How to get government IT contracts at the state and local level

SLED stands for state, local and education, and the useful thing about the acronym is that it groups buyers who behave similarly and separates them from federal buyers who do not. The differences are not cosmetic. They change your go-to-market entirely.

• No single registration. Federal vendors register once in SAM.gov. SLED vendors register separately in every portal: Bonfire, OpenGov Procurement, Periscope, Ionwave, BidNet Direct, Vendor Registry, DemandStar, plus each state's own system such as Cal eProcure in California, the Electronic State Business Daily in Texas, and eMMA in Maryland. There are thousands of these. Finding the solicitations is a genuine operational problem, not an afterthought.
• No CPARS. There is no government-wide past-performance record. References are collected ad hoc per solicitation, which means a strong reference list is worth more here than a federal contractor would expect, and a bad experience with one county does not automatically follow you to the next.
• Cooperative purchasing is legal and enormous. An agency can often buy off a contract another jurisdiction competitively solicited. Federally this is rare. In SLED it is a primary channel.
• Different diversity programs. Federal set-asides such as 8(a), HUBZone and SDVOSB largely do not exist here. States run their own MBE, WBE, DBE, SDVOB and small business programs with their own certifications, and reciprocity between states is limited. If diversity status is part of your strategy, you certify state by state.
• Non-appropriation is standard. Nearly every state and local contract terminates if the legislature or council does not fund it. You cannot model SLED revenue the way you model a private multi-year SaaS contract.

The buyers themselves split into recognizable groups. Central state IT organizations, usually reporting to a state CIO, buy consolidated infrastructure, security and shared services and set the standards everyone else must meet. Individual state agencies buy their own line-of-business systems: transportation, health and human services, revenue, corrections, labor, motor vehicles. Counties buy public safety systems, courts systems, property and tax systems, and health services technology. Cities buy permitting and licensing, utility billing, 311, public safety, and websites. School districts buy student information systems, learning platforms, networks, devices and cybersecurity. Community colleges and universities buy ERP, learning management and research infrastructure. Special districts, transit authorities, water utilities, port authorities and public hospital districts buy everything the others do at smaller scale and with much less competition.

For guides to how each of these buyers governs its purchasing, see how to sell to state agencies, how to sell to county government, how to sell to municipalities and city government, how to sell to school districts, how to sell to universities and colleges, how to sell to special districts: water, fire, transit and parks and how to sell to public hospitals and health systems.

Vendors new to the market assume the RFP is the market. It is not. It is one of five routes, and for a firm without an incumbency it is usually the worst one to start with.

The strategic sequence for most firms is to earn early revenue and references through small purchases and task orders, use those references to satisfy the minimum qualifications that gate the larger open solicitations, and in parallel run a multi-year effort to get onto the term contracts and cooperatives that will carry volume in years three and four. RFP vs RFQ vs IFB vs ITB explains the instruments in detail.

Every state runs a central procurement office that competitively awards statewide contracts for categories of goods and services. Once awarded, agencies buy from them without running their own solicitation, and in most states local governments and school districts can use them too. This is the highest-leverage single thing a SLED IT vendor can pursue inside one state.

The offices go by different names. California uses the Department of General Services. Texas uses the Department of Information Resources for technology specifically, and DIR contracts are widely used by Texas local governments and districts. New York uses the Office of General Services. Ohio and Oregon use Administrative Services departments, Georgia uses the Department of Administrative Services, Florida uses the Department of Management Services. The names change; the mechanism does not.

Typical technology categories carried on state term contracts include hardware and value-added reseller services, software licensing and resale, IT staff augmentation, deliverables-based IT professional services, telecommunications, cloud services, and cybersecurity services. Some are open-enrollment, meaning any qualifying vendor can apply at any time. Most are periodic, re-solicited every three to five years, with the contract closed to new entrants in between.

