CITY OF SEBASTOPOL CITY COUNCIL
AGENDA ITEM REPORT FOR MEETING OF: October 7, 2025
=========================================================================================== To: Honorable Mayor and City Councilmembers
From: Ana Kwong – Administrative Services Director
Subject: Receipt of Results from the Request for Proposals for City IT Assessment Audit and Authorize City Manager to Reject the Proposals
=========================================================================================== RECOMMENDATIONS:
Staff recommends the City Council Receive the Results from the Request for Proposals for City IT Assessment Audit, Authorize the City Manager to Reject the Proposals.
EXECUTIVE SUMMARY:
June 5, 2025, City staff issued an RFP for IT audit assessment to 9 of IT companies as listed below. The deadline to submit such proposal was July 5, 2025. As of such date, the City only received 1 response.
1. Sonoma Tech Parterns - [email protected]
2. Progent - [email protected]
3. Sonoma Tech - [email protected]
4. GoSr Tech - [email protected]
5. Clarityreached - [email protected]
6. Apex - [email protected]
7. Portola Systems - [email protected]
8. United ECM - [email protected];
9. Valley Tech Logic - [email protected]
BACKGROUND:
Prior to 2017, the City lacked consistent IT support. IT services were reactive—issues were addressed by a local independent technician who assisted when available. At that time, the City operated entirely on Apple computers, which created compatibility challenges with Microsoft Office files received from external sources, hindering operational efficiency.
To transition to a PC-based environment, a secure server setup was required. Initially, the server rack was located in an open area. The Finance Department requested its relocation to a more secure upstairs room. Public Works coordinated with an electrician to reroute the necessary wiring, and the independent technician who assisted the City on all IT needs agreed to complete the final connections once electrical work was done.
However, during the relocation, the technician was unable to complete the wiring due to technical difficulties. To ensure continuity of operations by the next working day Monday, a specialized electrician was brought in to finish the job over the weekend.
Following this incident, alternative IT support options were explored. After contacting several providers, only Marin IT responded. With approval from the former City Manager, Marin IT was engaged and has provided IT services since Fiscal Year 2017–18.
Agenda Item Number 5 Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
DISCUSSION:
After the City transitioned to a more secure and centralized IT infrastructure in 2017, Marin IT became a steady and reliable partner. While no consultant is without flaws, Marin IT has consistently delivered results and remained responsive through every phase of the City’s evolving technology needs.
Their contributions have been substantial: migrating the City from Apple to PC systems, transitioning our domain from .org to .gov, deploying two-factor authentication, implementing VPN access, creating a centralized support platform, and providing dependable onsite assistance. These efforts have helped stabilize and modernize the City’s IT environment.
It is common practice to issue RFPs periodically to evaluate current service providers. Given that Marin IT has been providing service to the City for a long period of time without competitive evaluation, the City Council previously provided direction for staff to issue an RFP for IT services.
STAFF ANALYSIS:
City staff, particularly in Administrative Services, are not IT experts. Rather, staff play a supporting role, not a technical one, and a transition to a new IT services provider would require expertise and capacity that staff do not presently have. Accordingly, the City issued an RFP for IT audit assessment. The goal of the RFP was to retain a qualified professional who could evaluate the City’s IT system in order to help the City prepare a comprehensive RFP for IT Services. The RFP was sent to 9 companies, and posted the RFP on the City’s website.
Only one firm responded—with a proposal priced at $40,000. This reflects a broader trend of limited vendor capacity and rising costs. However, this cost was not budgeted for the IT assessment. Staff do not believe that moving forward with the IT audit is cost effective.
Over the coming months, staff will be reaching out to peer agencies of similar size to explore whether any have recently issued IT-related Requests for Proposals (RFPs). The goal is to identify relevant examples that could inform and streamline our own RFP development process. Where appropriate, we may adapt language or structure from these existing documents to better align with our specific needs and objectives.
BUDGET COMMITTEE REVIEW
This item was discussed and reviewed by the Budget Committee on September 15, 2025. The committee is not recommending a $40,000 IT audit proposal from a single vendor and instead in agreement for staff to reject the propsoal and to explore community expertise and contact other cities for IT service RFP examples.
CITY COUNCIL GOALS/PRIORITIES/ AND OR GENERAL PLAN CONSISTENCY:
This agenda item represents the City Council’s goals/priorities as follows:
Goal 4 – High Performance Organization
Action Plan 9 - IT Audit (approved during earlier Council Meeting) Conducting an IT audit to assess the city's IT needs before going out to a Request for Proposal (RFP) for IT support services. The audit would focus on various aspects such as system hardware, software, security, internal and Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
external IT standards, and the efficiency and effectiveness of the IT system.The goal is to ensure that the IT infrastructure is robust, secure, and aligned with the city's objectives.
This agenda item represents the City Council General Plan Consistency (if applicable): Not Applicable
FISCAL IMPACT:
Accepting this IT audit RFP would result in a fiscal impact of $40,000. Currently, the adopted FY25–26 budget does not allocate funding forsuch an audit. Therefore, if the City Council choosesto proceed with thisinitiative, a budget amendment will be required to accommodate the associated costs. It is important to note that the adopted budget includes only a modest surplus, and approving this item would eliminate that surplus and result in a general fund deficit.
COMMUNITY OUTREACH:
This item has been noticed in accordance with the Ralph M. Brown Act and was available for public viewing and review at least 72 hours prior to the scheduled meeting date. The City has also used social media to promote and advertise the City Council Meeting Agenda Items.
As of the writing of this agenda item report, the City has not received any public comment. However, if staff receive public comment from interested parties following the publication and distribution of this agenda item report, such comments will be provided to the City Council as supplemental materials before or at the meeting.
