What SLFRF Funded in State Technology
ARPA Section 602 (P.L. 117-2) authorized the Coronavirus State Fiscal Recovery Fund (with Section 603 covering local governments); together they established SLFRF and four broad eligible use categories under the 2022 Final Rule. For state technology investments, the most widely used were two: the revenue replacement category (which allowed states to use funds for any government service they would ordinarily fund from own-source revenue) and public health and negative economic impacts (which covered technology directly supporting pandemic response).
The revenue replacement category became the practical entry point for a wide range of state IT investments that would have otherwise competed with other budget priorities. Eligible state technology investments under that flexibility could include:
- Modernization of unemployment insurance systems strained by pandemic-era claim volumes
- Cybersecurity improvements, including zero trust architecture projects and SOC buildouts
- Cloud migrations for state agency systems
- Identity proofing and fraud detection upgrades for benefits programs
- Remote work infrastructure for the state workforce
- Digital service improvements for resident-facing platforms
- Data integration and interoperability projects
Not all of this work is completed. Some was phased over multiple years. Some encountered delivery delays. And in every case, the federal dollars behind it expire on December 31.
The Two-Part Problem
These are separate challenges that require separate answers, but they are often managed as one. Conflating them is a common failure mode.
Problem 1: Federal close-out compliance. Treasury's Compliance and Reporting Guidance requires states to document that every SLFRF expenditure was for an eligible use, to maintain records supporting those expenditures for five years after all funds have been expended or returned to Treasury (Compliance and Reporting Guidance, Version 10.1), and to submit accurate final Project and Expenditure Reports. Non-compliance, including program expenditures made after December 31 (Treasury allows only administrative closeout costs until April 30, 2027, per FAQ 17.5 and 17.26) or unsupported allocations, creates recoupment exposure. Treasury's Office of Inspector General has been active on SLFRF compliance; states that received large allocations should expect audit activity.
Problem 2: System sustainability. A technology system that was funded to operate through December 31, 2026 does not stop being needed on January 1, 2027. ARPA money filled a funding gap, but it did not change the underlying fiscal picture. Systems built on SLFRF now need a successor funding source, or they wind down. States that have not identified that successor source — through base appropriations, alternative federal grants, or contract restructuring — are weeks away from a gap.
These are related but not the same problem. A system can be fully compliant with Treasury's close-out requirements and still face a funding cliff. Conversely, a state can have a sustainable successor funding plan but an incomplete close-out record. Both problems need attention before December 31.
Federal Close-Out Requirements
Treasury's requirements under the SLFRF Final Rule (31 CFR Part 35) and its Compliance and Reporting Guidance establish what states must demonstrate. For technology programs, the key compliance requirements are:
Eligible use documentation. Each expenditure must trace to an eligible use category. For technology funded through revenue replacement, the connection is often straightforward — state governments ordinarily fund IT through own-source revenue — but the documentation still needs to exist and be accessible. Agency-level records that sat unreviewed for two years can become a problem during audit.
Procurement and contracting compliance. Procurement requirements depend on the eligible use category. In general, Treasury requires states to follow their own procurement policies and to meet the standards at 2 CFR 200.321 through 200.323 and 200.327 (FAQ 13.2). For funds used under revenue replacement, Treasury applies only a subset of Uniform Guidance Subparts D and E, and that subset does not include the procurement standards; recipients are directed to expend and account for those funds under their own laws and procedures, along with the financial-management (200.302), internal-control (200.303) and record-retention (200.334) provisions that still apply (FAQ 13.15). Either way, technology contracts awarded with SLFRF need to have followed the applicable competition and documentation standards. Contracts that were sole-sourced, piggybacked, or expedited during the pandemic-era urgency should be reviewed to confirm adequate documentation exists.
Project and Expenditure Reports. States have submitted quarterly P&E reports throughout the program. The final report, due to Treasury on April 30, 2027 (Compliance and Reporting Guidance), must reconcile all expenditures against obligated amounts. Technology programs with multiple contracts, change orders, or inter-agency allocations should begin that reconciliation now rather than in January when the urgency has already passed.
Records retention. Under SLFRF award terms, records must be maintained for five years after all funds have been expended or returned to Treasury, as the Compliance and Reporting Guidance describes the award terms. (2 CFR Part 200 §200.334 defaults to three years; the extended SLFRF-specific period derives from the program's award terms.) State technology offices should ensure that procurement files, contracts, change orders, invoices, and technical deliverable records are organized and accessible for that period — not archived in a way that becomes unrecoverable during a post-closeout audit.
The practical action here is a close-out audit of the IT portfolio before December 31: a structured review of each SLFRF-funded technology project to confirm that documentation exists, expenditures are supported, and records will survive the retention requirement.
Sustaining the Systems That Must Continue
The harder conversation for most states is sustainability. Budget offices and CIOs need to agree on a three-category assessment for every SLFRF-funded technology system before December 31:
Category 1: Wind down. Projects that were explicitly one-time — infrastructure built for pandemic-era operations, assessment tools no longer needed, legacy system replacements completed with no ongoing operating obligation — can close out cleanly. These are the easy cases. The close-out documentation is all that matters.
Category 2: Absorb into base budget. Operating systems that must continue — a UI modernization platform, a cybersecurity monitoring capability, an eligibility portal — need a budget-year appropriation to carry them forward. If that appropriation is not in the FY 2027 budget already enacted, it needs to be addressed through supplemental appropriations, continuity funding, or emergency authorization. State CIOs should confirm with their budget office and legislative affairs team that each ongoing system has a funded home after January 1.
