Notice of Special Procurement: SANS Long Course Vouchers SP

Notice of Special Procurement: SANS Long Course Vouchers SP THIS IS A NOTICE, NOT A BID. SEE ATTACHMENT FOR INFORMATION Special Procurement for SANS Long Course Vouchers REQ-10700-00147109_SANS Training Vouchers_EIS-CSS Page 1 of 5 REQUEST FOR SPECIAL PROCUREMENT No. REQ-10700-00147109 PART A. Requesting Agency must complete Items 1 through 13. 1. Requesting Agency Name: The Oregon Department of Administrative Services, State Procurement Services (DAS SPS), on behalf of Enterprise Information Services (EIS) 2. Date of Request: August 29, 2025 3. Agency Number: 107090 OBO 107040 4. Agency Contact Name: Jennifer Alton 5. Phone: (971) 375-5158 6. Type of Request: Class Special Procurement X Contract-specific Special Procurement 7. Time Period Requested: From: August 29, 2025 To: December 31, 2035 8. Total Estimated Cost: $1,550,000 9. Title: Supplies and/or Services to be Acquired: SANS (SysAdmin, Audit, Network, Security) Institute’s Information Technology (IT) technical training vouchers 10. Request, Background, Current Need, and Proposed Contracting Procedure: a. Request: DAS SPS, on behalf of EIS, requests approval of Special Procurement (SP) No. REQ-10700-00147109 to direct award a contract to The Escal Institute of Advanced Technologies, dba as SANS Institute (SANS) to purchase SANS training vouchers for cybersecurity technical training. The Term of the contract will be 10 years, ending on December 31, 2025, with a not-to-exceed (NTE) of $1,550,000. b. Background: EIS is responsible for enterprise IT/security policy, security monitoring of the state network, enterprise incident response, and enterprise security architecture, as well as dissemination of security training, policy, and best practices across state government. A trained workforce is the strongest defense against cyber risk. To truly reduce risk, EIS needs workforce training that connect with people in their roles, show them how to respond to real threats, and measure progress over time. SANS is uniquely positioned to deliver hands on, job relevant cybersecurity training and industry recognized certifications that align with the specialized needs of government cybersecurity professionals. SANS offers more than 85 hands-on cybersecurity courses to help cyber professionals at every level of experience gain immediately applicable skills. SANS courses are expert-led, role-based learning that strengthens culture and makes security part of operations. Additionally, their courses provide access to the most current resources, best practices, and threat intelligence in a rapidly evolving industry, ensuring staff are equipped to respond effectively to emerging risks. For more than a decade, the State of Oregon has relied on SANS training vouchers to strengthen its cybersecurity workforce. This long-standing relationship has enabled staff to obtain the critical skills and certifications necessary to address the State’s complex and evolving security challenges. No alternative REQ-10700-00147109_SANS Training Vouchers_EIS-CSS Page 2 of 5 vendor offers equivalent content, delivery methods, or industry recognition, making SANS the only provider capable of meeting these requirements. The technical training vouchers are available exclusively through SANS. SANS does not authorize resellers for these vouchers and is the sole provider. On June 23, 2015, a Sole Source Determination was established and approved pursuant to Oregon Revised Statute (ORS) 279B.075 and Oregon Administrative Rule (OAR) 125-247-0275 for the purchase of SANS technical training vouchers. c. Current Need: The current need is for additional SANS training vouchers to support ongoing workforce development. As cybersecurity threats continue to evolve, it is critical that staff maintain access to the most up-to-date training and industry recognized certifications. SANS vouchers provide the State’s cybersecurity professionals with timely, job relevant education that directly addresses the skills gap and ensures the workforce remains prepared to meet emerging security challenges. Below is a Cost Table (Table 10.c.) to reflect the Total Estimated Cost for the requested ten (10) years: Table 10.c. Year Year Year Year Year Year Year Year Year Year ‘25-‘26 ‘26-‘27 ‘27-‘28 ‘28-‘29 ‘29-‘30 ’30-‘31 ’31-‘32 ’32-‘33 ’33-‘34 ’34-‘35 $150,000 $150,000 $150,000 $150,000 $150,000 $160,000 $160,000 $160,000 $160,000 $160,000 Total Estimated Cost: $1,550,000 d. Proposed Contracting Procedure: 1. As required by OAR 125-247-0287, DAS SPS, on behalf of EIS, will issue a public notice (Notice) of the approved SP on OregonBuys® for a period of seven (7) calendar days. 2. The Notice will include provisions that any Affected Person(s) may protest the approval of this SP Request. 3. DAS SPS, in collaboration with EIS, will respond to and resolve all protest(s), if any. 4. If no protests to this SP Request are received or sustained, DAS SPS will proceed with direct award of a contract to SANS Institute as set out in section 10.a. 5. DAS SPS will work with EIS and obtain its endorsement prior to executing the contract, if required. 6. Pursuant to OAR 137-045-0015, DAS SPS will work with Oregon Department of Justice (DOJ) and obtain legal sufficiency approval prior to executing the contract, as required. 11. Justification for use of Special Procurement: Oregon’s Public Contracting Code (the “Code”), set out in ORS Chapters 279A, 279B, and 279C, is predicated on the principles of competition. The SANS Vouchers were originally obtained via a Sole Source Determination procurement as noted in section 10.b. However, it has been established that the vouchers for training outlined in Section 9 (above) are only available from SANS. Therefore, outside of ORS 279B.065 Small procurements, which limits the maximum compensation of a direct awarded contract to $25,000, there are only two procurement methods defined in statute through which the request articulated in this SP can be solicited and approved: o ORS 279B.075 Sole-source procurements REQ-10700-00147109_SANS Training Vouchers_EIS-CSS Page 3 of 5 o ORS 279B.085 Special procurements The State of Oregon provides essential services to some of the most vulnerable and underserved populations. To deliver these services, the State has developed applications and systems that must be available 24/7 from any location. The current geopolitical landscape and the rapid growth of the cybercriminal industry have created an extremely hostile environment for state systems. Threat intelligence organizations report that threat actors ranging from organized crime groups to nation-state adversaries are intensifying attacks on cloud-based systems, employing increasingly advanced techniques, and leveraging artificial intelligence to generate more sophisticated exploits. This evolving threat environment has created an immediate and ongoing need to ensure that State staff remain highly trained and knowledgeable in cybersecurity best practices. As nation-state backed attacks increase in frequency and sophistication, the volume of individuals and groups entering the cyber threat landscape continues to grow. However, the State’s cybersecurity staffing and capabilities are not scaling quickly enough to meet these rising threats. This gap amplifies the need for specialized, external training resources to strengthen workforce skills, enhance enterprise-wide threat detection and risk management, and improve overall effectiveness in defending against increasingly complex attacks. 12. Findings to Satisfy the Required Standards: This proposed special procurement: ____X__ (a) will be unlikely to encourage favoritism in the awarding of public contracts or to substantially diminish competition for public contracts because: SANS is uniquely recognized within the cybersecurity community as the gold standard for workforce development and certification, ensuring that state staff’s training directly translates into operational security improvements. Training vouchers are only available directly from SANS, with no authorized resellers or alternative providers. The SANS Institute’s IT technical training vouchers:

