Department: Universal Services
Department Head: Sindhu Menon, Executive Director and CIO
Regular or Supplemental RCA: Regular RCA
Type of Request: Investment Memo
Investment Memo Type: Final Investment Memo
Project Name: Cyber Security
Project ID (if applicable): NI007
Vendor Legal Name (if applicable): N/A
MWDBE Contracted Goal (if applicable): N/A
MWDBE Current Achievement (if applicable): N/A
Justification for 0% MWDBE Participation Goal: N/A - Goal not applicable to request
Managing Entity: Universal Services
Incremental Authorization Requested: $5,536,500
Total Estimated Project Cost: $9,890,000 (FY25 & FY26 2-year total estimate)
Request Summary:
title
Request for approval of the Final Investment Memo for the Cybersecurity project (continuous) for an additional incremental authorization of $5,536,500 for an FY2025 total authorization of $5,736,500.
end
Project Description:
The objective of this project is to enhance Harris County's overall cyber security program. The program’s objectives are designed to (1) mitigate known risks, (2) address ongoing threats, and (3) ensure a defense-in-depth strategy that will continuously improve the County’s ability to proactively identify and address risks across the county's enterprise network and technology resources. This project and its investments complement the County’s cybersecurity operations and provide the necessary hardware and software for it to run.
Project Scope:
This project provides critical systems to keep the county secure, including penetration testing, multi-factor authentication (MFA CJIS Requirement), identity management application system and consultants, secure file transfer and storage platform, and cybersecurity labor. This includes the implementation of new detection, monitoring, and protective controls while ensuring compliance with regulatory controls.
FY24 accomplishments include Security Operations Center / Network Operations Center (SOC/NOC) vendor has been selected, the statement of work and service levels have been defined. Evaluated 21 vendors for Penetration Testing and selected 5, the Forensics Lab has researched hardware and software upgrades. Password Manager (IAM) is correcting application service account permissions issue. HCAM performed upgrade with new servers.
In FY25, US’s focus will be on the following:
|
Cybersecurity Consultant Services |
The consultant personnel will support Cybersecurity capital project setup and deployment. |
|
Penetration testing (Phase 1) - testing new applications or capitalizable services before operation |
Penetration testing will allow the detection of application vulnerabilities and improper configurations, as well as the implementation of corrective action. Initial penetration testing before deployment is essential to development and is capitalized in this project. The vendor has been selected and is reviewing the Contract. |
|
Multi-Factor Authentication - Law Enforcement |
Multi-factor authentication (MFA) for Harris County systems with CJIS requirements. |
|
Identity and Access Management (IAM) system (Phase 2) |
Upgrade of the county’s Identity and Access Management system infrastructure will increase performance and enhance our ability to restrict access to authorized users. This consists of hardware and one-time software development costs. Phase 2 will involve new and upgraded hardware (servers) and integration for Harris County Access Management systems in test and development. |
|
Secure File Transfer & Storage Platform |
The Secure File Transfer and Storage platform will provide the county with the ability to store, send, receive, and share sensitive content with external 3rd parties and internally to remain in compliance with regulatory requirements. Expenses consist of establishing the platform and the required software and hardware. Delayed due to the RFP process. |
|
Cybersecurity labor |
Cybersecurity labor will comprise of 4 current personnel to implement Cybersecurity capital project setup, and deployment. |
These projects provide the technology and services necessary to enable early detection of advanced cyber threats against the County's network and IT services while ensuring compliance with regulatory controls.
There might be changes in the County’s needs that result in operational changes for the project throughout the Fiscal Year, but the overall scope will remain the same.
Justification:
This project enables rapid incident detection, prevention, analysis, response, and monitoring processes that will minimize potential disruption to county services from a cyber-attack. The requested software, services, and staff will help address requirements identified as needing to be addressed for CJIS, PCI-DSS, HIPAA, and Privacy compliance. Compliance with these standards is required to meet basic law enforcement data security standards and process credit/debit card transactions. This project will also demonstrate the cyber security competency required to qualify for some grant programs, bond ratings, insurance, and business contracts.