RESTATED RECOMMENDATION:
Staff recommends the City Council Receive the Results from the Request for Proposals for City IT Assessment Audit, Authorize the City Manager to Reject the Proposals.
CITY COUNCIL OPTIONS:
1. Acceptance of the RFP Audit
2. Authorize City Manager to Reject of the RFP Audit
ATTACHMENTS:
Original RFP IT Audit Assessment
Portola Systems Response to RFP
APPROVALS:
Department Head Approval: Approval Date: 9/18/2025
CEQA Determination (Planning): Approval Date: 9/18/2025 This action is exempt from the California Environmental Quality Act (CEQA) because it is not a project which has potential for resulting in either a direct physical change in the environment, or a reasonably foreseeable indirect physical change in the environment, pursuant to CEQA Guidelines.
Administrative Services (Financial): Approval Date: 9/18/2025 Costs authorized in City Approved Budget: ☐ Yes ☐ No N/A Account Code (if applicable) ____________________________ City Attorney Approval Approval Date: __9/29/25_____
City Manager Approval: Approval Date: __9/29/25____
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 1
CITY OF SEBASTOPOL, CA
REQUEST FOR PROPOSALS (RFP)
FOR
INFORMATION TECHNOLOGY ASSESSMENT
ISSUE DATE: June 5, 2025
ISSUED BY: CITY OF SEBASTOPOL
7120BODEGA AVENUE
SEBASTOPOL, CA 95472
INQUIRIES: POINT OF CONTACT (POC) – Ana Kwong
CITY OF SEBASTOPOL
7120 BODEGA AVENUE
SEBASTOPOL, CA 95472
EMAIL: [email protected]
PHONE: 707-239-9036
INFORMATION DUE: July 7, 2025
TABLE OF CONTENTS
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 2
PROPOSAL REQUIREMENTS AND FORMS PAGE
CHECKLIST............................................................................................................................................................. 3 INTRODUCTION.................................................................................................................................................... 4 BACKGROUND...................................................................................................................................................... 4 PURPOSE............................................................................................................................................................... 4 SCOPE OF WORK .................................................................................................................................................. 5 CONTRACT TERM ................................................................................................................................................. 6 RESPONSE INSTRUCTIONS ................................................................................................................................... 6 PROPOSAL CONTENT ........................................................................................................................................... 7 CONTACT WITH CITY EMPLOYEES / WRITTEN QUESTIONS................................................................................ 7 PRESENTATION AND INTERVIEW......................................................................................................................... 7 REVIEW AND EVALUATION.................................................................................................................................. 8 RIGHT OF REFUSAL............................................................................................................................................... 9 PROCUREMENT SCHEDULE ................................................................................................................................. 9 EXPENSE OF PREPARING RESPONSES TO THIS RFP............................................................................................. 9 PUBLIC RECORDS................................................................................................................................................ 10 TAX EXEMPTION................................................................................................................................................. 10 INCOME TAX....................................................................................................................................................... 10 COMPLIANCE...................................................................................................................................................... 10 INDEMNIFICATION/INSURANCE ........................................................................................................................ 10 RELATIONSHIP OF THE PARTIES......................................................................................................................... 11 ASSIGNMENT...................................................................................................................................................... 11 TERMINATION.................................................................................................................................................... 11
APPENDIX
RESPONSE/PRICE PROPOSAL FORM
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 3
CHECKLIST
Proposers are urged to complete this checklist to confirm that all required documents are included with their proposal.
I. REQUIRED PROPOSAL FORMS
TRANSMITTAL LETTER
RESPONSE/PRICE PROPOSAL FORM (attached)
EXCEPTIONS LETTER
LETTER INDICATING PROPOSER CAN MEET ALL INSURANCE REQUIREMENTS PER
CONTRACT WITH NO EXCEPTIONS
INTRODUCTION
The City of Sebastopol’s IT needs have historically been met by City staff with the help of an outside consultant.
City staff consist of the Administrative Services Director, who is the primary point of contact, and the Assistant City Manager. Our intent is to assess our current technology environment to determine existing strengths and weaknesses and provide a basis for future investment as well as best programs and practices for use for City government to include security. Sebastopol is known for its vibrant community and is known for its high quality services and responsiveness to citizen requests and concerns and for continual increased transparency to the community.
PURPOSE:
• Conduct an independent, comprehensive IT audit and assessment. • Identify strengths, weaknesses, risks, and improvement opportunities. • Provide recommendations for future investment,security, and best practices.
BACKGROUND
The City of Sebastopol is primarily a Microsoft Windows domain network environment. All of the City’s department buildings (other than the Sebastopol Police Department) have been connected via site to site VPN for shared networking & internetservices, telephone system, and a security camera system at City Hall, Public Works and Fire Department. We use Microsoft 365 for City Email services and MS Office 365 application systems. The City has approximately 53 Full Time employees. The City also has approximately 6 MS Windows servers and 40PCs, and 15 aptops, and outsideDataprograms such as SCADA, ARC GIS . The City’s public website is hosted by an outside vendor (Planeteria).
PURPOSE
The City is seeking the services of a qualified firm experienced in assessing Information Technology (IT) for the purpose of performing an Audit Assessment of the City’s IT environment.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 4
The successful proposer will review the existing IT infrastructure, systems, equipment, software, security, policies, and procedures for an independent, comprehensive assessment of the City’s computing infrastructure, and will perform interviews with various City staff (IT consumers) to determine vision, strengths and capabilities.
The following is a list of the departments within Sebastopol’slocal government:
• Administrative Services (Personnel/Finance/Water/Sewer Utility Billing) • Assistant City Manager/City Clerk
• City Manager
• Building
• Engineering/Public Works
• Fire (However this department will be merged with an outside fire district and will no longer be part of the City’s IT structure).
