Last updated: September 7, 2026
Quick Answer
Searching state and local budgets for the words zero trust returns almost nothing. Searching for its components returns a great deal, because agencies buy the architecture one piece at a time over several years.
- Multi-factor authentication is the first line item in most sequences.
- Network segmentation and firewall replacement come next, usually as capital items.
- Identity and privileged access management arrive last, and cost the most.
- State cybersecurity grants are funding a meaningful share, on their own calendar.
Zero trust is an architecture, not a product, and public bodies do not budget for architectures. They budget for the next thing their insurer, auditor or grant condition requires. Read the sequence and you can predict the next purchase in an account two years ahead.
The few who do name it
Where the phrase does appear, it appears in a capital plan rather than an operating budget, and it comes with a described first phase.
The City of Ukiah in California proposed a zero trust architecture implementation project through its finance and IT capital plan in June 2026, at $155,000. The description is unusually explicit: moving from network-based trust to identity-driven least-privilege access, with an initial focus on zero trust network access and later phases addressing device compliance.
A California retirement system set out a similar programme for the 2026 to 2027 year, maturing privileged access management, monitoring enterprise systems continuously, inventorying assets and broadening multi-factor authentication, with the stated aim of reducing unmanaged privileged accounts.
Both documents are effectively a published roadmap of everything that body will buy next. That is rare, and it is worth reading in full when you find one.
What the money actually looks like
The floor is lower than the chart suggests. A small Iowa city approved multi-factor authentication for Windows logins and remote desktop access at a one-time $2,916 with $15 a month recurring. A Montana county carried a single budget line of $4,168 with $3,200 annual, descriptive rather than awarded, and naming no product at all.
That unnamed line is the most valuable row in this whole dataset. A budgeted amount with no vendor attached is an open decision.
The four component signals, in the order they appear
| Stage | What the record says | Typical size | What it means for you |
|---|---|---|---|
| 1. Governance | A board designates an official with authority over identity systems | No money | Names the person who will own the next identity purchase |
| 2. Authentication | Multi-factor authentication rollout, often for remote access first | $3,000 to $145,000 | The entry purchase, and usually the first outside partner |
| 3. Segmentation | Network segmentation, firewall replacement, server room work | $85,000 to $290,000 | Capital budget item, so visible a year ahead |
| 4. Identity and privilege | Identity access management, privileged access management, endpoint detection | $100,000 a year and up | The largest spend, reached only by agencies that did stages 2 and 3 |
Source: state and local meeting records indexed by Civic IQ, pulled September 1, 2026. Ranges are drawn from the 2026 records described in this article.
“The town said it was awarded almost $144,000 through the state cybersecurity grant programme. The funds will support the town’s multi-factor authentication programme over the next four years.”
Four years of funded work, announced in a single June council item. No solicitation, no bid board entry, and a defined budget envelope for anyone who reads it in time.
Two mechanics that decide who wins
Cooperative contracts remove the competition
Hudson County in New Jersey funded countywide network segmentation at $84,000 and server room decommissioning at $34,800 through a neighbouring county’s cooperative pricing system. No solicitation was issued, because none was needed. If you are not on the vehicle, you were never in the deal.
The integrator is the buyer
Lincoln County in New Mexico was invoiced $17,629 for a countywide authentication rollout including licences and project labour, by an integrator rather than a platform vendor. A small Iowa city approved its rollout through its managed provider. In agencies of this size the partner is the decision maker, not the influencer.
Schools are on a separate track
District signals cluster around authentication and state identity systems rather than architecture. Monroe-Woodbury Central School District and Mexico Central School District in New York both recorded ongoing authentication rollouts, with one scoping it specifically to users handling sensitive data. Dexter Community School District in Michigan raised network segmentation alongside its wider security work.
In Minnesota there is an annual compliance rhythm worth knowing. Districts must designate an identified official with authority for the state education identity system, and boards do so by name every year. It is not a purchase, but it tells you exactly who to talk to.
A monitoring list you can act on
- Watch for multi-factor authentication in IT budget lines, not for zero trust.
- Flag any budget line carrying an amount but no product name. That is an unmade decision.
- Follow your states’ cybersecurity grant programmes and read the award announcements.
- Track which cooperative vehicles the counties in your territory buy security through.
- When an agency completes authentication, diarise it. Segmentation is usually the next budget cycle.
Security is one of the more predictable buying sequences in the SLED sector, which is what makes it worth monitoring properly. See also our guide to finding cybersecurity projects before the RFP and the NAICS codes agencies file this work under.
Open RFPs related to this topic
Live opportunities surfaced by Civic IQ as of 2026-09-01. Status changes daily.
- Community TeamWork IT Support & Cybersecurity Services RFQ-2026-091, Community TeamWork, Inc., MA (due 2026-09-01)
- Community TeamWork IT Services Managed IT Support & Cybersecurity RFQ-2026-091, Community TeamWork, Inc., MA (due 2026-09-01)
- Gray County Airport Hardware, Network Diagnostics, and Cybersecurity Services 2026, Gray County, TX (due 2026-09-03)
- E&I Cooperative Services Telecommunications, Broadband, and Network Solutions RFP EI00433~2026RFP, University Of Kansas, KS (due 2026-09-02)
- Pennsylvania DL&I Identity Verification Services RFP-13755 2026, Pennsylvania DL&I|Advisory Committee for the Blind of Pennsylvania, PA (due 2026-09-11)
Frequently asked questions
Do state and local agencies budget for zero trust by name?
Very few do. In 2026 records the phrase appears mainly in larger capital plans, such as the City of Ukiah’s $155,000 zero trust architecture project. Most agencies fund the components instead: multi-factor authentication, identity management, network segmentation and endpoint protection.
Which component gets funded first?
Multi-factor authentication, by a wide margin. It is cheap, it satisfies insurers and grant conditions, and it can be done without redesigning the network. It is also the most common first line item in a sequence that ends in a full architecture.
How much do these projects cost?
The range is wide because the scope is. A small Iowa city approved workstation multi-factor authentication for a one-time $2,916 plus $15 a month. A California city budgeted $350,000 for a combined programme covering architecture, identity management and endpoint protection.
Are grants funding this work?
Yes, and it changes the timing. The Town of Portsmouth in Rhode Island recorded almost $144,000 from a state and local cybersecurity grant programme, funding its multi-factor authentication work over four years. Grant funded work runs on the grant calendar, not the budget cycle.
Who delivers this work in small agencies?
An integrator or managed provider, almost always. Lincoln County in New Mexico was invoiced $17,629 by an integrator for a countywide rollout including licences and project labour. Selling the product without a delivery partner leaves the buyer without hands.
What is the earliest signal of all?
A governance step with no money attached. Minnesota districts must annually designate an identified official with authority over state education identity systems. That designation names the person who will own any identity purchase that follows.
