How state data and analytics contracts actually get awarded

Fifty markets wearing one name

A firm that knows federal contracting usually assumes the mechanics carry over to state work. They do not carry over. There is no single registration, no single search, no shared numbering scheme, and no common definition of what counts as a competitive procurement. Each state runs its own procurement code with its own dollar thresholds, and underneath each state sit counties, cities, school districts, transit authorities, public universities, and independent boards that buy on their own authority. For a small data and analytics firm, that fragmentation is the main barrier and also the main opening: nobody can cover all of it, so coverage is a choice rather than a race.

What follows is drawn from public procurement codes, published portal documentation, state procurement manuals, and posted solicitations. Everything here is checkable by anyone willing to read the same documents.

The buying is steady and unglamorous. Medicaid claims analysis. Unemployment insurance fraud detection. Department of Transportation asset and crash data. Tax compliance modeling. Child welfare case data. Public health surveillance. School performance reporting. Utility and water billing reconciliation. Very little of it is labeled "AI." Most of it is labeled data processing, professional services, or software maintenance, which is exactly why vendors who search for "AI" and "machine learning" on state portals find almost nothing and conclude the market is empty.

The portal is a notification engine, not a marketplace

Almost every state and large locality runs an eProcurement system that does three things: registers vendors, publishes solicitations, and emails registered vendors when a new solicitation matches the commodity codes on their profile. The publishing is public. The matching is not automatic in any intelligent sense. A buyer creating the solicitation picks one or more codes from a list, and the system mails everyone registered against those codes.

That single mechanic decides whether a firm ever sees the work. The procurement officer writing a requisition for a claims data warehouse is not an analytics specialist. Depending on how the requesting program office phrased it, the same project can be coded as data processing services, as IT consulting, as professional services, or as software licensing with implementation. A vendor registered against only the narrow, technically precise codes will miss most of what it could bid.

NIGP class 920, class 918, and the two codes that carry the traffic

Most states and a large share of local governments classify purchases with the NIGP Code, a taxonomy maintained by the Institute for Public Procurement. The structure is a three-digit class plus a two-digit item, written as 920-39. Extended versions add group and detail digits for agencies that want finer granularity.

Two classes hold nearly all analytics work. Class 920 is Data Processing, Computer, Programming and Software Services. Class 918 is Consulting Services. Inside 920, the specific items are readable: 920-05 covers application, infrastructure, hosting and cloud computing services, both vendor-hosted and internally hosted, and 920-45 covers software maintenance and support.

The two codes that matter most for alerts are the catch-alls. 920-39, Processing System Services, Data (Not Otherwise Classified), is the only item in class 920 with the not-otherwise-classified qualifier. 918-71, IT Consulting (Not Otherwise Classified), plays the same role for consulting, with 918-32, Consulting Services (Not Otherwise Classified), sitting above it as the broadest residual code in the class. Buyers reach for a residual code whenever the requirement does not map cleanly onto a named item, and custom analytics work almost never maps cleanly. A model that scores claims for anomaly risk is not software maintenance, not cloud hosting, and not charting services. It ends up in the catch-all.

Where a state allows registration at the class level, take it. Iowa's Department of Administrative Services documents the behavior plainly: register for the three-digit class and you receive notification when any five-digit code inside that class is used on a bid document. Registering only for a handful of precise items is how a firm ends up believing a state buys nothing.

NIGP is common but not universal. California's Cal eProcure uses UNSPSC instead. Federal registration in SAM.gov runs on NAICS and Product Service Codes. A firm working all three markets maintains three separate code sets and should treat each one as a distinct piece of infrastructure, reviewed once a year against what it actually wants to be told about.

Registration, and what it costs

Most state vendor registrations are free. Iowa states directly that there is no charge to get on the bidders list. A few states monetize the transaction instead of the registration. Florida assesses a one percent transaction fee on payments to registered vendors through MyFloridaMarketPlace under Rule 60A-1.031, Florida Administrative Code, authorized by section 287.057, Florida Statutes. That fee comes out of the payment, so it belongs in the price before the bid goes in, not in a surprise reconciliation afterward.

Many agencies host their solicitations on commercial platforms rather than a state-built system. Bonfire, OpenGov, Ionwave, Periscope, JAGGAER, BidNet Direct and DemandStar all appear across state and local buyers. Reading and responding to a specific agency's posting on these platforms is generally free to the vendor; broad multi-agency or statewide notification is where the subscription pricing sits. Before paying for an aggregator, list the twenty agencies you would actually serve and check how many of them post somewhere free.

