IaaS, PaaS, SaaS: cloud service models for public agencies
What each cloud service model means, who is responsible for what, and how agencies typically use them.
Articles
Technology
Every reference article on hqt.org in Technology, written for agency procurement, technology, and program staff.
StateRAMP and FedRAMP, explained
What the two cloud security authorization programs are, how they differ, and what an authorization actually tells an agency.
Zero Trust architecture for public agencies
The principles behind Zero Trust, the maturity model, and a realistic sequence for a small security team.
The NIST Cybersecurity Framework for local government
How the framework is structured, why agencies adopt it, and how to use it without drowning in paperwork.
The CJIS Security Policy: an overview for agencies and vendors
What the policy covers, who it binds, and the areas that most often cause compliance findings.
DevSecOps pipelines for government software
The stages of a secure delivery pipeline and the evidence it produces for auditors.
Legacy modernization strategies: rehost, refactor, rewrite, replace
The main approaches to modernizing an old application, and how to choose among them.
API design for public-sector integration
Principles for designing interfaces between agency systems that will be maintained for years.
Low-code platforms in government: benefits, risks, and governance
Where low-code tools help agencies, where they cause trouble, and the governance that keeps them useful.
Data warehouses, lakes, and lakehouses for agencies
The main data platform architectures, what each is good for, and a sensible default for a public agency.
GIS in local government: what it does and how it is built
The role of geographic information systems across agency functions and the components of a modern GIS.
Next Generation 911: an overview for agencies
What NG911 changes about how emergency calls are routed and handled, and what agencies must prepare.
Web accessibility and WCAG for public agencies
The technical standard behind accessibility requirements, what it covers, and how agencies achieve and maintain conformance.
Operational technology security for utilities and public works
How control systems differ from IT, the risks they face, and the practical controls that protect them.
Identity and access management for agencies
Directory services, single sign-on, multi-factor authentication, and lifecycle management as the foundation of agency security.
Backup and ransomware recovery for public agencies
What a backup strategy must include to survive ransomware, and how to know it works before it is needed.
Monitoring and observability for public-facing services
How agencies know their online services are working, and what to measure.
Software supply chain security for agencies and vendors
The risks in the components software is built from, and the practices that manage them.
Containers and Kubernetes for agency applications
What containers are, when orchestration is worth it, and a right-sized approach for public agencies.
Network segmentation for local government
Why flat networks are dangerous, how to divide them, and how to do it without breaking operations.
Passkeys and phishing-resistant authentication for agency staff
Why one-time codes are no longer enough, what passkeys and security keys change, and how to roll them out.
Post-quantum cryptography: what agencies should do now
Quantum computers will eventually break today's public-key encryption. The preparation is inventory and agility, not panic.
Real-time data: streaming and IoT platforms for cities and utilities
How agencies collect and act on data from sensors, meters, vehicles, and signals as it happens.
Serverless and managed services for resident-facing applications
How agencies can run online services that scale for deadlines and cost little when idle, without managing servers.
Digital twins for utilities and public infrastructure
What a digital twin is in practical terms, and where the concept delivers value for water, power, and facilities.
Platform engineering for agencies that build software
How a shared, paved road for development teams speeds delivery and keeps security consistent across applications.
Computer vision for infrastructure inspection
Using imagery from vehicles, drones, and fixed cameras to find pavement defects, sign damage, and asset conditions at scale.
A modern data stack for agency reporting
The components that have replaced nightly exports and spreadsheets, and how they fit together for a public agency.
SPF, DKIM, and DMARC: protecting an agency's email domain
What SPF, DKIM, and DMARC records do, how alignment works, and how to reach enforcement without blocking legitimate agency mail.
Endpoint detection and response: EDR and managed detection for agencies
What EDR adds beyond antivirus, and how agencies decide whether to watch the alerts in house or buy managed detection.
