What SLFRF Funded in State Technology
ARPA Section 602 (P.L. 117-2) authorized the Coronavirus State Fiscal Recovery Fund (with Section 603 covering local governments); together they established SLFRF and four broad eligible use categories under the 2022 Final Rule. For state technology investments, the most widely used were two: the revenue replacement category (which allowed states to use funds for any government service they would ordinarily fund from own-source revenue) and public health and negative economic impacts (which covered technology directly supporting pandemic response).
The revenue replacement category became the practical entry point for a wide range of state IT investments that would have otherwise competed with other budget priorities. States used it to fund:
- Modernization of unemployment insurance systems strained by pandemic-era claim volumes
- Cybersecurity improvements, including zero trust architecture projects and SOC buildouts
- Cloud migrations for state agency systems
- Identity proofing and fraud detection upgrades for benefits programs
- Remote work infrastructure for the state workforce
- Digital service improvements for resident-facing platforms
- Data integration and interoperability projects
Not all of this work is completed. Some was phased over multiple years. Some encountered delivery delays. And in every case, the federal dollars behind it expire in eight weeks.
The Two-Part Problem
These are separate challenges that require separate answers, but they are often managed as one. Conflating them is a common failure mode.
Problem 1: Federal close-out compliance. Treasury's Compliance and Reporting Guidance requires states to document that every SLFRF expenditure was for an eligible use, to maintain records supporting those expenditures for five years after program closeout, and to submit accurate final Project and Expenditure Reports. Non-compliance, including expenditures made after December 31 or unsupported allocations, creates recoupment exposure. Treasury's Office of Inspector General has been active on SLFRF compliance; states that received large allocations should expect audit activity.
Problem 2: System sustainability. A technology system that was funded to operate through December 31, 2026 does not stop being needed on January 1, 2027. ARPA money filled a funding gap, but it did not change the underlying fiscal picture. Systems built on SLFRF now need a successor funding source, or they wind down. States that have not identified that successor source — through base appropriations, alternative federal grants, or contract restructuring — are weeks away from a gap.
These are related but not the same problem. A system can be fully compliant with Treasury's close-out requirements and still face a funding cliff. Conversely, a state can have a sustainable successor funding plan but an incomplete close-out record. Both problems need attention before December 31.
Federal Close-Out Requirements
Treasury's requirements under the SLFRF Final Rule (31 CFR Part 35) and its Compliance and Reporting Guidance establish what states must demonstrate. For technology programs, the key compliance requirements are:
Eligible use documentation. Each expenditure must trace to an eligible use category. For technology funded through revenue replacement, the connection is often straightforward — state governments ordinarily fund IT through own-source revenue — but the documentation still needs to exist and be accessible. Agency-level records that sat unreviewed for two years can become a problem during audit.
Procurement and contracting compliance. SLFRF expenditures must follow applicable procurement requirements, including the Uniform Guidance at 2 CFR Part 200 for subrecipients. Technology contracts awarded through SLFRF need to have followed required competition and documentation standards. Contracts that were sole-sourced, piggybacked, or expedited during the pandemic-era urgency should be reviewed to confirm adequate documentation exists.
Project and Expenditure Reports. States have submitted quarterly P&E reports throughout the program. The final report, due to Treasury after December 31, must reconcile all expenditures against obligated amounts. Technology programs with multiple contracts, change orders, or inter-agency allocations should begin that reconciliation now rather than in January when the urgency has already passed.
Records retention. Under SLFRF award terms, records must be maintained for five years after final program closeout. (2 CFR Part 200 §200.334 defaults to three years; the extended SLFRF-specific period derives from the program's award terms.) State technology offices should ensure that procurement files, contracts, change orders, invoices, and technical deliverable records are organized and accessible for that period — not archived in a way that becomes unrecoverable during a post-closeout audit.
The practical action here is a close-out audit of the IT portfolio before December 31: a structured review of each SLFRF-funded technology project to confirm that documentation exists, expenditures are supported, and records will survive the retention requirement.
Sustaining the Systems That Must Continue
The harder conversation for most states is sustainability. Budget offices and CIOs need to agree on a three-category assessment for every SLFRF-funded technology system before December 31:
Category 1: Wind down. Projects that were explicitly one-time — infrastructure built for pandemic-era operations, assessment tools no longer needed, legacy system replacements completed with no ongoing operating obligation — can close out cleanly. These are the easy cases. The close-out documentation is all that matters.
Category 2: Absorb into base budget. Operating systems that must continue — a UI modernization platform, a cybersecurity monitoring capability, an eligibility portal — need a budget-year appropriation to carry them forward. If that appropriation is not in the FY 2027 budget already enacted, it needs to be addressed through supplemental appropriations, continuity funding, or emergency authorization. State CIOs should confirm with their budget office and legislative affairs team that each ongoing system has a funded home after January 1.
