Frequently asked questions

HQT is pursuing the California Multiple Award Schedule and local vendor registrations. Agencies purchase from HQT by direct purchase order under their small-purchase threshold, through a solicitation, or through a prime contractor.

A well-scoped assessment, integration, or advisory task that fits under an agency's informal purchase threshold. Defined deliverables with clear acceptance criteria suit both sides.

Yes. HQT is registered or registering with agencies in its region and provides tax information, insurance certificates, and any required business license on request.

Insurance certificates, including cyber liability, general liability, professional liability, and workers' compensation, are provided to agencies on request and before contract execution.

Generally yes. We expect standard public-sector terms including termination for convenience, non-appropriation, data ownership, and audit rights, and we review each contract for insurance and indemnification requirements.

Yes. HQT maintains a written security program aligned to the NIST Cybersecurity Framework and answers questionnaires from it with supporting evidence.

Yes. HQT performs technical work packages under prime contractors' existing contracts and joins proposal teams under teaming agreements.

Certification applications are in progress. Current certifications will be listed on this page as they are granted.

Fixed price when the scope can be defined precisely, and time and materials with a not-to-exceed ceiling when it cannot. Every proposal states its assumptions and acceptance criteria.

Federal registration details, including the Unique Entity ID, are provided to agencies and prime contractors on request.

Both. We recommend a commercial or low-code product when one fits the agency's process, and we build custom software when the process is distinct or when public-facing quality, accessibility, and integration needs exceed what a product offers. The recommendation comes from the requirements, not from what we would prefer to build.

The agency does. Code is delivered into the agency's own repository with build pipelines, tests, and documentation, so that agency staff or another vendor can maintain it.

Every interface is built and tested to WCAG 2.1 Level AA, including screen reader testing of primary workflows, and we deliver conformance documentation with each release.

Yes. We scope releases as fixed-price increments with defined outcomes and acceptance criteria. The agency has budget certainty per release, and the team has room to adapt details within it.

We offer support agreements with defined service levels, regular dependency and security updates, and a managed backlog for small enhancements, priced as a fixed monthly fee that fits an annual budget.

Amazon Web Services, Microsoft Azure, and Google Cloud, including their government regions where data classification requires it. We recommend the provider that fits the agency's existing licensing, staff skills, and compliance needs.

Tagging standards, budgets and alerts by department, scheduled shutdown of non-production environments, rightsizing, and a monthly review with finance staff. These controls are set up in the landing zone before the first workload arrives.

That is the goal. Environments are defined as infrastructure as code, documented, and handed over with runbooks and training. Nothing depends on knowledge that only HQT holds.

The design documents the shared responsibility split between the provider, the agency, and HQT for each control, uses services and regions appropriate to the data, and applies encryption, access control, and logging to meet the applicable policy.

Yes. We can operate or augment network operations, systems administration, and service desk functions under a support agreement with named contacts and service levels.

Interviews, review of policies and configurations, technical validation such as vulnerability scanning, scoring against the NIST Cybersecurity Framework and CIS Controls, and a prioritized roadmap. The executive summary is written for a council or board; the technical detail is for the staff who fix things.

They may be subject to requests. We structure reports so that sensitive technical details can be withheld under applicable exemptions while the summary remains shareable. Agency counsel makes the final determination.

Yes, under written rules of engagement agreed with the agency, covering scope, timing, and emergency contacts. Reports include reproduction steps and evidence, and we retest to confirm remediation.

Yes. We scope which systems and people fall under the CJIS Security Policy, perform gap analysis, implement controls, and prepare audit evidence. HQT staff assigned to public safety work complete the required background screening and training.

Multi-factor authentication on everything internet-facing, tested and isolated backups, patching, centralized logging, and an incident response plan that has been exercised. These address the majority of real incidents and are prerequisites for cyber insurance.

Agreeing on definitions. Most reporting problems come from different reports calculating the same measure differently. We start with a metric dictionary and an owner for each measure, then build the platform and dashboards on that foundation.

Yes, with the handling those data require. The platform design separates and protects regulated data while allowing aggregate reporting, and we document the rules for each dataset.

Yes, for defined use cases with measurable outcomes. Every model ships with a model card, validation and bias testing results, monitoring, and an operating procedure that keeps a person responsible for consequential decisions.

Grounded in agency sources with citations, evaluated against real examples before deployment, logged for audit and public records, and hosted within an approved boundary for sensitive data. We do not deploy open-ended generation for consequential tasks.

Power BI, Tableau, and open-source alternatives, depending on the agency's licensing. The governed data platform underneath matters more than the visualization tool.

No. We integrate the systems agencies already run, build the tools vendors do not provide, manage the data those systems generate, and modernize the applications around the core platforms.

Staff assigned to this work complete CJIS fingerprint-based screening and security awareness training. Integrations use encryption in transit and at rest, record-level audit logging, and synthetic data outside production.

Yes. We assess GIS layers against NG911 data standards, build validation and cleanup tooling, and integrate location data with dispatch and mapping applications.

Definitions documented and reviewed with command staff and legal counsel, suppression and aggregation rules applied automatically, and automated pipelines so published data stays current.

Yes, alongside them. Integrations are built against vendor APIs where available, documented, and monitored, and we coordinate with vendors during upgrades.

No. HQT has no reseller relationships with the products it helps agencies evaluate or oversee, and we do not bid on solicitations we helped write. Independence is documented in the engagement agreement.

Represents the agency's technical interests during a vendor implementation: reviewing deliverables against the contract, tracking risk, analyzing change requests, validating data migration, and advising on acceptance and go-live.

Yes. We develop statements of work, testable requirements, evaluation criteria, demonstration scripts, and contract exhibits such as service levels and acceptance criteria, working with the agency's purchasing office.

Independent confirmation that a system was built correctly and meets the agency's needs, performed by a party other than the one that built it. It is often required by state and federal funding for large systems.

Fixed price for defined deliverables such as an assessment or a solicitation package, and time and materials with a ceiling for ongoing oversight through an implementation.