Title
Information Technologies Department recommending the Board:
1) Make findings in accordance with Procurement Policy C-17, Section 3.4 (3) that the continuation of Crowdstrike products and services is exempt from competitive bidding, as competitive bidding would produce no economic benefit to the County, and Section 3.4 (2) (f) that continuity of providers will provide efficiency or critical knowledge that couldn’t be provided by other providers;
2) Authorize the Purchasing Agent to issue Purchase Contract 9896 in the amount of $211,013.81 for the period of January 16, 2026, through January 15, 2027, for Falcon Complete endpoint protection and Security Information and Event Management Services; and
3) Authorize the Purchasing Agent to accept and execute Crowdstrike quote Q-1376642.
FUNDING: General Fund.
Body
DISCUSSION / BACKGROUND
Since January 2018, the Information Technologies (IT) Department has used Crowdstrike Falcon advanced breach and endpoint protection services with Antivirus, Threat Intelligence, USB Device Control, and Threat Hunting capabilities. In March 2022, IT upgraded to Falcon Complete managed detection and response (MDR) services, which delivers 24/7 expert management, monitoring, and response for the Crowdstrike Falcon platform. The Crowdstrike Falcon security solution is an industry leader to stop advanced threats, including next-gen antivirus, endpoint detection through Falcon Insight, and threat protection with Falcon Identity. The Crowdstrike Falcon Complete team, available 24/7, uses Overwatch to manage threat hunting and ensures comprehensive security for our El Dorado County IT assets, remediating security incidents in minutes to minimize impacts to the County.
In March 2022, the IT Department began using Foresite MSP, Inc. to provide Security Information and Event Management (SIEM) services offering real-time analysis for the IT Security Operations Center (SOC) by offering real-time analysis of the County's infrastructure and providing continuous monitoring of cyber threats through their Integrated Risk Management (FIRM) platform. These SIEM services were extended through Board action (Legistar file 23-0398 on March 7, 2023) to provide coverage through March 15, 2026. Foresite has since created a new platform for SIEM services (MXDR) and is migrating clients to this new platform at renewal. The new MXDR platform is offered at a much higher cost than the current FIRM platform. The IT SOC looked into effective, comparable alternatives for SIEM services, and found an acceptable option with Crowdstrike, our current provider for endpoint protection.
Crowdstrike provided a quote for Falcon Next-Gen SIEM services, including 365-day log retention and essential support services, along with the renewal for the County's current endpoint licenses for 2,108 devices. In order to transition SIEM providers, Crowdstrike has recommended a two-month overlap period, and has provided renewal quote Q-1376642 covering Falcon Complete Endpoint Protection Services and Next-Gen SIEM Services for the period of January 16, 2026, through January 15, 2027. The quote includes a credit for Falcon Complete services that were previously paid as part of the current year renewal, for the period of January 16, 2026, through March 3, 2026. IT is requesting a Purchase Contract in the amount of $211,013.81 per quote Q-1376642 be approved for the renewal of the Falcon Complete services and licenses and the addition of SIEM SOC support services. Funds are available within the IT Fiscal Year (FY) 2025-26 Budget for this fiscal year's expenses and appropriations will be included in the FY 2026-27 Budget request to continue services.
Procurement Policy C-17 allows for the exemption from competitive bidding when competitive bidding would produce no economic benefit to the County. This request is a renewal for existing established and approved services and licenses. In addition, the movement of SIEM services from Foresite to Crowdstrike provides additional economic savings and synergies, by keeping SOC support services on one platform. Furthermore, while Crowdstrike Falcon and SIEM services are available through resellers, we have been partnering directly with Crowdstrike to procure licenses and Falcon Complete security services (since 2020 and 2022, respectively). The direct procurement of licenses allows for better pricing than through competitively bid NASPO contract AR2472 for CrowdStrike Falcon Complete. Therefore, competitive bidding would produce no economic benefit to the County.
ALTERNATIVES
The Board could choose to decline this request, which would impact our countywide cyber security monitoring services and SIEM support and the County would need to determine an alternative way to provide 24/7 security monitoring and oversight, including endpoint protection, overwatch services, and SIEM support.
PRIOR BOARD ACTION
Legistar file 22-0850 - May 24, 2022 - Board authorized the Purchasing Agent to issue a Purchase Order in the amount of $32,775.52 for the period of June 5, 2022, to March 3, 2023 for additional licenses for necessary security endpoint protection and authorized the Purchasing Agent to accept and execute Crowdstrike quote Q-441989.
Legistar file 23-0082 - February 14, 2023 - Board authorized the Purchasing Agent to issue a Purchase Order in the amount of $148,455.80 for the period of March 4, 2023, through March 3, 2024, for Falcon Complete endpoint protection and authorized the Purchasing Agent to accept and execute Crowdstrike quote Q-579846.
Legistar file 24-0185 - February 27, 2024 - Board authorized the Purchasing Agent to issue a Purchase Order in the amount of $155,878.90 for the period of March 4, 2024, through March 3, 2025 for Falcon Complete endpoint protection and authorized the Purchasing Agent to accept and execute Crowdstrike quote Q-823645.
Legistar file 24-1582 - October 15, 2024 - Board approved an updated warranty document for our current term through March 3, 2025.
Legistar file 25-0124 - February 25, 2025 - Board approved the Purchasing Agent to issue a Purchase Order in the amount of $163,673.79 for the period of March 4, 2025 through March 3, 2026 for Falcon Complete endpoint protection and authorized the Purchasing Agent to accept and execute Crowdstrike quote Q-1132474.
OTHER DEPARTMENT / AGENCY INVOLVEMENT
Procurement and Contracts
CAO RECOMMENDATION / COMMENTS
Approve as recommended.
FINANCIAL IMPACT
Funds are available within the FY 2025-26 Budget for this fiscal year's expenses and appropriations will be included in IT’s FY 2026-27 Budget request to continue services.
CLERK OF THE BOARD FOLLOW UP ACTIONS
N/A
STRATEGIC PLAN COMPONENT
N/A
CONTACT
Amanda Earnshaw, Interim Director of Information Technologies