Cloud, SaaS, colocation, or on-premises: choosing where agency workloads run

Reference article · 8 min read

Most agencies do not make this decision once. They make it repeatedly, one system at a time, and a mixed environment accumulates: a permitting platform bought as a subscription, a finance system on a server in a converted closet, and a records system whose vendor will not support any other arrangement.

The four options below are not ranked, and none of them is a modernization strategy by itself. Each is a reasonable choice for some workloads and a poor choice for others. What settles a given case is usually not technical: the data classification and the policy that governs it, the skills of the staff who will operate the result, whether the money is capital or operating, and the network at the buildings that use the system.

Each section follows the same shape: what the agency is buying, where it tends to fit, what the agency still owns, and where it tends not to fit.

Public cloud

The agency rents compute, storage, and managed services from a provider and remains responsible for what it builds on top.

Where it tends to fit: uneven or seasonal demand, resident-facing applications, analytics, development and test environments, and recovery into a second region.

What the agency still owns: identity, network design, configuration, patching above the provider's line of responsibility, backup and restore testing, and cost control. Consumption pricing and annual appropriations do not reconcile themselves. Tagging, budgets, alerts, and a standing review with finance are part of the operating model rather than an optional extra.

Where it tends not to fit: a legacy application that cannot be rearchitected and gains little from being moved as it is; an agency with nobody available to operate the environment; and an on-site process that cannot tolerate the latency or the outage exposure of reaching a distant region.

On authorizations: some providers operate regions intended for government workloads, and individual services within them hold FedRAMP authorizations. An authorization covers a named service offering at a stated impact level. It does not extend to every service the provider sells, and it does not discharge the agency's own obligations.

Vendor-hosted software as a service

The vendor runs the application and the infrastructure beneath it, and the agency subscribes.

Where it tends to fit: line-of-business categories where established products exist, including finance, permitting, human resources, case management, and records. For a department with a small IT staff and a long application list, moving patching, upgrades, availability, and often security monitoring to the vendor can be the difference between a supported system and an unsupported one. Cost is predictable within a term.

What the agency still owns: configuration, user administration, data quality, integration work on its own side, and the contract. Accessibility obligations remain with the agency regardless of who wrote the software. Renewal increases and any per-connection or per-transaction charges belong in the cost estimate from the start.

Where it tends not to fit: a process the agency has a documented reason to run differently from the product; integrations that are unsupported or priced beyond what the budget will carry; and data that cannot leave a boundary the vendor will not commit to in writing.

Because operational control passes to the vendor, the contract is what replaces it. Data ownership and export, service levels and remedies, breach notification, security documentation, accessibility conformance, and termination assistance are settled before signature, because the agency has little bargaining power afterward. Confirm where the product actually runs. An authorization such as FedRAMP, or one issued by a state-level program, applies to a specific service, not to the vendor as a company.

Colocation

The agency owns the equipment and rents space, power, cooling, and connectivity in a commercial data center.

Where it tends to fit: an agency whose server room is the weakest part of the environment and whose staff already run the systems competently. Generator power, redundant cooling, access control, fire suppression, and more than one carrier become available without a construction project, and the operating model staff already know does not change.

What the agency still owns: hardware refresh, licensing, patching, monitoring, backup, and staffing. Remote hands is billed separately, staff still travel to the site for physical work, and cross-connect, bandwidth, and power charges are commonly underestimated in the first budget. Agreements usually commit the agency for a term of years.

Where it tends not to fit: an agency that cannot staff infrastructure operations at all. Colocation moves the equipment, not the work. It also provides no elasticity on its own, since capacity is still purchased in units of hardware.

On-premises infrastructure

Servers, storage, and network equipment in space the agency controls.

Where it tends to fit: workloads tied to something physical in the building, systems that must keep running when the internet connection is down, and data under a constraint the agency has read and documented. Evidence storage, building and utility control systems, and some 911 call handling components commonly stay local for these reasons. Capital funding, including some grant and bond money, is often easier to apply to equipment than to subscriptions.

What the agency still owns: everything. Power, cooling, physical security, patching, monitoring, restore testing, and a refresh cycle that competes for capital in every budget round. Single points of failure accumulate easily, and operational knowledge tends to concentrate in one or two people.

Where it tends not to fit: when it is selected by default rather than from a requirement the agency can point to. One common default is worth checking directly. The CJIS Security Policy does not prohibit cloud hosting of criminal justice information; it permits it when the policy's requirements are met, including encryption, access control, audit logging, personnel screening, and contractual terms with the provider. The policy is revised periodically and is administered with your state CJIS Systems Agency, so confirm the current version and any additional state requirements there.

