FY27 - Privileged Access Management (PAM)

Confidential

IT Governance Business Case Privileged Access Management (PAM) for Technology Solutions Technology Solutions

Confidential

Background The City of Durham operates a complex IT environment with numerous systems requiring privileged access, used by IT staff, vendors, contractors, and automated services. This access includes sensitive data, critical infrastructure, and administrative control over citywide systems.

Currently, vendors fill out a form online with questions such as the specific endpoint(s) the vendor needs, which is later approved by our Cybersecurity team.

There is no centralized access management solution in place, and privileged access are often managed manually or through disparate tools with inconsistent policies.

Confidential

Current Business Problem Currently, privileged accounts are managed and polices are created manually, which is inefficient and can result in human error. The City's system administrators govern access from multiple, privileged accounts with different usernames and passwords. These accounts do not provide an audit trail and rely on users following manual processes to check in and out.

The organization faces increased risk of unauthorized access, reduced auditability of administrative actions, and difficulty meeting compliance requirements from frameworks such as the National Institute of Standards and Technology.

Confidential

Current Pain Points • No Centralized Control of Privileged Accounts • Lack of Audit Capability • Risk of Insider Threats and External Breaches • Increased Compliance Risk • Inefficient and Manual Access Processes

Confidential

Future State Benefits • Centralized Control of Privileged Access • Full Auditability • Stronger Protection Against Insider Threats and Cyber Attacks • Improved Compliance Posture • Operational Efficiency and Reduced IT Burden

Confidential

Strategic Alignment

Confidential

Analysis & Recommended Solution

Confidential

Solution Analysis A centralized, auditable access control system does not exist for the City's administrative accounts.

A Privileged Access Management (PAM) solution is a solution to the current business problem. It’s a security technology that controls, monitors, and protects privileged accounts and access within an organization. PAM provides visibility, control, and accountability.

Market research will be conducted to find viable PAM solutions.

Confidential

Market Analysis Available solutions from CyberArk, BeyondTrust, and Delinea have been evaluated.

These vendors are recognized as Leaders in the 2025 Gartner Magic Quadrant for Privileged Access Management. Each vendor is considered highly capable and visionary in the PAM space because of their strong ability to execute and completeness of vision.

Based on current and anticipated requirements, it has been determined that moving forward with a formal Request for Proposal (RFP) is necessary to assess vendor capabilities and select a solution that best aligns with strategic objectives, budget considerations, and long-term needs of the City of Durham.

Confidential

Recommended Solution: Issue an RFP to identify and implement a Privileged Access Management (PAM) Description

Pros

Continue the selection process by initiating a request for proposals (RFP) to identify and implement a Privileged Access Management system

• Centralized Control of Privileged Access • Improved Credential Security • Full Visibility and Auditability • Enforcement of Least Privilege and Just-in-Time Access

Cons

•

N/A

Confidential

TS Architecture Review The identified solution will undergo the standard Architecture Review once a vendor is selected.

Confidential

Cybersecurity Review The identified solution will undergo the standard Cybersecurity Review once a vendor is selected.

Confidential

Recommended Solution - Project Financial Estimate COST ESTIMATES Description

FUNDING

Implementation Costs (Hours)

Post Implementation Run Costs (Hours)/ KTLO

423 Hours

475 hours

Departmental Operation Funding Amount:

$0

Labor $ (Hours) Internal TS Department:

Funding Requested (Y/N): Internal Labor New FTE – Year 1 Costs

Y

Business Analysis

8 hours

Architecture Office

15 hours

50 hours

Project One Time Costs (External)

$140,000

Cybersecurity

150 hours

425 hours

*Total Project Funding Requested for Year 1

$140,000

PMO

250 hours

Total Project Funding Requested for Years 2+

$90,000

PAM Configuration

$40,000

PAM Cybersecurity Team Training

$10,000

Non-Labor $ Software PAM

$90,000

$90,000

* Total Project Funding Requested Year 1 includes New FTE Labor, External Labor and Non Labor

$0.00

Confidential

Risk Identification Description of Risk

Risk Impact (High/Medium/Low)

Vendor performance

Low

Y

N

Cyber Security

Low

Y

N

Project Team Turnover

Low

Y

N

Poor Execution

Low

Y

N

Mitigated (Y/N) Contingency(Y/N)

Confidential

Mitigation Risk (Costs) •

N/A

Contingency Risk (Costs) •

N/A

Confidential

Our ask We are asking the IT Governance Steering Committee to approve and score the business case to identify and implement a Privileged Access Management system for Technology Solutions. If approved, the business case will be scored, ranked, and submitted to the City Manager for final approval.