Alvarez Technology Group - Manage IT Services Contract Amendment #2:

1. APPROVE and AUTHORIZE the Executive Director to execute contract amendment #2 with Alvarez Technology Group for the Agency's managed IT services contract to increase the budget by $25,600 for a total not-to-exceed amount of $176,200 over the remaining term of the agreement ending December 31, 2024 to cover additional cybersecurity services, pending Agency Counsel approval;
2. AUTHORIZE the use of funds from the approved budget for this project;
3. FIND that this amendment is justified as a sole source due to the efficiencies that support award to the existing consultant as a logical follow-on to work already in progress under a competitively awarded contract; and
4. AUTHORIZE the Executive Director to take such other further actions as may be necessary to fulfill the intent of the contract, including approvals of future modifications or amendments that do not significantly alter the scope of work, or change the approved contract term or amount.

On December 4, 2019 the Transportation Agency Board of Directors approved an agreement for services with Alvarez Technology Group to provide computer and network services as the Agency's information technology support consultant. The agreement for services with Alvarez Technology Group is for a five-year time period, terminating on December 31, 2024. The scope of work covers maintenance and security of the agency’s file and email servers, as well as the set up of mobile devices and workstations. Alvarez Technology Group is also required to install and maintain a network monitoring and management appliance and configure all the covered workstation and servers to be monitored twenty-four hours per day, seven days per week. The network monitoring and management appliance will alert the consultant(s) to any significant problem that arises on the devices and they will respond during normal working hours. Other tasks in the scope of work cover the Agency's cloud-based email system, set up and maintenance of the wireless network, virus and malware protection, mobile device set up, backups and data loss prevention, annual evaluations, and monthly reporting.

With the proliferation of network intrusions and ransomware attacks, the Agency is seeking to amend its existing agreement with Alvarez to incorporate additional cybersecurity protections.  The proposed amendment would provide security services consistent with the National Institute of Standards and Technology federal cybersecurity framework. The additional services would include Cybersecurity Awareness Training for all Agency staff, a cloud services security assessment, a network device to detect and stop ransomware attacks, and an annual risk assessment.  Agency staff is also proposing to coordinate with Alvarez to update password and remote work policies for better protection of Agency resources.