Three things to understand before you invest in this:

• A contract is eligibility, not revenue. Getting on a staff augmentation contract with 200 other vendors means you may now bid the task orders. It does not mean anyone will call you. Plan the sales effort that follows the award, or the award is worthless.
• Timing is the whole game. Because the windows are periodic, missing one costs you years. Find out today when each contract you care about expires, and set a reminder eighteen months before, because that is when the re-solicitation planning and the sources-sought notices start.
• Read the ordering rules. Some contracts allow direct orders up to a threshold and require a mini-bid among contract holders above it. Some allocate work by rotation. Some allow local entities to use the contract and some restrict it to state agencies. These rules determine whether the contract is worth holding.

NASPO ValuePoint is the cooperative purchasing arm of the National Association of State Procurement Officials, and it is the largest single mechanism in state government purchasing. It operates what it calls the Lead State Model, leveraging the combined buying power of all 50 states, the District of Columbia and the US territories. As of its own published figures it manages more than 21 billion dollars in annual spend across 61 portfolios and more than 450 suppliers, with 29 states currently serving in the lead state role.

The mechanism works in three steps, and understanding it explains why the timeline is long:

1. A lead state runs the solicitation. One state's procurement office solicits on behalf of all participating states for a category, for example cloud solutions, software value-added reseller, or data communications products and services. The solicitation is issued through that state's own eProcurement system, which is where you have to be registered to see it and respond.
2. Winners receive a master agreement. This sets the national scope, pricing structure, and baseline terms. Holding it makes you eligible, nationally, in principle.
3. Each participating state executes a participating addendum. The state adds its own terms, its own administrative fee, and sometimes its own restrictions on which entities may use the agreement and whether local government and education entities are included. Only after a participating addendum is executed can entities in that state actually order from you.

That third step is where vendors lose momentum. Winning the master agreement is not the finish line; you then have to work state by state to get participating addenda executed in the states where you have demand, which is a business development activity, not a procurement one. Portfolios run across seven categories including information technology and communications, public safety, health and human services, and services generally.

The practical approach for a firm that wants this: identify the two or three NASPO ValuePoint portfolios that match what you sell, find out which state is the lead state and when the current master agreements expire, register in that lead state's procurement system now, and watch for the sources-sought and draft solicitation notices that precede the re-solicitation. Categories come up when they come up, and there is no way to accelerate the cycle.

NASPO ValuePoint is the state-government cooperative. A parallel set of cooperatives serves local government and education, and for a mid-sized IT firm they are often more accessible.

One large caveat that vendors regularly get wrong. Whether a specific local entity may piggyback on a cooperative contract depends on that state's procurement statute and on the entity's own board policy. Some states require that the originating solicitation satisfied that state's own competitive requirements, including advertising and bonding rules. Others cap the dollar value that may be purchased cooperatively. A cooperative contract is a strong asset, but never build a revenue forecast on the assumption that every agency in the country can use it. Confirm with the specific buyer's procurement officer, in writing, before you plan around it.

If you sell networking, connectivity, wifi, cabling, firewalls or managed network services into school districts, E-Rate is not a niche. It is the mechanism by which most of that spending is funded, and its rules override the district's ordinary procurement instincts. It is administered by the Universal Service Administrative Company on behalf of the FCC, and the rules are specific enough that vendors who know them have a structural advantage over vendors who do not.

What is eligible

Category One covers data transmission services and internet access, including leased lit fibre, leased dark fibre and self-provisioned networks. Category Two covers internal connections such as routers, switches, wireless access points and cabling, plus managed internal broadband services and basic maintenance of internal connections.

The Category Two budget arithmetic

Category Two support is capped by a per-applicant budget fixed for a five-year cycle. For the FY2026 to FY2030 cycle the multipliers are 201.57 dollars per student for schools and 5.43 dollars per square foot for libraries, with a funding floor of 30,175 dollars for schools and libraries generally and 66,385 dollars for Tribal libraries. The previous FY2021 to FY2025 cycle used 167.00 dollars per student, 4.50 dollars per square foot and a 25,000 dollar floor. Applicants validate their student counts or square footage in the first year they apply within a cycle, and the resulting pre-discount budget is then fixed for the whole five years.

