Skip to content
Documentation

CrowdStrike

What this guide covers

How to actually buy CrowdStrike for a Maryland agency — which statewide vehicle you ride, which reseller fulfills the order, the FedRAMP/ATO path, and the functionality gates to clear before you sign. CrowdStrike’s government story splits across two separate environments (a FedRAMP Gov-1 boundary and a DoD IL-4/IL-5 Gov-2 boundary), so the most important decision here is which environment your workload requires.

Who it’s for

Engineering leads, security staff, and procurement officers at a Maryland State agency or education entity who have decided they need CrowdStrike Falcon for endpoint detection and response and need the path from “we want it” to “it’s authorized and on contract.”

Part of the SaaS Catalog. For the vehicles themselves, see Maryland Master Contracts; for the process and thresholds, see Maryland Procurement.

Disclaimer. Not legal or procurement advice. FedRAMP authorizations, DoD impact levels, contract catalogs, and BPO numbers change as awards are renewed and authorizations are re-baselined. Verify every figure below against the FedRAMP Marketplace, the Carahsoft Maryland COTS page, and the DoIT Statewide Contracts hub before relying on it. CrowdStrike’s FedRAMP level moved recently (Moderate to High in 2025) and the IL-4/IL-5 authorization lives in a separate environment — re-check both.

TL;DR

  • Category: Security — endpoint detection and response (EDR/XDR), the Falcon platform.
  • Maryland vehicle: COTS 2012, BPO 060B2490021, via Carahsoft (CrowdStrike is on the Carahsoft MD COTS publisher list); also reachable via NASPO ValuePoint.
  • Reseller: Carahsoft is the primary public-sector aggregator.
  • Authorization: CrowdStrike Falcon Platform for Government = FedRAMP High (certified 2025-03-12, runs in the Gov-1 / GovCloud environment, Marketplace ID FR1807853629A; Moderate since 2018, elevated to High in 2025). A separate Gov-2 environment holds DISA IL-4 and IL-5 Provisional Authorization (IL-5 PA granted May 2023).
  • The ATO trap: FedRAMP High applies to Falcon for Government (Gov-1) only — commercial Falcon is not FedRAMP, and IL-4/IL-5 is the separate Gov-2 environment.

What This Tool Is

CrowdStrike Falcon is a SaaS endpoint detection and response (EDR/XDR) platform — a cloud-managed agent on each endpoint feeding a console that does threat detection, threat hunting, and incident response. Agencies reach for Falcon when they need managed endpoint security with current threat intelligence rather than building and staffing that capability themselves. There is no drop-in OSS equivalent at this assurance level — open-source endpoint tooling exists, but nothing matches a FedRAMP-authorized managed EDR with a vendor SOC behind it, so the honest trade is managed-EDR-or-build-a-program, and this page covers the buy.

Which Maryland Vehicle

VehicleBPOHow CrowdStrike rides it
COTS 2012060B2490021The primary path. CrowdStrike appears on Carahsoft’s Maryland COTS publisher catalog; you issue an order against the COTS master contract and Carahsoft fulfills it.
NASPO ValuePointMaryland participating addendum (Carahsoft)A cloud/SaaS alternative the State extended into Maryland. Compare ceiling pricing against COTS before choosing.

The same publisher can be reachable through more than one Carahsoft vehicle, and which one you ride affects ceiling pricing, terms, and which approvals apply — see Maryland Master Contracts → Where Carahsoft Fits and the CrowdStrike entry on Carahsoft’s MD COTS publisher list.

Resellers and Pricing Path

Carahsoft is CrowdStrike’s primary public-sector aggregator and the reseller holding the Maryland awards. You do not buy a “Carahsoft contract” — Carahsoft fulfills your order against the COTS master contract (or the NASPO addendum). Request a quote referencing the Maryland COTS BPO 060B2490021 so the order is priced against the statewide ceiling rather than commercial list price. Falcon is licensed per-endpoint by module bundle, so the quote depends on your endpoint count and which modules you select — size both before you ask.

Authorization and ATO

AttributeValue
Authorized offeringCrowdStrike Falcon Platform for Government
FedRAMP statusHigh — certified 2025-03-12; runs in the Gov-1 / GovCloud environment (Moderate since 2018, elevated to High in 2025)
Marketplace IDFR1807853629A
DoD impact levelIL-4 and IL-5 Provisional Authorization in a separate Gov-2 environment (IL-5 PA granted May 2023)
Commercial Falcon in scope?No — commercial Falcon is not FedRAMP

The single thing to get right for the ATO: match your workload to the right environment. FedRAMP High attaches only to Falcon for Government in the Gov-1 / GovCloud environment — commercial Falcon carries no FedRAMP authorization. If you have DoD IL-4 or IL-5 workloads, those run in the separate Gov-2 environment; a FedRAMP Gov-1 ATO does not cover DoD IL-5 workloads. Confirm which environment your data classification requires before you commit; the two are different boundaries with different authorizations, and the gap will surface late in your security review.

Functionality Gates to Verify

Clear these before price comparison — any one can disqualify the buy regardless of cost. See the canonical list in Tools and Software → Enterprise Functionality.

GateCrowdStrike-specific note
SSO (SAML/OIDC) + SCIMSupported; confirm SCIM de-provisioning is included at your tier, not gated to a higher plan.
Audit logsAvailable; confirm retention meets your records policy.
RBACGranular roles supported; map them to least-privilege before rollout.
Data residency / environment boundaryThe Gov-1 (FedRAMP) and Gov-2 (IL-4/IL-5) environments are the residency answer — confirm the correct one (see above).
Accessibility (VPAT/ACR)Request CrowdStrike’s current VPAT; Maryland’s Nonvisual Access (NVA) requirement applies to the procurement.
BAA / DPARequired if any collected telemetry could carry PII/PHI; confirm availability for the government environment.

Procurement Steps

  1. Confirm the need. Endpoint EDR at this assurance level has no drop-in OSS equivalent — document why managed Falcon is worth the spend versus building an endpoint-security program, the core of the budget justification.
  2. Register / confirm eMMA. Your agency and the reseller must be set up in eMMA.
  3. Pick the vehicle. Default to COTS 060B2490021; compare the NASPO ValuePoint addendum if cloud terms suit you better.
  4. Determine your environment. Decide whether your workload needs the Gov-1 (FedRAMP High) environment or the Gov-2 (DoD IL-4/IL-5) environment — this drives the boundary you inherit.
  5. Get a Carahsoft quote referencing the BPO, sized to your endpoint count and module bundle, for the correct government environment.
  6. Check the threshold. The order’s dollar value drives the method — purchasing card, small procurement, or BPW review. See Maryland Procurement → how the value picks the path. Do not split a buy to dodge a threshold.
  7. Run the ATO package. Inherit the FedRAMP controls for the Gov-1 boundary (or the IL-4/IL-5 PA for Gov-2); document the rest.
  8. Issue the order against the vehicle once approvals clear.

Sources

ClaimSource
CrowdStrike Falcon Platform for Government FedRAMP High (FR1807853629A)FedRAMP Marketplace — FR1807853629A
DoD IL-5 authorizationCrowdStrike — Achieves IL5 Authorization
Gov-1 / GovCloud environment detailsCrowdStrike — Falcon on GovCloud FAQ
CrowdStrike on the Maryland COTS catalogCarahsoft — Maryland State Contracts

CrowdStrike’s FedRAMP level moved from Moderate to High in 2025, and IL-4/IL-5 lives in a separate Gov-2 environment. Re-verify the current level and which environment matches your workload against the Marketplace listing before relying on any figure here.