1082742 software -security -crowdstrike renewal (brand only)

The State of California is issuing a Request for Bid (RFB-IS-26200819) for the renewal of CrowdStrike Falcon security software on a brand-only basis, posted on April 9, 2026, with proposals due by April 23, 2026. This procurement seeks to renew the existing endpoint protection and threat prevention infrastructure through a continuation of the current CrowdStrike license agreement. Bidders must provide competitive pricing quotes for CrowdStrike Falcon renewal based on specified licensing requirements and user counts detailed in the RFB. The vendor must deliver comprehensive security software capabilities including encryption protocols, access controls, audit logging, and incident response procedures. Key requirements include adherence to industry security standards, compliance with federal and state privacy regulations (including CCPA and HIPAA), implementation of multi-factor authentication controls, regular security assessments and vulnerability testing, and maintenance of current security certifications. The vendor must maintain cyber liability insurance, demonstrate financial stability, provide detailed audit logs and monitoring capabilities, implement business continuity and disaster recovery procedures with defined recovery objectives, and allow full audit rights to California government agencies including on-site facility inspections. Evaluation criteria encompass technical capability to meet security requirements, compliance with data protection and privacy standards, and the vendor's ability to maintain service continuity for the state's endpoint protection infrastructure.

This procurement is designated as a brand-only solicitation, meaning only CrowdStrike products are eligible for bid response, effectively limiting competition to the incumbent vendor, CrowdStrike. Respondents must submit required documentation including a Certificate of Insurance demonstrating adequate coverage, completion of all forms specified in Appendix A, and certification of Certified Business Enterprise (CBE) status on the provided CBE Form. The vendor must execute a Business Associate Agreement establishing terms for handling protected health information and personal data with comprehensive safeguarding obligations, including encryption, access controls, audit logging, and incident response procedures, along with provisions for breach notification and subcontractor data protection requirements. Funding for this renewal is anticipated to come from the state's existing IT security budget allocation, though specific contract values and award amounts are not disclosed in the solicitation materials. The contract term includes the renewal period for the software license with potential renewal options to be determined based on the state's operational needs and budget availability, with award contingent upon successful contract negotiations and budget authorization.