Cloud, SaaS, colocation, or on-premises: choosing where agency workloads run
How public cloud, vendor-hosted SaaS, colocation, and on-premises infrastructure differ, and the criteria an agency uses to choose.
Articles
Guides & Checklists
Every reference article on hqt.org in Guides & Checklists, written for agency procurement, technology, and program staff.
Build, buy, or configure: choosing an approach for an agency system
How custom development, commercial products, low-code configuration, and open source compare for an agency system, and how to decide.
Integrated suite or best-of-breed systems: how to decide
A comparison of single-vendor suites and best-of-breed systems, with the questions an agency should answer before choosing.
Who does the work: in-house staff, a managed service, or project vendors
Hiring staff, contracting a managed service, or buying project by project: what each model costs an agency in money, risk, and retained knowledge.
Replace the system or modernize around it: a decision guide
Full replacement, incremental modernization, re-platforming, or an API layer: how to compare four options for an aging system.
Run your own security operations or buy monitoring as a service
Four models for continuous security monitoring, what each asks of staff and contracts, and how response decisions stay with the agency.
Where to run a language model: a decision guide for agencies
How agencies choose among a commercial AI service, a provider model in their own cloud tenancy, and a self-hosted open model.
A go-live readiness checklist for a new agency system
A checklist for agency project managers and department leads deciding whether a new system is ready to go live on its scheduled date.
A pre-solicitation readiness checklist for technology purchases
A readiness checklist for IT and program staff to work through before drafting a solicitation for technology products or services.
Vendor offboarding checklist for agencies changing technology suppliers
A checklist for IT and contracting staff closing out a technology contract: notice, data return, access shutdown, and handover to the next supplier.
Cyber insurance readiness: a checklist for public agencies
Work through this checklist before completing a cyber insurance application or renewal so every answer you give is backed by evidence.
A new IT director's first ninety days: a checklist
A checklist for a newly appointed agency IT leader covering people, systems, contracts, security, work already in flight, and setting direction.
Accessibility conformance checklist before launching a public service
A pre-launch checklist for agency project teams verifying that a resident-facing website or application conforms to WCAG 2.1 Level AA.
A data sharing agreement checklist for agencies exchanging records
A working checklist for program, legal, and IT staff negotiating or reviewing an interagency data sharing agreement.
Public records readiness checklist for agency technology systems
A checklist for records officers and IT staff testing whether an agency system can retain, find, produce, and redact public records.
SaaS renewals: what to do in the year before the term ends
A month by month approach to a SaaS renewal: notice windows, price escalation caps, usage inventory, and exit readiness.
Writing an incident response plan a small agency team can follow
What belongs in an incident response plan a small agency team can follow, from severity levels to who approves a public statement.
Privacy impact assessments before launching a new agency system
What a privacy impact assessment answers, and how to make it a gate in procurement rather than paperwork filed after go-live
Scoping a penetration test: rules of engagement and deliverables
How agencies define engagement types, authorization, testing windows, deliverables, and a required retest in a penetration test solicitation
Security awareness training and phishing simulations for agency staff
How to run security awareness training and phishing simulations that change staff behavior and still satisfy auditors and insurers
Data migration when replacing an agency system
The sequence of a data conversion during a system replacement, who owns each decision, and what belongs in the statement of work
User acceptance testing before a government system goes live
How agency staff plan and run user acceptance testing: scenario-based test scripts, tester recruitment, defect severity, and formal sign-off.
Replacing PDF forms with online forms staff can maintain
How to run a forms modernization effort, from inventory and process redesign to platform choice, accessibility, and ongoing ownership.
Native app, mobile web, or PWA: choosing for resident services
How to weigh native apps, responsive websites, and progressive web apps for resident services, and defend the choice
Setting up a data governance program in a public agency
The parts of a working data governance program in a public agency, and the order to put them in place without new headcount.
Choosing performance measures a department will actually use
A practical guide to picking inputs, outputs, outcomes, and efficiency measures a small staff can define, sustain, and review
Benchmarking your agency against other jurisdictions
How to choose peer jurisdictions, normalize the numbers, and document definitions so a comparison holds up in public.
Building an AI test set from your own records to measure accuracy
How to assemble an evaluation set from real agency cases, set the answer key, and hold vendors to a measured accuracy number.
What belongs in a technology strategic plan, and how to keep it current
A practical structure for a technology strategic plan agency staff will read, plus an annual refresh routine that keeps it current.
IT steering committees: charter, intake, and project prioritization
How to charter an IT steering committee that decides: membership, decision rights, cadence, intake, and scoring.
Recruiting and retaining IT staff at a public agency
A practical guide to fixing IT classifications, shortening hiring timelines, and keeping technical staff at a public agency.
Preparing staff for a new system: training, super users, and go-live support
How agencies prepare staff for a new system: naming super users, mapping role changes, timing training, and staffing go-live.
Parallel payroll testing before a payroll system go-live
A practical method for running legacy and new payroll side by side: how many cycles, which cases to force in, and how to clear every variance.