Category 3: Alternative federal funding. Some systems built with SLFRF may qualify for ongoing federal program funding — CISA's State and Local Cybersecurity Grant Program, ARPA-H or HHS program grants for health IT, or other federal-state cost-sharing programs. Transitioning a SLFRF-funded cybersecurity capability to an SLCGP-funded one, for example, requires a new performance period, matching requirements, and reporting obligations. That transition needs to be in motion now, not started after SLFRF closes.
The risk in misclassifying is significant. A system placed in Category 2 without a confirmed appropriation goes dark. A system placed in Category 3 without a submitted and funded grant application faces the same gap. Category 1 systems that were not actually completed create close-out documentation problems.
What Happens When the Funding Runs Out Mid-System
The systems most at risk are those where SLFRF funded a multi-year implementation that is not complete by December 31. Some states obligated SLFRF dollars into technology contracts with performance periods extending into 2027 — the obligation met the December 31, 2024 deadline, but delivery is not finished.
This creates a specific problem. Work performed and invoiced after December 31, 2026 cannot be paid with SLFRF dollars. A vendor who expects to invoice for work completed in January 2027 against a SLFRF-funded contract will not receive that payment unless the state has an alternative funding source ready. Contracts that extend past December 31 without alternate funding create a payment gap that both parties need to resolve before it becomes a dispute.
States in this situation have a few options:
- Accelerate delivery. Move up final deliverables and acceptance testing so the work is invoiced and paid before December 31.
- Reduce scope. Negotiate a change order that reduces the remaining scope to what can be completed and invoiced by December 31, with a separate contract funded from base appropriations for remaining work.
- Confirm alternative funding is in place. If base appropriations or alternative federal funds will cover January-onward costs, confirm that in writing with the vendor before December 31, so payment expectations are clear.
- Do not assume Treasury will grant an extension. Treasury extended certain SLFRF deadlines earlier in the program for infrastructure projects. There is no current basis to assume extensions will be available for technology projects. Plan against the hard date.
A Decision Sequence for October Through December
Given the timeline, states should prioritize in this order:
- Complete the portfolio inventory this week. Map every technology project funded in whole or part with SLFRF dollars, with the total obligated amount, amount expended to date, and amount expected to be expended before December 31.
- Identify every contract with work or payments scheduled after December 31. Flag these immediately for legal, procurement, and the budget office. Each one needs a resolution: accelerated delivery, scope reduction, or confirmed alternative funding.
- Classify each ongoing system under one of the three categories. Not as an aspirational plan — with a confirmed budget line or a submitted grant application. An unconfirmed plan is not a plan.
- Conduct the close-out documentation review in October. Do not leave it to the last two weeks of December. December 2026 will have holiday scheduling constraints, staff leave, and FY 2027 budget pressure. The documentation review needs to be completed before that compression hits.
- Prepare the final P&E Report data. The final report is due shortly after December 31. Having the data reconciled before year-end reduces the risk of errors in a compressed post-deadline submission.
- Brief agency heads and legislative leadership. State CIOs who are absorbing SLFRF-funded systems into base appropriations need agency heads and budget committee staff to understand what is at stake. Systems that go dark because of a missed close-out are an agency leadership problem, not just a technology problem.
A Note on Audit Risk
SLFRF was the largest direct allocation of federal aid to state and local governments since the Coronavirus Relief Fund in 2020. Treasury's OIG has been conducting oversight throughout the program period, and post-closeout audit activity should be expected — both Treasury OIG and state auditors will review SLFRF expenditures. Technology projects that were funded through the revenue replacement category, which offered the broadest discretion, will receive scrutiny as to whether the connection between the expenditure and an eligible government service was genuine.
States that built strong documentation during the program are well-positioned. States that did not should use the next eight weeks to reconstruct as much of that documentation as possible from contracts, invoices, deliverable records, and budget justifications — not to retroactively justify poor decisions, but to ensure that accurate records exist for legitimate expenditures that would not survive an audit simply because the paper trail was disorganized.
The risk is not primarily one of having made ineligible expenditures. For most state IT investments, the eligible use connection is straightforward. The risk is documentation: audit findings often turn on the absence of contemporaneous records rather than the underlying impropriety of a transaction.
Sources and further reading
- American Rescue Plan Act of 2021, P.L. 117-2, §9901 — adding §602 (State Fiscal Recovery Fund) and §603 (Local Fiscal Recovery Fund) to the Social Security Act
- U.S. Department of the Treasury, SLFRF Final Rule, 31 CFR Part 35, published January 27, 2022
- U.S. Department of the Treasury, SLFRF Compliance and Reporting Guidance, version as of January 2023
- 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance)
- U.S. Department of the Treasury OIG, SLFRF oversight reports and audit findings available at oig.treas.gov
- NASCIO, State CIO Top 10 Priorities (2026 edition), for context on where state IT investment has been directed
Spartan X has supported state governments in designing and delivering programs at scale — including AI strategy and enterprise platform work for state-level clients where program execution and vendor accountability were central to delivery. The fiscal and programmatic complexity of managing a federal grant-funded technology portfolio to a hard close-out deadline is exactly the kind of work where outside advisory capacity pays for itself in reduced audit exposure and continuity risk.
