Primary Department: Universal Services
Primary Department Head/Elected Official: Sindhu Menon, Executive Director and CIO
Managing Department: Universal Services
Managing Department Head/Elected Official: Sindhu Menon, Executive Director and CIO
Regular or Supplemental RCA: Regular RCA
Type of Request: Investment Memo
Investment Memo Type: Final Investment Memo
Project Name: Cyber Security
Project ID (if applicable): NI007
Vendor Legal Name (if applicable): N/A
MWBE Contracted Goal (if applicable): N/A
MWBE Current Achievement (if applicable): N/A
Justification for 0% MWDBE Participation Goal: N/A - Goal not applicable to request
Grant Indirect Costs Rate (if applicable): N/A
Justification for 0% Grant Indirect Costs Rate (if applicable): N/A - Not a grant item
Incremental Authorization Requested: $6,170,000
Total Estimated Project Cost: $6,570,000 (FY2026)
Request Summary:
title
Request for approval of a Final Investment Memo for the Cyber Security project, for an incremental authorization of $6,170,000 for a total authorization of $6,570,000 for FY2026 and commercial paper funding in the amount of $3,000,000.
end
Project Description:
The objective of this project is to enhance Harris County's overall cyber security program. The program’s objectives are designed to (1) mitigate known risks, (2) address ongoing threats, and (3) ensure a defense-in-depth strategy that will continuously improve the County’s ability to proactively identify and address risks across the county's enterprise network and technology resources. This project and its investments complement the County’s cybersecurity operations and provide the necessary hardware and software for it to run.
This project provides critical systems to keep the county secure from cyber-attacks on Harris County computer systems, networks and data from digital attacks and unauthorized access. For FY2026 projects include penetration testing, Identity and Access management application system (Single Sign-On, Multifactor Authentication), cybersecurity consultants, and cybersecurity labor. This includes the implementation of new detection, monitoring, and protective controls while ensuring compliance with regulatory controls.
FY2025 accomplishments include
• The county wide deployment (HCUS managed scope) of the Security Operations Center / Network Operations Center (SOC/NOC)
• Annual Pen Test - Internal & External Testing has been completed
• Situation Room is being used for triage of emerging threats
• Threat Intelligence Platform - Actively receiving, monitoring, and actioning threat intel
In FY2026, Cyber Security focus will be on the following:
|
Penetration testing - testing of prioritized applications or capitalizable services before operation |
Penetration testing will allow the detection of application vulnerabilities and improper configurations, as well as the implementation of corrective action. Initial penetration testing before deployment is essential to development and is capitalized in this project. Testing will be based on County priorities. |
|
Identity and Access Management (IAM) system |
Upgrade of the county’s Identity and Access Management system infrastructure will increase performance and enhance our ability to restrict access to authorized users. This consists of hardware and one-time software development costs. The solution will provide a scalable IAM solution aligned with the County’s IT modernization strategy and evolving business and security needs. |
|
MFA (Law enforcement) |
Multi-factor authentication (MFA) for Harris County MDT systems to be compliant with new FBI Criminal Justice Information System (CJIS) requirements. |
|
Cybersecurity Labor |
Cybersecurity labor will comprise of personnel to implement Cybersecurity capital project setup, and deployment. Establish Cyber Review Committee. |
|
Cybersecurity Consultant Services |
The consultant personnel will support Cybersecurity capital project setup and deployment. |
Anticipated Project Expenditures and Timeline:
|
Project Scope Breakdown |
Estimated Cost |
Estimated Completion |
|
Penetration Testing |
$500,000 |
9/30/2026 |
|
Identify and Access Management |
$2,800,000 |
9/30/2026 |
|
Multi-Factor Authentication - Law Enforcement |
$500,000 |
9/30/2026 |
|
Cyber Security Labor |
$800,000 |
9/30/2026 |
|
Cyber Security Consultant Services |
$1,800,000 |
9/30/2026 |
|
Project Manager |
$170,000 |
9/30/2026 |
|
FY26 Total Authorization |
$6,570,000 |
|
|
Unencumbered existing project balance to carry into FY26 |
($400,000) |
|
|
Total |
$6,170,000 |
|
Justification & Alternatives:
This project enables rapid incident detection, prevention, analysis, response, and monitoring processes that will minimize potential disruption to county services from a cyber-attack. The requested software, services, and staff will help address requirements identified as needing to be addressed for Criminal Justice Information Services (CJIS), Payment Card Industry Data Security Standard (PCI-DSS), Health Insurance Portability and Accountability Act (HIPAA), and Privacy compliance. Compliance with these standards is required to meet basic law enforcement data security standards and process credit/debit card transactions. This project will also demonstrate the cyber security competency required to qualify for some grant programs, bond ratings, insurance, and business contracts.
