60-36100-26-CP018_2021_Sole_Source_Form_MS-ISAC_2025.01292025..pdf.PDF

Docusign Envelope ID: 05C2ADA0-2F36-4B7C-ACDF-2F99C63CA411

2021 Sole Source Form

STATE OF NEW MEXICO

SOLE SOURCE REQUEST AND DETERMINATION FORM

A sole source determination is not effective until the sole source request for determination has been posted for thirty (30) calendar days without challenge, and subsequently approved in writing by the State Purchasing Agent or, for Professional Services Agreements, the Secretary of the General Services Department. The foregoing requirement is regardless of whether the sole source request for determination has been signed by the Agency and/or the Contractor.

I. Name of Agency: Office of Cybersecurity

Agency Chief Procurement Officer: Lucy Vigil Rendon Telephone Number: (505) 629-2297 Agency Contact for this request: Dan Garcia, Cybersecurity Program Manager Telephone Number & Email Address (505) 795-2638

Dan.Garcia@cyber.nm.gov

II. Name of prospective Contractor: Center for Internet Security, Inc.

SHARE Vendor Number (must be active): 0000148450 Address of prospective Contractor: 31 Tech Valley Drive

East Greenbush, New York 12061

Contact Name, Telephone Number and Email Address:

Carlos Kizzee (518) 266-3460 carlos.kizee@cisecurity.org

Amount of prospective contract before tax: $236,000.00

Estimated tax amount (tax is subject to change): $19,328.40

Term of prospective contract: March 1, 2026 – February 28, 2027

III. Agency is required to state purpose/need of purchase and thoroughly list the services (scope of work), construction or items of tangible personal property of the prospective contract (if this is an amendment request to an existing contract, include current contract number issued by SPD):

Membership to the: Multi-State Information Sharing and Analysis Center (MS-ISAC).

The MS-ISAC, operated by the Center for Internet Security (CIS), provides cybersecurity threat intelligence, incident response support, real-time alerts, and coordinated defense resources specifically tailored for U.S. State, Local, Tribal, and Territorial (SLTT) governments as follows:

Threat Intelligence and Distribution

State, Local, Tribal, and Territorial (SLTT) Specific Threat Intelligence Analysis Products and Reporting

MS-ISAC Threat Intelligence Platform Access Virtual Threat Intelligence Briefings (SLTT threat brief)

Member Collaboration and Engagement Exclusive access to a collaborative peer community 1:1 service consultation with Center for Internet Security (CIS) cybersecurity experts MS-ISAC Annual Membership Meeting Monthly membership calls Best practice webinars led by experienced peers and top experts SLTT mentorship program

Incident Response & Forensic Services MS-ISAC Incident Response & Forensic Services (as resources allow)

Security Operations Center (SOC) 24x7x365 SOC Access SOC Alerts, Advisories, Weekly Malicious IP/Domain List Passive Threat Notification Service

– Targeted Vulnerability Notifications

– Initial Access Broker (IAB) Monitoring

– Breached Credential Monitoring

– IP and Domain Monitoring

Services and Programs Albert Network Monitoring and Management Malicious Domain Blocking and Reporting (MDBR) Annual cybersecurity self-assessment (NCSR)

IV. Provide a detailed explanation of the criteria developed and specified by the agency as necessary to perform and/or fulfill the contract and upon which the state agency reviewed available sources. (Do not use “technical jargon;” use plain English. Do not tailor the criteria simply to exclude other contractors if it is not rationally related to the purpose of the contract.)

MS-ISAC is the only cyber threat intelligence and incident response provider solely tailored to state, local, tribal and territorial governments. These services are not provided by the federal government. Members receive threat intelligence directly relevant to the types of systems, vulnerabilities, and threats that specifically target their communities, unlike generic threat feeds from alternative sources. The MS-ISAC is recognized as the national Information Sharing and Analysis Center (ISAC) for State, Local, Tribal, and Territorial governments (SLTT) cyber readiness and response coordination.

V. Provide a detailed, sufficient explanation of the reasons, qualifications, proprietary rights or unique capabilities of the prospective contractor that makes the prospective contractor the one source capable of providing the required professional service, service, construction or item(s) of tangible personal property. (Please do not state the source is the “best” source or the “least costly” source. Those factors do not justify a “sole source.”)

The MS-ISAC currently includes representatives from all 50 states, more than 18,500 local governments, more than 200 tribal entities and six U.S. territories. This vast and diverse membership creates a unique forum for collaboration and information sharing across all levels of government where best practices are created, shared and adopted nationwide. In addition, MS-ISAC can bring together state CIOs, CISOs, city IT directors, tribal government leaders, and federal officials in real-time to respond to emerging threats.

VI. Provide a detailed, sufficient explanation of how the professional service, service, construction or item(s) of tangible personal property is/are unique and how this uniqueness is substantially related to the intended purpose of the contract.

Members receive carefully vetted and verified threat indicators, including malicious domains and file hashes, which can be used to automate defenses across their local networks, often without additional equipment. This actionable intelligence, designed for state, local, tribal and territorial government context, provides a significant advantage in proactively defending against cyber-attacks.

VII. Explain why other similar professional services, services, construction or item(s) of tangible personal property cannot meet the intended purpose of the contract.

No other organization offers the same level of integrated national cybersecurity threat sharing tailored to SLTT governments. The MS-ISAC delivers a unique combination of expertise, trust, scale, access, and mission alignment that cannot be replicated by commercial vendors or other government programs. MS-ISAC directly collaborates with federal partners and other ISAC organizations to support national security interests.

VIII. Provide a narrative description of the agency’s due diligence in determining the basis for the procurement, including procedures used by the agency to conduct a review of available sources such as researching trade publications, industry newsletters and the internet;

contacting similar service providers; and reviewing the State Purchasing Divisions’ Statewide Price Agreements. Include a list of business contacted, date of contact, method of contact (telephone, mail, e-mail, other), and documentation demonstrating an explanation of why those businesses could not or would not, under any circumstances, perform the contract; or an explanation of why the agency has determined that no businesses other than the prospective contractor can perform the contract.

MS-ISAC is a trusted cybersecurity partner for 18,000+ U.S. State, Local, Tribal, and Territorial (SLTT) government organizations, they cultivate a collaborative environment for information sharing in support of their mission. They offer members incident response and remediation support through their team of security experts and develop tactical, strategic, and operational intelligence, and advisories that offer actionable information for improving cyber maturity. The MS-ISAC was partially funded by Congress through a cooperative agreement administered by CISA. The MS-ISAC is a division of the Center for Internet Security (CIS) and is autonomously guided by its Executive Committee and member organizations. MS-ISAC is the only initiative offering cyber threat intelligence, incident response support, and real-time information sharing programs not performed by the federal government.

The State of New Mexico and various local government entities have been participating in this program for several years. MS-ISAC was formed in 2000, and over the years has created an 18,000+ collaborative environment including all 50 State. Other for-profit security vendors offer similar type services, but we could not find a vendor that offers cyber threat intelligence, incident response support, and real-time information sharing programs not performed by the federal government.

Certified by: Date:

Agency Chief Procurement Officer

Agency Approval by: Date:

Cabinet Secretary/Agency or Entity Head or Designee

APPROVED: Date:

State Purchasing Agent