{"resourceId":"el-dorado-county-falcon-complete-ransomware-warranty-2026","versions":[{"version":"external-d893fcfbc32769abd54dcee8d71d1acd375113551006db25d13c282d8efec19a","resource":{"id":"el-dorado-county-falcon-complete-ransomware-warranty-2026","title":"El Dorado County File 26-1598: Updated CrowdStrike Falcon Complete Limited Warranty (ransomware coverage)","organization":"County of El Dorado, California (Information Technologies Department)","sector":"Local government (county IT/SOC)","geography":"El Dorado County, California, USA","publishedAt":"2026-10-20","publicationDate":"2026-10-20","eventDate":"2026-10-20","sourceName":"County of El Dorado (Legistar)","sourceLabel":"Board of Supervisors legislation record","sourceUrl":"https://eldorado.legistar.com/LegislationDetail.aspx?GUID=EF5E4BB8-EA4E-42CD-B790-72BA31248493&ID=8288446","evidenceClass":"government-evaluation","outcomeClass":"emerging","topics":["governance-procurement","operating-model","data-security"],"finding":"El Dorado County's Board approved on Oct 20, 2026 an updated CrowdStrike Falcon Complete Limited Warranty, at no added cost, after CrowdStrike notified the county on Sept 27 that the warranty now covers ransomware-related events and gave 30 days to accept or opt out. The record shows Falcon use since January 2018, Falcon Complete MDR since March 2022, and Falcon Next-Gen SIEM for the county SOC since January 2026 with 365-day retention, expanded in May 2026. Purchase Contract 9896 runs Jan 16, 2026 to Jan 15, 2027 with a not-to-exceed amount of $240,194.46 after a 30 GB SIEM increase.","sledRelevance":"Direct county evidence of a long-running CrowdStrike estate consolidating MDR and SIEM, and of warranty terms becoming a board-level procurement item. It shows how vendor-initiated contract changes with short response windows reach elected boards.","evidence":"Primary county legislative record with prior board actions and dollar amounts. It documents procurement and coverage decisions, not security outcomes; warranty terms themselves (attachment A) were not opened.","architectureImplications":"County runs endpoint, identity protection, MDR and SIEM on one vendor platform with full data-source SIEM ingestion, which concentrates telemetry and dependency in one place.","governanceImplications":"A 30-day accept-or-opt-out window for warranty changes required a board item; counties need processes for vendor-initiated contract changes. County Counsel approval is listed as an attachment.","securityPrivacyImplications":"Ransomware warranty coverage is a contractual risk-transfer feature; its conditions and limits are not described in the record.","caveats":"Warranty attachment not opened, so coverage limits and conditions are unknown. The record lists file 25-1683 as dated December 9, 2026, which appears to be a source typo (likely 2025). No AI features (e.g., Charlotte AI) are mentioned.","streamIds":["crowdstrike"],"roles":{"sales":"Contract terms are the framing point: El Dorado County treated a vendor warranty update adding ransomware coverage as a board decision with a 30-day window. For county IT leaders, the bounded conversation is about understanding warranty conditions and how they interact with cyber insurance. Interpretation: help the customer read the warranty terms and align them with insurance and incident plans. The record does not state coverage amounts or conditions, so avoid presenting the warranty as guaranteed financial protection.","engineering":"Platform consolidation is the framing point: the county runs Falcon endpoint, identity, MDR and Next-Gen SIEM with all data sources ingested and 365-day retention. Interpretation: pre-sales should review SIEM capacity growth (an additional 30 GB was approved in April 2026), retention needs and dependency risk from a single platform. Warranty eligibility often depends on configuration, so confirm what deployment and policy settings the warranty requires before assuming coverage applies to an incident.","delivery":"Warranty readiness is the framing point: coverage usually depends on the customer meeting stated conditions. Interpretation: delivery should map the warranty's requirements to current configuration and incident procedures and record gaps. Ownership sits with the county CIO and security operations. Proposed acceptance criteria include a documented crosswalk between warranty conditions and configuration, an insurance-coordination note, and a renewal calendar ahead of the January 15, 2027 contract end."},"roleDetails":{"sales":{"customerProblem":"Vendor-initiated warranty changes with short windows require board action and unclear interplay with insurance.","stakeholders":["County CIO","Purchasing Agent","County Counsel","Risk manager","Board of Supervisors"],"discoveryQuestions":["What conditions apply to the ransomware warranty?","How does it interact with your cyber insurance?","What is the plan for the Jan 15, 2027 renewal?"],"valueHypothesis":"Clarifying warranty conditions and insurance overlap could reduce surprises after an incident; value unquantified.","potentialEngagement":"A warranty-and-insurance alignment review ahead of renewal.","unsupportedClaims":["Guaranteed financial recovery after ransomware","Security outcome improvements","Use of AI features at the county"]},"engineering":{"fit":"Long-term Falcon customer with MDR and Next-Gen SIEM.","architectureIntegration":"All data sources flow into Falcon Next-Gen SIEM with 365-day retention.","prerequisites":["Warranty attachment review","SIEM ingestion and capacity data","Configuration baseline"],"constraints":["Contract term ends Jan 15, 2027","SIEM capacity limits","Single-vendor dependency"],"security":"Confirm configuration meets warranty eligibility.","proofOfValue":["Crosswalk warranty conditions to settings","Verify SIEM capacity headroom","Test incident escalation with MDR"]},"delivery":{"work":"Warranty condition crosswalk, insurance coordination, renewal planning.","dependencies":["County Counsel","Risk management","Vendor documentation"],"ownership":"County CIO with security operations.","skillsAdoption":"IT and risk staff need shared understanding of warranty terms.","governanceCheckpoints":["Counsel review","Board renewal item timing","Annual warranty review"],"acceptanceCriteria":["Proposed: documented crosswalk of conditions","Proposed: insurance coordination note","Proposed: renewal item scheduled before expiry"],"risks":["Unmet warranty conditions","Overlapping or conflicting insurance terms","Renewal lapse"]}},"retrievedAt":"2026-10-30T22:12:54-05:00","enrichedAt":"2026-10-30T22:21:24-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Relies on vendor 24/7 MDR to supplement county staff; staffing levels not stated.","procurementImplications":"Shows vendor-initiated warranty changes routed through existing purchase contracts and County Counsel approval.","operatingModelImplications":"County SOC uses vendor MDR plus SIEM; operating model is heavily outsourced to one vendor.","sourceVerification":{"openedUrl":"https://eldorado.legistar.com/LegislationDetail.aspx?GUID=EF5E4BB8-EA4E-42CD-B790-72BA31248493&ID=8288446","referenceExcerpt":"On September 27, 2026, Crowdstrike notified the County that their Falcon Complete LImited Warranty agreement has been updated to now cover Ransomware related events.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}