Security logging and SIEM: what to collect and how long to keep it
A practical order for onboarding log sources into a SIEM, how to set retention periods, and why ingestion volume drives cost
Encryption and key management: what agencies should require
How encryption in transit, at rest, and at the field level differ, who holds the keys, and what to require of vendors.
Secure configuration baselines: CIS Benchmarks and system hardening
How CIS Benchmarks and DISA STIGs give an agency a defensible hardening standard, and how to handle levels, exceptions, and drift
Physical security for server rooms, network closets, and devices
How agencies control and log access to equipment spaces, manage power and water risk, and document media disposal for assessors.
Software asset management and license audits for agencies
How agencies keep an accurate software entitlement record, reconcile it against deployment, and prepare for a vendor license audit.
One resident login across agency services: what it takes
What it takes to give residents one account across permitting, utility billing, and court systems, and the tradeoffs of each approach.
Accepting online payments: merchant services, gateways, and PCI scope
How agencies take card and ACH payments online: merchant accounts, gateways, PCI scope and SAQ choice, fee models, and reconciliation.
Choosing a content management system for an agency website
How agency communications and IT staff compare hosted government platforms, commercial products, and open source CMS options during a redesign.
Technical debt in agency systems: how to name it and fund it
A practical guide for agency IT leaders on naming technical debt, ranking it by risk, and funding remediation in the budget
Offline-capable field apps for inspectors and work crews
What changes when a field application must work without a signal: local storage, selective sync, conflict handling, and device security.
Master data management: one record for a person, place, or asset
How agencies build one authoritative record for a resident, parcel, business, or asset across systems that disagree
Address data: building and maintaining an authoritative address list
How local governments decide who assigns addresses, keep points, parcels, and centerlines aligned, and publish one list other systems can trust
Geospatial metadata and data standards for agency GIS
How agency GIS teams document coordinate systems, schemas, and metadata so shared layers can actually be trusted
Data catalogs and data inventories: making agency data findable
How agencies separate a technical data catalog from a statutory data inventory, what a minimum entry in each contains, and who keeps them current.
Measuring data quality: completeness, accuracy, and timeliness
A practical way to define, profile, and automatically test data quality so the numbers on an agency dashboard can be trusted.
Getting data out of a vendor system you do not control
Compares the realistic routes for getting agency data out of a hosted vendor system, and the access terms to settle before go-live.
Running an agency service desk: tiers, service catalog, and metrics
How agency IT teams set up a service catalog, intake and triage, support tiers, priority rules, and the metrics worth reporting.
IT change management: approvals, maintenance windows, and freeze periods
How to size an IT change process for a public agency: change types, approvers, review boards, maintenance windows, and freeze periods.
Device refresh cycles: planning, funding, and secure disposal
How agencies set refresh intervals by device role, fund replacement predictably, and retire equipment on schedule.
Planning a network refresh: switches, wireless, and what to replace first
How to inventory network gear, rank switch and wireless replacements by risk, and plan for PoE, cabling, and closet limits.
Redesigning your chart of accounts before an ERP replacement
How to restructure fund, department, program, project, and object segments before an ERP conversion and document a crosswalk that survives audit.
Budget preparation software: what it does that spreadsheets cannot
How budget preparation software handles position budgeting, scenarios, decision packages, and the adopted budget book.
Centralized cash receipting: counters, deposits, and daily reconciliation
How agencies run one receipting system across counters, balance drawers, tie deposits to the bank, and post revenue to the ledger.
Capital improvement program tracking from budget to capitalized asset
How multi-year CIP budgets, multiple funding sources, change orders, retention, and construction in progress fit together in one system.
Applicant tracking systems that fit civil service hiring rules
What an applicant tracking system must do under merit system rules, from requisition approval through eligible lists, certification, and audit trails.
Civil service testing platforms: item banks, proctoring, and eligible lists
How agencies run civil service exams at scale: item bank security, proctoring options, accommodations, scoring, and eligible lists.
Learning management systems for mandated training in agencies
What to look for in a learning management system that has to prove training compliance to auditors, not just deliver courses.
