A newly elected county commissioner from a rural jurisdiction asked us a version of this question after a state association meeting, and it comes up often enough that it's worth answering here in full.
The question: "Every vendor who calls us gives us a different number. How are we supposed to know what a reasonable cybersecurity budget actually looks like for a county our size?"
The honest range
For outside security support — a managed detection and monitoring service, not a full in-house security team — smaller local agencies are typically spending somewhere in the neighborhood of $35,000 to $120,000 a year. That's a wide range on purpose, because the number that actually fits your county depends on a few specific things, not on population alone.
What actually drives the number
- What you're starting from. A county with a recent assessment and modern infrastructure needs less than one still running systems nobody's touched in a decade.
- Whether you have any in-house IT at all. One dedicated IT staffer changes what you need to buy versus build.
- What you're required to protect. A jail management system or anything touching criminal justice records (CJIS) carries requirements a general-purpose office network doesn't.
- How many separate departments and buildings you're covering. A courthouse, a sheriff's office, and public works aren't the same network, even if they're the same budget line.
Where to actually start if that number feels out of reach
You don't need to fund the whole range on day one. In order:
- An assessment first. You can't budget accurately for a problem you haven't measured. This is usually the cheapest step and the one that makes every later number defensible in a board meeting.
- Fix the free and cheap things before buying anything. Multi-factor authentication and tested backups cost far less than most of the tools vendors will try to sell you first.
- Check what funding already exists. Federal and state cybersecurity grant programs specifically exist because Congress and state legislatures recognize this exact budget gap — see our update on the SLCGP for where that stands right now.
- Budget the ongoing piece last, once you know what you're actually monitoring. Buying a monitoring contract before an assessment usually means paying to watch the wrong things closely.
If a vendor's first move is a number before an assessment, that's usually worth a second opinion — not because the number is necessarily wrong, but because it's a guess dressed up as a quote.