50-36100-24-EM065_36100 DoIT_Approved EP_FY25-001_ANM_7.5.2024.pdf.PDF

2022 Emergency Form

STATE OF NEW MEXICO

EMERGENCY DETERMINATION FORM

The emergency procurement method (NMSA 1978, Section 13-1-127) may only be used when the service, construction or item of tangible personal property procured:

1. is needed immediately to:

a. control a serious threat to public health, welfare, safety or property caused by a flood, fire, epidemic, riot, act of terrorism, equipment failure or similar event; or

b. plan or prepare for the response to a serious threat to public health, welfare, safety or property caused by a flood, fire, epidemic, riot, act of terrorism, equipment failure or similar event; and

2. cannot be acquired through normal procurement methods.

a. The agency entering into an emergency procurement should employ a competitive process to the extent practicable under circumstances.

The purchase or lease of heavy road equipment is not allowed under the emergency procurement statute.

The state purchasing agent or a central purchasing office that makes an emergency procurement shall outline its determination of the basis for the procurement and its selection of the contractor in writing and include the writing in the procurement file. (That writing can be made on this form.) Promptly thereafter:

• the state purchasing agent shall post notice of the procurement on its website; or

• the central purchasing office shall post notice of the procurement on its website, if it maintains one, and shall transmit the notice to the state purchasing agent for posting on the state purchasing agent's website.

NOTE: the state purchasing agent or a central purchasing office that makes an emergency procurement to plan or prepare for the response to a serious threat to public health, welfare, safety or property caused by a flood, fire, epidemic, riot, act of terrorism, equipment failure or similar event shall account for the money spent in making the procurement and report on that accounting to the legislative finance committee and the department of finance and administration within sixty days after the end of the fiscal year in which the procurement was made.

I. Name of Agency: Department of Information Technology (DoIT)

Agency Chief Procurement Officer: Lucy Vigil Rendon Telephone Number: (505) 629-2297

II. Name of Contractor: Advanced Network Management, Inc. (Contractor) Address of Contractor: 4001 Jefferson Plaza, NE Albuquerque, NM 87109

Amount of prospective contract: $94,664.06

Term of prospective contract: 250 hours

DocuSign Envelope ID: BF6B3739-CE74-45F3-8251-EFB4765D0EF7 markm Highlight

Highlight

III. Thoroughly list the services (scope of work), construction or items of tangible personal property being procured:

The Contractor to provide professional services to support Emergency Incident Response to the Ransomware attack of the Law Offices of the Public Defender during the week of June 23-27, 2024, for Procuring Entity. The goals and objectives for Contractor are: initial Incident Response, by determining the method of compromise, find and eliminate any persistent threats to the system, and support the overall progress of the incident with regular phone, video, and email correspondence. The contract will divide the project into six areas:

Initial Incident Response; Data Compromise Investigation; Data Prevention; Data Recovery & Restoration; Threat ACTOR Communication; and Containment, monitoring of existing end point detection, and Network Exposure Monitoring, IV. Provide an explanation for the justification of the procurement including a description of the emergency condition(s) requiring use of emergency procurement and the practicable competition utilized in compliance with NMSA 1978, Section 13-1-127.

Over the past week (June 23-27, 2024) State agency, Law Offices of the Public Defender (LOPD), suffered a ransomware cyber-attack that affected their entire network, Email, and backup servers including all offices that are part of LOPD statewide. To stop the spread, preserve information, identify and remove the threat, restore functions to LOPD, and to patch that vulnerability, DoIT was required to bring in a vendor that can address this emergency immediately. The longer the wait, the greater the risk of spreading and further damage. Artic Wolf has been used in the past and has been quick to respond as well as familiar with the processes of DoIT and Office of Cybersecurity.

V. Describe what measures are being taken to minimize the duration and effect of this particular emergency procurement (for example: is the emergency only in place until a competitive process can be completed, etc.).

The duration of this emergency procurement is limited to two hundred fifty (250) hours. By working with this vendor, DoIT and the LOPD are able to review incident playbooks, work together to quarantine the event, scan if the event has spread, scan if the event is still active, remediate the event, and restore functions to that agency.

VI. Describe what measures the Agency will take in the future to prevent/mitigate use of emergency procurement under similar circumstances.

DoIT has been working with various vendors to acquire an Incident Response contract. The biggest challenge is costs and scoping what is needed as these “retainers” must be paid in advance regardless of if services are used. Cyber-attacks are not predictable, and each attack can cause a different level of damage and cost to remediate. It has been very difficult to find a balance. We have resumed negotiations with these vendors and are looking into a scale up service where we pay a base retainer and can scale up as needed. At this time, bringing in ArticWolf as needed has been the least expensive solution.

Certified by: Date: _______________

Agency Chief Procurement Officer

Agency Approval by: Date: _______________

Cabinet Secretary/Governmental Entity Head or Designee

7/3/2024

7/5/2024 markm

FY25

New Stamp

I. Name of Agency: Department of Information Technology (DoIT)