Item 12 - Email Security and Cybersecurity Awareness Training

Home Browse Search

Information Technology Department www.santa-ana.org/IT Item # 12 City of Santa Ana 20 Civic Center Plaza, Santa Ana, CA 92701 Staff Report July 1, 2025 TOPIC: Email Security and Cybersecurity Awareness Training AGENDA TITLE Agreement with CDW-G for Email Security and Cybersecurity Awareness Training Software Subscription Services (Specification No. 25-090) (Non-General Fund) RECOMMENDED ACTION Authorize the City Manager to execute an agreement with CDW-G for cloud-based email security and cybersecurity awareness training services for a 39-month term. The agreement will commence on or after July 1, 2025, with the exact start date to be adjusted based on the actual implementation and purchase order issuance. The agreement end date will be extended accordingly to maintain the full 39-month term, in an annual amount not to exceed $75,306 to accommodate potential growth in user licenses, for a total not- to-exceed amount of$225,918 over the 39-month term (Agreement No. A-2025-XXX). GOVERNMENT CODE 484308 APPLIES: No DISCUSSION The City of Santa Ana currently relies on two separate platforms to support its cybersecurity framework: one for on-premise email security and another for employee cybersecurity awareness training. However, the current email security solution is based on legacy technology that will no longer be supported after March 2026. Without security updates or patches, the continued use of this system poses significant operational and security risks. Furthermore, the existing platforms lack the advanced capabilities and flexibility of modern cloud-based solutions, limiting the City's ability to effectively detect and respond to today's rapidly evolving cyber threats. In response, staff recommends transitioning to a consolidated, cloud-based cybersecurity solution that integrates advanced email threat protection with user training tools. The proposed solution would replace the City's current platforms, streamline system administration, and improve threat visibility. It would also enhance employee awareness through interactive cybersecurity training, including simulated phishing campaigns and behavior-based learning modules.