Category 3: Alternative federal funding. Some systems built with SLFRF may qualify for ongoing federal program funding, such as HHS program grants that support health IT or other federal-state cost-sharing programs. CISA's State and Local Cybersecurity Grant Program should not be treated as a dependable successor: CISA describes the program as a $1 billion appropriation distributed over four years, and the most recent funding round it lists is fiscal year 2025, at $91.7 million nationally. Confirm current authorization and any new notice of funding before relying on it, and treat new SLCGP money as contingent on congressional action. Where a federal transition is possible, it brings a new performance period, matching requirements, and reporting obligations, so it needs to be in motion now, not started after SLFRF closes.
The risk in misclassifying is significant. A system placed in Category 2 without a confirmed appropriation goes dark. A system placed in Category 3 without a submitted and funded grant application faces the same gap. Category 1 systems that were not actually completed create close-out documentation problems.
What Happens When the Funding Runs Out Mid-System
The systems most at risk are those where SLFRF funded a multi-year implementation that is not complete by December 31. Some states obligated SLFRF dollars into technology contracts with performance periods extending into 2027 — the obligation met the December 31, 2024 deadline, but delivery is not finished.
This creates a specific problem. Work performed and invoiced after December 31, 2026 cannot be paid with SLFRF dollars. A vendor who expects to invoice for work completed in January 2027 against a SLFRF-funded contract will not receive that payment unless the state has an alternative funding source ready. Contracts that extend past December 31 without alternate funding create a payment gap that both parties need to resolve before it becomes a dispute.
States in this situation have a few options:
- Accelerate delivery. Move up final deliverables and acceptance testing so the work is invoiced and paid before December 31.
- Reduce scope. Negotiate a change order that reduces the remaining scope to what can be completed and invoiced by December 31, with a separate contract funded from base appropriations for remaining work.
- Confirm alternative funding is in place. If base appropriations or alternative federal funds will cover January-onward costs, confirm that in writing with the vendor before December 31, so payment expectations are clear.
- Do not assume Treasury will grant an extension. Treasury's published flexibilities have centered on a broader definition of obligation (FAQ 13.17), not on moving the December 31, 2026 expenditure deadline, and Treasury's guidance states that recipients may not use SLFRF funds for costs after the deadline and should be prepared to use other financing (Compliance and Reporting Guidance). There is no basis to assume an extension for technology projects. Plan against the hard date.
A Decision Sequence for October Through December
Given the timeline, states should prioritize in this order:
- Complete the portfolio inventory this week. Map every technology project funded in whole or part with SLFRF dollars, with the total obligated amount, amount expended to date, and amount expected to be expended before December 31.
- Identify every contract with work or payments scheduled after December 31. Flag these immediately for legal, procurement, and the budget office. Each one needs a resolution: accelerated delivery, scope reduction, or confirmed alternative funding.
- Classify each ongoing system under one of the three categories. Not as an aspirational plan — with a confirmed budget line or a submitted grant application. An unconfirmed plan is not a plan.
- Conduct the close-out documentation review in October. Do not leave it to the last two weeks of December. December 2026 will have holiday scheduling constraints, staff leave, and FY 2027 budget pressure. The documentation review needs to be completed before that compression hits.
- Prepare the final P&E Report data. The final report is due April 30, 2027 (Compliance and Reporting Guidance). Reconciling before year-end, while contract staff and records are still at hand, reduces the risk of errors in that final submission.
- Brief agency heads and legislative leadership. State CIOs who are absorbing SLFRF-funded systems into base appropriations need agency heads and budget committee staff to understand what is at stake. Systems that go dark because of a missed close-out are an agency leadership problem, not just a technology problem.
A Note on Audit Risk
SLFRF was a $350 billion program (Final Rule). Treasury's OIG has been conducting oversight throughout the program period, and post-closeout audit activity should be expected — both Treasury OIG and state auditors will review SLFRF expenditures. Technology projects that were funded through the revenue replacement category, which offered the broadest discretion, will receive scrutiny as to whether the connection between the expenditure and an eligible government service was genuine.
States that built strong documentation during the program are well-positioned. States that did not should use the weeks before December 31 to reconstruct as much of that documentation as possible from contracts, invoices, deliverable records, and budget justifications — not to retroactively justify poor decisions, but to ensure that accurate records exist for legitimate expenditures that would not survive an audit simply because the paper trail was disorganized.
The risk is not primarily one of having made ineligible expenditures. For most state IT investments, the eligible use connection is straightforward. The risk is documentation: audit findings often turn on the absence of contemporaneous records rather than the underlying impropriety of a transaction.
Sources and further reading
- American Rescue Plan Act of 2021, P.L. 117-2, §9901 — adding §602 (State Fiscal Recovery Fund) and §603 (Local Fiscal Recovery Fund) to the Social Security Act
- U.S. Department of the Treasury, SLFRF Final Rule, 31 CFR Part 35, published January 27, 2022
- U.S. Department of the Treasury, SLFRF Compliance and Reporting Guidance, Version 10.1, September 23, 2025
- U.S. Department of the Treasury, SLFRF Frequently Asked Questions, as of August 7, 2026 (FAQ 13.2, 13.15, 13.17, 17.5, 17.26)
- 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance)
- U.S. Department of the Treasury OIG, SLFRF oversight reports and audit findings available at oig.treasury.gov
- NASCIO, State CIO Top 10 Priorities (2026), for context on where state IT investment has been directed
Spartan X has supported state governments in designing and delivering programs at scale — including AI strategy and the design and delivery of major state platforms. That experience designing and delivering major state platforms, and building phased roadmaps aligned with mission priorities and budget realities, applies directly to deciding which SLFRF-built systems to sustain, transition, or retire.