That arithmetic is a sales tool. A district with 6,000 students has roughly 1.2 million dollars of pre-discount Category Two budget for the five-year cycle. You can calculate a prospect's remaining budget before you ever call them, and you can tell them how much of it they have left.

The competitive bidding rules that govern your bid

• The applicant files an FCC Form 470 describing the services requested. These postings are public and searchable, and they are the earliest reliable signal that a district is about to spend on its network.
• The applicant must wait at least 28 days from the date the Form 470 is certified before closing the competitive bidding process. Changes to the Form 470 that materially affect the competitive bidding process restart the 28-day clock.
• Price of the eligible equipment and services must be given the most weight in bid evaluation. This is a federal program rule, not a district preference. It means that even when a district runs a full RFP with a scoring matrix, price must carry more weight than any other single factor.
• An applicant is generally not required to issue an RFP unless its own state or local procurement rules require one, so many E-Rate competitions are conducted entirely through the Form 470 and vendor responses.
• Service providers and potential service providers generally cannot give gifts to applicants. The limited exceptions are narrow. Ordinary vendor hospitality that is unremarkable in private-sector sales can disqualify a bid here.
• The FCC Form 471 is filed by the applicant during an annual window that generally opens about six months before the start of the funding year and stays open about two and a half months.
• Services provided under tariff or on a month-to-month basis require a Form 470 every year. Multi-year contracts resulting from a completed competitive bidding process do not, until the contract expires, which is a strong argument for proposing multi-year terms.

On the vendor side you need a Service Provider Identification Number and you must file the annual service provider certification. Then the operational task is monitoring Form 470 postings in your service area continuously, because a posting gives you a defined 28-day window in which the district is obligated to consider responses.

An open IT RFP is typically evaluated in three stages, and most losses happen in the first one.

Stage one is pass or fail. The procurement officer checks that your submission is complete, on time, in the required format, and that you meet every stated minimum qualification. Nothing is scored here. Either you proceed or you do not.

Stage two is committee scoring. An evaluation committee, usually a mix of the requesting department's staff and IT, scores the technical volume against published criteria. Weightings vary but a common shape is technical approach and solution fit at 30 to 40 percent, experience, qualifications and references at 20 to 30 percent, cost at 20 to 40 percent, and smaller allocations for diversity participation, local preference where allowed, and implementation or support approach.

Stage three is cost scoring, demonstrations and negotiation. Cost is usually scored by formula rather than judgment. The most common one awards full points to the lowest price and gives everyone else the lowest price divided by their price, multiplied by the available points. That formula is worth internalising. If cost carries 30 points and you bid 20 percent above the low bidder, you lose roughly 5 points, which you must recover on technical. If you bid 60 percent above, you lose about 11 points and you almost certainly cannot recover it. Knowing the formula tells you exactly how much premium your differentiation can carry.

For systems purchases such as ERP, student information systems, permitting and public safety software, scripted demonstrations are frequently the decisive stage. They are scored by end users rather than procurement, they follow a script the agency wrote, and vendors lose them by demonstrating impressive functionality that is not on the script. Rehearse the script, in order, using the agency's own terminology and data examples.

After scoring, many states permit discussions with the competitive range and a best and final offer. Some hold the right to negotiate only with the top-ranked vendor, which makes rank one enormously more valuable than rank two. Read the evaluation section before you decide how to price.

One underused fact: in most states, evaluation scores, scoring sheets and sometimes the winning proposal become public records after award. Request them on every loss. That is a far better source of competitive intelligence than any market research, and how to request a debrief after losing a bid covers how to ask for it and what to do with the answer. how to respond to an RFP covers the response mechanics themselves.

In SLED IT, compliance certifications are not marketing. They are pass-or-fail minimum qualifications, and they are usually named in the solicitation. A vendor who cannot produce the artefact loses at stage one regardless of the solution.