• Planning
• Police
The overall goal of this RFP is to obtain a firm, fixed priced contract for IT assessmentservices as described herein.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 5
SCOPE OF WORK
The IT Assessment can be summarized as a Current State Analysis.
The RFP respondent that is awarded a contract on the merits of its offer (hereinafter “successful proposer” or “contractor”) shall be responsible to:
Provide an assessment report of the City’s information technology system environment including:
The overall goal of this RFP is to obtain a firm, fixed priced contract for IT assessment services as described herein.
The RFP respondent that is awarded a contract on the merits of its offer (hereinafter “successful proposer” or “contractor”) shall be responsible to:
• Provide an assessment report of the City’s information technology system environment including:
• IT Structure within the Organization
• Workflow processes within the organization
• Third party service providers and a high level evaluation of each • Identification of formal policies and procedures
• Identification of Disaster Recovery Plan
• Change control process
• User id/password management and logical access controls • Local Area Network lifecycle and practices
• Wide Area Network lifecycle and practices
• Broadband/Internet Service Provider fit and competence • Telecommunication system(s) lifecycle and practices
• Security controls - network, system and application
• Penetration testing
• Internal vulnerability testing
• Power systems
• Backup/Restore routines
• Antivirus systems and practices
• Remote access practices and infrastructure
• Problem escalation, resolution
• Maintenance and testing
• Desktop Hardware Asset Details and Lifecycle
• Printer Hardware Asset Details and Lifecycle
• Server Hardware Asset Details and Lifecycle
• Storage Hardware Asset Details, Lifecycle & Remaining Capacity • Software (current and proposed for best practices)
• Physical access and environmental controls
• List of Software Solutions (onsite) and Lifecycle
• List of Software Solutions (hosted) and Lifecycle
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 6
• Microsoft licensing audit
• Server operating system use and management
• Desktop operating system use and patch management
• Database use and patch management
• Bring your own device platform and management
• Adobe licensing audit
• Other software licensing audit
• Software installation practices
• Software maintenance practices
• Purchasing practices and governance/policies
• Hardware maintenance practices
• Recommendations for immediate, practical and cost effective improvement • Estimate of City’s capacity for change/implementation • Conduct periodic meetings to discuss progress and unique issues that have surfaced
• Provide a weekly status report noting progress against each measure to the management team. The format of the report will be provided by the City. • Notify the management team separately and immediately of any urgent issues identified and an estimation of the risk.
Conduct periodic meetings to discuss progress and unique issues that have surfaced Provide a weekly status report noting progress against each measure to the management team. The format of the report will be provided by the City.
Notify the management team separately and immediately of any urgent issues identified and an estimation of the risk.
Project Completion: The assessment completion date shall be within a mutually agreed period of time after receipt of Notice to Proceed.
CONTRACT TERM
The initial term of the proposed contract shall be for a set period of time. The contract shall be in effect from the date of execution by the City through project completion.
RESPONSE INSTRUCTIONS
All responses should include the forms provided or exact copies of such forms (adjust columns and field size, add rows as necessary) and be submitted by 4 p.m. on July 2, 2025 via e-mail, hand delivery or postal mail to the Point of Contact (POC) shown on the cover of this RFP.
Additional pages may be attached and cross-referenced as necessary. Unnecessarily lengthy documents are discouraged. All responses are to include a searchable, digital copy of the proposal through a drop box link.
It is the sole responsibility of the proposer to see that its proposal is received in the proper time. Proposals received after the specified time will not be considered.
Adherence to the rules set forth in this RFP is mandatory to ensure a fair and objective analysis of all proposals.
Failure to comply with or complete any portion of this request may result in rejection of a submitted proposal.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 7
Receipt of a proposal by the City or submission of a proposal to the City confers no rights upon the proposer nor obligates the City in any manner.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 8
PROPOSAL CONTENT
Proposals should include concise but complete information about your company, emphasizing your method of approach and why you believe your company to be uniquely qualified for the project.
At a minimum, the Proposal should include:
• Transmittal Letter. Provide a brief overview of your company highlighting your understanding of the project and the benefits of accepting your proposal; explain the value that you provide to the City as a prospective customer. Since your service team is significant for this project, names and biographies, for key staff positions, as well as identification of any subcontractors that may be associated with the project are requested in the Background Response Worksheet. • Response/Price Proposal Form. Complete the provided Response/Price Proposal Form in order to provide the City with information related to your company’s responsibility, experience, capability to meet requirements, and pricing.
• Exceptions Letter. Should your company take exception to ANY terms and conditions identified in this RFP, a letter must be submitted with the proposer’s proposal identifying ALL exceptions. Any exceptions will be part of the evaluation process. The City will not entertain any exceptions not previously submitted with the proposer’s response, at the time of contract negotiations.
CONTACT WITH CITY EMPLOYEES / WRITTEN QUESTIONS
To ensure a fair and objective evaluation of all proposals, all inquiries are required to be submitted in writing to the POC. Written inquiries (e-mail preferred) must be received no later than 4 p.m. on the date indicated in the Procurement Schedule. Questions will be documented and an addendum will be issued with the City’s responses. Such addendum will be e-mailed to all known RFP recipients. A copy will be posted to the City’s website at www.cityofSebastopol.gov no later than 4 p.m. on the date indicated in the Procurement Schedule.
Though the notification method identified above will be utilized to notify proposers of addenda, it is ultimately the proposer's responsibility to check the City’s website for verification of any issued addenda.
PRESENTATION AND INTERVIEW
Selected proposers may be invited to submit sample materials and/or make presentations to City personnel.
