The short version
- The agency owns the need; the state owns the rules. A program director and agency CIO start the purchase. The state CIO, CISO, central procurement office and attorney general decide how it can happen.
- Money comes from the legislature, on a calendar. Agencies request budget in summer and fall; the governor proposes in winter; the legislature appropriates by the start of the fiscal year, July 1 in 46 states. Miss the request and the project waits a year, or two in biennial-budget states.
- Large IT projects are gated. Most states run an oversight process for projects above a threshold (often $1–5 million): business case, planning, procurement approval, implementation reviews. It adds 6–18 months and is why routine state deals run 12–24 months and large overseen projects 24–36.
- Contract vehicles skip the RFP. A statewide term contract, a NASPO ValuePoint participating addendum or, for IT and security, a GSA Schedule can turn a procurement into a purchase order.
- Security is a gate, not a checkbox. State CISOs increasingly require StateRAMP (or TX-RAMP in Texas) authorization, SOC 2 reports and NIST-aligned controls before a product can touch state data.
How state government is organized for buying
Every state has 50–150 agencies, departments, boards and commissions, most headed by a governor's appointee. The ones that buy the most technology are the large human-services agencies (Medicaid, SNAP, child welfare, unemployment insurance), transportation, revenue, corrections, public safety and motor vehicles, plus the central IT agency itself. Universities and community colleges are state entities but buy through their own systems, so we cover them separately under higher education.
Three central offices shape every purchase. The central procurement office (usually inside a Department of Administration or General Services) sets procurement rules, runs statewide contracts and delegates authority to agencies up to a limit. The state CIO's office sets technology standards and, in the roughly half of states that have consolidated IT, runs infrastructure and reviews or approves agency IT projects; NASCIO tracks the state CIO's growing role as a broker of shared services. The governor's budget office decides what goes in the governor's budget and approves spending plans after the legislature acts.
Two more bodies matter for large deals. The legislature appropriates every dollar and, in many states, has a joint committee or legislative fiscal office that reviews IT projects. And most states have an IT project oversight function (California's Project Approval Lifecycle, Texas's Quality Assurance Team and TX-RAMP, Washington's OCIO oversight, Florida's Digital Service, New York's ITS) that gates large projects through stages. The thresholds, forms and stage names vary, but the pattern is the same: no procurement for a large project until the business case and plan are approved.
Who is involved and what they decide
Search by title, office or decision.
Showing all 13 roles
| Role | Role in the purchase | What they decide | Approach |
|---|---|---|---|
| Agency program director or division chiefDirector of a program (Medicaid eligibility, driver licensing, child welfare, unemployment insurance) | Owns the business problem and the program budget; writes the business case and often the first draft of requirements | Whether there is a need and what it must do; champions the project through the agency | First call for most products; they need a story they can take to the agency CIO and the budget office |
| Agency CIO / IT directorEach major agency has one; reports to the agency head and, in consolidated states, dotted-line to the state CIO | Owns the agency's technology portfolio, architecture and security review; sponsors IT projects | Whether the solution fits the agency's architecture and whether IT will support it | Must be an ally; in consolidated states they also broker the state CIO's approval |
| Agency head (commissioner, secretary, director)Appointed by the governor in most states; elected in a few (agriculture, insurance, education in some states) | Approves the agency's budget request and signs large contracts; sets priorities that make or break projects | Which initiatives get budget requests and executive attention | Rarely a first call; reached through the program director and the governor's policy agenda |
| Agency procurement officerAgency contracts manager or procurement director; delegated authority from the central office up to a limit | Runs agency-level solicitations below the delegated limit; routes larger ones to the central procurement office | Procurement method (quotes, RFP, cooperative, sole source) and vendor compliance | Ask which contract vehicles the agency already uses; they know the shortcuts |
| State chief procurement officer / central procurement officeDepartment of Administration, General Services, Administrative Services or Management and Budget | Runs statewide term contracts, large agency solicitations, cooperative participating addenda (NASPO ValuePoint) and vendor registration | Award on large solicitations; whether an agency may use a cooperative or sole-source justification | Register in the state's eProcurement system; get on statewide contracts; attend vendor days |
| State CIO and the central IT agencyOffice of Information Technology, Department of Technology, Office of Enterprise Technology; the state CIO is a governor appointee in most states | Sets enterprise architecture, security standards and (in consolidated states) runs infrastructure; approves or reviews agency IT projects above a dollar threshold; often runs IT-specific procurement | Project approval, security and accessibility compliance, whether a solution must be enterprise rather than agency-specific | Learn the state's IT project oversight process and thresholds; the state CIO's strategic plan tells you what will be funded |
| State CISOReports to the state CIO in most states | Security review of every technology purchase; sets requirements (SOC 2, StateRAMP or TX-RAMP, NIST 800-53, data residency) | Whether a product is allowed on the state network or to hold state data | Have your security documentation ready before the first demo; StateRAMP authorization is increasingly required |
| Governor's budget officeOffice of Management and Budget, Department of Finance, Division of Budget | Reviews agency budget requests, builds the governor's recommended budget, approves spending plans and position counts | Whether the project is in the governor's budget; whether federal funds can be used | Not a sales call; the program director and agency head make this case, with your business case and total-cost figures |
