Decision

Procurement of licensing to restore the use of centralised logging for firewalls.

Reasons for the decision

The Council has recently replaced its core firewalls. The previous firewalls used the vendor's centralised logging capability to provide the team with the ability to search all firewall logs in a single browser application, as well as dramatically increasing the period of time that logs are held for. Both of these capabilities make it significantly easier and quicker to investigate issues and potential security incidents.
Licensing could not be purchased until the new firewall serial numbers were known. As they have now been purchased and are operational, these are known and can be used to provide the same level of capability as the decommissioned firewalls had.

Alternative options considered

Three quotes were sought. Two quotes were received, both from existing suppliers that had shown an interest in supplying firewall services to the Council. As the licensing was identical, the lowest priced option was chosen.