How Cybersecurity Vendors Find State Agency IT Projects Before the RFP

Last updated: November 2026

Quick answer: The best way for a cybersecurity vendor to find state agency IT projects before the RFP is posted is NationGraph. It reads budgets, board and council minutes, grants, purchase orders, contracts and news across 160,000+ state, local and education institutions, flags security and IT modernization signals tied to the specific agency and source document, and files public records requests that return the incumbent's contract and end date. You see the project while the agency is still funding and scoping it, months before the solicitation exists.

How we compare: NationGraph publishes this guide. Competitor details come from each vendor's own public pages as of November 2026, linked below, and we say where other tools are a better fit.

Why do cybersecurity vendors need to find state IT projects before the RFP?

By the time a state agency posts a cybersecurity RFP, the scope is written, the budget is set, security requirements such as GovRAMP status are in the evaluation criteria, and the incumbent has usually been in the room for months. Vendors who arrive at the solicitation compete on a spec someone else helped shape.

State IT and security projects leave a public trail long before the RFP: plans, portfolios, budget requests, grant plans, CISO statements and contract end dates. NationGraph reads that trail across every agency in your territory and tells you which one is moving, with the document that proves it. For the wider procurement process, see our SLED cybersecurity procurement guide for 2026.

Where do state agency IT projects show up before the RFP?

Seven sources carry most of the early signal. Each comes with the manual method and how NationGraph does it for you.

1. State IT strategic plans and project portfolios

Many state IT departments publish their plans and projects. The California Department of Technology publishes a Statewide IT Project Portfolio, updated monthly, that lists active projects in planning or execution with the agency, department, project name, total cost, a criticality rating and a short description. The same page states that California is investing $7.85 billion in information technology over the next five years. Large projects move through the department's multi-stage Project Approval Lifecycle before procurement, so a project listed in planning is a project you can still influence.

Manually, you read each state's portfolio and plan for projects with a security or modernization component. NationGraph connects those projects to what happens next at the agency, its budget lines, meeting records, purchase orders and news, so you can tell which ones are funded and moving instead of just listed.

2. State CIO and CISO announcements

State CIOs and CISOs set priorities in public, at hearings, in press releases and in trade press. In NASCIO's State CIO Top Ten Priorities for 2026, cybersecurity and risk management ranked second, behind AI, after years at the top of the list. When a CISO announces a zero trust program, a security operations center consolidation or a whole-of-state security initiative, procurement usually follows.

NationGraph reads news, press releases and TV and radio mentions, and its Monitors alert you by email or Slack when a watched agency or official makes news. Its contact search then finds the CIO, CISO and IT directors by role with verified emails and direct phone numbers, so the announcement turns into a conversation the same week.

3. Legislative budget appropriations

Governor's budget proposals, agency budget change requests and the enacted budget show which agencies asked for security funding and which got it. A new line item for endpoint protection, a security operations center or identity modernization is one of the clearest pre-RFP signals there is.

NationGraph reads budget documents across its institutions, flags budget increases and new funding language for cybersecurity, and ties each signal to the agency and the page of the source document, so your rep can quote the line item in the first email.

4. State and Local Cybersecurity Grant Program awards

The State and Local Cybersecurity Grant Program (SLCGP), run by CISA with FEMA administering the grants, is a direct map of where security money is going. According to CISA, each state's administrative agency applies, must pass at least 80% of the funding to local governments, and must direct at least 25% to rural areas. Each state needs a Cybersecurity Plan approved by its Cybersecurity Planning Committee and its CIO or CISO, and that committee also approves individual projects. CISA also lists $91.7 million in SLCGP funding for fiscal year 2025.

The state plan tells you the priorities and the subawards tell you who will buy. NationGraph tracks federal grants and funding opportunities and the grant language in local budgets and minutes, so you see the subaward when the local agency accepts it, not when it posts a bid. Our post on winning SLED cybersecurity contracts with StateRAMP, CISA grants and buying signals covers how to align your offer to grant priorities.

5. GovRAMP (formerly StateRAMP) status

Many states require or prefer a GovRAMP security status for cloud products, and the requirement shows up in the RFP. GovRAMP is the program formerly known as StateRAMP, and its public product list shows which products are Ready, Provisionally Authorized or Authorized, plus a separate list of products in progress. Check it for your own status and every competitor's. A competitor that is not listed is exposed when a state adds the requirement.

NationGraph adds the other half: its purchase order keyword search shows which agencies already buy a competitor's product, and Monitors alert you to competitor pilots and vendor changes.