GovRAMP, formerly StateRAMP

GovRAMP is a non-profit that provides a standardized, risk-based pathway for governments to verify cloud solutions, modeled on the federal FedRAMP approach but built for state and local buyers. It rebranded from StateRAMP, so solicitations that still say StateRAMP are referring to the same program. It operates tiered verification levels based on NIST controls: a Security Snapshot at 40 controls with a 12-month assessment, a Progressing Security Snapshot at 40 controls assessed on an ongoing basis, Core Verification at 60 controls, Ready Verification at 80 controls, and Authorized or Provisional verification at more than 300 controls. Its published figures include more than 1,200 member organizations, more than 70 government organizations engaged, and more than 330 products in program, with the authorized and progressing lists now unified into a Program Participants List.

The practical implication for a SaaS vendor is a sequencing decision. Full authorization at 300-plus controls is a serious investment. A Security Snapshot is achievable quickly and satisfies a growing number of solicitations that ask for participation in the program rather than full authorization. Read what the solicitation actually requires before you assume you need the top tier.

Other regimes, by data type

Two operational notes. First, these obligations flow down. If your product runs on a hyperscaler and integrates a third-party service, the buyer's requirements apply to that chain, and you will be asked to evidence it. Second, the questionnaire arrives late. Many solicitations attach a security questionnaire as a required submittal with a two-week turnaround. Have a maintained, current answer set before you need it, or you will be writing security policy at midnight during proposal week.

Selling software into school districts adds a legal layer that has killed more closed-won deals than any competitor. The federal baseline is FERPA, under which a vendor typically gains access to student records through the school official exception, which requires the district to maintain direct control over the vendor's use and to limit the vendor to the purpose for which the data was disclosed. PPRA adds restrictions around surveys and marketing.

The federal baseline is the easy part. The state statutes are where deals stall:

• New York Education Law section 2-d and its Part 121 regulations require a data privacy agreement with each educational agency, a supplemental information document published by the district, and vendor adoption of a recognized security framework such as the NIST Cybersecurity Framework.
• Illinois SOPPA, the Student Online Personal Protection Act, requires a written agreement with each district, publication of certain information, and breach notification within defined timeframes.
• California combines Education Code section 49073.1, from AB 1584, which governs the contract terms districts must include, with SOPIPA at Business and Professions Code section 22584, which restricts targeted advertising, profiling and sale of student data by operators of K-12 services.
• Connecticut, Colorado, Texas and a long list of other states have their own variants with their own required contract clauses.

The practical instrument that solves most of this is the Student Data Privacy Consortium's National Data Privacy Agreement, a standard agreement with state-specific exhibits developed collaboratively by 28 state alliances to cover both common national obligations and specific state requirements. The current version is NDPA v2.2, published in November 2025, and it comes in standard, vendor-specific and district-modified forms. More than 222,000 standard data privacy agreements have been executed or subscribed to since 2016, which the consortium estimates has saved participating entities over 111 million dollars in legal cost. Many alliances run public registries of executed agreements, so that a district joining the alliance can adopt an existing signed agreement rather than starting a legal review. If you sell into K-12 at any scale, sign the NDPA in each state alliance where you have prospects and get listed. A district that finds you already on the registry can buy in weeks. A district that has to route your standard master services agreement through counsel may take a full quarter, and quite often simply chooses a vendor that is already listed.

Accessibility has moved from a checkbox to the largest single demand driver in citizen-facing state and local technology, and most vendors are underprepared for it.

The Department of Justice final rule on web and mobile application accessibility under Title II of the ADA adopts WCAG 2.1 Level AA as the technical standard for state and local government web content and mobile apps. Compliance is required by 26 April 2027 for public entities serving 50,000 or more persons, and by 26 April 2028 for public entities serving fewer than 50,000 persons and for all special district governments. The rule reaches state and local governments, their agencies and departments, special purpose districts, Amtrak and commuter authorities. It contains five categories of exception: archived content meeting specific conditions, pre-existing conventional electronic documents such as word processing, presentation, PDF and spreadsheet files posted before the deadline, content posted by third parties who are not under contractual arrangement with the entity, individualised password-protected conventional documents about specific persons or accounts, and pre-existing social media posts. Those exceptions do not remove the underlying ADA obligations for effective communication.