For 2026, the current state IAM upgrade is budgeted as part of Phase 2. However, due to the fragmented and incomplete implementation of the existing solution, several key functionalities - including SSO, MFA, Identity Governance, and automation - remain unaddressed. These are critical for an enterprise-grade IAM platform that supports HCUS and participating agencies across on-prem, cloud, and hybrid environments.
The upcoming RFP will guide the procurement of a modern, scalable IAM solution aligned with the County’s IT modernization strategy and evolving business and security needs.
The Cyber Review Committee (CRC) is a critical component of the CIO Technology Projects Prioritization Process for both Enterprise and Operations initiatives. To support this effort, HCUS will need to establish a formal intake process for cybersecurity reviews, develop a centralized portal to manage incoming requests, and ensure timely feedback is provided to the IT Review Boards.
This process will help ensure that cybersecurity risks and regulatory requirements are fully considered and integrated into IT planning and project evaluation efforts. Additionally, this role will be instrumental in designing and implementing a standardized risk evaluation intake process-enabling consistent, repeatable, and transparent assessments across the enterprise
The MFA for law enforcement project is for the MDT’s to have multi factor authentication (MFA) as required by new FBI Criminal Justice Information Systems (CJIS) security protocols. MFA was not required previously for patrol cars under the old policy, however policies were updated in October 2024 now require MFA and agencies were given timeframes to meet compliance.
No alternatives have been identified for this project that provide adequate cybersecurity. Failure to secure the county’s enterprise network, devices, and data from unauthorized access and criminal use can lead to ransomware attacks, data exfiltration, distributed denial of service, loss of citizen trust, and loss of compliance with PCI, CJIS, HIPAA/HI-Trust, EHR, Privacy laws, etc. Alternate funding sources are not available for this project.
Anticipated Impact on Other Funds (If Applicable):
|
Fund Code |
Description |
Estimated Cost |
Funding Method (Existing or Future Budget Request Required) |
Estimated Date of Needs |
|
|
|
$- |
|
- |
|
|
|
$- |
|
- |
|
Total |
|
$- |
|
- |
County Strategic Plan Goal: 2. Connect our community with safe, reliable, equitably distributed, and well-maintained infrastructure.
County Strategic Plan Objective: N/A
Justice/Safety Initiative (Goal 1): Choose an item.
Infrastructure Initiative (Goal 2): N/A
Economy Initiative (Goal 3): Choose an item.
Health Initiative (Goal 4): Choose an item.
Climate/Resilience Initiative (Goal 5): Choose an item.
Housing Initiative (Goal 6): Choose an item.
Decision Analysis Matrix Score (rubric on last page):8
Previous Court Action:
|
Date |
Agenda Item # |
Action Taken |
|
4/10/2025 |
25-2375 <https://harriscountytx.legistar.com/LegislationDetail.aspx?ID=7290048&GUID=99167C6E-3743-47D8-BE02-89F029CC8C3E&Options=ID|Text|Attachments|&Search=NI007>Request by the Office of Management and Budget for approval of commercial paper funding for Universal Services for the Cyber Security project in the additional amount of $705,000 for a total CP funding of $6,730,000. |
|
|
1/9/2025 |
25-0050 <https://harriscountytx.legistar.com/LegislationDetail.aspx?ID=7080893&GUID=85CF55B5-8A69-4AC6-98BC-5194B79E127F&Options=ID|Text|Attachments|&Search=NI007>Request for approval of commercial paper funding for Universal Services for the Cyber Security project in the additional amount of $650,000 for a total CP funding of $6,025,000. |
|
|
10/8/2024 |
24-6287 <https://harriscountytx.legistar.com/LegislationDetail.aspx?ID=6883605&GUID=832AA9E4-558E-4361-BBA5-853E894C3884&Options=ID|Text|Attachments|&Search=NI007>Request for approval of the Final Investment Memo for the Cybersecurity project (continuous) for an additional incremental authorization of $5,536,500 for an FY2025 total authorization of $5,736,500. |
|
|
8/29/2023 |
23-4823 <https://harriscountytx.legistar.com/LegislationDetail.aspx?ID=6325786&GUID=27C6A201-2729-4E58-8083-A744C47902AF&Options=ID|Text|Attachments|&Search=NI007>Request for approval of the Final Investment Memo for the Cyber Security project for an additional incremental authorization. |
