From the CrowdStrike edition of October 30, 2026
El Dorado County File 26-1598: Updated CrowdStrike Falcon Complete Limited Warranty (ransomware coverage)
County of El Dorado, California (Information Technologies Department) · Local government (county IT/SOC) · El Dorado County, California, USA
- Publisher
- County of El Dorado (Legistar)
- Original publication
- 2026-10-20
- Source retrieved
- 2026-10-31
- Event date
- 2026-10-20
What happened
El Dorado County's Board approved on Oct 20, 2026 an updated CrowdStrike Falcon Complete Limited Warranty, at no added cost, after CrowdStrike notified the county on Sept 27 that the warranty now covers ransomware-related events and gave 30 days to accept or opt out. The record shows Falcon use since January 2018, Falcon Complete MDR since March 2022, and Falcon Next-Gen SIEM for the county SOC since January 2026 with 365-day retention, expanded in May 2026. Purchase Contract 9896 runs Jan 16, 2026 to Jan 15, 2027 with a not-to-exceed amount of $240,194.46 after a 30 GB SIEM increase.
Why it matters
Direct county evidence of a long-running CrowdStrike estate consolidating MDR and SIEM, and of warranty terms becoming a board-level procurement item. It shows how vendor-initiated contract changes with short response windows reach elected boards.
Evidence and measured results
Primary county legislative record with prior board actions and dollar amounts. It documents procurement and coverage decisions, not security outcomes; warranty terms themselves (attachment A) were not opened.
Limitations and uncertainty
Warranty attachment not opened, so coverage limits and conditions are unknown. The record lists file 25-1683 as dated December 9, 2026, which appears to be a source typo (likely 2025). No AI features (e.g., Charlotte AI) are mentioned.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-30; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Vendor-initiated warranty changes with short windows require board action and unclear interplay with insurance.
- Stakeholders
- County CIO
- Purchasing Agent
- County Counsel
- Risk manager
- Board of Supervisors
- Discovery questions
- What conditions apply to the ransomware warranty?
- How does it interact with your cyber insurance?
- What is the plan for the Jan 15, 2027 renewal?
- Value hypothesis
- Clarifying warranty conditions and insurance overlap could reduce surprises after an incident; value unquantified.
- Potential engagement
- A warranty-and-insurance alignment review ahead of renewal.
- Unsupported claims
- Guaranteed financial recovery after ransomware
- Security outcome improvements
- Use of AI features at the county
Pre-sales engineering
Role takeaway
- Fit
- Long-term Falcon customer with MDR and Next-Gen SIEM.
- Architecture and integration
- All data sources flow into Falcon Next-Gen SIEM with 365-day retention.
- Prerequisites
- Warranty attachment review
- SIEM ingestion and capacity data
- Configuration baseline
- Constraints
- Contract term ends Jan 15, 2027
- SIEM capacity limits
- Single-vendor dependency
- Security
- Confirm configuration meets warranty eligibility.
- Proof of value
- Crosswalk warranty conditions to settings
- Verify SIEM capacity headroom
- Test incident escalation with MDR
Delivery
Role takeaway
- Work
- Warranty condition crosswalk, insurance coordination, renewal planning.
- Dependencies
- County Counsel
- Risk management
- Vendor documentation
- Ownership
- County CIO with security operations.
- Skills and adoption
- IT and risk staff need shared understanding of warranty terms.
- Governance checkpoints
- Counsel review
- Board renewal item timing
- Annual warranty review
- Acceptance criteria
- Proposed: documented crosswalk of conditions
- Proposed: insurance coordination note
- Proposed: renewal item scheduled before expiry
- Risks
- Unmet warranty conditions
- Overlapping or conflicting insurance terms
- Renewal lapse
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
County runs endpoint, identity protection, MDR and SIEM on one vendor platform with full data-source SIEM ingestion, which concentrates telemetry and dependency in one place.
Governance
Who approves, reviews and stays accountable for outcomes?
A 30-day accept-or-opt-out window for warranty changes required a board item; counties need processes for vendor-initiated contract changes. County Counsel approval is listed as an attachment.
Security and privacy
What data, permissions and controls need testing?
Ransomware warranty coverage is a contractual risk-transfer feature; its conditions and limits are not described in the record.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Relies on vendor 24/7 MDR to supplement county staff; staffing levels not stated.
Procurement
What should contracts, pricing and exit terms secure?
Shows vendor-initiated warranty changes routed through existing purchase contracts and County Counsel approval.
Operating model
Which teams own the service once it runs?
County SOC uses vendor MDR plus SIEM; operating model is heavily outsourced to one vendor.
Publication history
- 2026-10-30CrowdStrike · Issue 0212 resources
Stable resource ID: el-dorado-county-falcon-complete-ransomware-warranty-2026