Agenda

Return

C. 75

To:	Board of Supervisors
From:	Karen Caoile, Director of Risk Management
Date:	April 18, 2023

Contra

Costa

County

Subject:

Contract with Kroll Information Assurance, LLC

APPROVE	OTHER
RECOMMENDATION OF CNTY ADMINISTRATOR	RECOMMENDATION OF BOARD COMMITTEE

Action of Board On: 04/18/2023

APPROVED AS RECOMMENDED

OTHER

Clerks Notes:

VOTE OF SUPERVISORS

AYE:

Candace Andersen, District II Supervisor
Diane Burgis, District III Supervisor
Ken Carlson, District IV Supervisor
Federal D. Glover, District V Supervisor

ABSENT:

John Gioia, District I Supervisor

Contact:

Karen Caoile 925-335-1400

I hereby certify that this is a true and correct copy of an action taken and entered on the minutes of the Board of Supervisors on the date shown.
ATTESTED: April 18, 2023
Monica Nino, County Administrator

BY:	, Deputy

RECOMMENDATION(S):

APPROVE and AUTHORIZE the Director of Risk Management, or designee, to execute a contract with Kroll Information Assurance, LLC in an amount not to exceed $50,000 for data breach notifications and call center services for the period of April 18, 2023, through April 17, 2025.

FISCAL IMPACT:

Costs are paid through the County's Public Liability Insurance Internal Service Fund.

BACKGROUND:

County Risk Management recommends entering into an contract with Kroll Information Assurance, LLC (Kroll) to provide data breach notification services and call center services related to the unauthorized access of two email accounts at Employment and Human Services (In-Home Support Services - Public Authority). It is unknown whether any emails or attachments in the accounts were accessed or downloaded by the unauthorized source.

BACKGROUND: (CONT'D)

Pursuant to the terms of the agreement, Kroll’s liability to the County for damages is limited and the County agrees to indemnify and defend Kroll, including paying attorney’s fees, for matters related to these services.

CONSEQUENCE OF NEGATIVE ACTION:

Failure to approve the contract could result in delays in delivering data breach notifications and providing associated call center services.