Representative(s) attending/hosting these presentations must be qualified to respond to questions related to any component of the proposal.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 9
REVIEW AND EVALUATION
The City will use a committee comprised of stakeholders and City personnel to review all proposals received as part of a documented evaluation process. For each decision point in the process, the committee will evaluate proposers on a variety of quantitative and qualitative criteria and will then elevate a select number of proposers to compete in the next level. Proposers not previously selected for the initial interview may be interviewed at a later date. The lowest price proposal will not necessarily be selected.
The sole purpose of the proposal evaluation process is to determine which proposer can provide the best value to the City (highest level of service and desired deliverables in the most cost effective manner that most closely meets the City’s needs). The evaluation process is not meant to imply that one proposer is superior to any other, but rather that the selected proposer can best support the City’s needs, based on the information available and the City’s best efforts of determination. • Evaluation Criteria The proposal evaluation criteria should be viewed as standards that measure how well an proposer’s approach meets the desired requirements and needs of the City. The criteria that will be used to evaluate proposals may include, but are not limited to the following:
• RESPONSIVENESS
The degree to which the proposer’s Transmittal Letter and overall proposal have responded to the RFP’s purpose and scope; included in this criterion is conformance in all material respects to this RFP.
• RESPONSIBILITY
Proposer’s ability, in all respects, to perform fully the contract requirements and demonstrate the moral/business integrity necessary to assure good faith performance.. • EXPERIENCE
Proposer's experience in providing services and deliverables as requested in this RFP including, but not limited to, reference checks. Scored by PEC.
• CAPABILITY
Proposer's capability, flexibility and skill to meet the City’s requirements and perform the work identified in the RFP including but not limited to, creative alternatives and value-added services/ technologies.
• COST
Cost is scored by the team based on the competitiveness of the pricing as compared to the other proposals.
• Validity of Proposals Proposals are to be good for ninety (90) days from the proposal due date. The City may hold the proposals for ninety (90) days after the proposal due date, and may award a contract at any time during that period. Should there be reasons why a contract cannot be awarded within the specified period; the time may be extended by mutual agreement between the City and Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 10
the selected proposer.
• Contract Award The City reserves the right to (a) reject any or all proposals, or to make no award, (b) request modifications to initial proposals or (c) make partial or multiple awards. In addition, the City reserves the right to obtain other supplemental information concerning the proposer. The City further reserves the right to excuse technical defects in a proposal when, in its sole discretion, such excuse is beneficial to the City. The City may award based on initial proposals received, without discussion of such proposals.
RIGHT OF REFUSAL
The City reserves the right to reject all RFPs in their entirety or to select certain applications from the RFPs.
The City reserves the right to award a contract in any manner deemed in the best interest of its citizens.
PROCUREMENT SCHEDULE
RFP Date June 1, 2025
Deadline for Submission of Written Questions June 17, 2025 Date of City Response to above mentioned Questions June 23, 2025 Proposals Due: 4:00pm July 1, 2025
Evaluation of Proposals July 29, 2025
Presentations/Interviews (if needed) August 12, 2025
Contract Negotiations September 1, 2025
Commencement of Services/Award of Contract September 16, 2025
EXPENSE OF PREPARING RESPONSES TO THIS RFP
The City accepts no responsibility for any expenses incurred by the responders to this RFP including cost associated with RFP responses and presentations. Such expenses are to be borne exclusively by the responders.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 11
PUBLIC RECORDS
In entering into a contract with the City (or responding to a City solicitation), all proposers are hereby notified that all bids, proposals, quotations, RFI responses, agreements, invoices, correspondence and any other documents submitted to the City become public property and are subject to public disclosure in accordance with California Public Records Act. All public records will be made available upon request, at the earliest time permitted by law.
Ownership of all data, materials, and documentation originated and prepared for the City pursuant to this RFP shall belong exclusively to the City and be subject to public disclosure in accordance with California Public Records Act.
TAX EXEMPTION
The City is not tax exempt from materials purchases.
COMPLIANCE
The contractor shall observe and comply with all applicable laws, ordinances, and the rules and regulations of all authorities having jurisdiction over the City’s contract for IT assessment services.
The contractor agrees that in the hiring of employees for the performance of work under the contract or any subcontract, no contractor, subcontractor, or any person acting on its behalf shall, by reason of race, sex, disability, color, religion, military status, national origin, age or ancestry or any other class protected by law discriminate against any employee or applicant for employment
INDEMNIFICATION/INSURANCE
The contractor shall agree to indemnify and hold harmless the City, its officers, elected officials, agents and employees from and against all claims, damages, losses and expenses including attorney’s fees arising out of or resulting from the contractor’s performance, provided that any such claims, damage, loss or expense is attributable to bodily injury, sickness, disease or death, or to injury to or destruction of tangible property, including the loss of use resulting therefrom; and is caused in whole or in part by any negligent or willful act or omission of the contractor, subcontractor, anyone directly or indirectly employed by any of them or anyone for whose acts any of them may be liable.
If the contractor is required to go on City property to perform work or services, the contractor shall assume full responsibility and expense to obtain all necessary insurance as required by the City.
Insurance Limits Listed Below:
Consultantshall procure and maintain for the duration of the contract insurance against claims for injuries to persons or damages to property which may arise from or in connection with the performance of the work hereunder by the Consultant, its agents, representatives, or employees.
MINIMUM SCOPE AND LIMIT OF INSURANCE
Coverage shall be at least as broad as:
1. Commercial General Liability (CGL): Insurance Services Office Form CG 00 01 covering CGL on an “occurrence” basis, including products and completed operations, property damage, bodily injury, and personal & advertising injury with limits no less than $2,000,000 per occurrence. If a general aggregate limit applies, Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 12
either the general aggregate limit shall apply separately to this project/location (ISO CG 25 03 or 25 04) or the general aggregate limit shall be twice the required occurrence limit.
