{"resourceId":"uc-systemwide-crowdstrike-agreement-2026","versions":[{"version":"external-69c6a601aae446e4f4b9ee27ff0f99a0d49a594f162e85c6af5b7cc94b4db032","resource":{"id":"uc-systemwide-crowdstrike-agreement-2026","title":"CrowdStrike | UC-Wide Agreement (University of California Systemwide Procurement)","organization":"University of California Office of the President, Systemwide Procurement","sector":"Higher education and academic health","geography":"California, USA","publishedAt":"2026-07-18","publicationDate":"2026-07-18","eventDate":"2026-07-18","sourceName":"UC Procurement","sourceLabel":"Procurement news post","sourceUrl":"https://procurement.ucop.edu/news/crowdstrike-uc-wide-agreement","evidenceClass":"government-evaluation","outcomeClass":"effective","topics":["governance-procurement","data-security","operating-model"],"finding":"UC established a systemwide agreement with CrowdStrike as of July 18, 2026 for Falcon Complete MDR and related endpoint security, reporting a 61% cost reduction versus initial pricing available to all UC locations. Negotiated terms include UC Appendix DS (Level 4 protections), Appendix BAA and Appendix GDPR. UC says adapting CrowdStrike's standard model to public-sector requirements for cyber risk allocation, data security, privacy and incident notification was challenging and required Procurement, Legal, Cybersecurity, Privacy, Risk and CIO coordination.","sledRelevance":"A large public research university system shows how data-security, BAA, GDPR and incident-notification terms can be negotiated into a vendor's standard model at system scale.","evidence":"Institutional procurement announcement. The 61% figure is a negotiation outcome versus initial vendor pricing, not versus market or prior spend; no security outcome data. 'Effective' refers to the procurement outcome only.","architectureImplications":"Centralized purchasing through UCOP with campus-level deployment; health locations have dedicated vendor contacts, implying separate clinical environments.","governanceImplications":"Demonstrates cross-functional negotiation of risk allocation and incident notification terms; useful precedent for other systems.","securityPrivacyImplications":"Level 4 data protections and a BAA indicate the service may touch protected health and highly sensitive data.","caveats":"Self-reported by the buyer; 'initial pricing' baseline undefined; deployment scope per campus not stated; AI features not mentioned. Published July 2026, before this edition; included because the stream has no prior run and the terms precedent is current.","streamIds":["crowdstrike"],"roles":{"sales":"Contract terms are the framing point: UC's announcement highlights negotiated data-security, BAA and GDPR appendices as much as price. Interpretation: higher-ed systems value help translating vendor standard terms into public-sector risk allocation and incident-notification requirements. A bounded engagement could review a campus's terms against UC's approach. The 61% figure is relative to initial pricing only, so it cannot support savings claims against prior spend or competitors, and nothing here speaks to AI value.","engineering":"Federated deployment is the framing point: a systemwide contract does not mean a single architecture across campuses and health systems. Interpretation: engineers should map which campuses and medical centers are onboarding, how tenants are structured, and whether health data environments need separate policies under the BAA. The page gives no technical scope, so validation should confirm sensor coverage, data residency and logging per location before proposing integrations such as Next-Gen SIEM or agentic features.","delivery":"Cross-functional governance is the framing point: UC credits Procurement, Legal, Cybersecurity, Privacy, Risk and CIO collaboration. Interpretation: delivery for campus onboarding should preserve that model with defined owners for incident notification and privacy obligations. Acceptance criteria should be proposals, such as each location's onboarding status and documented notification paths, since UC reports no deployment outcomes. Risks include uneven campus adoption and health-system complexity."},"roleDetails":{"sales":{"customerProblem":"Standard vendor terms did not fit UC's public-sector risk allocation, privacy and incident-notification requirements.","stakeholders":["Systemwide procurement","Campus CISOs","Office of General Counsel","Privacy office","Risk management","Health system IT"],"discoveryQuestions":["Which campuses have moved to the new pricing?","How are incident notification obligations defined in the negotiated appendices?","Are health locations under separate tenants?"],"valueHypothesis":"System-level negotiation can improve terms and pricing for campuses; magnitude depends on baseline.","potentialEngagement":"Terms-and-onboarding review for a campus or peer system modelled on the UC appendices.","unsupportedClaims":["Savings versus prior spend or competitors","Security outcome improvements","Any AI capability value"]},"engineering":{"fit":"Falcon Complete MDR and endpoint security across a federated multi-campus and health environment.","architectureIntegration":"Central contract, decentralized deployment; integration with campus SIEMs not described.","prerequisites":["Per-location endpoint inventory","Tenant design","Health data segmentation plan"],"constraints":["BAA and Level 4 data obligations","GDPR for international data","Campus autonomy"],"security":"Appendix DS Level 4 protections signal high-sensitivity data handling requirements.","proofOfValue":["Confirm onboarding per campus","Test incident notification path end to end","Verify data residency settings"]},"delivery":{"work":"Campus onboarding, policy baselines and notification runbooks under the systemwide agreement.","dependencies":["CalUsource contract #2026004932","Campus funding","Vendor regional representatives"],"ownership":"Campus IT security teams under UCOP systemwide procurement.","skillsAdoption":"Legal, privacy and security staff need shared understanding of negotiated appendices.","governanceCheckpoints":["Privacy review for health locations","Annual terms review","Incident-notification drill"],"acceptanceCriteria":["Each location documents onboarding status (proposed)","Notification contacts tested","Pricing transition confirmed per location"],"risks":["Uneven campus adoption","Health-system complexity","Baseline ambiguity in savings reporting"]}},"retrievedAt":"2026-10-29T22:08:39-05:00","enrichedAt":"2026-10-29T22:18:51-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Not addressed beyond stakeholder collaboration.","procurementImplications":"Centralized purchasing model through UCOP with pricing extended to all locations; precedent for system-level negotiation.","operatingModelImplications":"MDR outsourcing at system scale with campus-level operational roles.","sourceVerification":{"openedUrl":"https://procurement.ucop.edu/news/crowdstrike-uc-wide-agreement","referenceExcerpt":"61% in cost reduction versus initial pricing, with all UC locations able to transition to the new pricing structure","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}