|
|
11/29/2022 |
22-7519 <https://harriscountytx.legistar.com/LegislationDetail.aspx?ID=5942375&GUID=8C84713C-2688-4B0A-8208-8456380ACA80&Options=ID|Text|Attachments|&Search=NI007>Request for approval of the Final Investment Memo for the Cyber Security project (continuous) for an additional incremental authorization of $3,052,500 for an FY 2023 total authorization of $6,752,500. |
|
|
3/8/2022 |
22-1753 <https://harriscountytx.legistar.com/LegislationDetail.aspx?ID=5477821&GUID=835F049E-50F8-42EC-8532-3C6725EC0C5C&Options=ID|Text|Attachments|&Search=NI007>Request for approval of commercial paper funding for Universal Services for the Cyber Security project in the additional amount of $1,000,000 for a total CP funding of $5,375,000. |
|
|
2/22/2022 |
22-1291 <https://harriscountytx.legistar.com/LegislationDetail.aspx?ID=5460200&GUID=FA63C3BF-24B1-40A6-9112-7E852A9A135C&Options=ID|Text|Attachments|&Search=NI007>Request for approval of the Final Investment Memo for the Cyber Security project for an additional incremental amount of $3,272,000 for a SFY 2022 authorization of $5,209,000. |
|
|
1/25/2022 |
22-0637 <https://harriscountytx.legistar.com/LegislationDetail.aspx?ID=5389607&GUID=BF3ADB83-17EF-4659-9652-1A4492960EBC&Options=ID|Text|Attachments|&Search=NI007>Request for approval of commercial paper funding for Universal Services for the Cyber Security project in the additional amount of $990,000 for a total CP funding of $4,375,000. |
|
|
6/29/2021 |
21-2845 <https://harriscountytx.legistar.com/LegislationDetail.aspx?ID=5008372&GUID=40B14283-8C5E-4278-8721-EFFD065545E1&Options=ID|Text|Attachments|&Search=NI007>Transmittal of the Commercial Paper Status Report for the 1st Quarter FY 2021-2022. This report is a requirement of the Commercial Paper Policies and Procedures approved annually by Commissioners Court. |
|
Address:
Precinct(s): Choose an item.
|
Fiscal and Personnel Summary |
|
Service Name |
|
|
|
|
Current Fiscal Year Cost |
Annual Fiscal Cost |
|
|
Labor |
Non-Labor |
Total |
Recurring Expenses |
|
|
|
|
|
|
|
Funding Sources |
|
|
Existing Budget |
|
|
|
|
|
Commercial Paper |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Total Current Budget |
$ |
$ |
$ |
$ |
|
Additional Budget Request |
|
|
Commercial Paper |
$ |
$3,000,000 |
$3,000,000 |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Total Additional Budget Request |
$ |
$3,000,000 |
$3,000,000 |
$ |
|
Total Funding Request |
$ |
$3,000,000 |
$3,000,000 |
$ |
|
Personnel (Fill out section only if requesting new PCNs) |
|
|
Current Position Count for Service |
- |
- |
- |
- |
|
Additional Positions Request |
- |
- |
- |
- |
|
Total Personnel |
- |
- |
- |
- |
Anticipated Court Date: 8/26/2025
Anticipated Implementation Date (if different from Court date): 10/1/2025
Emergency/Disaster Recovery Note: Not an emergency, disaster, or ARPA related item
Legal funding compliance confirmed by: Paige Abernathy, Special Assistant County Attorney, 8/14/2025
Department Approval by: Heather Merkel, Universal Services Director of Budget, 8/17/2025
OMB CIP Team Approval by: William McGuinness, Director-Capital Projects & Infrastructure, 8/15/2025
________________________________________
Commercial Paper Request (For OMB use only):
Receiving Department: Universal Services
Project PeopleSoft ID: NI007
CP Series Description: Commercial Paper Series D-2 can be used for (1) construction of public works, (2) the purchase of automobiles, equipment and machinery, including computers, materials and supplies for the operation of the County’s precincts and departments (3) Professional services, including services provided by engineers, architects, attorneys, auditors, financial advisors, and fiscal agents, in connection with the contractual obligations described in (1) and (2).
Commercial Paper is being requested for the Cyber Security project and is expected to be repaid within the next three fiscal years either through bonds, budgetary means or pay-as-you-go sources.
Note: Commercial Paper is issued in increments of $5,000 and the excess is not available to be spent by the department
OMB Financial Management contact: Amy Perez, Deputy Executive Director, Office of Management and Budget