• meets the State’s mission critical needs;
• addresses an urgent and immediate requirement;
• closes critical workforce and capability gaps; and
• provides the most effective and efficient solution.

and ____X__ (b)(i) will result in substantial cost savings to the contracting agency or to the public because: SANS maintains a partnership agreement with its Multi-State Information Sharing and Analysis Center (MS- ISAC) that allows Cyber Security Services to purchase training vouchers at a discount of up to 55%. This partnership provides significant cost savings for the State, which could not be achieved through competitive traditional procurement. In addition, purchasing directly through this program reduces administrative REQ-10700-00147109_SANS Training Vouchers_EIS-CSS Page 4 of 5 burden and accelerates delivery of critical training, ensuring the cybersecurity workforce can address urgent and evolving threats without delay. Approval of this SP will significantly support the interests of the State and Oregon taxpayers. or ______ (b)(ii) will otherwise substantially promote the public interest in a manner that could not practicably be realized by complying with the requirements of ORS 279B.055, 279B.060, 279B.065, or 279B.070, or any rules adopted thereunder because: 13. Signature: The actual signature of the Agency Head or designee (e.g., Designated Procurement Officer) is not required on the Request if it is submitted through OregonBuys®. Agency may elect to attach a signed Request. Signature: e.g. Electronically in OregonBuys® _________________ Type Name: Date: REQ-10700-00147109_SANS Training Vouchers_EIS-CSS Page 5 of 5 PART B. The Department of Administrative Services completes Part B. STATUTORY AND RULE AUTHORITY: ORS 279B.085(2) states the Director of the Department of Administrative Services may approve a special procurement if the Director finds that a written request submitted under ORS 279B.085(4) demonstrates that the use of a special procurement as described in the request, or an alternative procedure prescribed by the Director will: (a) Be unlikely to encourage favoritism in the awarding of public contracts or to substantially diminish competition for public contracts; and (b)(A) Result in substantial cost savings to the contracting agency or to the public; or (B) Otherwise substantially promote the public interest in a manner that could not practicably be realized by complying with requirements that are applicable under ORS 279B.055, 279B.060, 279B.065 or 279B.070 or under any rules adopted thereunder. OAR 125-246-0170 delegates the authority of the Director of the Department of Administrative Services to approve special procurements to the State Chief Procurement Officer. OAR 125-247-0285 through 125-247-0288 implement ORS 279B.085. OAR 125-247-0700(2) Protests and Judicial Review of Special Procurements designates the State Chief Procurement Officer as the Contract Review Authority. FINDINGS: The findings are accepted, adopted, and incorporated by reference herein. CONDITIONS OF APPROVAL: 1. Notice Period. The Authorized Agency shall post the Public Notice on OregonBuys. The Special Procurement may not be used until after the completion of the seven (7) day notice period required pursuant to OAR 125-247- 0287(4), and either: a. No Written protests are received by the Contract Review Authority, State Chief Procurement Officer, from an Affected Person in response to the notice, or b. If any protest is received during the notice period, then not until: i. the State Chief Procurement Officer or delegate issues a written disposition of the protest in accordance with ORS 279B.400 and OAR 125-247-0700 and OAR 137-047-0700, and ii. confirms in writing the first possible date of use of the Special Procurement. 2. ORS 279A.165 Requirements. Authorized Agency shall comply with the requirements of ORS 279A.165 and OAR 125-247-0287(12) regarding a report about this Special Procurement. Agency shall use a form and follow the instructions provided by the State Chief Procurement Officer or delegate. 3. Authorized Agency shall comply with all Enterprise Information Services (“EIS”) conditions and requirements prior to contract amendment execution, if any. APPROVED Jay Jackson, Procurement Policy Officer Date: Department of Administrative Services, State Procurement Services 10/3/2025