What this means commercially is straightforward. Every state and local government in the country is now on a clock to remediate or replace its web properties, portals, forms and citizen-facing applications. Every solicitation for a website, a CMS, a portal, a mobile app or any SaaS product a member of the public touches will carry a WCAG 2.1 AA requirement, a contractual warranty, and frequently a remedy clause if you fail to meet it. If you sell in that space, this is the tailwind, and it is dated.

On the vendor side, the artefact you need is an Accessibility Conformance Report. An ACR documents how information and communication technology conforms to the applicable accessibility standards, and it is commonly produced using the VPAT template. Government solicitations that include ICT specify their accessibility requirements, and the recommendation from Section508.gov is to produce ACRs for products marketed to government and to make them easy to find on your website.

Three warnings. Do not submit a VPAT claiming full support across every criterion; evaluators increasingly test the product against the claims, and a demonstrably false conformance claim is both a scoring problem and a contractual misrepresentation problem. Do not submit a VPAT prepared against an outdated standard when the solicitation names WCAG 2.1 AA. And have the report prepared or reviewed by someone who actually tests with assistive technology, because a self-assessment produced by the engineering team that built the product is the single most common source of inaccurate claims.

A meaningful number of SLED opportunities are won on evaluation and then lost in contract negotiation, because the vendor's standard terms are incompatible with what a public entity is legally permitted to sign. Know these before you bid, not after.

• Limitation of liability. Many agencies will not accept a cap at twelve months of fees, particularly where personal data is involved. Expect to negotiate a higher cap or an uncapped carve-out for data breach and IP indemnity.
• Indemnification, in one direction. Sovereign immunity means most states cannot indemnify you at all. Mutual indemnity clauses in your standard agreement will simply be struck.
• Intellectual property. Custom deliverables are frequently required to be work made for hire owned by the agency, or licensed perpetually and irrevocably. If your commercial model depends on retaining ownership of configurations or integrations, say so in your exceptions rather than discovering it at signature.
• Breach notification windows. Twenty-four to seventy-two hours is common and is sometimes statutory. Make sure your incident response process can actually meet the number you sign up to.
• Cyber liability insurance. Requirements commonly run from one to five million dollars, and higher for systems holding sensitive personal data. Check your policy limits and your ability to add the entity as an additional insured before bidding.
• Non-appropriation and termination for convenience. The contract can end if funding is not appropriated, and many allow termination for convenience on thirty days notice. This is near-universal and rarely negotiable.
• Source code escrow, audit rights, data return and deletion obligations, and restrictions on assignment on change of control all appear routinely and all have commercial consequences worth pricing.

The operational fix is to have counsel produce a standing exceptions document, kept current, that lists the clauses you will negotiate and the position you will take on each. Then submit exceptions exactly as the solicitation instructs. This detail matters: many states provide that exceptions not submitted with the proposal are waived, meaning that by staying silent you have accepted their terms in full. Others treat any exception as grounds to deem the proposal non-responsive, in which case the right move is to raise the issue as a question during the question period so the agency can amend the terms for everyone.

Timing in SLED is governed by fiscal years that are not the federal one. Forty-six states end their fiscal year on 30 June. School districts almost universally run July to June. Cities and counties split between calendar years and July to June. Federal pass-through money, which funds a lot of state health, human services and transportation technology, moves on a 30 September year end.

Incumbency is the other structural feature. In IT the incumbent has three advantages: they helped write the requirements, they hold the relationships with the people who will score the proposal, and the switching cost of a data migration is a real and quantifiable argument against you. Unseating one is possible, but it is not a proposal-week activity. It requires work twelve to eighteen months ahead of the recompete.

