not strictly sysadmin. working on fedramp certification of really big system. we have crowdstrike in our usual production environment and i was always against

not strictly sysadmin. working on fedramp certification of really big system. we have crowdstrike in our usual production environment and i was always against it because i was always afraid of something like what happened. but security department pushed it through because this is something that they understand and can control. "security architecture of product" it's not concept that they understand. but answering your question, fedramp does requires EDR to be present. according to our fedramp advisors clamav is sufficient for passing audit.