2. Automobile Liability: Insurance Services Office Form Number CA 0001 covering, Code 1 (any auto), or if Consultant has no owned autos, Code 8 (hired) and 9 (non-owned), with limit no less than $1,000,000 per accident for bodily injury and property damage.
3. Workers’ Compensation insurance, as required by the State of California, with Statutory Limits, and Employer’s Liability Insurance with limit of no less than $1,000,000 per accident for bodily injury or disease. (Not required if consultant provides written verification that it has no employees)
4. Professional Liability (Errors and Omissions) Insurance appropriates to the Consultant’s profession, with limit no less than $2,000,000 per occurrence or claim, $2,000,000 aggregate.
The Retroactive Date must be shown and must be before the date of the contract or the beginning of contract work. Insurance must be maintained and evidence of insurance must be provided for at least five (5) years after completion of the contract of work. If coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a Retroactive Date prior to the contract effective date, the Consultant must purchase “extended reporting” coverage for a minimum of five (5) years after completion of contract work. A copy of the claims reporting requirements must be submitted to the City of Sebastopol for review. If the Consultant maintains broader coverage and/or higher limits than the minimums shown above, the City of Sebastopol requires, and shall be entitled to, the broader coverage and/or higher limits maintained by the Consultant. Any available insurance proceeds in excess of the specified minimum limits of insurance and coverage shall be available to the City of Sebastopol.
Other Insurance Provisions
The insurance policies are to contain, or be endorsed to contain, the following provisions:
• The City of Sebastopol, its officers, officials, employees, and volunteers are to be covered as additional insureds on the CGL policy with respect to liability arising out of work or operations performed by or on behalf of the Consultant including materials, parts, or equipment furnished in connection with such work or operations.
• General liability coverage can be provided in the form of an endorsement to the Consultant’s insurance at least as broad as one of the following ISO ongoing operations Forms: CG 20 10 or CG 20 26 or CG 20 33 (not allowed from subcontractors), or CG 20 38; and one of the following ISO completed operations Forms: CG 20 37, 2039 (not allowed from subcontractors), or CG 20 40.
Primary Coverage
For any claims related to this contract, the Consultant’s insurance coverage shall be primary insurance coverage at least as broad as ISO CG 20 01 04 13 as respects the City of Sebastopol, its officers, officials, employees, and volunteers. Any insurance or self-insurance maintained by the City of Sebastopol, its officers, officials, employees, or volunteers shall be excess of the Consultant’s insurance and shall not contribute with it.
Notice of Cancellation
Consultant shall provide immediate written notice if (1) any of the required insurance policies is terminated; (2) the limits of any of the required polices are reduced; (3) or the deductible or self-insured retention is increased. In the event of any cancellation or reduction in coverage or limits of any insurance, Consultant shall forthwith obtain and submit proof of substitute insurance.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 13
Waiver of Subrogation
Consultant hereby grants to the City of Sebastopol a waiver of any right to subrogation which any insurer of said Consultant may acquire against the City of Sebastopol by virtue of the payment of any loss under such insurance. Consultant agrees to obtain any endorsement that may be necessary to affect this waiver of subrogation, but this provision applies regardless of whether or not the City of Sebastopol has received a waiver of subrogation endorsement from the insurer. However, the Workers’ Compensation policy shall be endorsed with a waiver of subrogation in favor of the City of Sebastopol for all work performed by the Contractor, its employees, agents, and subcontractors.
Self-Insured Retentions
Self-insured retentions must be declared to and approved by the City of Sebastopol. The City of Sebastopol may require the Consultant to provide proof of ability to pay losses and related investigations, claim administration, and defense expenses within the retention. The policy language shall provide, or be endorsed to provide, that the self-insured retention may be satisfied by either the named insured or the City of Sebastopol.
Acceptability of Insurers
Insurance is to be placed with insurers authorized to conduct business in the state with a current A.M. Best’s rating of no less than A:VII, unless otherwise acceptable to the City of Sebastopol.
Verification of Coverage
Consultant shall furnish the City of Sebastopol with original Certificates of Insurance including all required amendatory endorsements (or copies of the applicable policy language effecting coverage required by this clause) and a copy of the Declarations and Endorsement Page of the CGL policy listing all policy endorsements to the City of Sebastopol before work begins. However, failure to obtain the required documents prior to the work beginning shall not waive the Consultant’s obligation to provide them. The City of Sebastopol reserves the right to require complete, certified copies of all required insurance policies, including endorsements required by these specifications, at any time.
Subcontractors
Consultantshall require and verify that allsubcontractors maintain insurance, meeting all the requirements stated herein, and Contractor shall ensure that the City of Sebastopol is an additional insured on insurance required from subcontractors.
Special Risks or Circumstances
The City of Sebastopol reserves the right to modify these requirements, including limits, based on the nature of the risk, prior experience, insurer, coverage, or other special circumstances.
SECTION 8 – INDEMNIFICATION
A. Consultant shall indemnify and hold harmless City, its agents, officers, officials, employees, and volunteers from any and all claims, demands, suits, loss, damages, injury, and/or liability (including any and all costs and expenses in connection therewith), incurred by reason of any negligent or otherwise wrongful act or omission of Consultant, its officers, agents, employees and subcontractors, or any of them, under or in connection with this Agreement; and Consultant agrees at its own cost, expense and risk to defend any and all claims, actions, suits, or other legal proceedings brought or instituted against City, its agents, officers, officials, employees and Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 14
volunteers, or any of them, arising out of such negligent or otherwise wrongful act or omission, and to pay and satisfy any resulting judgments.
