{"resourceId":"illinois-doit-k12-crowdstrike-slcgp-endpoint-program","versions":[{"version":"external-f4dffd3847cc98fe01c8e6bba5c4087d4ff842a825672f8f56a27e2c16ffc2a3","resource":{"id":"illinois-doit-k12-crowdstrike-slcgp-endpoint-program","title":"Illinois DoIT offers no-cost CrowdStrike EDR licenses to K-12 districts via SLCGP, limited to critical systems and subject to federal grant continuation","organization":"Illinois Department of Innovation & Technology (DoIT) Security Office","sector":"State government (serving K-12 districts)","geography":"Illinois, U.S.","publishedAt":"Undated (accessed November 8, 2026)","publicationDate":null,"eventDate":null,"sourceName":"Illinois DoIT","sourceLabel":"State government program page","sourceUrl":"https://doit.illinois.gov/initiatives/cybersecurity/slcgp/k-12-endpoint.html","evidenceClass":"public-sector-association","outcomeClass":"emerging","topics":["data-security","governance-procurement","operating-model","infrastructure"],"finding":"Illinois DoIT says it now provides CrowdStrike licenses at no cost to eligible K-12 public districts using federal State and Local Cybersecurity Grant Program funds, extending an initiative for local governments. Licenses are limited and prioritize critical servers and essential services; the program will not cover all endpoints. Districts receive EDR, exposure-management support, 24x7x365 monitoring by a managed security services provider, live support from DoIT's SOC and threat alerts. DoIT states it collects only system data needed to detect threats and does not access student records, personal communications or instructional content. Long-term availability depends on federal continuation of SLCGP. The page is undated; it is newly relevant because Illinois district board documents in October 2026 (e.g., Skokie-Morton Grove SD 69, Oct 20) report receiving Falcon licensing through DoIT, seen via an aggregator.","sledRelevance":"A whole-of-state model where the state SOC operates CrowdStrike for local governments and districts changes the K-12 sales motion in Illinois: partners compete with a free, partial-coverage state offer and can sell coverage for remaining endpoints, managed services or AI-era capabilities on top.","evidence":"Opened the DoIT K-12 Endpoint page and the related DoIT 'Whole of State EDR' local-government flyer (dated July 2023). No adoption counts or outcome data are published.","architectureImplications":"State-tagged sensor installs feed a state SOC; districts must decide which critical systems get limited licenses and how remaining endpoints are protected.","governanceImplications":"Shared-responsibility boundaries between the district, DoIT SOC and MSSP need to be written down, including incident authority.","securityPrivacyImplications":"DoIT's stated monitoring limits (no student records or instructional content) give districts a privacy baseline to verify.","caveats":"Program page is undated and has no participation numbers or results; it describes the offer, not its effectiveness. District uptake evidence came from an aggregator summary, not the original board report. No AI features are described.","streamIds":["crowdstrike"],"roles":{"sales":"In Illinois, start K-12 conversations by asking whether the district already takes DoIT's free CrowdStrike licenses. If so, the opening is coverage for endpoints the state program excludes, managed response beyond the state SOC, or newer Falcon modules, not a competing EDR. Flag funding risk honestly: the page ties availability to federal SLCGP continuation. Do not imply AI features are part of the state offer.","engineering":"Map which district systems are on state-provided licenses and which are not. Confirm how state-tagged sensors coexist with any district-owned Falcon tenant or other EDR, who holds console access, and how alerts route among DoIT SOC, the MSSP and district staff. Plan a fallback if grant-funded licenses end, including migration of policies and telemetry.","delivery":"Write a shared-responsibility matrix covering DoIT, the MSSP and the district: who monitors, who isolates hosts and who notifies families. Track license counts against critical-system inventory, and set a review date tied to SLCGP funding decisions so the district is not left uncovered. Verify DoIT's stated privacy limits in the district's data-privacy documentation."},"roleDetails":{"sales":{"customerProblem":"Districts get partial, grant-dependent CrowdStrike coverage and must protect the rest of their endpoints and plan for funding loss.","stakeholders":["District technology director","Superintendent or CFO","DoIT Cyber Navigator","District data-privacy officer"],"discoveryQuestions":["Are you enrolled in DoIT's K-12 endpoint program, and for how many systems?","How are endpoints outside the program protected?","What happens to coverage if SLCGP funding ends?"],"valueHypothesis":"Partners can add value by covering gaps and planning continuity around a free state baseline; no outcome data support savings claims.","potentialEngagement":"Coverage-gap and continuity assessment for an Illinois district enrolled in the DoIT program.","unsupportedClaims":["That the program covers all district endpoints","That it includes AI features","Measured ransomware reduction"]},"engineering":{"fit":"Illinois public K-12 districts and local governments eligible for SLCGP-funded services.","architectureIntegration":"State-tagged CrowdStrike sensors monitored by the DoIT SOC and an MSSP.","prerequisites":["Critical-system inventory","Designated district point of contact","Coordination with Cyber Navigator"],"constraints":["Limited license counts","Funding tied to federal SLCGP","State-held console access"],"security":"Clarify isolation authority and data-collection scope; verify stated exclusion of student records.","proofOfValue":["Alert-to-district notification time in a test","Coverage map of licensed versus unlicensed systems","Documented fallback plan"]},"delivery":{"work":"Shared-responsibility matrix, coverage tracking and funding-continuity plan.","dependencies":["DoIT eligibility determination","SLCGP funding","District asset inventory"],"ownership":"District technology director, with DoIT SOC as monitoring operator.","skillsAdoption":"District staff learn escalation paths with the state SOC and MSSP.","governanceCheckpoints":["Matrix signed by district and DoIT","Annual funding review","Privacy documentation updated"],"acceptanceCriteria":["Proposed: all critical systems on a licensed sensor","Proposed: written plan for coverage if grant licenses end"],"risks":["Grant funding lapses","Unclear incident authority","Uncovered endpoints"]}},"retrievedAt":"2026-11-09T04:05:39Z","enrichedAt":"2026-11-09T09:23:00Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Cyber Navigators assist deployment, reducing load on small district IT teams.","procurementImplications":"Districts may defer or shrink commercial EDR purchases; a Feb 2025 Illinois district technology memo (not separately cited; district not named in the memo text) chose a short CrowdStrike contract anticipating this program. Funding risk if SLCGP lapses.","operatingModelImplications":"State-operated SOC plus MSSP monitoring model; district retains responsibility for uncovered endpoints.","sourceVerification":{"openedUrl":"https://doit.illinois.gov/initiatives/cybersecurity/slcgp/k-12-endpoint.html","referenceExcerpt":"It will not cover all endpoints within a District's network at this time.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}