{"resourceId":"placer-county-crowdstrike-renewal-2026","versions":[{"version":"external-69c6a601aae446e4f4b9ee27ff0f99a0d49a594f162e85c6af5b7cc94b4db032","resource":{"id":"placer-county-crowdstrike-renewal-2026","title":"Placer County Board memo: CrowdStrike software subscription renewal via ePlus (NASPO ValuePoint)","organization":"County of Placer, California (General Services / Information Technology Department)","sector":"Local government (county IT, sheriff's office)","geography":"Placer County, California, USA","publishedAt":"2026-10-06","publicationDate":"2026-10-06","eventDate":"2026-09-16","sourceName":"County of Placer","sourceLabel":"Board of Supervisors memorandum (PDF)","sourceUrl":"https://www.placer.ca.gov/DocumentCenter/View/117981/20A","evidenceClass":"government-evaluation","outcomeClass":"emerging","topics":["governance-procurement","data-security","operating-model"],"finding":"Placer County staff asked the Board to approve $363,625 for CrowdStrike subscriptions and support for Sept 16, 2026 to Sept 14, 2027, plus an optional renewal year up to $399,988 (total $763,613). IT has used CrowdStrike antivirus and endpoint detection since 2023; the Sheriff's Office separately funds a $4,900 SIEM component. Licenses expired Sept 15, 2026, and CrowdStrike kept them operational pending approval. Purchase uses a California participating addendum to the Utah-led NASPO ValuePoint agreement via Carahsoft, exempt from competitive bid.","sledRelevance":"Direct county-level evidence of sustained CrowdStrike use across general IT and public safety, and of the cooperative-contract route counties use to renew without a new competitive solicitation.","evidence":"Primary government procurement memo with dollar amounts, term dates, contract vehicle and funding sources. It documents a purchasing decision, not a security-outcome evaluation; no detection, incident or AI-feature performance data is reported.","architectureImplications":"Single-vendor endpoint/EDR estate with a separate public-safety SIEM line item suggests mixed tooling across county IT and the sheriff; integration between them is not described.","governanceImplications":"Licenses lapsed before board approval and the vendor extended coverage informally, a renewal-timing risk; cooperative vehicles shorten procurement but depend on the master agreement's term (NASPO AR2472 effective through Jan 13, 2027).","securityPrivacyImplications":"Continuity of endpoint protection depended on vendor goodwill during the lapse window; sheriff SIEM data implies criminal-justice logging considerations, though the memo does not discuss CJIS.","caveats":"Procurement record only; classed as government-evaluation because it is a staff recommendation to elected officials, not an effectiveness assessment. Does not say which modules are licensed or whether Charlotte AI is included. Board action outcome not confirmed on this page.","streamIds":["crowdstrike"],"roles":{"sales":"Renewal timing is the framing point: Placer County's licenses expired before board approval, and CrowdStrike kept them running. That exposes a recurring county pain around fiscal-year alignment and board calendars. Interpretation: a bounded conversation about renewal calendars, co-terming public-safety SIEM with enterprise EDR, and whether the NASPO vehicle's January 2027 expiry affects next year's option. The memo supports no claim about AI value, savings or security outcomes, so lead with procurement continuity rather than features.","engineering":"Mixed estate is the framing point: county IT runs CrowdStrike EDR and antivirus while the Sheriff's Office funds a separate SIEM line, so the technical question is whether those telemetry streams are integrated or siloed. Interpretation: pre-sales should inventory which Falcon modules are active, where sheriff logs land, and whether CJIS boundaries constrain consolidation. The source gives no architecture detail, so any Next-Gen SIEM or Charlotte AI fit claim must be validated against the county's actual deployment and logging needs first.","delivery":"Continuity of coverage is the framing point: delivery value here is operational hygiene rather than new capability. Interpretation: a renewal runbook that tracks license expiry, board agenda lead time and cooperative-vehicle term would prevent another lapse. Ownership sits with county IT, with sheriff administration as co-owner of the SIEM component. Acceptance criteria should be measurable, such as zero days of unlicensed coverage and a documented module inventory, and should not assume any security improvement the memo does not report."},"roleDetails":{"sales":{"customerProblem":"Endpoint licenses expired Sept 15, 2026 before board approval; renewal depends on the board calendar and a cooperative master agreement expiring Jan 2027.","stakeholders":["County Director of General Services","Purchasing Manager","IT Department leadership","Sheriff's Office administration","Board of Supervisors"],"discoveryQuestions":["How will the county renew if NASPO AR2472 is not extended past Jan 13, 2027?","Is the sheriff's SIEM integrated with county EDR telemetry?","Which Falcon modules are licensed today, and are any AI features in use?"],"valueHypothesis":"Co-terming and calendaring renewals across county IT and the sheriff could reduce lapse risk and administrative effort; savings are unquantified.","potentialEngagement":"A short renewal and license-inventory review aligning county IT and sheriff security subscriptions to fiscal and board timelines.","unsupportedClaims":["Any security outcome improvement from CrowdStrike","Cost savings versus alternatives","Use or value of Charlotte AI at the county"]},"engineering":{"fit":"Existing EDR/antivirus customer since 2023 with a separate public-safety SIEM component.","architectureIntegration":"Unknown whether the sheriff SIEM ingests county Falcon telemetry; needs discovery before any consolidation proposal.","prerequisites":["Module and endpoint inventory","Sheriff SIEM data-flow map","CJIS boundary review"],"constraints":["Cooperative vehicle term limits","Separate departmental budgets","Possible CJIS logging requirements"],"security":"Coverage continuity relied on a vendor extension during the lapse; confirm contractual coverage terms for future gaps.","proofOfValue":["Verify all county endpoints report to the console after renewal","Confirm sheriff SIEM retention meets policy","Document any AI features enabled and their approvals"]},"delivery":{"work":"Renewal runbook, license inventory and SIEM data-flow documentation.","dependencies":["Board approval","Reseller quote under the NASPO addendum","Sheriff administration participation"],"ownership":"County IT Department, with Sheriff Administration for the SIEM component.","skillsAdoption":"Minimal new skills; procurement and IT staff need a shared renewal calendar.","governanceCheckpoints":["Board agenda deadline 60+ days before expiry","Master agreement term check","Annual module inventory review"],"acceptanceCriteria":["Zero days of unlicensed endpoint coverage at next renewal","Documented inventory of licensed modules","Written data-flow for sheriff SIEM"],"risks":["Master agreement expiry before option year","Informal vendor extensions not guaranteed","Departmental budget misalignment"]}},"retrievedAt":"2026-10-29T22:08:37-05:00","enrichedAt":"2026-10-29T22:18:51-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"No workforce detail; continued reliance on a county IT team is implied but not quantified.","procurementImplications":"Shows NASPO ValuePoint participating addenda as a standard county renewal route and the optional-year structure (up to $399,988).","operatingModelImplications":"Split funding between IT and sheriff points to shared-service governance needs.","sourceVerification":{"openedUrl":"https://www.placer.ca.gov/DocumentCenter/View/117981/20A","referenceExcerpt":"ITD has been utilizing Crowdstrike antivirus and endpoint detection products since 2023.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}