Cloud & Enterprise IT
Network Engineering & Operations
Designing, upgrading, and monitoring the networks that connect agency sites and staff.
What this covers
Agency networks span city halls, field offices, fire stations, treatment plants, and remote sites, often connected over a mix of fiber, carrier circuits, microwave, and cellular links. HQT designs and operates these networks with an emphasis on segmentation, resilience, and visibility.
Typical activities
- Network assessments and documentation of current topology and configurations
- Segmentation design that separates public safety, utility control, business, and guest traffic
- Wide-area design including SD-WAN, carrier diversity, and failover
- Wireless design and surveys for campuses, yards, and public facilities
- Firewall and access control rule reviews and cleanup
- Monitoring, alerting, and on-call operations support
What you receive
Documented designs and configurations, a change history, monitoring dashboards, and operational procedures that agency staff can follow.
Considerations for public agencies
Public safety and utility control traffic has distinct availability and isolation requirements. CJIS Security Policy, for example, sets expectations for how criminal justice information traverses the network. We design with those requirements as first-class constraints.
Signs the network needs engineering work
A few conditions point to a design problem rather than another hardware refresh. No current topology drawing exists, or the newest predates recent equipment changes. Core switches, firewalls, or wireless controllers have passed the manufacturer's last date for software maintenance, so security fixes no longer arrive. A single VLAN carries staff desktops, cameras, building automation, and a workstation that touches criminal justice data. A site depends on one carrier circuit, or a second circuit exists but has never been failed over to. Wireless complaints cluster in identifiable places: council chambers during televised meetings, garage bays, maintenance yards. The firewall rule base contains permits nobody can attribute to an application or an owner, and new requests are met by adding a rule rather than editing one. External events also force the question: an insurance questionnaire, an audit finding, a new facility, or a carrier contract nearing renewal.
How to verify the work, and where it commonly fails
Segmentation holds only when traffic between zones passes through a device that inspects it, each allow rule names an application and an owner, and no temporary permit from the cutover is still in place. Circuit diversity holds only when the carriers use different building entrances and different upstream paths rather than different account numbers, and when failover has been exercised with the results written down. Device configurations should come from templates and live in version control, so a failed switch is restored from a known file instead of rebuilt from memory. Checks should follow the paths people use, including a synthetic test of a service such as a permit portal from a branch office and a voice quality measurement, not only whether a device answers a ping. The common failures mirror each of those: an overlay running across two circuits that share a last mile, alerting so noisy that staff stop reading it, exceptions that live only in one administrator's memory, and a design that assumes closet power, cooling, or fiber the building does not have because the site survey was skipped.
Dependencies that sit outside the agency
Network work is rarely greenfield, and much of the schedule risk sits at the boundaries. Access to court systems, state databases, and criminal justice applications often runs over a network operated by a state agency with its own connection standards, security review, and lead times, so treat it as a queue rather than a task the project controls. Dispatch and records vendors publish port and quality-of-service requirements, mobile data in vehicles depends on cellular and sometimes private backhaul, and 911 call delivery may arrive over a separate network run by an emergency communications authority. Operational technology is usually attached somewhere already, including plant SCADA, traffic controllers, building automation, and cameras, often maintained by facilities staff or an integrator rather than IT and intolerant of an unannounced scan or reboot. Where a managed service provider is in place, settle who holds configuration authority and who responds overnight before work starts.
Requirements to write down, and measures to check afterward
These requirements are easier to enforce in the solicitation than in a later change order.
- As-built documentation in editable source files, with exported device configurations, delivered before final payment
- Equipment, licenses, and support contracts registered in the agency's name
- A per-site cutover plan with a defined rollback point, a success test, and a named person authorized to call the back-out
- Maintenance windows bounded by blackout dates the agency sets, such as election periods, payroll close, and storm season
- A site survey accepted as an early and separate deliverable, so scope can be adjusted where closets differ from the record drawings
- Monitoring data and dashboards that stay accessible and exportable if the engagement ends
Afterward, the measures worth tracking are unplanned outage minutes per site against a baseline taken before the work, the share of devices running vendor-supported software, documented results from failover tests, the share of firewall rules carrying an owner and a review date, and how often an outage is found by monitoring before a department or a resident reports it.
Working with HQT on this
HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.
Frequently asked questions
How do we know whether we need a redesign or just new equipment?
Replacing hardware closet by closet keeps whatever topology is already there, including flat addressing, single-path wide-area links, and firewall rules with no owner. A redesign is warranted when the addressing plan, segmentation, or site-to-site paths no longer match how the agency operates, for example after adding facilities, moving applications to hosted services, or taking on public safety or utility control traffic. A short assessment that records current topology, traffic flows, and software support status usually answers the question before any purchase is committed.
Do we need SD-WAN, or is a second circuit enough?
A second circuit adds capacity and something to fail over to. SD-WAN adds policy on top of that, including which application uses which path, how a degraded path is detected, and how branch configurations stay consistent. Agencies with a few sites often get most of the benefit from diverse circuits and a well-configured firewall pair, while the case for SD-WAN grows with site count and with the number of hosted applications that should not be backhauled. In either case, confirm that the two circuits do not share the same last mile or the same entrance into the building.
Can public safety and utility control traffic share infrastructure with the rest of the network?
Often yes, provided traffic between zones passes through an enforcement point and sensitive data is encrypted in transit. The CJIS Security Policy sets requirements for protecting criminal justice information, including boundary protection and encryption, and the state CJIS Systems Agency interprets how it applies locally, so work from the current version rather than an older reading. Some system vendors, state agencies, or operational technology safety cases still call for physically separate paths. Ask each system owner what their governing policy requires and get the answer in writing.
Will a cutover take systems offline during working hours?
Most core switch and firewall cutovers need an outage window, but the window can be scheduled, scoped, and bounded. The usual practice is to stage and test configurations in advance, cut over one site or one layer at a time, and keep a defined rollback point so the change can be reversed when the success test fails. Agencies should name blackout dates early, including election periods, payroll processing, and periods of high public safety demand, and confirm who is authorized to approve or abort a change overnight.
Are there funding sources for network upgrades at a local agency?
Availability varies by state and by year, so confirm the current status of any program rather than relying on a past cycle. The federal E-Rate program supports eligible schools and libraries, which can include a public library operated by a city or county, and federal and state cybersecurity grant programs have at times treated segmentation and monitoring as eligible costs, subject to appropriation and to the administering agency's rules. Capital improvement budgets, utility enterprise funds, and state 911 fee revenue are sometimes available where the work is tied to a specific facility or service, within the limits set by state law. Most applications require a documented current state, so an assessment usually has to come first.