Somewhere in your building sits a server old enough to vote, running software nobody’s supported in years, and a budget that won’t touch replacing it until something breaks first. That’s not a hypothetical. It’s the starting position for most municipal and public agency IT teams heading into 2026.
Government IT services means the managed technology support, cybersecurity, and compliance work that helps cities, counties, school districts, and other public agencies keep essential systems running securely and within budget. For most municipalities, that includes network and infrastructure management, 24/7 threat monitoring, and help meeting frameworks like CJIS, PCI DSS, and state records retention law. Done well, it closes the gap between aging legacy systems and the compliance and security standards public agencies are held to.
Talk to a Government IT Team That Gets It
Most of what shows up when you search that phrase talks past you. Enterprise systems integrators pitch federal agencies with nine figure contracts. Cloud vendors sell platform modernization to teams that already have a data strategy. None of it speaks to the IT director running a department of one, two, or five people, keeping 911 dispatch, the water treatment SCADA system, and the tax portal online on a budget the council can slash after one bad meeting.
This post is for that person. We’ll walk through the four things municipal and public agency IT teams are actually wrestling with right now: legacy systems that won’t die, budgets that don’t match the risk, compliance requirements that multiply instead of consolidate, and a threat landscape that has decided small government is an easy mark.
What Are the Biggest Legacy IT Problems Facing Local Government?
The biggest legacy IT problems in local government are end of life software still running critical services, industrial control systems that can’t be patched without a planned shutdown, and undocumented systems built by staff who’ve since left. Each one raises security risk and slows modernization, and none can be fixed with a single upgrade.
Your permitting software runs on a platform that’s reached end of life (EOL) support, meaning the vendor no longer ships security patches for it, and switching means a procurement process, a data migration project, and retraining every clerk who touches it. Your water treatment plant runs supervisory control and data acquisition (SCADA) systems tied to operator interfaces that can’t be patched without a scheduled shutdown, so patches queue up for months. Your finance department still runs a general ledger system that one retired employee understood completely, and everyone since has been reverse engineering it.
The pattern shows up early in almost every public sector network assessment: the surprises are rarely a sophisticated zero-day. They're the shadow systems nobody remembers building. In a NinjaOne survey of state and local government IT teams, 52 percent of public sector employees admitted to bypassing security policy, 52 percent used unapproved devices, and 49 percent relied on unauthorized software, often just to route around a legacy tool that was too slow or too limited to do the job. That's not a staffing failure. It's what happens when the sanctioned system can't keep up with the actual work.
None of this is negligence. It’s what happens when agencies buy systems once, fund them reluctantly, and never budget for real replacement. The private sector treats aging infrastructure as a cost of doing business and refreshes it on a cycle. Government treats it as a capital project that competes with roads, schools, and payroll for the same shrinking pool of money.
The Budget vs. Risk Bind Every Public Agency Knows
Here’s the tension nobody names directly: the cost of doing nothing keeps rising faster than the budget to do something about it. A ransomware attack that knocks out billing, dispatch, or records isn’t a hypothetical line item. It’s real, it’s documented, and it lands on agencies your size often enough that “it won’t happen here” isn’t a plan.
Meanwhile, replacing the legacy system that made the attack possible in the first place usually needs a bond measure, a budget cycle, or a council vote nobody wants to be the one to request. That’s the actual bind: the fix that would lower your risk costs money you don’t have on hand right now, and the risk you’re carrying costs money you don’t have a line item for either.
What Compliance Frameworks Apply to Municipal and Public Agency IT?
Public agencies typically answer to several overlapping frameworks at once, not one. The most common are the CJIS Security Policy for anything touching criminal justice data, PCI DSS for online payments, state records retention law, and E-Rate or student data privacy rules for school districts. StateRAMP applies if you’re evaluating cloud vendors for state level systems.
CJIS, for example, isn’t just a police department problem. If your city shares network infrastructure with dispatch, courts, or any system that touches criminal justice information, CJIS Security Policy requirements likely apply to you too. The policy gets specific fast: it requires FIPS 140-2 validated encryption modules for criminal justice information (CJI) in transit, and FIPS 197 (AES) encryption for CJI stored outside physically secure locations, on top of access logging and background checks for anyone with system access.
The policy’s baseline security standards are derived directly from NIST Special Publication 800-53 controls, the same control catalog federal information systems use. The current version, CJIS v6.0, released in December 2024, expanded the policy to twenty policy areas covering more than 1,300 subcontrols, and added a multi-factor authentication mandate in October 2024 that caught agencies off guard who hadn’t budgeted for the rollout.
Even with outside help, expect to own most of that work yourself. According to VC3’s CJIS compliance guide for municipal leaders, a skilled managed IT partner can typically close about 20 to 30 percent of the gap toward CJIS compliance, which leaves the majority, documentation, personnel training, ongoing policy enforcement, sitting with your team.
