{"resourceId":"torrance-usd-guidepoint-crowdstrike-falcon-three-year-2026-10","versions":[{"version":"external-e26d358f4c4324b0c65e7959e4e664d58d546e36bf9eb71d79f0fd946f458016","resource":{"id":"torrance-usd-guidepoint-crowdstrike-falcon-three-year-2026-10","title":"Torrance Unified (Calif.) board item: three-year, $1.39M GuidePoint agreement for CrowdStrike Falcon MDR, identity, exposure management and SIEM via NASPO","organization":"Torrance Unified School District","sector":"K-12 public school district","geography":"Torrance, California, United States","publishedAt":"Undated board agenda item (agreement term begins October 19, 2026)","publicationDate":null,"eventDate":"2026-10-19","sourceName":"Torrance USD Board agenda (Diligent Community)","sourceLabel":"Government board memo","sourceUrl":"https://tusd.community.diligentoneplatform.com/document/b75ec665-67b7-4f1f-b638-76cdaa4c1d4c/","evidenceClass":"government-evaluation","outcomeClass":"emerging","topics":["governance-procurement","data-security","infrastructure"],"finding":"A Torrance Unified board agenda item requests approval of a three-year agreement with GuidePoint Security for CrowdStrike software, support and services totaling $1,387,202.72 from the General Fund/Technology budget, for Oct 19, 2026 through Oct 18, 2029. The Falcon scope listed is managed detection and response, endpoint protection, identity threat protection, exposure management, security information and event management, threat monitoring and extended data retention. The purchase piggybacks NASPO ValuePoint California Contract 7-17-70-40-05 (Master AR2472) under Public Contract Code 20118 and a June 16, 2025 board authorization.","sledRelevance":"A K-12 district buying Falcon as a consolidated platform including SIEM and exposure management, not just endpoint, through a reseller on a cooperative contract. Why now: newly surfaced and unarchived, and it follows CrowdStrike's Nov 2 push on Next-Gen SIEM consolidation already in the archive.","evidence":"Opened board agenda summary with amount, term, scope list and contract vehicle.","architectureImplications":"Platform consolidation (EDR, identity, exposure, SIEM, retention) on one vendor reduces integration count but increases dependency.","governanceImplications":"Uses a piggyback authorization and NASPO vehicle; three-year commitment from general fund.","securityPrivacyImplications":"Extended data retention and SIEM centralize student and staff telemetry; retention policy should be reviewed.","caveats":"Meeting date and approval outcome not shown on the opened page; no AI features named; no efficacy metrics.","streamIds":["crowdstrike","k12"],"roles":{"sales":"Torrance shows a district buying Falcon as a platform, including SIEM, through a reseller on NASPO. Use it to discuss consolidation with other California districts, asking which legacy SIEM or point tools it replaces and how three-year pricing compares. Stay bounded: the item does not mention Charlotte AI or any AI feature, so do not imply it does.","engineering":"Plan log onboarding into Falcon SIEM, retention tiers and identity sensor coverage on domain controllers. Validate exposure management scope for internet-facing school systems. Confirm data retention aligns with California student-data obligations before ingesting broadly.","delivery":"Phase the rollout: MDR and endpoint first, then identity, then SIEM log sources and retention, with milestones per year of the term. Define reporting to the board on coverage and incident handling, and plan a mid-term review before renewal."},"roleDetails":{"sales":{"customerProblem":"Districts juggle separate EDR, identity, SIEM and exposure tools with limited staff.","stakeholders":["District CTO","Business services","Board of Education","Reseller (GuidePoint)"],"discoveryQuestions":["Which tools does this consolidation replace?","How is SIEM log volume priced?","What does the board expect reported?"],"valueHypothesis":"Platform consolidation on a cooperative vehicle can simplify procurement and operations; savings are not shown in the source.","potentialEngagement":"Consolidation roadmap and three-year value tracking plan.","unsupportedClaims":["That Torrance uses AI features","Any cost savings figure"]},"engineering":{"fit":"Good fit for mid-to-large districts consolidating security tooling.","architectureIntegration":"Falcon sensor, identity protection, exposure management and SIEM ingest with extended retention.","prerequisites":["Log source inventory","Identity infrastructure access","Retention policy"],"constraints":["General fund budget","Student-data privacy rules","Single-vendor dependency"],"security":"Centralized telemetry requires access controls and retention governance.","proofOfValue":["Log sources onboarded","Identity coverage of domain controllers","Exposure findings remediated"]},"delivery":{"work":"Phased onboarding across MDR, identity, exposure and SIEM.","dependencies":["Board approval","Reseller provisioning","District IT staff time"],"ownership":"District technology department with GuidePoint/CrowdStrike services.","skillsAdoption":"Train staff on SIEM search and MDR escalation.","governanceCheckpoints":["Board approval","Retention policy sign-off","Annual review"],"acceptanceCriteria":["Proposed: all endpoints reporting by end of phase one","Proposed: priority log sources ingested by year one"],"risks":["SIEM cost growth","Vendor lock-in","Staff capacity for onboarding"]}},"retrievedAt":"2026-11-08T04:03:06Z","enrichedAt":"2026-11-08T04:03:06Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"MDR reduces after-hours burden on district IT staff.","procurementImplications":"NASPO ValuePoint California piggyback via reseller; three-year term from general fund.","operatingModelImplications":"District relies on vendor MDR with in-house oversight.","sourceVerification":{"openedUrl":"https://tusd.community.diligentoneplatform.com/document/b75ec665-67b7-4f1f-b638-76cdaa4c1d4c/","referenceExcerpt":"The term of the agreement is October 19, 2026 through October 18, 2029.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}