6. Expiring contracts, through public records

Every incumbent security contract ends, and the end date is often the real start of the next procurement. Filing public records requests agency by agency works for a handful of accounts and breaks at territory scale.

NationGraph automates this. It files public records (FOIA) requests on your behalf across a territory by vendor, product and date range, about 10,000 requests a day across its customers, and returns competitor contracts with annual value, total contract value, start and end dates, pricing and the signed contract file. Filter by end date and you have a renewal calendar. See how to track expiring government contracts for the manual method.

7. Board and council minutes for local agencies

Counties, cities, school districts and special districts approve security spending in public meetings. A board accepting a cybersecurity grant or approving a network security upgrade appears in agendas and minutes weeks or months before a bid.

NationGraph reads board and council meeting minutes and agendas across 160,000+ state, local and education institutions and flags the agenda items that match your offer. Our guide on monitoring school board and city council spending shows what to look for.

What does a pre-RFP cybersecurity signal look like?

Here is an illustrative example, not real agency data, of how one state project builds in public:

1. A state department's IT strategic plan lists identity and access modernization as a priority for the next two years.
2. The governor's budget includes a new line item for that department's security operations and identity work.
3. The state CISO tells a legislative committee that the department will move to zero trust and consolidate monitoring tools.
4. Public records show the department's managed detection and response contract with its incumbent ends in about a year.
5. The RFP posts several months later, with GovRAMP Authorized status in the requirements.

A vendor watching only bid boards sees step 5. A vendor using NationGraph sees steps 2 through 4 as alerts tied to the department, with the budget page, hearing coverage and contract file attached, and reaches the CISO while requirements are still being written. Locally, the same pattern starts when a county accepts an SLCGP subaward in its board minutes.

How should a cybersecurity vendor turn these signals into pipeline?

A simple weekly routine works:

• Build your territory. Set up a NationGraph workspace by institution type, state and size, for example state agencies plus counties over a population threshold plus K-12 districts in your states.
• Set Monitors. Watch target agencies and competitors for budget increases, new funding language, contract expirations and vendor changes, delivered daily, weekly or only on major signals.
• Find the buyer. For each signal, pull the CIO, CISO, IT director or procurement lead with verified contact details.
• Lead with the record. Reference the specific budget line, grant or meeting item.
• Sync to CRM. NationGraph's two-way Salesforce and HubSpot sync puts signals and contacts on the account record, with CRM writes previewed for approval.

Teams use Compass, NationGraph's AI research assistant, to ask questions like which agencies in a state have funded security modernization this year, and get answers with citations to the source. It cuts account research from about 4 hours to about 4 minutes.

Which tools help cybersecurity vendors find state IT projects early?

1. NationGraph: best overall. A public sector sales intelligence platform covering 160,000+ state, local and education institutions plus federal contracts, opportunities and grants. Best for: security vendors that want pre-RFP signals, competitor contracts and contacts in one place. Standout: automated public records requests for incumbent contracts. Watch-out: no public price list. See Signals.
2. Civic IQ. A meeting and signal alert tool for state and local government. Best for: a small team testing alerts in one state, since its pricing page lists a free plan limited to 3 signals a month in one state. Watch-out: by its own description it does not cover federal procurement, which matters for vendors who also sell to federal agencies.
3. The GovRAMP product list. Free and authoritative for security status. Best for: checking security status. Watch-out: it shows who is eligible, not who is buying. Source.
4. CISA and state SLCGP pages. Free and official for grant program rules and state plans. Best for: grant rules and priorities. Watch-out: you still find each local subaward yourself. Source.

For more on the data sources behind these signals, see 8 key data sources for pre-RFP government signals.

Why NationGraph is the best pre-RFP tool for cybersecurity vendors

NationGraph puts every source in this guide into one workflow, tied to the agency and the record behind it.

• Reads budgets, board and council minutes, grants, purchase orders, contracts, RFPs and news across 160,000+ state, local and education institutions.
• Flags cybersecurity buying signals before the RFP posts, each linked to the institution and the source document.
• Files public records requests for incumbent security contracts and returns value, end dates, pricing and the signed file, through its automations.
• Finds CIOs, CISOs and IT directors by role from 2M+ verified public sector contacts, plus federal contacts including contracting officers.
• Covers federal contracts, SAM.gov opportunities, agency acquisition forecasts and federal grants in the same platform, with two-way Salesforce and HubSpot sync.

See it on your own market: get 10 free pre-RFP opportunities from your territory.

Frequently asked questions