• Find out when the contract expires. Contracts are public records; so are the amendments and often the pricing.
• Request the incumbent's contract and any documented performance issues, correspondence or change orders through a public records request. Deficiencies documented in the agency's own files are the strongest material you will ever have.
• Attend or watch the board, council or committee meetings where the system is discussed. Complaints from end users in a public meeting are a roadmap.
• Respond to the RFI. Requirements are shaped in the RFI stage, and a vendor who is not in that conversation is responding to a document their competitor helped draft.
• Attack where incumbents are weakest, which in this market is usually accessibility conformance, a security certification they do not hold, integration and data portability, and implementation timelines.

The majority of eliminated proposals never reach an evaluator. They are eliminated administratively, and every one of these is preventable.

1. Missing, unsigned or incomplete required forms

The signature page, addenda acknowledgment, W-9, certificate of insurance with the correct endorsements, non-collusion and conflict of interest affidavits, debarment and suspension certification, state-specific certifications such as Iran divestment or scrutinized-company forms in New York, Florida and Texas, diversity utilization plans, and the security questionnaire. Any one missing is grounds for rejection, and procurement officers in most states have no discretion to waive a required form. Build a how to build an RFP compliance matrix that maps every requirement in the solicitation to the document that satisfies it and the person who owns it, and have someone other than the author verify it before submission.

2. Failing a pass-or-fail minimum qualification

Minimum qualifications look like requirements but function as filters. Five years in business. Three current clients of comparable size. A named certification such as SOC 2 Type II or a GovRAMP status. Authorized reseller status for a named manufacturer. A minimum number of comparable implementations in the last three years. These are checked before anything is scored, there is no discretion, and no cover letter explaining that your two years of exceptional work is equivalent to five will change the outcome. Read the minimum qualifications first, before you read the scope of work, and disqualify yourself early rather than spending forty hours on a proposal that cannot be evaluated.

3. Non-conforming pricing

This is the one that catches technology vendors specifically, because their commercial models rarely fit the required format. Submitting your own pricing sheet instead of the mandatory workbook. Leaving a required line item blank or marking it included. Conditioning pricing on assumptions, minimum terms or volumes that the solicitation did not invite. Adding an escalation clause where none was permitted. And the most damaging version: putting pricing information in the technical volume when the solicitation requires cost to be submitted in a separate sealed file. Many states treat that as an automatic disqualification because it compromises the integrity of the blind technical evaluation.

Beyond the top three, three more worth guarding against. Portal submission failures, where a large upload times out at the deadline, which is why you submit a day early and then replace the file if needed. Page limit violations, which some agencies enforce by simply not reading past the limit and others by rejection. And contact during the quiet period: nearly every solicitation names one procurement contact and prohibits contact with anyone else, and a well-meant email to the department director you know is an automatic disqualification in a number of states.

A firm entering SLED from a commercial or federal background should expect year one to be about becoming eligible and building references, with real revenue arriving in year two. The reason is structural rather than motivational: the minimum qualifications on the good opportunities require public-sector references you do not yet have, and the vehicles that carry volume re-solicit on cycles you cannot accelerate.

Realistic expectations on outcomes. Open competitive RFPs where an incumbent exists have a low win rate for a new entrant, and you should not be discouraged by it. Task orders off a vehicle you hold convert far better because the field is smaller and the buyer has already decided to buy. Sales cycles run three to six months for services and staff augmentation, and twelve to twenty-four months for enterprise systems, with the board or council approval adding weeks at the end even after the decision is made.

Two disciplines separate the firms that make this work from the ones that quit. The first is bid discipline: know what a proposal actually costs you in loaded hours and refuse the ones you cannot win, which how much does it cost to bid on a government contract? covers. The second is learning from losses: request scores, scoring sheets and, where public, the winning proposal, on every single loss. In this market that material is obtainable, and the vendors who systematically collect it price and position better every quarter while their competitors guess.

The hardest operational problem in SLED is not writing proposals. It is finding the right solicitations, across thousands of separate portals and Form 470 postings, early enough to do anything other than react. If you would rather see what is live in your categories and states than build that monitoring yourself, book a call and we will go through your market with you.