City Council
Report
City Council Meeting: August 27, 2024
Agenda Item: 5.O
1 of 4
To: Mayor and City Council
From: Feroz Merchhiya, Chief Information Officer, Information Services Department Subject: Award Sole Source Purchase Order to vCloud Technologies, Inc. for Proofpoint's Email Security Solution
Recommended Action
Staff recommends that the City Council:
1. Adopt a finding of no possibility of significant effect pursuant to Section 15061(b)(3) (Common Sense Exemption) of the California Environmental Quality Act (CEQA) Guidelines;
2. Authorize the Procurement Manager to issue a purchase order with vCloud Tech Inc. for Proofpoint’s Email Security Solution for the Information Services Department in an amount not to exceed $52,046 for an initial five-month term, with two (2) additional one-year renewal options to extend on the same terms and conditions for a total amount not to exceed $316,957 (including a $28,815 contingency) with future year funding contingent on Council budget approval.
This recommended authorization is made as an exception to the competitive bidding process pursuant to Section 2.24.250(c).
Summary
Ensuring the security and integrity of email and technology systems is critical to the delivery of City services and operations. Proofpoint’s Email Security solution, available for purchase through vCloud Tech Inc. (vCloud), provides critical protection against email-based threats such as phishing, malware, and business email compromise (BEC).
Procuring Proofpoint’s Email Security solution will ensure the City remains secure and resilient against emerging email threats. Staff seeks City Council approval to authorize the Procurement Manager to issue a purchase order with vCloud for Proofpoint’s Email Security in the amount not to exceed $52,046 for an initial five-month term, with two (2) additional one-year renewal options each in an amount not to exceed $118,048, to 2 of 4
extend on the same terms and conditions for a total amount not to exceed $316,957, which includes a 10% contingency.
Discussion
Since 2019, the City of Santa Monica has relied on Proofpoint’s Email Security to secure its inbound, outbound, and internal emails. As a leading email security solution, Proofpoint’s Email Security offers unique insights into email-based threats and proactively implements protective measures as new threats emerge. Email is one of the most popular vectors for cyberattacks. Without a robust email security solution in place, the City would be vulnerable to a myriad of cyber threats.
The City has successfully and responsibly protected itself with other Proofpoint products purchased through vCloud in the past. On December 12, 2023, City Council awarded Bid #4471 to vCloud to provide Proofpoint's Intelligent Classification and Protection, Enterprise Data Loss Prevention, and Web Security solutions to monitor and safeguard the City’s data stored with cloud-based providers, strengthen identity management, and provide greater cybersecurity risk prioritization to aid in cyberattack prevention.
Proofpoint’s Email Security has demonstrated its effectiveness by intercepting emails containing unknown malware or links to new phishing sites before they reached City employees. In 2024, from April-July, more than half of all incoming emails were blocked as threats, significantly reducing the City’s exposure to cyber risks. Only a fraction of emails were ultimately delivered, underscoring the critical role that Proofpoint’s Email Security plays in maintaining the City’s digital security.
Switching to a new email security solution could disrupt current workflows and require time for integration and adaptation. By continuing with Proofpoint’s Email Security, the City can maintain consistent security measures without interruptions to email operations. Transitioning to a new solution could also incur significant costs, including the purchase of new licenses, implementation fees, and additional training for staff.
Continuing with Proofpoint’s Email Security avoids these expenses and leverages existing investments in the current system. Additionally, City staff are already familiar 3 of 4
with Proofpoint’s interface and functionality, minimizing the need for extensive retraining and ensuring a smooth continuation of operations.
Proofpoint’s Email Security solution aligns with the City’s commitment to protecting its digital assets. This initiative supports the goal of minimizing cyber threats and ensuring the safety and security of City communications.
Vendor Selection
Exception to Competitive Bidding
Staff recommends vCloud Tech Inc. (vCloud) to provide Proofpoint’s Email Security solution as an exception to competitive bidding per Muni Code 2.24.250 (c). The National Association of State Procurement Officials (NASPO) conducted a competitive bidding process awarding vCloud as an authorized reseller. Under the State of California’ Participating Addendum, the City of Santa Monica is eligible to piggyback on the NASPO Master Contract Number: AR2472, Contract Number: 7-17-70-40-05. The City of Santa Monica intends to utilize this agreement, which not only ensures competitive pricing but also aligns closely with the City’s requirements for an email protection solution.
c. competitive procedures were followed by a governmental agency, federal, state, county, city, joint powers agency, special district, or cooperative purchasing agency and the goods or services are supplied to the City at the same or better price;
Environmental Review
The proposed agreement with vCloud to provide Proofpoint Email Security software solution is exempt from the California Environmental Quality Act (CEQA) pursuant to Section 15061(b)(3) (Common Sense Exemption) of the CEQA Guidelines, which states that CEQA does not apply, “where it can be seen with certainty that there is no possibility that the activity in question may have a significant effect on the environment.” The email security solution is programmatic in nature and would not result in adverse physical effects on the environment, and so therefore, is exempt from CEQA.
Financial Impacts and Budget Actions
4 of 4
Staff seeks authority to approve available funding from the General Fund to authorize a purchase order with vCloud Tech Inc. for Proofpoint Email Security solution.
Agreement Request
FY 2024-25 Request
Amount Future Years Amount Account Number(s)
Total
Contract
Amount
$52,046 $264,911 01140001.529230 $316,957
Future year funding is contingent on Council budget approval.
Prepared By: Keenan McCardle, Principal Information Security Analyst Approved Forwarded to Council
Attachments:
A. Staff Report Item 5.J 12.13.2023 vCloud Proofpoint Cybersecurity Software B. vCloud - FY23-24_Oaks_Initiative_Disclosure_Form
C. Levine Act Disclosure Form