B. When Consultant under this Agreement is duly licensed under California Business and Professions Code as an architect, landscape architect, professional engineer, or land surveyor (“design professional”), the provisions of this section regarding Consultant’s duty to defend and indemnify apply only to claims that arise out of or relate to the negligence, recklessness, or willful misconduct of the design professional.
C. If any action or proceeding is brought against Indemnitees by reason of any of the matters against which Consultant has agreed to indemnify Indemnitees as provided above, Consultant, upon notice from City, shall defend Indemnitees at Consultant’s expense by counsel acceptable to City, such acceptance not to be unreasonably withheld. Indemnitees need not have first paid for any of the matters to which Indemnitees are entitled to Indemnification in order to be so indemnified. The insurance required to be maintained by Consultant shall ensure Consultant’s obligations under this section, but the limits of such insurance shall not limit the liability of Consultant hereunder. The provisions of this section shall survive the expiration or earlier termination of this Agreement. D. The provisions of this section do not apply to claims to the extent occurring as a result of the City’s sole negligence or willful acts or misconduct.
TERMINATION
The City reserves the right to terminate any contract resulting from this solicitation in whole or in part for default (termination due to the contractor’s failure to perform satisfactorily) or convenience (termination due to the best interests of the City). After 10 days from delivery of a written notice to the contractor, the City may, without cause and without prejudice to any other right or remedy, elect to terminate the contract. In such case, the contractor shall be paid for work executed, goods delivered and accepted, and any expense sustained plus reasonable profit, unless such termination was due to the act or conduct of the contractor.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 15
Response/Price Proposal Form
SECTION 1: COMPANY INFORMATION
Company Name:
Address:
Contact Person:
Phone: Email:
Years in Business:
SECTION 2: PROJECT COST PROPOSAL
Provide a firm-fixed price for each componentlisted below.
Please include any services/fees not listed.
Service Description Estimated Hours Hourly Rate Total Price Project Management & Reporting
IT Infrastructure Review
Security Assessment
Software Licensing Audit
Staff Interviews & Analysis
Draft Report Development
Final Report & Presentation
Travel/Expenses (if applicable)
**Total Fixed Price**
*Optional Add-Ons / Value-Added Services:*
SECTION 3: PROJECT TIMELINE
Estimated Start Date:
Completion Timeline:
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol
Request for Proposals
Information Technology
Assessment
INFORMATION TECHNOLOGY ASSESSMENT PAGE 16
SECTION 4: SIGNATURE
Authorized Representative:
Title:
Date:
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
City of Sebastopol IT Assessment Proposal
Transmittal Letter
Brooke Mincey
Portola Systems, Inc.
327 O’Hair Court, Suite B
Santa Rosa, CA, 95407
[email protected]
(707) 824-8800
July 1, 2025
Ana Kwong
City of Sebastopol
7120 Bodega Avenue
Sebastopol, CA 95472
Dear Ana Kwong,
Portola Systems, Inc. is pleased to submit our proposal to perform an Information Technology Assessment for the City of Sebastopol. Our proposal blends deep expertise in public sector IT management, a hands-on approach tailored for small to mid-sized municipalities, and a comprehensive understanding of how to enhance technology governance. We bring experience supporting government entities throughout Northern California and a proven track record of delivering timely, actionable IT roadmaps that reduce risk, improve operational uptime, and maximize strategic investments. This proposal reflects input from our full leadership and engineering teams, ensuring both high-level planning insight and tactical delivery experience inform every aspect of our approach.
Thank you for your time and consideration. We look forward to the opportunity to support the City of Sebastopol in this important initiative.
Sincerley,
Brooke Mincey
Project Manager - Portola Systems, Inc.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
1. Company Qualifications & Experience
Portola Systems is a locally based IT engineering and consulting firm serving public sector agencies since 1994. We specialize in providing managed services, network engineering, and technology planning to cities, school districts, and transportation entities throughout California. Our organization supports over 40 public agencies and has completed numerous assessments similar in scope and goals to this engagement.
Relevant Experience Highlights:
• Comprehensive IT audits for local governments
• Ongoing MSP services for police departments and municipalities • Hybrid cloud planning, cybersecurity improvements, and helpdesk modeling
2. Executive Summary
• Purpose. Conduct a comprehensive assessment of the City’s IT environment— people, process, and technology—across all departments except Fire, and deliver a prioritized, budget‑aligned roadmap.
• Approach. Five‑phase methodology (Initiate → Discover → Validate → Analyze → Report) completed over eight - ten weeks, combining automated tooling, staff interviews, on‑site inspections, and best‑practice benchmarking. • Outcomes. Clear articulation of risks, quick‑win improvements, 3‑5-year modernization and lifecycle roadmap, and an estimate of the City’s internal capacity to implement change.
• Value. Fixed‑fee engagement, weekly status reporting, and knowledge transfer sessions minimize disruption while maximizing transparency.
3. Understanding of Requirements
The City has 53 users, 55 Windows endpoints, and 6 servers distributed across multiple facilities. The RFP requests a holistic review including:
1. Governance & Policy. IT policies, DR/BCP, change control, logical access.
2. Infrastructure. LAN/WAN, ISP performance, telecom, hardware lifecycles.
3. Security. Pen‑testing, vulnerability scans, security controls, physical & environmental safeguards.
4. Operations. Patch management, asset management, licensing compliance, backup & restore routines, BYOD.
5. Stakeholder Alignment. Interviews to capture pain points, vision, and capacity for change.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
