State and Local IT in 2027: Modernization Priorities Amid Fiscal Uncertainty

State and local governments are entering 2027 with a sharper version of a familiar problem: the need to modernize technology is urgent, but the budget environment is uncertain. Agencies are being asked to do more with systems that were designed for a different era of public service, while revenue forecasts stay cautious and federal support keeps shifting.

This is not a "modernize everything" moment. It is a prioritization moment. This guide lays out where state and local IT leaders should focus in 2027: the fiscal picture shaping every decision, the layered approach that replaces risky big-bang projects, and five priorities that earn their budget when budgets are tight.

The 2027 Fiscal Picture

The numbers explain the mood. According to the National Association of State Budget Officers’ spring 2026 fiscal survey, governors’ proposed budgets projected median general fund spending growth of just 0.6 percent for fiscal 2027, against median revenue growth of 2.5 percent. Thirteen states reported projected budget gaps totaling $26.3 billion before balancing actions. Nearly half the states are already implementing some form of spending restraint: eliminating vacant positions, freezing hiring, and trimming agency budgets.

As NASBO Executive Director Shelby Kerns put it, states are "continuing to navigate a tighter fiscal environment than they experienced earlier this decade." The pressure reaches local governments too: Maryland’s $70.8 billion fiscal 2027 budget closes a $1.5 billion shortfall largely through fund transfers and cost shifts to counties, while Prince George’s County, Maryland, faces a projected $151 million deficit driven by school spending mandates, compensation costs, and the ripple effects of federal workforce cuts.

Federal support is shifting at the same time. The State and Local Cybersecurity Grant Program expired in September 2025 after its four-year run and has not been reauthorized, despite NASCIO naming its restoration a top congressional priority. The House advanced the bipartisan PILLAR Act to fund the program through 2033, but it did not move out of the Senate. Separately, partial defunding hit the Center for Internet Security’s Multi-State Information Sharing and Analysis Center, which had provided free cybersecurity monitoring to some 18,000 state, local, tribal, and territorial organizations.

The business consequence for IT leaders: 2027 roadmaps must assume flat or shrinking discretionary funding, do more with existing staff, and treat every modernization dollar as a choice against something else. Procurement strategy matters more than ever when each purchase competes directly with another priority.

The Real Path: Modernize in Layers, Not All at Once

The public sector’s operating environment has changed faster than many systems were designed to handle, but the answer is not a wholesale replacement program that no 2027 budget can support. The pattern that works under fiscal pressure is incremental: modernize in layers, protect mission continuity, build better integration points, improve knowledge management, and introduce automation only where governance and accountability are clear.

This is a risk management exercise, not just a technology upgrade. Many agencies still depend on monolithic or heavily customized systems that encode years of policy, process, and reporting logic. The cost of breaking a benefits system, a permitting portal, a tax process, or a public safety tool is far higher than the cost of moving slowly. Agencies need strategies that reduce risk while still making measurable progress each year.

In practice, layered modernization means:

• Wrapping legacy systems with modern APIs and integration points instead of replacing them outright, so new digital services can launch without touching the system of record.
• Replacing one high-friction module at a time, starting where resident impact or maintenance cost is highest.
• Moving commodity workloads (email, collaboration, backup) to managed services to free scarce staff for mission systems.
• Documenting the policy and process knowledge locked inside legacy systems before the people who hold it retire.

Each layer should pay for the next one: savings and credibility from early wins fund the harder replacements later.

Priority 1: Cybersecurity Without the Federal Backstop

Cybersecurity has topped NASCIO’s state CIO priority list for years, and 2027 makes it harder, not easier. With the federal cybersecurity grant program expired and shared monitoring resources partially defunded, state and local agencies must cover more of their own defense with the same or fewer people.

The practical priorities for a constrained 2027:

• Identity and access management first: compromised credentials remain the most common entry point, and IAM improvements protect every system at once.
• Patch and asset discipline: you cannot defend what you cannot see. A current inventory of systems and a ruthless patching cadence beat new tools.
• Incident response readiness: tabletop exercises with county and municipal partners cost little and matter most when something breaks.
• Shared services where they exist: states already provide security services and infrastructure to local governments; 2027 is the year to use them fully before building alone.

Where federal funding does return, through a reauthorized grant program or otherwise, agencies with a current risk assessment and a prioritized project list will be first in line. Preparation is the strategy.

Priority 2: Contain, Integrate, and Selectively Replace Legacy Systems

Legacy modernization has sat near the top of NASCIO’s priority list for years, and the fiscal environment finally forces the honest version of it: not every legacy system needs replacing, and 2027 cannot fund the ones that do not earn it.

A defensible triage for 2027:

• Contain: stabilize systems that work but are fragile. Improve monitoring, documentation, and backups; stop customizing them further.
• Integrate: connect systems that hold resident or case data to modern front ends through APIs, so digital services improve without a core replacement. Composable architecture is the enterprise name for the same idea.
• Replace selectively: fund full replacement only where maintenance cost, security risk, or resident impact clearly outweighs the project cost and risk.

The question to ask about each system is not "how old is it" but "what does it cost us to keep it, in money, risk, and resident experience, versus what a replacement costs." Age alone is a poor prioritization criterion.

Priority 3: Data Readiness Before AI Scale

State CIOs are moving AI from pilots into operational use, but the 2026 NASCIO survey carries a warning: data management has been a top-10 priority every year since 2016, yet only 4 percent of respondents described their data governance as "very mature." AI built on immature data produces immature results, at scale.

For 2027, the highest-return data investments are unglamorous:

• Master person and address records: duplicate, conflicting resident records undermine every digital service and every AI pilot.
• Data inventories and ownership: assign a named owner to each critical dataset, with defined quality standards.
• Analytics on existing data first: fraud detection, backlog triage, and demand forecasting use data you already hold.

