What the Iowa Manufacturing 4.0 Grant Will and Will Not Fund for Cybersecurity

THE ELIGIBLE TECHNOLOGY LIST SAYS "CYBERSECURITY SOFTWARE." MOST OF WHAT YOU WOULD ACTUALLY BUY IS SOLD BY SUBSCRIPTION, AND SUBSCRIPTIONS DO NOT QUALIFY. HERE'S WHAT DOES:

A plant manager in central Iowa reads the Manufacturing 4.0 eligible technology list, gets four items down, and stops at "cybersecurity software." The MDR renewal is sitting on his desk. The quote is real money. He circles the line, forwards the page to his CFO, and writes one sentence above it: we might be able to get half of this back.

He cannot. Not that line item, anyway.

This is the most common misread of a program that is otherwise one of the better deals available to a small Iowa manufacturer, and it is an easy mistake to make, because the eligible list really does say cybersecurity software. The problem is what has happened to how security software is sold.

Does the Manufacturing 4.0 grant cover cybersecurity?

Yes, but narrowly. Cybersecurity software appears on the Iowa Economic Development Authority's published list of eligible technology, alongside IIoT infrastructure hardware, predictive maintenance software, sensor integration, and data analytics. The category is in.

The catch is in how the program pays. Manufacturing 4.0 is a technology investment program, and it reimburses purchases. IEDA confirmed directly in September that subscription and SaaS licensing is not eligible.

In 2026, nearly every security product a mid-sized plant would actually buy is sold as a subscription. Managed detection and response. Endpoint protection. Email security. Monitoring platforms. All monthly or annual, all recurring, all outside what this grant reimburses.

So the honest version is this: cybersecurity is an eligible category, and a large share of the cybersecurity products on the market do not qualify. A manufacturer can pick a platform in good faith, build it into the application, and find out at reimbursement that none of it counted.

Why don't security subscriptions qualify?

Because the program is built around things you buy and place in service, not things you rent.

A grant agreement runs one year from the date of award. In that window you purchase the technology, put it to work, and submit receipts. That structure fits a firewall. It does not fit a license that renews every month and disappears the moment you stop paying. The state is funding a capital investment that stays in your plant, not an operating expense that continues after the agreement closes.

You may not love the logic, but knowing it ahead of time is worth a great deal, because it changes what you put in the application.

What security spending actually qualifies?

Three things, and they work best together.

Hardware. Firewalls, managed switches, access points, and server equipment. IIoT infrastructure hardware, including enhanced server equipment, is named on IEDA's eligible list. This is the most reliable category in the whole program, and it is also where most plants are genuinely behind.

Perpetually licensed software. Bought once and owned, rather than rented. There is less of it on the market than there used to be, but it exists, and it is worth asking a vendor directly which licensing model they sell before you build a quote into an application.

Implementation labor from an outside provider. IEDA confirmed that implementation, installation, and integration labor is allowable when it is tied to an eligible piece of equipment. Read that carefully. It is labor that installs or integrates specific hardware. It is not general consulting, it is not a monthly service agreement, and it is not hours floating free of a purchase.

One more useful detail: a single application can combine both grant tracks, the Manufacturing Innovation Equipment track and the IIoT Infrastructure Investment track, up to the combined maximum.

Every application is evaluated and scored on its own, so nothing here is a guarantee. What it does tell you is the shape of a project the rules favor.

What does a fundable security project look like?

Hardware, plus any perpetual licensing, plus the labor to install and integrate it, in one application.

Separating your shop floor network from your office network is the clearest example. It is the single most effective thing most mid-sized plants can do to keep a problem in accounting from reaching the production line, and it happens to be built almost entirely out of things this grant reimburses. Managed firewalls. Switches. The design work to map what talks to what. The configuration and integration hours to stand it up without stopping production.

Server replacement is the second. A domain controller or file server running past its support date is both a security problem and an uptime problem, and new server equipment is explicitly named on the eligible list.

We did not design the program to point at this kind of work. The rules did. It is worth saying plainly that our advice and our interest line up here, rather than pretending otherwise, and it is also worth saying that scoping this well matters more than scoping it big. Applications are scored against each other.

