
https://21646602.hs-sites.com/ChILY3ULxN 4/8 Council Agenda 12-3-2024 9.G-9
Attachment 1.A
11/22/24,8:58 AM City of Pismo Beach,CA-STEM/SOAR
MANAGED CYBERSECURITY AGREEMENT TERMS
Term:This Agreement between Client and THINKGARD is effective upon the date signed by the Client, shall remain in force for a period of 3 year(s),and be reviewed yearly to address any necessary adjustments or modifications.Should adjustments or modifications be required that affect the monthly fees paid for the services rendered under this Agreement,said fee adjustment will be negotiated and agreed to between the Client and THINKGARD in writing.Absent such a written adjustment,the Agreement automatically renews for a subsequent one-year term beginning on the day immediately following the end of the Initial Term unless either party gives the other thirty(30)day's prior written notice of its intent not to renew this Agreement.This Agreement cannot be automatically renewed more than five(5)times.
This Agreement may be terminated by the Client upon ninety(90)days written notice if THINKGARD:
• Fails to substantially complete or satisfy its obligations under this Agreement and does not cure any identified failure within ninety(90)days of receipt of written notice of said failure from the Client;
• Breaches any material term or condition of this Agreement and fails to remedy such breach within ninety(90)days of receipt of written notice of such a breach from the Client;Terminates or suspends its business operations,unless it is succeeded by a permitted assignee under this Agreement.
If either party terminates this Agreement,THINKGARD will,if requested by the Client,assist Client in the orderly termination of services,including timely transfer of the services to another designated provider.
Client agrees to pay THINKGARD the actual costs of rendering such assistance.Actual costs could include but are not limited to:Training,data transfer,license transfers or equipment de-installation. If Client terminates this Agreement without cause,Client agrees to pay THINKGARD a termination fee equal the actual hard costs that ThinkGard incurred as result of this early cancellation.Client agrees to allow THINKGARD to assign,delegate,subcontract services to third parry competent contractors approved by THINKGARD and client.
Services Provided: Includes the support and maintenance of a suite of Cisco security products listed in THINKGARD proposal,ongoing Managed Security Services and CyberSecurity Incidence Response services.THINKGARD will install any equipment if applicable. Incident Response services itemized in proposal.
Catastrophe Service:In the event of a breach,fees for consulting are included in Monthly Services Agreement.
Interference:Client shall not,directly or indirectly,during the term of this Agreement and for twelve(12) months following its termination,induce or influence any employee of THINKGARD or any other person or entity to terminate their relationship with THINKGARD.
Warranty_ ThinkGard warrants:(1)it shall provide the Services in a professional,workmanlike manner consistent with this Agreement and generally accepted industry standards of care and competence;and (2)for ninety(90)days after date of delivery,the Services shall materially conform to their descriptions set forth on the proposal These warranties are voided to the extent of any alterations to any Services are not performed or authorized by the Company.Client must bring any breach of these warranties to the Company's attention promptly in writing within thirty(30)days of the date that the Services that are the subject of the breach were performed.Upon any breach of the warranties set forth in this section,the Company may,at its election:(1)use reasonable efforts to re-perform such Services or to correct any defect,at no charge to Client;or(2)terminate the applicable Service and return of the fees paid by Client to the Company for such non-conforming Services(without interest).THE REMEDIES SET FORTH ABOVE https://21646602.hs-sites.com/ChILY3ULxN 5/8 Council Agenda 12-3-2024 9.G-10
Attachment 1.A
11/22/24,8:58AM City of Pismo Beach,CA-SIEM/SOAR
SHALL BE CLIENT'S SOLE REMEDY AND THE COMPANY'S SOLE LIABILITY WITH RESPECT TO A BREACH BY COMPANY OF THE WARRANTIES SET FORTH IN THIS SECTION.
ThinkGard will not be responsible for any unauthorized access,alteration,theft or destruction of Client Data,unless caused as a result of ThinkGard's negligence or intentional misconduct,in which case ThinkGard's only obligation and Client's exclusive remedy is for ThinkGard to use commercially reasonable efforts to restore the Client Data from the most recent back-up.ThinkGard is not responsible for unauthorized access,alteration,theft or destruction of Client Data arising from Client's own or its Authorized Users'actions or omissions in contravention of the Documentation.
In the event that ThinkGard has determined that a Security Breach will or is likely to cause harm to the Client or an Authorized User,ThinkGard will,as promptly as practicable but in no event later than as required by law, provide Client with notice of the Security Breach.After initial notification,ThinkGard will keep Client updated at periodic intervals on the steps taken by ThinkGard to investigate the Security Breach including providing a reasonably detailed incident report,including measures to be taken by the Client to minimize potential damages.Such report will be provided promptly but no later than thirty(30) days following completion of the report.The Parties understand and agree that if ThinkGard is prevented by law or regulation from providing such notice(s)and/or reports within the time frames,such delay shall be excused.
Confidentiality_Each party shall treat the information received from the other party that is designated as confidential("Confidential Information")as a trade secret and strictly confidential.THINKGARD designates the Deliverables and all information relating to the Deliverables as confidential. Both parties shall:(i)restrict disclosure of Confidential Information to employees and agents solely on a"need to know"basis;(ii)advise employees and agents of their confidentiality obligations;(iii)use commercially reasonable means to comply with the confidentiality obligations of this Agreement;and(iv)notify the other of any unauthorized possession or use of that party's Confidential Information as soon as practicable after receiving notice of same. Notwithstanding the foregoing,neither party shall be obligated to preserve the confidentiality of any information which:(i)was previously known;(ii)is a matter of public knowledge;(III)was or is independently developed;(iv)is released for disclosure with written consent;or(v)is received from a third party to whom the information was disclosed without restriction.