6. Reporting. Weekly status, urgent issue escalation, draft/final reports, and formal presentation of findings.
4. Project Approach & Methodology
Phase
Duration
(Weeks) Key Activities Deliverables
1 – Initiate &
Plan
1-2 Kick‑off meeting, refine scope, confirm
contacts & schedule
• Project charter •
Stakeholder matrix
2 – Discover
Current State
2‑4 Automated network scans,
documentation review, on‑site
inspections, stakeholder interviews
• Inventory spreadsheets
• Interview notes •
Issues log
3 – Validate &
Test
3‑5 Internal/external vulnerability
assessment, controlled penetration
testing, configuration sampling
• Vulnerability &
pen‑test reports
4 – Analyze &
Recommend
5‑6 Risk ranking, cost‑benefit analysis,
lifecycle & roadmap drafting
• Draft assessment
report • Quick‑win
checklist
5 – Report &
Present
7‑8 Review draft with City, incorporate
feedback, final presentation to leadership
• Final report &
executive slide deck
5. Tooling & Frameworks
• CIS Controls v8 benchmarking
• NIST CSF & 800‑53 security mapping
• CISA Municipal Infrastructure guidance
• Nessus Pro or Other, Nmap, and OWASP for scanning & pen‑testing • ITIL 4 for process assessment
6. Detailed Scope of Work
The following table maps each RFP requirement to our tasks.
RFP Requirement Tasks & Artifacts
Comprehensive IT assessment Automated discovery, physical walkthroughs, documentation review.
Evaluate IT structure & workflows Org‑chart mapping, RACI analysis, ticketing system data review.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
RFP Requirement Tasks & Artifacts
Review policies / DR / change
control / access
Gap analysis against CIS/NIST controls,
recommendations per deficient control and adherence
scorecard.
LAN/WAN/ISP/Telecom High-Level Topology diagramming, throughput testing, QoS review.
Hardware & software lifecycle Asset age matrix, warranty status report (where records are available), license compliance audit (where records are available)
Patch & BYOD management System compliance and patch audit, patch management system capability and policy review
(RMM/MDM).
Security testing & controls Internal and External vulnerability & penetration testing (up to 254 IP addresses) and physical security
walk‑through.
Operational practices Procurement & maintenance policy review.
Stakeholder interviews 1-2 interviews across Admin, Police, Public Works, Finance and other key-stakeholders as required.
Reporting & meetings Weekly 1hr status meetings (review tasks and milestone status and dependencies), progress
summary reports and findings, conduct final draft
report and gather feedback, deliver final report to City key Stakeholders, attend Council Meeting to deliver
final report.
7. Technical Task Breakdown by Requirement
• Conduct a comprehensive IT assessment across all departments (except Fire) • Collect current network diagrams and create/validate logical & physical topology maps
• Deploy lightweight discovery agent or run credentialed Network/AD scans (e.g., Nmap, ADRecon) across 55 endpoints & 6 servers
• Export asset/hardware inventories from SCCM/Intune (or create inventory using Portola provided tools if no City tools unavailable)
• Capture server roles, OS versions, patch levels, warranties, and virtualization details (VM host & guest)
• Document business applications in use within each department and map to servers & databases
• Evaluate IT structure, workflow processes, and use of third‑party service providers Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
• Review IT org chart, job descriptions, ticketing system categories, and KPIs • Pull 12 months of ticket data to analyze workload distribution & response times • Map escalation paths, change‑management approvals, and vendor dependencies • Catalog all third‑party support contracts (ISPs, copier, phone, ERP, body‑cam, CCTV, etc.) and SLAs
• Identify & review policies (IT, DR, change, logical access) • Request and inventory all written policies & procedures • Conduct IT controls interviews and compare attestation, and policies/procedures to CIS Controls v8 & NIST 800‑53 baselines and provide scorecard. • Score maturity (0‑5 scale) and highlight gaps/obsolete sections • Verify DR plan RPO/RTO against backup capabilities & test documentation • Review IAM policies: password length, MFA, privileged access workflow • Evaluate LAN lifecycle & practices
• Trace‑route and switch‑level CDP/LLDP discovery to validate VLAN segmentation • Export switch configs; analyze IOS/OS versions, EoL/EoS status, and security settings (SSH, SNMPv3)
• Measure switch/UPS power & port utilization; note spare capacity and redundancy • Conduct 1 Gb/10 Gb iPerf throughput tests and latency baselines during business hours
• Review hardware, document warranty, vendor support contracts, in-service dates, and remaining life expectancy.
• Evaluate WAN lifecycle & practices
• Review ISP circuits (type, bandwidth, contract terms, fail‑over paths) • Examine firewall/SD‑WAN firmware levels, policy counts, and HA status • Run 24‑hour ping jitter tests to remote sites (if any) and collect NetFlow data • Review hardware, document warranty, vendor support contracts, in-service dates, and remaining life expectancy.
• Evaluate ISP performance
• Collect the last 12 months of ISP trouble tickets and SLA credits • Perform 24‑hour continuous iPerf & Speed test monitoring from core site • Compare measured latency/bandwidth against contractual SLAs • Evaluate telecommunication systems
• Inventory phone system (PBX/VoIP), firmware versions, licenses, PRI/SIP trunks • Review call‑recording retention, E911 configuration, voicemail backups, test call routing to key sample departments and document result.
• Evaluate desktop, server, printer, and storage hardware lifecycles • Age‑profile hardware and map to vendor EoL/EoS lists
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
• Extract warranty/maintenance data from Dell/HP portals • Calculate 3‑year replacement forecast and CapEx schedule • Software licensing audits (Microsoft, Adobe, etc.)
