Cybersecurity RFPs from public institutions hit 317 in October 2026 alone, a number that exceeds the entire prior monthly range of 15 to 72 over the previous 14 months. In the trailing 60-day window, 291 institutions across 35 states issued procurement notices, roughly 5.3 times the prior bimonthly average of 55. The institutions range from rural Mississippi school districts to California transit agencies. The scale is not organic demand. It is a deadline.
Two distinct federal programs are colliding at the same moment on the calendar, and together they are forcing hundreds of local governments, school districts, and county agencies to procure firewalls, endpoint protection, and network monitoring tools before October and November close out their last chance to collect.
The first program is the FCC's Schools and Libraries Cybersecurity Pilot, a three-year, $200 million initiative funded through the Universal Service Fund. Participants, 571 of them, were selected in January 2025 and locked into the program through 2028. As of July 2026, $129.2 million had been committed with roughly $71 million still awaiting disbursement. But the FCC Pilot does not write checks in advance: a participating school or library must complete competitive bidding, publish an RFP, and receive a vendor bid before it can invoice USAC for reimbursement. The RFP is not a planning step. It is the compliance trigger that unlocks the money. K-12 institutions alone account for 101 of the 291 RFPs in the 60-day window, more than any other institution type.
Source: NationGraph.
The second program is structurally different and aimed at a different set of actors. The State and Local Cybersecurity Grant Program, created by the 2021 Bipartisan Infrastructure Law and administered by DHS and FEMA, appropriated $1 billion across four fiscal years for states to pass through to local governments for cybersecurity planning, assessments, and incident response. Its FY2025 final-year allocation is $91.7 million nationally, a 67 percent cut from FY2024's $279.9 million, with a 40 percent local match now required. States are passing those dollars to sub-recipients right now, and the deadlines are fixed: Michigan's closes October 11, Wisconsin's October 30, Colorado's October 30. Congress reauthorized the SLCGP through September 30, 2026 but attached no new appropriation to the extension, what one analyst called "reauthorized, but not funded." For local governments that have built cybersecurity plans around this money, this is not a budget cycle. It is the last one.
The procurement data reflects what that pressure looks like at scale. County governments issued 27 RFPs in the 60-day window, matching higher education. State agencies added 21 more. Public safety agencies, including sheriff's offices and emergency management departments, contributed 12. The geographic spread, spanning South Carolina, West Virginia, New Mexico, and Connecticut simultaneously, along with population giants like California and Texas, confirms the pattern is policy-driven rather than concentrated in a handful of large jurisdictions.
The unspent-grant figures make the urgency concrete. California, the top state by institution count with 49 RFPs, has $412 million in active federal cybersecurity grants obligated but only 12.9 percent of it outlayed. New York has $289 million committed at 4.0 percent outlayed. Georgia has $245 million obligated with just 1.7 percent spent. These are not unfunded ambitions; they are commitments already made by the federal government, sitting inert because the procurement step that triggers reimbursement has not yet happened. The RFP wave is that step, happening now, all at once.
The federal posture has shifted in ways that amplify the urgency. CISA expanded its direct support to state and local governments in February 2026 after its cooperative agreement with the Center for Internet Security expired. Executive Order 14409, signed June 2, 2026, directed CISA to extend access to cybersecurity tools to state and local authorities within 30 days; the agency issued Binding Operational Directive 26-04 on June 10. And NASCIO, the state CIO association, sent a formal letter to congressional appropriators on June 23 explicitly requesting FY2027 SLCGP funding restoration, a signal that the organizations most dependent on the program do not expect it to continue without a legislative fight.
For residents of the 35 states now seeing this procurement activity, the near-term outcome is a wave of new vendor contracts for tools most municipal IT offices have wanted for years: next-generation firewalls, identity protection, network monitoring, and incident response retainers. For smaller jurisdictions, particularly the rural sub-recipients the SLCGP requires states to fund with at least 25 percent of their allocation, this may be the only window to build infrastructure they could not otherwise afford.
The open question is what happens after October. The FCC Pilot runs through 2028 and its 571 participants are already enrolled, so that procurement wave will continue in smaller installments. The SLCGP, absent a new appropriation, will not. The next signal to watch is whether Congress acts on NASCIO's request in the FY2027 budget cycle, or whether the $91.7 million now being spent is the last federal check local governments will receive for this purpose.