What the grant will NOT pay for

Short list, worth reading twice.

• Anything purchased before the date of your application. Not the hardware, not the labor, not any portion of the project. If you buy it early, it does not count.

• Subscription or SaaS licensing, of any kind.

• Your monthly IT agreement. Managed services are an ongoing operating expense and are not what this program funds.

• More than $75,000, ever. That is a lifetime maximum per legal entity, not an annual one.

How does the money actually reach you?

It arrives after you have already spent it.

Manufacturing 4.0 reimburses. You pay the full line item, submit the receipts, and IEDA sends back half, against a minimum one-to-one cash match from a private source.

The practical consequence catches people off guard. A $150,000 project that earns the full $75,000 award requires $150,000 of capacity, not $75,000. You need the whole amount available first.

A bank loan or a line of credit does qualify as the private match source, which helps. If financing is part of your plan, that is a conversation to start before the holidays rather than in late January.

When is the Manufacturing 4.0 deadline?

There are two dates, and most people write down the wrong one.

January 29, 2027 is the application deadline. Applications open January 4 on iowagrants.gov and are scored competitively.

November 20, 2026 is the one that will actually stop you. That is the last day to request your Manufacturing 4.0 assessment through CIRAS at Iowa State, and a completed assessment is required to apply. Miss it and the January date does not matter.

The assessment is an on-site visit of about three hours, so plan for up to four. You supply five candidate dates within the next three to four weeks, and the report follows roughly two weeks after the visit. CIRAS has confirmed that any company requesting an assessment by November 20 will have the report in hand before applications open, so a late request does not leave you stranded.

What a late request costs you is room. Request at the wall and you are hosting an assessment in your plant in mid-December and receiving the report the same week the window opens, with twenty-five days to scope the project, gather quotes, arrange financing, and write a competitive application, in January, on top of year-end. Request in late October and the report lands in early December with a quiet month to work in.

One more thing worth knowing before you request. The CIRAS request form asks what technology you are considering investing in, and you cannot submit it without an answer. CIRAS also asks you to bring impact numbers to the onsite visit, meaning cost, productivity, labor, or quality figures tied to the problem you are trying to solve. Most plant managers do not have those sitting in a folder, not because they do not know their operation, but because nobody tracks what a recurring line stoppage costs in a format you can hand to a stranger in a conference room.

Are you eligible?

You need all seven. Check them honestly before you spend time on this.

• You manufacture goods at a facility in Iowa, and are incorporated or authorized to do business in Iowa

• Your NAICS code falls in the 31 to 33 manufacturing range

• You have been in operation at least three years

• At least 51% of your gross revenue comes from the sale of manufactured goods, measured across the entire legal entity

• You employ at least 3 and fewer than 125 full-time employees, counting all locations everywhere, with part-time staff counted as fractions

• You have completed a Manufacturing 4.0 assessment through CIRAS

• You have not already received the $75,000 lifetime maximum

If you are close to a line and not sure, call IEDA directly at 515.348.6199 and ask. They would rather tell you now than at reimbursement.

Where to start

We do not administer this grant, we do not score applications, and we do not perform the assessment. What we can do is help you walk into that assessment already knowing which problem you are solving, so the report that comes out of it points at a project worth funding.

That is the whole offer. A 30-minute Manufacturing 4.0 Scoping Call with a Koltiv engineer to sort through which technologies are worth your match dollars in your plant, before CIRAS arrives. Not an assessment, not grant writing, and not a pitch.

1. Book a Scoping Call. Thirty minutes, and you will leave with an answer to the technology question on the request form.

2. Request Your CIRAS Assessment. Do this before November 20, whether or not you talk to us.

3. Look at where you stand on security. If you want a prioritized list of what to fix first, with or without grant money attached, that is what our cybersecurity assessments produce. 

Forty-five years in Iowa plants has taught us that the best projects are not the ones with the biggest number on them. They are the ones where somebody could explain, in one sentence, what problem they were solving. This grant rewards that kind of clarity, because the applications are read side by side. If you are staring at the technology question on the CIRAS form and not sure what to put, that is a good reason to call. And if it turns out the grant is not a fit for what you need, we will tell you that too.

book a manufacturing 4.0 scoping call