• Collect Active Directory user & device counts, correlate with Microsoft licensing portal
• Run and review mailbox report against active org-chart or seek customer feedback if not complete list is available
• Run Adobe admin console export & compared to installed software via SCCM • Reconcile discrepancies and estimate compliance costs • Patch management of server, desktop, DB OS
• Review WSUS/SCCM/Intune or third‑party patch reports for past 12 months or run MSP provide patch compliance tool
• Identify failed or deferred patches and critical missing CVEs • Validate database (SQL) CU levels and auto‑update schedules • BYOD platform management
• Examine MDM solution (Intune, AirWatch, Jamf) policies: enrollment, encryption, wipe
• Validate separation of corporate vs personal data and conditional access rules • Conduct penetration testing
• Scope external IPs/domains; run external recon & black‑box tests (OWASP ZAP, Burp Suite)
• Conduct credentialed internal network pen‑test on representative VLANs using Kali/Nessus/Metasploit
• Attempt privilege escalation and lateral movement; document exploit paths • Internal vulnerability testing
• Run authenticated Nessus Pro or Other scans against all 55 endpoints & 6 servers, network devices and IOT devices up to 254 IP addresses
• Prioritize findings (CVSS), tag exploitable vs informational • Review security controls (network, system, application) • Compare firewall rules to zero‑trust model; flag overly broad rules • Assess server hardening (CIS Benchmarks) and application‑level settings • Physical access & environmental controls
• Inspect MDF/IDF rooms for lock, badge, camera coverage, HVAC & UPS • Verify data‑center fire suppression & environmental monitoring • Antivirus practices & infrastructure
• Gather AV/EDR console reports for definition currency & active alerts • Review policy settings (scan frequency, tamper protection, USB control) Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
• Backup & restore routines
• Examine job schedules, retention periods, off‑site replication, encryption • Perform sample restores of file share and VM to validate RTOs • Remote access practices
• Review VPN configurations, MFA enforcement, split‑tunnel settings • Enumerate active remote desktop services and verify logging • Assess software install/maintenance practices
• Review packaging/deployment tools (SCCM, Intune) & change approval process • Spot‑check workstations for unauthorized software
• Assess software inventories & lifecycle
• Build application catalog; tag cloud vs on‑prem, vendor support status, and versioning
• Assess purchasing practices & governance
• Review procurement policy docs, PO samples, and budget planning cycle • Interview finance on asset capitalization thresholds
• Assess hardware maintenance practices
• Evaluate preventative maintenance schedules for servers, network infrastructure, UPS, generators
• Check printer/copier service logs & consumables burn rate
8. Project Schedule (High‑Level) Project Schedule (High‑Level) Week 1 | Kick‑off, planning
Weeks 1‑3 | Discovery (on‑site & remote)
Weeks 3‑4 | Testing & validation
Weeks 5‑6 | Analysis & draft report
Week 7 | City review & feedback
Week 8 | Final report & presentation
All dates will be finalized at project launch to accommodate City calendars.
9. Staffing Plan
Role Certification Responsibilities
Engagement
Manager
PMP, ITIL Governance, client liaison, QA
Senior Security
Consultant
CISA, CCIE
Security
Security controls, pen‑test
oversight
Network Engineer CCNP LAN/WAN analysis, telecom
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
Role Certification Responsibilities
Systems Analyst MCSA,
Azure Admin
Server/endpoint review, licensing
audit
Technical Writer — Draft & final reports
10. Deliverables
• Project charter & schedule
• Weekly status reports (City format)
• Issues & risk log with severity & remediation suggestions • Vulnerability and penetration test reports
• Asset inventory & lifecycle spreadsheets
• Draft IT Assessment Report (Word & PDF)
• Final IT Assessment Report with executive summary & 3‑5-year roadmap • Slide deck (PowerPoint) for leadership presentation
11. Assumptions
1. City will provide administrative credentials, network diagrams, and policy documents within five business days of project start.
2. On‑site visits are included but remote access will be required during the duration of the engagement.
3. Testing will occur during standard business hours unless otherwise agreed.
4. Travel portal to portal between Santa Rosa and Sebastopol is included.
5. Findings and recommendations are advisory; implementation is out of scope.
12. Pricing (See SIGNED RFP)
Service Description Estimated Hours Hourly Rate Total Price Project Management & Reporting 40 $185.00 $7400.00
IT Infrastructure Review 30 $185.00 $5,550.00
Security Assessment 45 $185.00 $8,325.00
Software Licensing Audit 45 $185.00 $8,325.00
Staff Interviews & Analysis 15 $185.00 $2,775.00
Draft Report Development 20 $185.00 $3,700.00
Final Report & Presentation 22 $185.00 $4,070.00
Travel/Expenses (if applicable) 0 N/A $0.00
*Total Fixed Price** $40,145.00
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025
In addition to the scope defined in the RFP, Portola Systems can optionally provide strategic IT planning, helpdesk modeling, or endpoint security hardening as added-value services. These services are available on an as-needed basis to support long-term IT resilience.
Payment schedule: 35 % at project start, 35 % on delivery of draft report, 30 % upon acceptance of final report.
13. References
• Town of Windsor – Julé Taylor, IT Manager | [email protected] | $400K annual MSP services
• SMART (Sonoma Marin Area Rail Transit) – Bryan Crowley, IT Manager | Ongoing support across 13 rail sites
• Mountain View Los Altos HSD – Bob Fishtrom | Managed districtwide wireless & network redesign
• Sonoma County Fire District – John Lantz | Network upgrades and security support • Benicia Unified School District – Bruce Lambert | VMware and HP infrastructure architecture and VDI rollout
14. Insurance & Compliance
Portola Systems meets all required insurance thresholds, including:
• $2M General Liability
• $1M Workers Compensation
• $2M Professional Liability (E&O)
A formal letter of compliance will be provided upon contract award.
15. Conclusion
Portola Systems is confident in our ability to perform this IT assessment with diligence, transparency, and long-term value in mind. We appreciate the City of Sebastopol’s consideration and welcome the opportunity to partner in strengthening your technology environment.
Agenda Item Number 5
Agenda Item Number 5
City Council Meeting Packet of October 7, 2025