Non-Competitive Award of Contracts for IT and Cybersecurity Audits

Performing Information Technology (IT) penetration testing (Pen Testing) and vulnerability assessments (VA) is complex and requires highly trained IT security experts and specialized testing tools and software. Each tester must have a police security clearance to perform assessments on critical technology systems. In 2019, the Auditor General presented her report "Cyber Safety: A Robust Cybersecurity Program Needed to Mitigate Current and Emerging Threats" at the City Council meeting on October 29 and 30, 2019. At the meeting the recommendation "City Council request the City Manager, in consultation with the Auditor General, to report by the December 17 and 18, 2019 meeting of City Council on mechanisms required that would enable the Auditor General to conduct risk assessments or investigate cyber security for City Agencies and Corporations not currently within the Auditor General's purview" was adopted. To mitigate emerging cybersecurity threats the Auditor General increased the number of cybersecurity audits on her workplan. The Auditor General has now sole sourced several work assignments to the Firm that won a competitive bid in 2019 for a cybersecurity audit. We selected this Firm because the only other proponent that bid has since performed consulting work for the City, so there is an independence issue. The selected Firm has the expertise in cybersecurity and provided very competitive rates. The selected Firm is familiar with the current state of City system architecture and this knowledge is key. As most of the pre-qualified Firms have expressed little interest on bidding for these assignments, the Auditor General expects to continue to sole source such projects to the Firm. The Auditor General intends to revisit the sole source arrangement during latter half of 2021 to evaluate and determine other procurement choices. The Auditor General expects that the aggregate value of all contracts for various technology and cybersecurity audits at the City and its Agencies and Corporations may exceed $500,000 in total. Therefore, the purpose of this report is to keep Audit Committee and Council apprised of the non-competitive nature of these procurements.