Then there’s state records retention law, which varies by state and dictates how long you have to keep everything from council meeting minutes to email, and PCI DSS if your agency takes utility payments or permit fees online. School districts add E-Rate and student data privacy requirements on top of everything else. Nobody designed these frameworks with each other in mind, so the real compliance work is reconciling them, not satisfying one at a time.
| Framework | Who It Applies To | Key Requirement | Audit Cycle |
|---|---|---|---|
| CJIS Security Policy | Police, dispatch/911, courts, and any shared network touching criminal justice information | FIPS 140-2/197 encryption, access logging, background checks, MFA on all CJI systems | Triennial audit by the FBI CJIS Audit Unit or your state's CJIS Systems Agency |
| PCI DSS | Any agency accepting card payments (utility bills, permits, court fines) | Cardholder data encryption, network segmentation, regular vulnerability scanning | Annual self-assessment (SAQ) or QSA audit, depending on transaction volume |
| State Records Retention Law | All agencies handling public records, official email, and meeting minutes | Defined retention schedules by record type; specifics vary by state | Reviewed on an ongoing basis, often surfaced during public records requests or state audits |
| E-Rate & Student Data Privacy (FERPA) | School districts and public libraries | CIPA content filtering, FERPA student data protections, E-Rate program compliance | Annual E-Rate certification; FERPA reviewed via complaint or state audit |
Not Sure Where Your Risk Actually Sits?
Why Are Municipalities a Top Target for Ransomware Attacks?
Municipalities are targeted because they hold sensitive resident and law enforcement data, run services that can’t stay offline, and typically carry weaker security budgets than private sector peers of similar size. That combination makes them a predictable, repeatable target rather than a random one, and the data on attack frequency backs that up.
According to the Information Technology and Innovation Foundation (ITIF), ransomware hit federal, state, and local government entities 525 times between 2018 and 2024, causing an estimated $1.09 billion in downtime. That’s not a trend leveling off. According to Comparitech’s tracking, governments worldwide were hit by ransomware at a rate of roughly one attack per day in the first half of 2026 alone, with close to a third of those attacks landing in the United States. And according to Verizon’s 2025 Data Breach Investigations Report, ransomware was present in 30 percent of public sector breaches.
These aren’t abstract national security threats aimed at agencies with three letter names. In July 2025, St. Paul, Minnesota declared a state of emergency after a ransomware attack shut down billing, emergency coordination, and citizen services for more than two weeks. That’s a city, not a nation state target, and that’s exactly the point.
Agencies dealing with an active incident, or trying to get ahead of one, aren’t on their own. CISA’s resources for state, local, tribal, and territorial (SLTT) governments include no-cost tools and incident guidance, a direct-support model CISA moved to after its longstanding funding agreement with the Center for Internet Security’s MS-ISAC ended in September 2025. Worth bookmarking even if you already work with a managed provider.
If your agency’s cybersecurity posture is “we have a firewall and antivirus,” you’re not behind because you did something wrong. You’re behind because the threat model changed faster than most public sector budgets can respond to it, and that gap is exactly what attackers are counting on you not closing before the next attempt.
What to Look for in a Government IT Services Partner
Not every managed services provider is built for this. Here’s what actually matters when you’re evaluating one:
- Experience with public sector procurement and budget cycles. A partner who understands how a fiscal year budget request works, and can help you build the business case for it, is worth more than one who just quotes you a monthly rate.
- Direct familiarity with the compliance frameworks you’re under. CJIS, records retention, PCI, whatever combination applies to your agency. Ask them to name the specific controls they help you meet, such as FIPS validated encryption or NIST 800-53 mapped controls, not just the word “compliant.”
- A security posture built for a target rich environment. You need a 24/7 security operations center (SOC) running endpoint detection and response (EDR) and SIEM based log correlation, ideally built around Zero Trust principles and mapped to the NIST Cybersecurity Framework (CSF), not a vendor who checks in quarterly.
- A plan for legacy systems that doesn’t require ripping everything out at once. Realistic modernization roadmaps beat all-or-nothing pitches, especially when your next capital budget conversation is a year away.
- Straight talk about what a managed partner covers and what still needs your involvement. Anyone promising to make CJIS or state compliance entirely their problem, with zero lift from your staff, isn’t being straight with you.
What to Do Next
None of this is meant to be alarming for its own sake. Public agencies have always run on tighter margins than the private sector, and that’s not going to change. What has changed is the gap: legacy IT and a stretched budget on one side, a threat landscape and compliance load that keep raising the bar on the other. Closing that gap doesn’t take a miracle. It takes a plan built for the constraints you actually have, not the ones a vendor wishes you had.
From here, network and infrastructure modernization for public agencies walks through what that plan looks like inside a real procurement timeline, and building a cybersecurity program your team can actually staff covers the part budget alone won’t fix. If you’d rather have the compliance, budget, and cybersecurity essentials in one place, the Government IT Readiness Checklist pulls all three together.
