If you buy a security tool with one-time funds, settle three things first: who pays in year two, what happens if nobody does, and how you export your records. Many public teams start tools with short term money, then face a gap when it ends. Decide the renewal path before the purchase, not at the renewal date.
Why this trips public teams
Funding for projects can be time limited, while a subscription tool needs to run every year. Rules on what grants and special funds may pay for differ by program and by entity, so check yours. Nothing in this post says which funds are available now. Confirm with your finance office.
Five questions to answer before signing
| Question | Why it matters |
|---|---|
| Who owns the budget line in year two? | A named owner prevents a silent lapse |
| What is the renewal notice period? | Short notice windows catch teams off guard |
| What happens to data if we do not renew? | You need export and deletion terms |
| Can we shrink scope instead of stopping? | A smaller plan beats none |
| What is the fallback? | Free services and scripts can cover part |
Build a three year view
- List what the tool costs per year, using quotes you have, not guesses.
- Mark which years have funding and which do not.
- For each gap year, write the source: operating budget, a new request, or a smaller scope.
- Add the staff time to run it. Time is a cost even when no one invoices it.
- Put the renewal date on a shared calendar with an alert 120 days before.
Ways to reduce the cliff
- Choose a term that matches funding. Ask whether a multi-year term fits your rules and what it commits you to.
- Right size the scope. Start with the applications that matter most, not the whole estate.
- Use free government services for the outside view. See free government scans versus a bought tool.
- Document the value. Keep a record of issues found and fixed, so the renewal request has evidence.
Evidence that helps the next budget request
- Number of applications covered
- Findings fixed, by severity
- Time from finding to fix, where you can measure it
- Questionnaires answered faster because of exported evidence
- Incidents avoided, only where you have a documented case
Do not invent numbers. A short, true record beats a large estimate.
Plan the exit too
If funding ends, you need your data out. See what should happen to your data when a contract ends. Test an export during the first year, not the last month.
What to tell the buyer's board
Say plainly: this is a one-time start, here is the cost to continue, here is who owns it, and here is what we do if it stops. Boards respond to a clear plan more than to a perfect one.
Quick check
Can grant money pay a subscription?
It depends on the program and your entity's rules. Ask your finance office and the grant administrator.
What is the first thing to settle?
Who owns the year two budget line.
Last reviewed: 19 October 2026.