Equipment and Facilities:Client agrees that THINKGARD may utilize certain items of Their equipment and may gain access to certain parts of The Client's facilities. Facility access may be denied for any reason at any time,however if access to facilities is denied,The Client understands that THINKGARD may be unable to perform their duties adequately and if such a situation should exist,THINKGARD will be held harmless.
Passwords:THINKGARD acknowledges that it must have remote access to perform their duties under this Agreement.THINKGARD will require a CCO(Cisco Connection Online)associated with customer's Cisco Security and licensing,to perform mutually agreed upon services.
No Third Party Beneficiary_Client shall not subcontract,assign,subrogate or transfer any interest, obligation or right under this Agreement without prior written consent from ThinkGard,and any such attempt shall be null and void.Except that a board of a governing authority cannot bind their successors in office to contracts beyond their term of office and extension beyond its term is voidable by the successor Board.
Dispute Resolution:This Agreement shall be governed by the state and Federal laws applicable to the State of California,U.S.A.
Limitation of Liability_ IN NO EVENT,WHETHER IN TORT,CONTRACT,OR OTHERWISE,SHALL
THINKGARD OR ITS LICENSORS, PARTNERS,OR SUPPLIERS BE LIABLE TO CUSTOMER OR ANY THIRD
PARTIES UNDER THIS AGREEMENT FOR ANY INDIRECT,SPECIAL, INCIDENTAL, PUNITIVE,OR https://21646602.hs-sites.com/ChILY3ULxN 6/8 Council Agenda 12-3-2024 9.G-11
Attachment 1.A
11/22/24,8:58 AM City of Pismo Beach,CA-SIEM/SOAR
CONSEQUENTIAL DAMAGES,COSTS,LOSSES OR EXPENSE,(INCLUDING BUT NOT LIMITED TO LOST
PROFITS,LOSS OR INTERRUPTION OF USE, LOSS OF DATA,DAMAGE TO NETWORKS, EQUIPMENT,OR THE
COST OF PROCUREMENT OF SUBSTITUTE GOODS OR TECHNOLOGY),OR ANY AMOUNTS IN EXCESS OF THE ORIGINAL AMOUNTS PAID TO THINKGARD.THE FOREGOING LIMITATIONS SHALL APPLY TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW.
Force Majeure&Malicious Acts:THINKGARD shall not be liable for any loss,damage or failure due to causes beyond its control,including strikes,riots,earthquakes,epidemics,wars,fires,floods,weather, power failure,telecommunications and/or internet interruptions,the failure or closure of a financial institution,computer malfunctions,acts of God or any other failure,interruption or error not directly caused,or reasonably anticipated,by THINKGARD.
Taxes:Client shall be solely responsible for any taxes or similar charges arising out of this Agreement, including all applicable Federal,State or local sales taxes,customs,duties,use taxes,value-added taxes, excise charges or brokerage fees.Client shall also be solely responsible for assessing and remitting payment for any such items to the appropriate authorities.
Warranty of Representative Capacity;Client warrants that its undersigned representative has the authority and capacity to bind Client to the terms and conditions of this Agreement and understands that THINKGARD has reasonably relied upon such warranty and promises as an inducement to enter into this Agreement.
Severability_If a court or quasi-judicial body subsequently determines that one or more of the provisions of this Agreement is unlawful,then the provisions deemed unlawful,and only those provisions,shall be rendered void and shall be considered severed from the other terms and conditions of this Agreement.
Additional Documents:The Parties agree to cooperate to the extent possible and execute any and all supplementary documents and to take all additional actions which may become necessary or appropriate to give full force and effect to the basic terms and intent of this Agreement.
Remedy Upon Client's Payment Default:Client agrees that in the event it defaults on its payment obligations under this Agreement,THINKGARD shall:a)To the extent provided by law have the right to pursue any and all available legal remedies to collect said sums,including through the immediate filing of an action in a court of law in California and/or the federal jurisdiction which includes said United States,California.
Understanding_The undersigned have read and understood each and every provision of this Agreement and agree that,at a minimum,prior to executing this Agreement,they were each given sufficient time and the opportunity to present the Agreement to an attorney for clarification of the meaning and function of each and every provision.
Integrated Agreement:This Agreement embodies the entire understanding of the Parties and all of the terms and conditions with respect to the matters discussed in this Agreement and that the terms are contractual and are not mere recitals.The Parties agree this Agreement supersedes and annuls any and all other or former Agreements,contracts,promises or representations,whether written or oral, expressed or implied,and it may not be altered,superseded or otherwise modified except in a writing signed by the party to be charged.
Immigration:By signing this contract,the contracting parties affirm,for the duration of the Agreement, that they will not violate federal immigration law or knowingly employ, hire for employment,or continue to employ an unauthorized alien within the State of California. https://21646602.hs-sites.com/ChILY3ULxN 7/8 Council Agenda 12-3-2024 9.G-12
Attachment 1.A
11/22/24,8:58 AM City of Pismo Beach,CA-SIEM/SOAR By signing ThinkGard's Proposal,Client agrees to pricing and services terms indicated on proposal pricing pages.
Questions?Contact me
4 Audra Kincart
Account Executive
[email protected]
ThinkGard
3000 Galleria Circle,Suite 1130
Hoover,AL 35244
United States
https://21646602.hs-sites.com/ChILY3ULxN 8/8 Council Agenda 12-3-2024 9.G-13