| Legislature: appropriations and fiscal committeesHouse and Senate appropriations or ways and means committees, joint budget committee, legislative fiscal office | Appropriates the money; may line-item large IT projects; in some states a legislative IT oversight committee reviews projects over a threshold | Whether the money exists, and sometimes which project gets it | Indirect: legislative staff read agency budget requests and fiscal notes; lobbyists matter for large deals |
| Legislative or executive IT oversight bodyState IT project oversight (California's Project Approval Lifecycle, Texas Quality Assurance Team, Washington OCIO oversight, Florida Digital Service) | Gates large IT projects through stages (business case, planning, procurement, implementation); independent verification and validation on the biggest | Whether a large project may proceed to procurement and contract | Know the thresholds (often $1M–$5M) and stage gates; they add 6–18 months to the largest projects |
| Attorney general / agency counselAgency general counsel; the AG's office in states that must approve contracts | Reviews contract terms; several states require AG or central legal approval of contracts over a threshold | Indemnification, limitation of liability, data clauses, governing law; state terms are usually non-negotiable | Accept the state's standard terms where you can; fights over liability caps are the most common cause of delay |
| State auditor or comptrollerElected in many states | Pays invoices, audits contracts, reviews procurement compliance; may pre-audit contracts over a threshold | Whether the contract and payments comply | Clean invoices and reporting keep renewals easy |
| Federal partner agencyCMS, FNS, ACF, FHWA, DOL and others, for programs they fund | Approves advance planning documents and funding for systems they pay for (Medicaid 90/10, SNAP, child welfare, unemployment insurance); sets certification requirements | Whether federal match is available and whether the system meets federal standards (modularity, MITA, CCWIS) | For federally funded systems, the federal rules shape the RFP more than the state does |
The six stages of a state agency purchase
Showing all 6 stages
| Stage | What happens | Your window |
|---|---|---|
| 1. Need and business case6–18 months before an RFP | Program staff document a problem; the agency CIO scopes options; in oversight states a business case or Stage 1 analysis is filed | This is where requirements are shaped. Discovery conversations, demos and pilot results matter most here. |
| 2. Budget requestSummer and fall before the legislative session | The agency submits a budget request or decision package to the governor's budget office; large IT projects need a cost estimate and often an oversight-body review | Help the program director with total-cost figures, references and procurement options |
| 3. Governor's budget and legislative sessionGovernor's budget in December–February; session January through spring in most states | The budget office builds the governor's proposal; legislators hear agency testimony; appropriations pass before the fiscal year (July 1 in 46 states) | Mostly waiting. Legislative staff read fiscal notes; large deals may need a lobbyist. |
| 4. Procurement planningAfter appropriation; 2–6 months | The agency and central procurement choose a method: statewide contract, NASPO ValuePoint participating addendum, GSA Schedule, agency RFP; oversight bodies approve the procurement plan for large projects | If you are on a contract vehicle the state uses, the RFP may never be written |
| 5. Solicitation and evaluationRFP posted 4–8 weeks; evaluation 2–6 months | Posted on the state eProcurement portal; questions and addenda; written proposals, demos, best-and-final offers; evaluation committee scores; intent to award; protest period | Follow the rules exactly; contact outside the procurement officer is usually prohibited during the blackout |
| 6. Contract and approvals1–4 months | Negotiation on terms (limited); AG or central legal review; sometimes legislative or oversight committee review; contract execution | Accept standard terms where you can; have insurance and security documentation ready |
Ways state deals move faster
- Be on a vehicle the state can use. Statewide term contracts, NASPO ValuePoint participating addenda, GSA Schedules (IT, security) and sometimes other states' contracts through reciprocity. See how to get on a cooperative contract.
- Sell below the delegated threshold. Agencies can buy on quotes below their delegated authority (often $10,000–$100,000; see thresholds by state). Pilots and first-year subscriptions are often sized to fit.
- Use federal money and federal urgency. Programs funded by CMS, FNS, DOL or FHWA have their own timelines and matching funds; a federal mandate or deadline is the strongest forcing function in state government.
- Arrive security-ready. StateRAMP or TX-RAMP authorization, a current SOC 2 Type II, and an accessibility (VPAT) statement remove months from the CISO's review.
- Follow the governor's priorities. Each state CIO publishes a strategic plan and each governor a budget message; projects aligned with them get funded first.
The state budget calendar
Forty-six states start the fiscal year July 1; New York starts April 1, Texas September 1, and Alabama and Michigan October 1. Twenty states budget biennially, which means a project not in the biennial budget may wait two years. Legislatures convene in January in most states and adjourn between March and June; a few (Texas, Montana, Nevada, North Dakota) meet only in odd-numbered years. Agency budget requests are due to the budget office in late summer or early fall. Our government fiscal year calendar lists every state.
Method and sources
Roles, processes and thresholds are generalized from state procurement codes, the National Association of State Chief Information Officers (NASCIO), the National Association of State Procurement Officials (NASPO), published state IT project oversight frameworks and Kensington Sales Group's outbound calling into state agencies. Fiscal-year and session facts are from the National Conference of State Legislatures and the National Association of State Budget Officers. Specifics vary by state; check the state's procurement manual and IT oversight policy. Checked November 7, 2026. Corrections: research@kensingtonsalesgroup.com.
Cite or share this data
Free to reuse with attribution: "Kensington Sales Group, How State Agencies Buy Technology (2026), kensingtonsalesgroup.com/resources/how-state-agencies-buy-technology.html".