How to decide

Take these in order. Each one can eliminate options, which is faster than scoring all four against every dimension.

Data classification and governing policy. Read the current policy text for the data in question rather than a summary. If it imposes residency, screening, or contractual terms that a provider or vendor will not accept in writing, that option is out no matter how good the architecture looks. If it imposes none of those, do not let an assumption remove an option either.
Tolerance for losing connectivity. Ask how long the process can run without the network, and what the staff do at hour two. Anything that must keep operating through an outage needs local or hybrid processing; anything that can wait does not. This question alone usually separates the dispatch floor and the treatment plant from the back office.
The operator after go-live. Name the person or the contract that will patch, monitor, restore, and answer at two in the morning, and say what happens when that person leaves. If the honest answer is that nobody will, public cloud and colocation both become poor choices, and vendor-hosted software is the model most likely to survive.
Funding shape and sustainability. Capital dollars buy equipment more readily, and operating dollars carry subscriptions. Check whether the recurring cost survives in the base budget after any grant period ends, because a subscription funded by a one-time award turns into a service reduction later.
Portability. Determine whether the application can run in more than one place, or whether the vendor has already made the hosting decision. If the decision is already made, the remaining work is contractual rather than architectural, and the evaluation should be weighted accordingly.
Exit. Identify the export format, who holds the data, how quickly it can be retrieved, and what a transition would cost, before committing. An option with no credible exit path is more expensive than its price suggests, and should be scored that way.
Recovery objectives. State the recovery time and recovery point the agency will be held to, then check which options meet them at a price the agency will approve. Objectives written after the purchase tend to describe whatever was bought.

If two options survive all seven, the decision is genuinely close. Price over the same term, the skills of the staff who will operate it, and the strength of the proposed contract can settle it.

What this means for your solicitation

State constraints, not conclusions. Describe the data, the governing policy, the network at each site, the integrations, and the recovery objectives, then let proposers show a hosting model that meets them.
If more than one model is acceptable, require pricing for each over the same term, including implementation, migration, recurring cost, and exit.
Require the shared responsibility split in writing, control by control, among the provider, any vendor, and the agency. Ambiguity here becomes an unpatched system later.
Ask for authorization evidence for the specific service being purchased, at a stated impact level, rather than for the platform underneath it.
Score whether agency staff can operate what is delivered, and require the documentation, administrative access, and training that makes that possible.

Where HQT fits

Workload inventory and disposition analysis, hosting comparisons priced on a common basis, cloud environment design, migration planning, and support for on-premises and colocation environments where those remain the right place for the work.

Frequently asked questions

Does the CJIS Security Policy prohibit cloud hosting?

No. The policy allows criminal justice information to be stored and processed in cloud environments when its requirements are met, which include encryption, access control, audit logging, personnel screening, and contractual terms with the provider. The policy is revised periodically and is administered with your state CJIS Systems Agency. Confirm the current version and any additional state requirements through that office rather than working from a summary.

Is cloud cheaper than on-premises?

Not reliably, and cost by itself rarely settles the decision. Cloud replaces a capital purchase with a recurring operating cost, which suits some budgets and strains others. Compare total cost over the same number of years, including hardware refresh, licensing, facilities, staff time, and support. Include migration and exit costs on both sides, since those are where estimates most often fall short.

What does a FedRAMP or state-level authorization actually tell us?

It tells you that a specific cloud service offering was assessed against a defined control baseline and authorized at a stated impact level by a sponsoring body. It applies to the named service and its boundary, not to the vendor as a company or to every product the vendor sells. Ask which service and which impact level the authorization covers, and whether the product you are buying runs inside that boundary. Some states run their own authorization programs with their own requirements and naming, so confirm what your state accepts.

Can an agency mix these models?

Most agencies do, and it is usually a reasonable outcome, because different workloads have different constraints. The risk is unmanaged sprawl, with a separate identity system, backup approach, and monitoring tool in each environment. Decide each case deliberately, keep one identity provider and one logging destination wherever you can, and document which workloads live where and why.

What if the vendor will only host the application itself?

Treat the hosting model as fixed and put the effort into the contract. Settle data ownership, export format and frequency, service levels and remedies, breach notification, security documentation, and termination assistance before signing. Confirm where the data resides, which subcontractors are involved, and who at the vendor can access agency records. If those answers are unacceptable and the vendor will not change them, that is information about the product and it belongs in the evaluation.