Year-end close and audit readiness: what your systems must produce
A sequenced year-end close calendar, subledger tie-outs, and the reports and IT control evidence auditors ask for.
Employee offboarding checklist: access, assets, pay, and records
A working separation checklist for public agencies covering final pay, benefits, account access, physical assets, and records holds.
Parallel payroll testing checklist before an HR system go-live
A structured checklist for planning, running, and closing out parallel payroll testing before a new HR system goes live.
Sizing video surveillance storage and bandwidth before you buy cameras
A working method for estimating camera storage, bitrate, and network load before purchase, with a 200 camera worked example.
Construction closeout data: as-builts, O&M manuals, and new asset records
How to specify construction closeout as a structured data handover so asset records, as-builts, and controls files reach your systems.
Kiosks and assisted self-service in agency lobbies
A specification and siting checklist for public self-service kiosks in agency lobbies, from ADA placement and PCI scope to staffing the helper role.
A confidentiality checklist for health and human services systems
A checklist for configuring, monitoring, and proving access controls in health and human services case systems.
Specifying a tree inventory and urban forestry management system
A requirements checklist for tree inventory and urban forestry software: data fields, work order links, refresh cycles, and RFP terms.
Restore drills: proving your backups actually come back
A practical quarterly restore drill programme for agency IT: what to sample, how to time it against RTO, and what evidence to keep.
Running a disaster recovery failover test without breaking production
How to escalate from tabletop to live failover, scope a test to one maintenance window, and close the findings.
Vulnerability remediation: from scan report to closed ticket
How to turn a long scanner export into a tracked remediation queue with owners, deadlines, and signed risk acceptances.
Incident postmortems after an outage: blameless review and follow-through
How public agencies run a blameless outage postmortem, brief officials and the press, and hold hosted vendors to their own review.
Writing runbooks your staff will actually use at 2 a.m.
How to write operational runbooks agency staff can follow during a late-night outage, and how to keep them current.
Keeping system documentation and network diagrams current
How agencies keep network diagrams, system profiles, and as-built records current, and who owns each update.
Tabletop exercise: a SCADA compromise at a water utility
A ready-to-run two-hour tabletop exercise for a SCADA compromise at a water utility, with injects, roles, and decision points.
Tabletop Exercise: A Student Data Breach at a School District
A runnable ninety-minute tabletop exercise for districts facing a vendor-disclosed breach of student records.
Security metrics that a city council or board can act on
A one-page set of cybersecurity measures a city council or board can act on, with cadence, open-meeting, and definition guidance.
Tabletop exercise: a CAD outage at a 911 center
How to run a tabletop exercise for a 911 center CAD outage, from declaring continuity to rebuilding the call record.
Resident survey data: sampling, weighting, and margin of error
How sample frame, mode, response rate, weighting, and margin of error determine whether a resident survey's numbers hold up.
Form design that produces clean data: pick lists, validation, free text
A field-by-field guide to designing intake, permit, and inspection forms so the submissions can actually be counted and reported.
Rates and denominators: getting per-capita numbers right
How to choose the right denominator for agency per-capita rates, which population estimates to cite, and how to handle small jurisdictions.
Averages hide response times: medians, percentiles, and what to publish
Why average response times mislead on skewed data, how to compute percentiles consistently, and what to publish.
Is that change real? Small counts, noise, and year-over-year swings
How to tell whether a month-over-month or year-over-year move in a low-count agency measure is real signal or ordinary variation.
Before-and-after comparisons: what a pre/post number cannot tell you
Why a before-and-after chart rarely proves a program worked, and the low-cost comparison designs agencies can use instead.
A data literacy program for agency staff: scope and curriculum
How to scope, teach, tier, and evaluate an internal data literacy program so agency staff can interpret the reports they already receive.
Analytics staffing: central team, embedded analysts, or contracted
Compares central, embedded, and contracted analytics staffing on responsiveness, definitions, retention, and cost for public agencies.
Process mining and time studies: picking which workflow to automate first
A practical method for choosing your first automation target using system event data, queue and rework measures, and short staff time studies.
Reference checks that produce real information about a vendor
How agency teams find, question, and document software vendor references so the answers are useful and the award file holds up.
Running an evaluation committee: conflicts, confidentiality, records
How to seat, brief, and run a proposal evaluation panel: conflict disclosures, confidentiality, independent scoring, and the written record.
Writing a surveillance technology use policy and impact report
A section-by-section guide to drafting the surveillance impact report and use policy your governing body will review.
Writing an acceptable use policy for agency devices and networks
What an acceptable use policy needs to cover, from personal use and monitoring notice to remote wipe, plus who must review it.
The information security policy suite a small agency needs
How a small public agency can layer its security policies, adopt them in a sensible order, and keep the suite current.
Building a records management program: roles, policy, and training
How a local government builds the program around its retention schedule: roles, written policy, training, destruction approvals, and audits.
Legal holds in agency systems: issuing, scoping, and releasing
A practical guide to issuing, scoping, applying, tracking, and releasing legal holds across agency email, chat, file shares, and vendor systems.