Alternatives and Engagement:
No alternatives have been identified for this project that provide adequate cybersecurity. Failure to secure the county’s enterprise network, devices, and data from unauthorized access and criminal use can lead to ransomware attacks, data exfiltration, distributed denial of service, loss of citizen trust, and loss of compliance with PCI, CJIS, HIPAA/HI-Trust, EHR, Privacy laws, etc. Alternate funding sources are not available for this project.
Anticipated Project Expenditures and Timeline:
|
Scope of Work |
Estimated Cost |
Estimated Completion |
|
Penetration Testing (Vendor Selected) - Phase 1 |
$1,000,000 |
9/30/2025 |
|
Cyber Security Labor (4) |
$800,000 |
9/30/2025 |
|
Cyber Security Consultant Services |
$2,000,000 |
9/30/2025 |
|
Multifactor Authentication (MFA) Implementation - CJIS Requirement |
$1,000,000 |
9/30/2025 |
|
Identity & Access Management System & Consultants - Phase 2 |
$415,000 |
9/30/2025 |
|
10% Contingency |
$521,500 |
|
|
Total Planned FY25 Expenditures |
$5,736,500 |
|
|
Unencumbered Balance to carry into FY25 |
($200,000) |
|
|
Incremental Authorization Requested FY 25 |
$5,536,500 |
|
At this point, US is asking for authorization of $5,536,500 for FY25, CP allocation will be requested later when the PO is ready to be issued.
Alignment with Goal(s):
_ Justice and Safety
_ Economic Opportunity
_ Housing
_ Public Health
_ Transportation
_ Flooding
_ Environment
X Governance and Customer Service
Previous Court Action:
|
Date |
Agenda Item # |
Action Taken |
|
7/10/2018 |
6.b.6 |
Request for approval of funding for project cost $1,120,000 |
|
7/31/2018 |
4.j.3 |
Request for approval of commercial paper funding for $1,120,000 |
|
8/25/2020 |
4.f.2 |
Request for approval of commercial paper funding for $2,265,000 |
|
1/25/2022 |
22-0637 |
Request for approval of commercial paper funding for $990,000 |
|
2/22/2022 |
22-1291 |
Request for an additional incremental amount of $3,272,000 for a SFY 2022 authorization of $5,209,000. |
|
3/8/2022 |
22-1753 |
Request for approval of commercial paper funding for $1,000,000 |
|
11/29/2022 |
22-7519 |
Request for an additional incremental amount of $3,052,500 for an FY2023 authorization of $6,752,500 |
|
8/29/2023 |
23-4823 |
Request for an additional incremental authorization of $7,583,750 for FY24 |
Address: Multiple
Precinct(s): Countywide
|
Fiscal and Personnel Summary |
|
Service Name |
|
|
|
|
Current Fiscal Year Cost |
Annual Fiscal Cost |
|
|
Labor |
Non-Labor |
Total |
Recurring Expenses |
|
|
|
|
|
|
|
Funding Sources |
|
|
Existing Budget |
|
|
|
|
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Total Current Budget |
$ |
$ |
$ |
$ |
|
Additional Budget Request |
|
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Choose an item. |
$ |
$ |
$ |
$ |
|
Total Additional Budget Request |
$ |
$ |
$ |
$ |
|
Total Funding Request |
$ |
$ |
$ |
$ |
|
|
|
|
|
|
|
Personnel (Fill out section only if requesting new PCNs) |
|
|
Current Position Count for Service |
- |
- |
- |
- |
|
Additional Positions Request |
- |
- |
- |
- |
|
Total Personnel |
- |
- |
- |
- |
Anticipated Court Date: 10/8/2024
Anticipated Implementation Date (if different from Court date):
Legal funding compliance confirmed by: Paige Abernathy, Assistant County Attorney, 9/10/2024
Department Approval by: Dale Kenyon, Cybersecurity Threat & Vulnerability Manager 7/1/2024
OMB CIP Team Approval by: Amiel Chen, CIP Manager, OMB , 9/23/24
Commercial Paper Request (For OMB use only):
Receiving Department: N/A Choose an item.
Project PeopleSoft ID: N/A
CP Series Description: N/A
OMB Financial Management contact: N/A