Registration paperwork is light compared with federal onboarding, with one recurring expense. Several states require an out-of-state vendor to be qualified to do business through the Secretary of State before a contract is executed, which means a foreign qualification filing and a registered agent in each state. That is a real annual cost per state and a good reason to choose target states deliberately.

The agencies that never touch the central portal

Central procurement offices usually have authority over executive-branch agencies for defined categories, with named exemptions. Transportation departments, public universities, health and human services agencies, the judiciary, retirement systems, lotteries, and independent authorities frequently hold separate procurement authority and post on their own sites. Public universities are the clearest example, and they buy a large volume of data engineering, reporting, and research computing work that never appears in the state's main feed.

Two consequences follow. First, a state is not one subscription. Building a target list means enumerating the buying entities inside the state, then checking each one for a separate portal or a separate bid page. Second, transportation departments often route analytical work through a consultant prequalification track modeled on qualifications-based selection, the same approach the federal Brooks Act (40 U.S.C. 1101 through 1104) requires for architecture and engineering. Many states have their own version. Data work bundled into an asset management or safety analysis contract can land under that track, where price is not part of the initial selection at all.

What the evaluation actually looks like

State solicitations come in a small number of shapes, and each shape decides in advance whether a firm without contract history has a chance.

Solicitation type	How award is decided	Position for a firm with no state history
IFB / sealed bid	Lowest responsive, responsible bidder. Price only.	Open, but the work is commoditized and margins are thin.
RFP	Points across technical approach, staff qualifications, corporate experience, and cost.	Corporate experience is often 15 to 30 percent of the points. That is where a new firm loses.
Informal quote	Three quotes below the state's small-purchase threshold, minimal paperwork.	The realistic first door. Requires a named buyer who already knows you.
RFSQ / RFQC	Qualifications scored or graded pass/fail. Price is excluded.	Best available entry. Judged on capability, not on award history.
Cooperative award	Already competed by a lead state; other entities buy off it.	Closed unless you hold the contract or subcontract to a holder.
Sole source	Written justification, usually published for challenge.	Effectively unavailable to a newcomer.

Scoring is normally published in the RFP itself with exact point allocations, and it should drive how writing effort is allocated. If technical approach carries 40 points and corporate experience carries 20, a proposal that spends half its pages on company background is optimizing the wrong section. Many states also require cost to be submitted separately and opened only after technical scoring, and several run an oral presentation or product demonstration as a scored round. Protest windows are short, often a handful of business days from notice of intent to award, and the procedure lives in the state's procurement code rather than in any federal forum.

The requirement that ends most new-entrant proposals is the reference requirement. Three similar projects in the last five years, of comparable size, with contactable client references, stated as a mandatory pass or fail item. No amount of technical quality gets past a pass-fail gate. Reading for that requirement first, before writing anything, saves weeks.

Prequalification pools: the door that does not ask for a win

Prequalification is the structural answer to the reference problem, and it is underused by small firms because it does not look like a contract opportunity. The agency runs a solicitation whose only purpose is to build a list. Vendors submit qualifications, get evaluated, and the qualified ones become eligible to compete for task orders later. No price is submitted at the qualification stage.

Georgia formalizes this in its Procurement Manual as the Request for Qualified Contractors, a prequalification process whose stated intent is to identify multiple qualified sources of supply and screen them into a pool that can then respond to an RFP. California's Department of Technology runs Pre-Qualified Vendor Pools, including the pool for Agile Development and Digital Services, which began in 2016 inside the Child Welfare Digital Services program and has operated statewide since 2018. Qualified vendors compete for state work on agile delivery, user-centered design and software development without re-running a full solicitation each time. New York's Empire State Development has run a prequalified-provider solicitation for information technology goods and services on the same principle.

These pools reward exactly what a strong technical firm has and penalize exactly what it lacks less than an open RFP does. Entry criteria tend to be named staff, resumes, code or work samples, a written technical response, and in some cases a live exercise. Revenue history and contract counts matter less. Several pools have reopened on a recurring cycle, so a closed pool is a calendar item rather than a dead end.

