Cityworks

United States · www.cityworks.com · 21 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 21 sub-vendors.

Insights

Last updated 2026-08-14 · revision 1

21 direct vendors, 275 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Cityworks exhibits a medium level of migration readiness. A significant strength is the existing 'Cityworks Online' product, which is a cloud-hosted SaaS offering on Microsoft Azure. This demonstrates proven capability and experience in migrating and operating solutions in a cloud environment. The use of REST APIs also supports integration and potential re-platforming efforts. However, several factors present challenges for further or more extensive migration. The internal tech stack's deep integration with the Esri ArcGIS Platform and Microsoft SQL Server represents substantial platform lock-in. Migrating away from or significantly re-architecting around these core dependencies, which are central to their product offerings, would be a complex, costly, and time-consuming undertaking. The presence of '.NET Framework / ASP.NET' and 'IIS' suggests that some components may be built on more traditional architectures, potentially requiring refactoring for a fully cloud-native, containerized, or microservices-based environment. The 'Total Vendors: 0' entry is inconsistent with the listed 'Vendor HQ Countries' and the company's reliance on major platforms like Esri ArcGIS and Microsoft technologies. Assuming these platform dependencies represent vendor relationships, Cityworks faces significant platform lock-in. There is no data available on regulatory compliance requirements, data residency constraints, or financial stability, which are critical factors in assessing the feasibility and complexity of future migration initiatives. The 'Vendor Lock-in Risk: Unknown' status, combined with the clear platform dependencies, suggests this could be a significant hurdle.

Compliance

7 in-scope frameworks identified; showing 3.

GDPR (source) — Assessment Required

Cityworks is a US-headquartered company (Lehi, Utah) primarily serving local governments and utility agencies in North America. However, as a software platform that may serve EU/EEA municipal or utility customers, or process employee/supplier data from EU/EEA residents, GDPR applicability cannot be ruled out. The risk is Medium rather than High because Cityworks' core market is US public sector, but any EU/EEA customer deployments or data processing would trigger GDPR obligations. Trimble Inc. (parent company) has global operations, which increases the likelihood of some EU/EEA data processing. Non-compliance fines can reach €20M or 4% of global annual turnover, which is significant given Trimble's scale.

Evidence: https://www.cityworks.com, https://www.trimble.com/en/our-company/legal/privacy-notice

SOC 2 (source) — Assessment Required

Cityworks offers a cloud-hosted SaaS product called 'Cityworks Online,' which makes SOC 2 compliance highly relevant. Government and utility customers increasingly require SOC 2 Type II reports as part of vendor due diligence and procurement requirements. The risk is Medium because: (1) failure to maintain SOC 2 compliance could result in loss of government contracts; (2) public sector customers are increasingly mandating SOC 2 reports; (3) without a confirmed SOC 2 report, there is reputational and contractual risk. The risk is not High because Cityworks also offers on-premise deployment, reducing cloud-specific risk exposure.

Evidence: https://www.cityworks.com/cityworks-online/, https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services

NIST SP 800-53 — Assessment Required

Cityworks serves US local governments and utility agencies, and its cloud-hosted product (Cityworks Online) may be used by federal, state, or local government entities. FedRAMP authorization is required for cloud services used by US federal agencies. Even for state and local government customers, NIST SP 800-53 controls are frequently mandated. The risk is High because: (1) government customers increasingly require FedRAMP or NIST-aligned security; (2) critical infrastructure data (water, wastewater, electric, transportation) is subject to heightened federal security requirements; (3) CISA and DHS have specific requirements for critical infrastructure software vendors; (4) without FedRAMP authorization, Cityworks Online cannot be used by federal agencies, limiting market access.

Evidence: https://marketplace.fedramp.gov/products, https://www.cityworks.com/cityworks-online/, https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

Financials

Three-year financials

Financial Resilience Score: 8/10

Cityworks benefits from significant financial resilience primarily through its status as a wholly-owned subsidiary of Trimble Inc. (NASDAQ: TRMB), a large-cap listed company with multi-billion-dollar annual revenue, investment-grade credit, and diversified cash flow. This parent backing effectively removes standalone liquidity and solvency risk for Cityworks. The company was acquired in September 2019 for approximately US$375 million in cash, indicating a strong valuation and strategic importance to Trimble's AECO segment. Cityworks operates in a defensive, high-switching-cost niche: GIS-centric public asset management software for municipalities and utilities. Its customer base of governments and public utilities provides sticky, multi-year contracts with deep ArcGIS integration creating switching cost barriers. The ongoing transition to subscription/SaaS licensing improves revenue visibility and quality of earnings. The long-standing exclusive partnership with Esri and leadership position in Esri-integrated public-sector asset management further supports competitive resilience. However, transparency is limited because Trimble does not break out Cityworks as a reportable segment, making independent monitoring of unit performance difficult. Risks include public sector budget cyclicality, competition from Infor/Hexagon, IBM Maximo, Accela, Brightly/Siemens, and Esri itself, brand transition risk as Cityworks is absorbed into Trimble Unity, and heavy dependency on the Esri ArcGIS relationship.

Key strengths: Backing of large-cap NASDAQ-listed parent Trimble Inc. with investment-grade credit, Sticky public sector customer base with multi-year contracts and high switching costs, Recurring/SaaS revenue mix improving revenue visibility, Strategic fit within Trimble AECO segment supporting internal investment, Long-standing exclusive Esri ArcGIS partnership and category leadership, Deep workflow embedding creates customer stickiness

Risk factors: Customer concentration in cyclical, politically-driven public sector budgets, Competition from Infor Public Sector/Hexagon, IBM Maximo, Accela, Brightly/Siemens, and Esri, Brand transition risk from absorption into Trimble Unity, Deep dependency on Esri ArcGIS relationship, Opacity of financial reporting - no standalone disclosure

Revenue by geography

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report