FY27 - Enhancing Enterprise Data Resiliency

Confidential

IT Governance Business Case Enhancing Enterprise Data Resiliency Technology Solutions

Confidential

Background The City of Durham's Technology Solutions Department supports the City's data infrastructure through two primary tools: Rubrik Foundation Edition and AvePoint. These tools provide critical data backup infrastructure and services that protects the City's data and enables rapid recovery in the event of data loss, system failure, or other disruptions.

Rubrik Foundation: Offers backup support for physical servers, virtual machines, and other SaaS applications.

• AvePoint: Offers backup support for Microsoft 365 systems including SharePoint, Teams, Active Directory, etc.

•

Secure copies of data are maintained to recover from hardware failures, accidental deletions, cyberattacks, natural disasters, and security threats such as ransomware and malware. These products and services help the City to meet legal and regulatory data retention requirements and provide business continuity and disaster recovery capability with minimal downtime.

Confidential

Current Business Problem The City's data volume and use of digital services continues to grow, pushing the current business continuity and disaster recovery products and services to their technical and functional limits.

To support continued growth, the City needs enhanced ransomware/malware detection and recovery, expanded protection for Microsoft 365 services, and scalable storage to cover increasing data volume through archiving.

Without growth-aligned investment, these limitations increase operational risk, reduces business continuity options, and increase cyber security resolution times.

Confidential

Current Pain Points Existing products and services are not modern, innovative, or advanced in key areas, including: • Ransomware/Malware and data protection requirements • Microsoft 365 data protection • Limited storage capacity for archiving data

Confidential

Future State Benefits Upgraded products and services that are modern, innovative, and advanced​in key areas:​ • Advanced Ransomware/Malware and data protection requirements​ • Identify data protection Microsoft 365 • Flexible storage capacity for archiving data

Confidential

Strategic Alignment

Confidential

Analysis and Recommended Solution

Confidential

Market Analysis We reviewed the following top candidates to address the current business problem.

Requirements

Candidates/Vendors

Ransomware/Malware Detection

Rubrik, Veem, Commvault

Identity Backup (Entra, AD)

Rubrik, Cohesity, AvePoint

Archival Solutions

AvePoint, Dropsuite

The City has previously evaluated Commvault, but their solution did not meet our needs.

While Veeam, Cohesity, and Dropsuite were considered, the City is already invested in the Rubrik and AvePoint ecosystem.

Ransomware/Malware Detection & Identity Backup: Upgrading with Rubrik ensures continuity with minimal disruption, offering a unified architecture that delivers rapid time-tovalue, strong ransomware and malware protection, immutable backups, and optional identity protection through Rubrik Identity.

Archival Solution: Similarly, since the City already relies on AvePoint for cloud backup, continuing with trusted partners helps minimize vendor complexity. AvePoint offers data archiving and data protection with advanced restore, compliance, and enterprise governance.

Confidential

Recommended Solution: Purchase and Implement Rubrik

Enterprise Edition, Rubrik Identity Back-Up, and the AvePoint Archive Solution

Description

Pros

Cons

Upgrade our Rubrik platform from the Foundations level to the Enterprise level, procure an additional Rubrik Identity backup module, and procure AvePoint's archival solution. By doing this, the City's data will be more resilient and secure.

• Stronger cyber resilience through advanced malware detection and recovery tools • Microsoft 365 data is protected (Entra ID and Active Directory) • Media archives are protected (pictures, videos, and meeting recordings)

•

N/A

Confidential

TS Architecture Review The recommended solution meets the TS Architecture standards for the City of Durham.

Confidential

Cybersecurity Review The recommended solution meets the cybersecurity standards for the City of Durham.

Confidential

Recommended Solution - Project Financial Estimate COST ESTIMATES Description

FUNDING

Implementation Costs (Hours)

Post Implementation Run Costs (Hours)/ KTLO

378 Hours

350 hours

Departmental Funding Amount:

$97,923.30

Labor $ (Hours) Internal TS Department:

Funding Requested (Y/N):

Y

Business Analysis

8 hours

Internal Labor New FTE – Year 1 Costs

Architecture Office

3 hours

Project One Time Costs (External)

$175,650.00

Data Center Services Manager

60 hours

100 hours

*Total Project Funding Requested for Year 1

$77,726.70

Cybersecurity

5 hours

150 hours

Total Project Funding Requested for Year 2+

$77,726.70

Project Management

300 hours

Data Center Cloud Engineers

-

100 hours

Non-Labor $ RUBRIK ENTERPRISE

$128,250

$128,250

Rubrik Identity recovery

$32,400

$32,400

AvePoint Archive

$15,000

$15,000

* Total Project Funding Requested Year 1 includes New FTE Labor, External Labor and Non Labor

Budget Analyst confirmed funding is available in org/obj code 0N01000-723410

$0.00

Confidential

Risk Identification Description of Risk

Risk Impact (High/Medium/Low)

Vendor performance

Low

Y

N

Cyber Security

Low

Y

N

Project Team Turnover

Low

Y

N

Poor Execution

Low

Y

N

Mitigated (Y/N) Contingency(Y/N)

Confidential

Mitigation Risk (Costs) •

N/A

Contingency Risk (Costs) •

N/A

Confidential

Our ask We are asking the IT Governance Steering Committee to approve and score the business case to Enhance Enterprise Data Resiliency, which will increase resiliency and security for our existing data infrastructure. If approved, the business case will be scored, ranked, and submitted to the City Manager for final approval.