cover
TO: Mayor John Laesch
FROM: Mark Taghap, Chief Information Security Officer,
Ram Tyagi, Chief Information Officer,
Jeff Anderson, Deputy Chief Information Officer,
Leela Karumuri, Director Cyber and Technology Risk
DATE: October 13, 2025
SUBJECT:
A Resolution authorizing the Director of Purchasing to award a Managed Security Services contract to NuHarbor Security, Inc., Colchester, VT, for a three year contract with two additional option years.
PURPOSE:
The City of Aurora plans to establish a long-term partnership with a Managed Security Service Provider (MSSP) that can help the City achieve the goals of the Information Technology Strategic Plan while effectively managing current and future cybersecurity risks.
BACKGROUND:
As part of the City of Aurora Technology Strategic Plan, the Information Technology Division is seeking to evaluate and improve Governance and Security citywide.
This strategic line of defense and arguably the most important, will be for the City to maintain a comprehensive Cybersecurity for all critical assets.
The City of Aurora seeks a managed security solution reduce cybersecurity risks, protect city system and assets, and prepare for future cyber risks. The solution that can also protect city owned and managed assets related to information technology and operating technology. This includes but is not limited to computers, servers, printers, infrastructure technology, phones, deployed sensors such as cameras, environmental sensors, WI-FI nodes, OT devices (Operational etc. As the city continues to refresh technology and or add new solutions, this would also be included. Any managed security solution must be capable of evolving as Aurora’s assets, technology and process evolves.
The city seeks a solution that supplements and works with existing technology solutions and processes and augments any existing gaps. Aurora recognizes this an evolving space and is open to solutions that achieve the goals of this opportunity that may look different from a traditional managed security service but proposed solutions should be a partnership with defined service levels and key performance indicators, versus a sale of technology solution that the city runs/manages with all internal resources.
A solution to achieve the City’s goals may include but not limited to:
- 24/7 monitoring of security events and security-related data sources
- The administration and management of IT security technologies
- The delivery of security operation capabilities via remote security operations centers (SOCs)
- Security technology administration and management of firewalls, unified threat management (UTM), intrusion detection and prevention system (IDPS), endpoint protection platform (EPP), endpoint detection and response (EDR), secure web gateway (SWG) and secure email gateway (SEG)
- Incident response services (both remote and on-site)
- Vulnerability assessment and managed vulnerability management services (e.g., scanning, analysis and recommendations/remediation)
- Threat intelligence services (e.g., machine-readable threat intelligence feeds, customer-specific dark web and social media monitoring)
- Managed detection and response (MDR) services.
The contracts with our current MSSP provider originally awarded in 2020 (R20-311) expire December 31, 2025.
DISCUSSION:
After several meetings to discuss the City’s needs and specific timeline, Marketplace.city drafted the Solicitation for vendors to complete to be included in the reporting and selection process.
- It was publicly posted on 7/14/2025 and closed 8/6/2025.
- There were 21 responses completed by the deadline.
- Met to review Vendor Response Data ON 8/8/2025
- The project team continued to review the response data, identifying the 11 most qualified respondents for initial 1-hour conversations.
- Finalists Global Solutions Group, NuHarbor Security, and Trustwave were identified by the project team as offering the most robust
solutions and most attractive potential partnership.
- Marketplace.city drafted a final proposal document for the three finalists to submit, clarifying remaining technical questions and final
pricing.
- It was released to finalists between 9/2/2025 - 9/12/2025.
- The full RFP Analysis presentation will be summarized on the following slides.
NuHarbor Security, Inc. was identified and selected as the top scorer and winning bid. NuHarbor Security, Inc is a 100% U.S.-based, pure-play cybersecurity firm built by a CISO and trusted by CISOs. Designed to scale with their clients’ missions and help them do more with less while protecting public trust, their practitioner-led team delivers tailored, contextual, and outcome-focused managed security services that cut through noise and maximize the value of existing tools. Together, they make cybersecurity stronger, easier, and more effective for the organizations that keep everyday life running.
The managed services contract model allows for flexibility as the City of Aurora and or the cybersecurity threat landscape evolves.
Pricing / Contracting Details:
The contract is for 3 years with 2 optional years at the City of Aurora’s discretion. Total amount should not exceed $1,462,362.00
* Penetration Testing: Estimated 2026 pricing for penetration testing is for NuHarbor to perform full testing of all network segments. We will perform penetration testing for subsequent years, but it will be another firm to test.
ADDITIONAL NOTE: Since we have chosen to directly manage the password manager and security awareness training platforms, instead of utilizing a third party, we will return to Council in the next few weeks to present these additional platforms.
Funding is available in general fund account #101-1283-419.32-80 Professional Fees/ Consulting Fees for 2025 and subsequent years.
IMPACT STATEMENT:
Customer breach notifications; Post-breach customer protection; Regulatory compliance; Public relations/crisis communications; Cybersecurity improvements; Technical investigations; Insurance premium increases; Increased cost to raise debt; Operational disruption or destruction; Lost value of customer relationships; Value of lost revenue; Devaluation of City brand/image; Loss of intellectual property (IP).
RECOMMENDATIONS:
Request the proposed resolution be adopted.
cc: Infrastructure & Technology Committee
CITY OF AURORA, ILLINOIS
RESOLUTION NO. _________
DATE OF PASSAGE ________________
title
A Resolution authorizing the Director of Purchasing to award a Managed Security Services contract to NuHarbor Security, Inc., Colchester, VT, for a three year contract with two additional option years.
body
WHEREAS, the City of Aurora has a population of more than 25,000 persons and is, therefore, a home rule unit under subsection (a) of Section 6 of Article VII of the Illinois Constitution of 1970; and
WHEREAS, subject to said Section, a home rule unit may exercise any power and perform any function pertaining to its government and affairs for the protection of the public health, safety, morals, and welfare; and
WHEREAS, the City seeks long-term partnership with a Managed Security Service Provider (MSSP) that can help the City achieve the goals of the Information Technology Strategic Plan while effectively managing current and future cybersecurity risks; and
WHEREAS, the City published a formal Request for Qualifications on July 14, 2025 with 21 respondents participating and then a more detailed Request for Proposal to a selected group of respondents; and
WHEREAS, NuHarbor Security, Inc. was the highest ranked respondent and is being recommended for the award of the Managed Security Services contract; and
WHEREAS, Funding is available in general fund account #101-1283-419.32-80 Professional Fees/ Consulting Fees for 2025 and subsequent years.
NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Aurora, Illinois, as follows: the Director of Purchasing is hereby authorized to execute the contract and issue purchase orders for services described in this resolution and as more fully set forth in the contract attached hereto.