Certification and license tracking for sworn and licensed staff
How agencies keep an authoritative record of staff licenses and certifications, verify them with issuers, and alert before they expire.
Scheduling software for 24/7 shift workforces: police, fire, and dispatch
How shift scheduling systems for police, fire, and dispatch handle minimum staffing, overtime callback lists, and audit trails.
Position control: budgeted positions, vacancies, and the HR-finance link
How position control links adopted budget authority to filled and vacant seats, and how to reconcile HR and finance headcount monthly.
Employee and manager self-service for a deskless public workforce
How agencies extend HR self-service to field and shift staff: kiosk and mobile access, phishing-resistant login, and delegated approvals.
Building automation systems on the agency network: BACnet, ownership, and remote access
How building automation systems land on agency networks, and how facilities and IT should divide patching, backups, accounts, and alarm routing.
Energy management information systems: utility bills, interval data, demand charges
How an energy management information system combines utility bills, interval meter data, and weather to manage agency building energy costs.
Replacing an access control system: credentials, readers, and a phased cutover
How to scope a building access control replacement: credentials, readers, panels, data migration, and a phased cutover.
Space and lease management systems: floor plans, occupancy, and GASB 87 data
What an IWMS or CAFM must hold to be trusted for floor plans, occupancy, and lease records, and what GASB 87 reporting demands.
Designing a 311 service request catalog: types, routing, and response times
How to build a 311 request type catalog: sizing the list, routing each type to an owner and queue, and setting response targets crews can meet.
Open311 and standards-based interfaces for service requests
How Open311 GeoReport v2 works, what its endpoints do, and how to require it in a service request system solicitation.
Closing the loop between 311 requests and public works work orders
How to connect a 311 request system to public works work orders: system of record, asset matching, status mapping, and closure notifications.
Constituent relationship management: what a CRM adds beyond 311
How a constituent relationship system differs from a 311 service request tool, and how to scope one without starting an enterprise data program.
Building a notification preference center residents will actually use
How to design a resident notification preference center: topics, channels, consent records, quiet hours, and cross-system opt-out sync.
Contact center technology for resident services: IVR, routing, and queues
What an agency call center needs beyond a phone system: routing, callback, IVR design, language access, recording, and peak sizing.
Appointment scheduling for agency counters and clinics
How to configure appointment scheduling for permit counters, clerk windows, clinics and inspections without simply hiding the wait.
HL7, FHIR, and health information exchange for agency systems
How HL7 v2, C-CDA, and FHIR fit together, and what to name in a solicitation so interface quotes are comparable.
Benefit eligibility interfaces: verification hubs and state system links
How local agencies connect case management tools to state eligibility systems: access agreements, matching rules, and audit limits.
Building a public zoning lookup map residents can actually use
How to build a public zoning lookup map that gives residents a clear, trustworthy answer about what they can build on a parcel.
Air quality monitoring data: low-cost sensors, calibration, and publishing
How agencies run low-cost air sensor networks: siting, calibration and drift, data gaps, and publishing readings residents can act on.
Managing water quality sampling data and lab electronic deliverables
Moving water quality results from field sampling and contract lab EDDs into a validated database, dashboard, and state report.
Stream and rain gauge telemetry for flood warning programs
How agencies specify stream and rain gauge telemetry that survives the storm: sensors, backhaul, power, alarms, and upkeep.
Capacity planning for agency systems: storage, compute, and seasonal peaks
How agencies can forecast storage, compute, and license growth on a budget cycle and size systems for predictable seasonal peaks.
Setting RTO and RPO targets for each agency system
A practical guide to assigning recovery time and recovery point objectives to agency systems and using them to drive backup, replication, and contract terms.
Choosing a disaster recovery site: distance, hosting, and network paths
How agencies weigh separation distance, hosting options, and network paths when choosing a disaster recovery site.
Database administration for agency systems on a small team
The routine database maintenance a two-person agency IT shop still owes a vendor system, and how to staff it.
