To: Board of County Commissioners
Through: Philip Savino, Director & CIO, Department of Technology
Prepared By:
prepared
Mark Harkleroad, IT Network Services Manager, Department of Technology on behalf of Philip Savino, Director & CIO, Department of Technology
end
presenter
Presenter: Philip Savino, Director & CIO, Department of Technology
end
Subject:
title
3:30 PM *Enterprise Network Firewall Replacement Funding and Fixed Asset Numbers
end
Purpose and Request:
recommended action
The IT Department is requesting Board of County Commissioners (BoCC) approval to utilize existing network firewall fixed-asset funds to replace the County's current Check Point enterprise firewall infrastructure with Fortinet FortiGate next-generation firewalls. The IT Department is requesting 7 new fixed asset numbers and appropriation in Fund 70 of the $223,692.
end
Alignment with Strategic Plan: Good Governance - Plan for future service, infrastructure, and fiscal needs.
Background and Discussion:
The County's enterprise network firewalls are a critical component of its cybersecurity and network infrastructure. They provide security controls and network connectivity for County data centers, facilities, applications, internet connectivity, remote access, and other critical services.
The County currently utilizes Check Point firewall appliances. The hardware support and renewal agreement expires in mid-February 2027, requiring the County to either renew the existing platform or transition to a replacement solution.
The IT Department Network Team evaluated replacement options and identified Fortinet FortiGate as the preferred platform for the County's next-generation firewall environment. Fortinet is an established enterprise network security vendor with broad market adoption and provides enterprise-class next-generation firewall capabilities through the FortiGate platform.
The County's current Check Point hardware support and renewal agreement expires in mid-February 2027, with an estimated renewal cost of $178,986. The proposed Fortinet hardware and first year of maintenance and support is quoted at $174,192, with a one-time implementation professional-services cost of $49,500, for a total initial project cost of $223,692. Therefore, we are requesting 7 new fixed asset numbers and appropriation in Fund 70 of the $223,692.
Based on the County's current cost comparison, replacing the Check Point platform with Fortinet is estimated to result in approximately $474,925 in operational savings during budget years 2027 through 2030 compared with continuing with the existing Check Point platform. Proceeding now also allows the County to begin realizing these savings sooner while providing sufficient time to complete the migration before the current Check Point support agreement expires.
The requested direction is to proceed with the Fortinet acquisition and implementation, with the goal of completing the purchase order and associated professional-services Statement of Work by the end of October 2026 and beginning implementation in December 2026.
The opportunity to replace the existing platform developed in September 2026 following discussions regarding Fortinet's capabilities, implementation requirements, and potential costs. The IT Department determined that the proposed replacement provides both technology modernization benefits and a significant opportunity to reduce ongoing operating costs. The proposed change is also consistent with the IT Department's Strategic Plan objectives to maintain and modernize security systems, protect County data, increase investment in technology-forward solutions, improve operational stability, and maximize the value of technology investments.
The financial analysis is a significant factor in the recommendation. The Fortinet hardware and first year of maintenance and support are quoted at $174,192, compared with the estimated $178,986 cost to renew the existing Check Point platform for one year. The Fortinet implementation also requires a one-time professional-services engagement of $49,500 for deployment and migration, resulting in an initial project cost of $223,692. Please see the PDF attachment for the year-by-year costs.
Despite the additional one-time implementation expense, the longer-term cost comparison favors replacement. Based on the County's current cost analysis, the Fortinet solution is projected to provide approximately $474,925 in operational savings during budget years 2027 through 2030 compared with maintaining the Check Point platform. These savings are primarily attributable to lower ongoing maintenance and support costs.
The implementation schedule is driven by the February 2027 expiration of the existing Check Point support agreement. Approval now is necessary to allow sufficient time for:
• BoCC consideration and approval;
• Purchase order processing;
• Processing and approval of the vendor's professional-services Statement of Work through the County's contract-management process;
• Approximately 10-14 calendar days for equipment delivery;
• Delivery and installation of the equipment in County data centers;
• Initial configuration and testing;
• Migration and validation of existing firewall rules and policies;
• Testing of critical network, application, internet, VPN, and security services; and
• Final migration and decommissioning of the existing Check Point firewalls.
Staff is targeting the end of October 2026 for approval and issuance of the purchase order. This will provide sufficient time for equipment delivery and preparation and allow the Network Team and vendor to begin implementation and firewall migration activities in early December 2026.
Beginning the migration in December provides approximately two months to complete the migration, validate services, address issues, and transition the County from the Check Point platform before the existing support agreement expires in mid-February 2027. This schedule reduces the risk of having to perform a complex firewall migration under a compressed timeline immediately before the renewal deadline.
Alternatives: The Board could opt to renew the existing Check Point hardware support and maintenance agreement when it expires in February 2027.
However, the estimated renewal cost is $178,986 for the next year. Continuing with Check Point would forgo the projected $474,925 in operational savings identified in the current cost comparison and delay modernization of the County's firewall infrastructure. A future replacement project would still be required.
Fiscal Impact:
The Fortinet hardware and first year of maintenance and support are quoted at $174,192. A one-time professional-services engagement of $49,500 is required for implementation and migration, resulting in an initial project cost of $223,692.
The County will avoid the estimated $178,986 Check Point renewal expense that would otherwise be required in February 2027.
Based on the County's current cost comparison, the proposed Fortinet solution is estimated to produce approximately $474,925 in operational savings during budget years 2027 through 2030 compared with continuing the Check Point platform. Actual savings will be dependent upon final pricing and future maintenance and support costs.
The IT Department is requesting authorization to use existing network firewall fixed-asset funds to request 7 new fixed asset numbers and appropriation in Fund 70 of the $223,692. No new ongoing funding source is being requested.
Alignment with Strategic Implementation Strategies: N/A
Staff Recommendation:
Staff recommends that the Board of County Commissioners utilize existing network firewall fixed-asset funds and approve 7 new fixed assets and appropriation in Fund 70 of $223,692 to purchase and implement the Fortinet enterprise firewall solution.
Staff further recommends proceeding with procurement and implementation as soon as practicable, with the goal of completing purchase-order and contract processing by the end of October 2026 and beginning implementation and firewall migration activities in early December 2026.
This approach will allow the County to replace its existing Check Point firewall infrastructure before the February 2027 support expiration, avoid the estimated $178,986 renewal expense, and realize projected operational savings while providing sufficient time for a controlled migration.
Concurrence: N/A