Sole Source Determination_Center for Internet Security_FINAL.pdf

Oregon State Treasury Sole-source Procurement Request

Date 6/2/2025

Provide background information (include identification of prospective supplier)

A Sole-source Procurement is defined as any contract entered into without a competitive process, based on a justification that only one known source exists or that only one single supplier can fulfill the requirements. Sole-source Procurements are allowable in circumstance when a determination has been made by the Treasurer, based on written findings of fact, that the products and services are available from only one provider. (Attach your market research findings to this request).

General Information (Enter information into the light blue cells)

Procurement Professional Josh Woodmansee Anticipated Contract Amount $145,000

Procurement and Contract Information (Enter information into the light blue cells)

Goods or services being purchased?

Albert sensor monitoring services

In 2018, Treasury solicited for Intrusion Detection System management and monitoring services. Treasury entered into a contract with a max term through June 30, 2025. Treasury seeks to procure cybersecurity services from Center for Internet Security, Inc. (CIS) to support the organization's security posture, specifically in alignment with industry standards and government compliance requirements. CIS provides specialized threat intelligence, monitoring, and advisory services tailored to state agencies and critical infrastructure entities.

Docusign Envelope ID: 3730057A-6738-48C3-A377-14C6919231A5

Oregon State Treasury Sole-source Procurement Request

False

False

False

True

Finding

Yes

The goods or services are available from only one source

Describe the contract (include current and contemplated future purchases of goods or services) Annual contract for Albert sensor monitoring. Contract will consist of two line items: 1. Small monitoring services & 2. Medium monitoring services (diffent locations).

Provide the reasons you are seeking a sole-source procurement method CIS operates as the designated Multi-State Information Sharing and Analysis Center (MS-ISAC), recognized by the US Department of Homeland Security (DHS). Their services, including real-time threat monitoring, intelligence sharing, and cybersecurity assessments, are proprietary and exclusively available to government entities through MS-ISAC membership.

While various cybersecurity vendors exist, CIS is the only organization mandated to provide government-focused cybersecurity services through federal partnerships, including the Cybersecurity & Infrastructure Security Agency (CISA). Their specialized tools and threat intelligence reports are unavailable through commercial providers.

Due to the proprietary nature of CIS's services, their unique role in government cybersecurity, and the absence of viable alternatives, a sole source procurement is justified.

Treasurer or Deputy Treasurer's use only (Enter information into the light blue cells)

Determine whether each of the following findings is true.

Using existing goods requires purchasing compatible goods or services

Only one vendor provides the good or services required to exchange softwarre or data with other public or private agencies

The goods or services are for use in a pilot or experimental project

The goods or services are available from only one source.

Approved?

Treasurer or Deputy Treasurer Signature Date

Docusign Envelope ID: 3730057A-6738-48C3-A377-14C6919231A5

6/4/2025