Patching systems you cannot reboot: rings, windows, and exceptions
How agencies can use deployment rings, realistic maintenance windows, and documented exceptions to patch 24/7 systems.
Building a CMDB a small agency IT team can actually maintain
How to scope, populate, and maintain a configuration management database that a small government IT team can keep accurate.
Mapping application dependencies before a migration or an outage
How agencies build and maintain an application dependency map to speed outage triage and avoid cutover surprises.
Alert fatigue: tuning monitoring so real outages get noticed
How agency IT teams can cut monitoring noise, tune alert rules, and make sure real outages still get noticed.
Network monitoring for a small agency: what to watch and why
A practical monitoring baseline for small government networks: which signals to watch, what each one tells you, and how to size a tool.
On-call rotations for small agency IT teams: schedules, pay, escalation
How small government IT teams can build an on-call rotation that works: schedules, escalation tiers, hand-off notes, standby pay, and budget.
TLS certificates and domain renewals: the expirations that cause outages
How agencies can inventory every TLS certificate and domain they depend on, with owners, expiry dates, funding, and automation.
Endpoint imaging and zero-touch provisioning for agency devices
How agencies move from bench imaging to zero-touch enrollment for laptops, patrol tablets, and rugged field devices.
Service account hygiene: inventory, ownership, and rotation
How agency IT teams can inventory service accounts, assign named owners, and rotate credentials without breaking scheduled jobs.
Privileged access management for agencies: vaults, sessions, and rollout
What privileged access management tools do, which pieces a small agency needs first, and how to write PAM requirements.
Removing local admin rights from staff computers without breaking work
A practical plan for taking local administrator rights off agency workstations without stranding staff who legitimately need to install things.
Active Directory tiering: protecting domain admin in a small agency
How the Active Directory tier model works, and a practical sequence a small agency can follow to protect domain admin credentials.
Certificate lifecycle management: ending expired certificate outages
How agencies can inventory certificates, assign owners, and automate renewal so expirations stop taking public systems offline.
Web application firewalls and DDoS protection for agency websites
How state and local agencies evaluate WAF and DDoS protection for public websites, from monitor mode to contract terms.
Protective DNS for local government networks
How protective DNS blocks malicious domain lookups, where enforcement gaps appear, and what to ask before an agency buys it.
Finding the agency systems you forgot: external attack surface reviews
How state and local agencies can find internet-facing systems nobody remembers owning, and keep that inventory current each quarter.
API security testing before an agency endpoint goes public
How to security test an agency API before it goes public, from authorization flaws to contract terms and go-live evidence.
Data lineage for agency reporting: tracing a number to its source
How to document the path from a source system field to a published figure, and what lineage details to record by hand.
Impact analysis before you change a field, report, or source system
How agencies can find every report, extract, dashboard, and submission that depends on a field before changing it.
Reference data and code lists: keeping shared values consistent
How agencies define, own, version, and distribute code lists so department, fund, case, and status values stay consistent across systems.
Geocoding accuracy: match rates, match types, and handling failures
How to measure geocoding quality using match rates, match types, and tie handling, and what to do with records that fail to match.
Storing sensor time series: retention, downsampling, and rollups
How agencies set retention windows, downsample sensor and meter readings into rollups, and choose a time series store.
Dashboard governance: owners, certification tiers, and retirement
How agencies separate certified dashboards staff may cite from exploratory ones using owners, definitions, reviews, and retirement.
Automated data tests that run before a dashboard refresh publishes
How agencies can automate row count, null, duplicate, referential, range, and freshness checks before a dashboard refresh publishes.
When two systems report different counts: a reconciliation method
A repeatable method for reconciling counts that disagree between a source system, a data warehouse, and a published report.
Synthetic data for testing agency systems without using real records
Why copying production records into test environments creates risk, and how to build synthetic and masked datasets that still catch real defects.
Website governance: page ownership, content standards, and review
How agencies assign page ownership, set content and accessibility standards, and run recurring reviews that retire stale pages.