AI expansion should follow data readiness, not lead it. Automate only where governance and accountability are clear, and treat each pilot as a data-quality test before committing to scale. For the state of AI agents in government specifically, see why 82% of agencies are adopting AI agents but readiness still lags.

Priority 4: Extending Constrained Teams

Workforce constraints are widening just as hiring freezes spread: nearly half the states are eliminating vacant positions or freezing hiring. State and local IT cannot hire its way out of the 2027 workload, so the priority is extending the team you have.

What that looks like in practice:

• Automation of toil: patching, provisioning, password resets, and report generation consume senior staff hours that 2027 budgets will not replace.
• Managed services for commodity IT: every hour your team spends on email servers is an hour not spent on mission systems.
• Knowledge capture: document the undocumented before retirements accelerate. The retirement wave is a data-loss event as much as a staffing event.
• Upskilling in place: short, role-specific training on cloud operations, security basics, and data tools pays back faster than new headcount you cannot hire.

Priority 5: Digital Services That Earn Their Keep

Digital government has held the second spot on NASCIO’s priority list since 2020, second only to cybersecurity. Residents now judge government services against consumer-grade digital experiences, and the gap is a trust issue, not just a convenience issue.

Under fiscal pressure, the discipline is sequencing: digitize the highest-volume, highest-friction services first (permits, licensing, benefits applications, tax payments), where each release measurably reduces call-center load, in-person visits, or processing backlogs. A service that does not reduce operational cost or measurably improve resident experience should wait for a better budget year.

Accessibility deadlines add a compliance driver to the same work: remediating high-traffic services for accessibility satisfies both resident experience and legal obligation in one project. Connected government shows what the target state looks like when services work as one.

How to Sequence the 2027 Roadmap

With five priorities and funding for perhaps two or three, sequencing is the actual job. A practical scoring frame for 2027:

1. Mission risk: what breaks, and for whom, if this system fails or is breached in 2027?
2. Cost of inaction: what does another year of maintenance, workarounds, and resident friction cost?
3. Funding leverage: does this project unlock federal matching funds, shared-service savings, or operational savings that fund the next project?
4. Reversibility: if the project underdelivers, can the agency recover without mission damage?
5. Workforce load: does this reduce toil for existing staff, or add to it?

Score each candidate initiative on these five, fund from the top down, and publish the ranking. A transparent, criteria-driven roadmap is also the best defense when legislators or councils ask why their preferred project waits.

What to Stop Doing in 2027

Prioritization also means honest cuts. Candidates:

• Chasing every new platform: if it does not map to one of the five priorities above, it waits.
• Customizing commodity software: configure, do not customize. Every customization is a future maintenance bill.
• Big-bang replacements without a layered fallback: if the project cannot survive a funding cut midstream, it is the wrong shape for 2027.
• AI pilots without a data owner: a pilot with no accountable data owner is an expensive demo, not a program.
• Duplicate analytics dashboards: consolidate on one platform before building the next report.

Frequently Asked Questions

How should state and local agencies prioritize IT modernization with tight 2027 budgets?

Score candidate initiatives on mission risk, cost of inaction, funding leverage, reversibility, and workforce load, then fund from the top down. Publish the ranking so tradeoffs are transparent. Priorities that typically score highest are cybersecurity basics, selective legacy replacement, and high-volume digital services.

What is the biggest risk of delaying legacy modernization?

Not age but fragility: unpatched, undocumented systems that support benefits, permitting, tax, or public safety processes. The cost of breaking one of these systems far exceeds the cost of moving slowly, which is why layered, incremental modernization beats big-bang replacement under fiscal pressure.

How does the expired federal cybersecurity grant program affect 2027 planning?

The State and Local Cybersecurity Grant Program expired in September 2025 and has not been reauthorized, so agencies should plan 2027 assuming no federal grant funding while keeping a prioritized project list ready in case reauthorization passes. Shared state security services are the nearest substitute for smaller local governments.

Should agencies expand AI in 2027?

Expand AI only where data readiness and governance are in place. Only 4 percent of state CIOs in the 2026 NASCIO survey described their data governance as very mature, so the highest-return move for most agencies is investing in data quality, ownership, and analytics before scaling AI pilots.

Where can smaller local governments get help they cannot staff themselves?

State IT organizations already provide services to local governments, most commonly GIS, network services, co-location, security services and infrastructure, and data center hosting. Using these shared services is typically the most cost-effective option for smaller jurisdictions in a tight budget year.

Sources

• National Association of State Budget Officers, Spring 2026 Fiscal Survey of States (via Governing): median general fund spending growth 0.6 percent for fiscal 2027; 13 states projected gaps totaling $26.3 billion.
• StateScoop: "Restoring State and Local Cybersecurity Grant Program tops NASCIO’s congressional priorities": SLCGP expired September 2025; PILLAR Act reauthorization status; MS-ISAC partial defunding.
• NASCIO, "The 2026 State CIO Survey: The State CIO in Motion": AI pilots to operational use; data governance maturity (4 percent "very mature"); half of respondents’ FY2026 budgets increased, 48 percent of the increase for modernization.
• GovTech: NASCIO survey coverage: state IT services to local governments; accessibility deadlines.
• StateScoop: NASCIO digital government report: digital government second on Top 10 priorities since 2020.
• GovTech: "Annual NASCIO Survey Highlights Dramatic Shifts in IT Priorities": recent Top 10 ranking (digital government/cybersecurity tied first; AI third; legacy modernization fourth).
• Conduit Street / Maryland DLS: fiscal 2027 budget briefing: $70.8 billion budget, $1.5 billion shortfall closed via transfers and cost shifts.
• The Banner: Prince George’s County projected $151 million deficit.