Federal money inside state contracts

A large share of state analytics spending is federal pass-through, and that changes the rules on both sides. Under 2 CFR 200.317, a state procuring under a federal award follows the same policies and procedures it uses for its own funds. Local governments and other non-state recipients follow the federal procurement standards at 2 CFR 200.318 through 200.327 directly, including the micro-purchase and simplified acquisition thresholds defined at 2 CFR 200.1, currently $10,000 and $250,000.

Medicaid systems carry their own layer. Enhanced federal financial participation of 90 percent is available for the design, development and installation of mechanized claims processing and information retrieval systems under 42 CFR 433.112, with 75 percent available for operations under 42 CFR 433.116. States seeking that match must file an Advance Planning Document under 45 CFR part 95 subpart F, with prior approval conditions at 45 CFR 95.611. The practical effect for a vendor is timing. Work that depends on an approved APD moves on the federal approval calendar, not the state's fiscal year, and a solicitation can sit dormant for months while an amendment clears.

Realistic contract sizes

Ranges quoted in vendor marketing are usually anchored on the largest awards, which are systems-integrator territory: multi-year eligibility system replacements and enterprise data platform builds that run into eight figures and are won by firms with a thousand people and a bonding capacity. Those are not the entry point.

The accessible band sits below each state's formal-competition threshold, which is set by statute and varies widely. Read the state's procurement code for the exact number rather than assuming; the informal range commonly runs from a low five-figure ceiling to roughly six figures, and beneath it sits a micro-purchase tier where a single quote or a purchasing card is allowed. Below the formal threshold a program manager can buy a scoped analysis, a data quality assessment, a matching or deduplication project, or a reporting build with two or three quotes and a purchase order.

Sizing a state is a research task with a public answer. Most states publish vendor payment data on a transparency portal, and some publish it in the exact taxonomy that matters. Iowa's Department of Administrative Services publishes state payments summarized by three-digit NIGP commodity class, which means the annual spend under class 920 is a matter of public record rather than an estimate. Texas, Ohio and others publish comparable expenditure data. An afternoon spent reading actual payments tells a firm more about whether a state is worth targeting than any market report.

Contract shape matters as much as size. Hourly staff augmentation against a rate card is the most common structure and the least attractive for a small firm, since the rate is capped and a prime often sits in the middle. Deliverable-based fixed price is where a technically strong small firm makes margin, because efficiency accrues to the vendor rather than reducing billable hours. When a solicitation offers a choice, the fixed-price deliverable is usually the better bid.

Preferences, certifications, and what does not transfer

Federal socioeconomic certifications largely do not carry into state procurement. An 8(a), HUBZone or SDVOSB designation has no automatic standing in a state code, and states run their own certifications with their own criteria. Some accept a federal certification as evidence toward a state one; most require a separate application.

The state preferences are worth checking because they change scoring arithmetic. California grants a five percent small business preference under Government Code sections 14835 and following, and sets a three percent participation goal for disabled veteran business enterprises under Military and Veterans Code section 999. Iowa operates a Targeted Small Business certification. A number of states apply a resident-bidder preference, and several apply a reciprocal penalty against bidders from states that maintain their own preference, which can quietly cost points based on nothing but where a firm was formed.

The compliance items that surprise commercial vendors

State contract terms are usually non-negotiable, published as an attachment, and signed as-is. Read them before investing in a bid.

• Insurance limits stated in the solicitation, commonly general liability plus professional liability or cyber coverage, with the state named as additional insured.
• Indemnification without a liability cap, which many commercial firms have never accepted and which some insurers price accordingly.
• Work-product ownership assigned to the state, sometimes including derived models and training artifacts. Check whether your reusable components survive.
• IRS Publication 1075 controls for any engagement touching federal tax information, including background screening and facility requirements.
• The FBI CJIS Security Policy for criminal justice data, plus HIPAA, FERPA and 42 CFR part 2 depending on the program.
• StateRAMP, now operating as GovRAMP, which a growing number of states require for hosted offerings before purchase.
• Foreign qualification and state tax registration, required before contract execution in several states.

Bottom line

State and local data work is bought through a set of mechanics that are public, documented, and mostly ignored by vendors who search the wrong words on the wrong portals. The commodity code decides whether you are told about the work. The solicitation type decides whether history disqualifies you before the technical read. Prequalification pools are the one structure built to evaluate capability without a contract record behind it, and the transparency portals let a firm size the market before spending a dollar on it. None of that requires scale. It requires reading the procurement code of the state in front of you and building the target list one buying entity at a time.

Frequently asked questions