Cybersecurity Subcontractor Has No DHS or ICE Contracts, City Staff Tells Council Ahead of Monday Vote – Pasadena Now

Author:

Using an unordered list, summarize the following article with between 4 and 8 key points.

The Pasadena City Council on Monday will reconsider a $968,124 cybersecurity contract with Carahsoft Technology Corporation that earlier was tabled at the May 4 meeting over concerns about the company’s federal contracts with the Department of Homeland Security and Immigration and Customs Enforcement.
The June 8 staff memo notes that the contract returns under a Council direction adopted April 6, instructing staff to collect vendor DHS and ICE contracting information over a 12-month period without impact on contractor selection during that time, to allow for a fully informed evaluation of further actions.
The contract, for managed cybersecurity monitoring services over five years, returns under Item 20 with a supplemental memo from Acting Chief Information Officer Serjik Arzoumanians that presents clarifications about the roles of the two companies: the entity actually performing the work, subcontractor Quzara LLC, holds no contracts with DHS or ICE; Carahsoft serves as a reseller and as a distribution and procurement partner without access to City information delivered through the service.
According to the June 8 Department of Information Technology memo, Carahsoft holds approximately 32,000 active federal contracts, including 224 with DHS and four with ICE; staff characterized the ICE-related work as “an extremely small fraction of the company’s overall federal contract portfolio.” The memo identifies Quzara’s 24 active federal contracts as 22 with the Department of Treasury, one with the General Services Administration, and one with the International Boundary and Water Commission: U.S.-Mexico, with none at DHS or ICE.
After the May 4 hold, the item was referred to the Economic Development and Technology Committee, which reviewed the staff recommendation at its May 19 meeting. The Committee agreed the item should return to Council with five clarifications — covering the roles of Carahsoft and Quzara, Carahsoft’s DHS and ICE contract counts, Quzara’s contracts with DHS and ICE, data protection requirements, and broader ethical procurement considerations. Following staff agreement to provide those clarifications, the memo states, the Committee “was comfortable moving the contract forward for Council approval.” The Committee also discussed the difficulty of drawing bright lines in vendor ethical evaluation because most large technology companies offer a wide variety of solutions across industries, and noted the need for a more structured policy framework before potentially incorporating such considerations into procurement scoring.
The contract and the Quzara services agreement incorporate the City’s standard data protection clause: “Vendor has no rights to use Organizational Data for any purpose other than to deliver the services contracted, unless otherwise authorized in writing by the City.” The Quzara agreement adds language stating, “The City retains all rights, title and interest in data and information input, uploaded, transmitted, or otherwise provided by or on behalf of the City into the vendor provided solution,” and that all such data shall remain the sole and exclusive property of the City.
The only opposition voice documented in the agenda packet is a public commenter who identified themself as Yadi, in written correspondence submitted to the May 4 meeting. “I ask the City Council to award the contract to an alternate vendor who does not have ties or contracts with DHS or ICE, and in alignment with the City’s commitment to protect residents regardless of immigration status,” Yadi wrote. The comment closed: “Say no, reject the Carahsoft contract and go with another competent vendor.” The packet contains no responsive statement from Carahsoft or Quzara.
The contract is not the City’s first arrangement with Carahsoft. The May 4 agenda report notes that there is currently one open purchase order with Carahsoft Technology Corporation to provide employment verification for Workforce Innovation and Opportunity Act program participants for the Career Services Division of the City Manager’s Department.
The proposal under consideration Monday was selected through a competitive Request for Proposals issued November 6, through the City’s OpenGov procurement platform. A total of 77 firms downloaded the Request for Proposals and 15 proposals were submitted by the December 5 deadline, of which 14 were responsive and considered for evaluation. A cross-departmental Department of Information Technology and Water and Power team scored proposals against criteria weighted 30% Implementation Approach, Operations, & Co-Management; 25% Detection and Response Capabilities; 20% Experience, Organizational Qualifications and Compliance Alignment; 20% Cost; and 5% Small or Micro-Business. Carahsoft, headquartered in Reston, Virginia, finished first at 83.49 of 100; Bulletproof Solutions, Inc., of Waltham, Massachusetts, finished second at 83.01.
The contract would fund Managed Detection and Response services, providing around-the-clock monitoring of critical systems supporting every department and expert response support during potential cybersecurity incidents, with implementation expected within three to five months. The amount comprises $21,060 in base implementation costs, $842,064 for five years of ongoing Managed Detection and Response services, and $105,000 in 12% contingency. In September 2024, the Department of Information Technology submitted a $225,000 competitive State of California cybersecurity grant proposal; the agenda report identifies $163,000 in State grant funding for the first year of expenses. Pasadena was one of only 13 cities, out of 113 entities and more than 400 applicants, to receive the state award announced in December 2024, according to the staff report.
The staff recommendation asks Council to do three things: find the contract exempt from the California Environmental Quality Act under the “common sense” provision; authorize the City Manager to execute the contract; and authorize the City Manager to approve no-cost amendments, including durational extensions — a provision that would allow the agreement to extend beyond the five-year term without further Council action.
The agenda report was prepared by IT Security Officer Michael Royer and approved by Interim City Manager Matthew E. Hawkesworth. The Council will consider the item Monday as Item 20.

Get our daily Pasadena newspaper in your email box. Free.
Get all the latest Pasadena news, more than 10 fresh stories daily, 7 days a week at 7 a.m.