Key Takeaways
- Pennsylvania’s FY 2027 budget includes an extra $10 million for cybersecurity, raising the three‑year total investment to $30 million.
- The funding supports a shift from reactive to proactive, outcome‑focused cybersecurity management under Chief Information Security Officer Andy Ritter.
- Investments target identity management, authentication, zero‑trust architecture, and safeguarding service availability while protecting residents’ data.
- Parallel technology upgrades fund a modern enterprise resource planning (ERP) system to replace a >20‑year‑old platform covering budget, finance, procurement, and HR.
- The Commonwealth Office of Digital Experience (CODE PA) receives $3.7 million to develop a new permitting process in partnership with the Department of Environmental Protection.
- Since the Shapiro administration began, the state reports $37 million in IT cost savings and cost avoidance, with $10 million credited to CODE PA initiatives.
- Officials emphasize that strengthened cybersecurity will maintain public trust, enable safe online access to services, and accelerate Pennsylvania’s digital transformation.
Overview of the New Cybersecurity Funding
Pennsylvania has earmarked an additional $10 million for its cybersecurity infrastructure within the FY 2027 budget. This allocation builds on prior years’ investments, bringing the state’s three‑year cumulative commitment to enhanced enterprise‑wide cybersecurity to $30 million. The Office of Administration announced the figure, noting that the money will be used to fortify defenses, protect sensitive data, and sustain public confidence in state‑run digital services. By dedicating recurring funds over multiple fiscal years, Pennsylvania signals a long‑term commitment to treating cybersecurity as a core component of government operations rather than an occasional expense.
Strategic Shift Toward Proactive Security
State Chief Information Security Officer Andy Ritter has publicly advocated moving Pennsylvania’s cybersecurity posture from reactive to proactive and outcome‑focused. Under this model, the state anticipates threats before they materialize, employing continuous monitoring, threat intelligence, and risk‑based decision making. Ritter emphasized that the new funding will enable the implementation of advanced identity‑management solutions, stronger authentication mechanisms, and a migration toward a zero‑trust framework—a security paradigm that assumes no implicit trust for any user or device, regardless of location. This approach aims to reduce the likelihood of successful breaches while ensuring that legitimate users retain seamless access to essential services.
Identity Management and Zero‑Trust Implementation
A significant portion of the cybersecurity investment will target identity and access management (IAM) upgrades. Modern IAM systems provide granular control over who can access specific applications and data, enforce multi‑factor authentication, and support adaptive access policies based on user behavior and risk scores. Coupled with a zero‑trust architecture, these tools require verification at every access attempt, limiting lateral movement within the network if an attacker gains a foothold. By integrating IAM with zero‑trust principles, Pennsylvania aims to create a resilient defensive layer that protects both internal government operations and the personal information of residents who interact with state portals online.
Balancing Security with Service Availability
While strengthening defenses, Ritter and Secretary of Administration Neil Weaver stressed that service availability must remain a priority. Cybersecurity measures should not impede the delivery of critical public services such as unemployment benefits, licensing, or health‑related information. The state’s strategy includes designing security controls that are transparent to end‑users—employing single‑sign‑on solutions, streamlined authentication workflows, and resilient infrastructure that can withstand Distributed Denial‑of‑Service (DDoS) attacks. This balance ensures that Pennsylvanians can continue to access necessary services online safely and efficiently, even as the threat landscape evolves.
Enterprise Resource Planning (ERP) Modernization
Beyond cybersecurity, the FY 2027 budget allocates funds for a new enterprise resource planning system to replace Pennsylvania’s legacy ERP platform, which has been in service for more than two decades. The outdated system currently handles core functions such as budgeting, finance, procurement, and human resources, but its aging technology limits agility, increases maintenance costs, and poses integration challenges. The forthcoming ERP solution will be built on a modern, cloud‑native architecture, enabling real‑time data analytics, improved reporting capabilities, and smoother inter‑agency collaboration. By consolidating these functions into a unified platform, the state expects to enhance operational efficiency, reduce duplication of effort, and support data‑driven decision making across departments.
CODE PA and the Environmental Permitting Initiative
The Commonwealth Office of Digital Experience (CODE PA) is slated to receive $3.7 million to develop a new permitting process in partnership with the Department of Environmental Protection (DEP). In 2025, DEP launched a permit tracker that lets applicants search, filter, and view applications online—a tool co‑created with CODE PA to improve transparency and user experience. The additional funding will expand this capability, integrating the tracker with broader state permitting workflows, automating routine checks, and providing applicants with real‑time status updates. This initiative exemplifies how targeted IT investments can streamline regulatory processes, reduce paperwork, and accelerate project timelines for businesses and citizens alike.
Reported IT Cost Savings and Avoidance
Since the inception of the Shapiro administration, Pennsylvania has reported $37 million in IT cost savings and cost avoidance. Of this total, $10 million is directly attributed to CODE PA’s efforts, highlighting the office’s role in driving efficiency through digital service improvements, process automation, and better resource allocation. These savings stem from consolidating duplicative systems, negotiating more favorable vendor contracts, leveraging cloud services to reduce hardware expenditures, and minimizing manual labor through automation. The demonstrated fiscal benefits reinforce the argument that strategic technology investments not only improve security and service delivery but also generate tangible economic returns for the state.
Leadership Statements and Vision for Digital Transformation
Office of Administration Secretary Neil Weaver framed the cybersecurity funding as a keystone of Pennsylvania’s broader digital transformation agenda. In a news release accompanying the inaugural IT Day event, Weaver asserted that the additional resources will help the state better protect sensitive data, maintain public trust, and accelerate digital transformation initiatives. He emphasized that a secure digital foundation is essential for residents to confidently engage with state services online, from filing taxes to accessing health information. Weaver’s remarks underscore the administration’s belief that cybersecurity is not merely a defensive measure but an enabler of innovation, allowing Pennsylvania to adopt emerging technologies such as artificial intelligence, data analytics, and citizen‑centric mobile applications without compromising safety.
Implications for Residents and Stakeholders
For Pennsylvania residents, the enhanced cybersecurity posture translates into greater confidence that personal information submitted through state portals—such as Social Security numbers, tax records, or health data—is safeguarded against unauthorized access and cyber threats. Improved identity management reduces the risk of fraudulent account creation, while zero‑trust principles limit the potential damage from any compromised credentials. Meanwhile, the ERP modernization and CODE PA permitting upgrades promise more efficient interactions with government agencies, reducing processing times, minimizing errors, and providing clearer communication throughout service delivery cycles. Businesses seeking permits or engaging in state contracts will benefit from faster approvals and clearer status visibility, fostering a more conducive environment for economic activity.
Future Outlook and Continued Investment
The $10 million FY 2027 allocation is part of a sustained, multi‑year strategy rather than a one‑off infusion. By earmarking funds across successive budgets, Pennsylvania aims to keep pace with evolving threats, technological advancements, and changing citizen expectations. Ongoing efforts will likely include regular security assessments, penetration testing, staff training programs, and partnerships with federal cybersecurity agencies and private‑sector experts. As the state progresses toward a zero‑trust environment and completes its ERP overhaul, it will be better positioned to leverage data analytics for policy making, improve disaster recovery capabilities, and innovate in areas such as smart‑city initiatives and digital health services. The cumulative effect of these investments is expected to yield a more secure, responsive, and citizen‑focused government well into the next decade.