Resources
Sitemap
Every page on hqt.org.
Capabilities
Software Development services
Cloud & Enterprise IT services
Cybersecurity services
Data & Analytics services
Public Safety & Mission Software services
Technology Advisory & Systems Engineering services
Solutions
- All solutions
- Cybersecurity for Cities and Towns
- Cybersecurity for County Governments
- Cybersecurity for Public Safety Agencies
- Cybersecurity for Water, Power, and Public Utilities
- Cybersecurity for School Districts and Colleges
- Cybersecurity for Special Districts and Authorities
- Software Development for Cities and Towns
- Software Development for County Governments
- Software Development for State Agencies
- Cloud and Enterprise IT for Cities and Towns
- Cloud and Enterprise IT for County Governments
- Cloud and Enterprise IT for Special Districts
- Data and Analytics for County Governments
- Data and Analytics for Cities and Towns
- Data and Analytics for Water, Power, and Utilities
- Data and Analytics for Public Safety
- Mission Software and Integration for Public Safety
- Public Safety and Justice Software for Counties
- Technology Advisory for Cities and Towns
- Technology Advisory and Systems Engineering for State Agencies
- Software Development for Transit and Transportation
- Cloud and Enterprise IT for Education
- Data and Analytics for School Districts and Colleges
- Technology Advisory for Special Districts and Authorities
- Software Development for Water, Power, and Public Utilities
- Software Development for Public Safety Agencies
- Software Development for School Districts and Colleges
- Software Development for Special Districts and Joint Powers Authorities
- Cloud and Enterprise IT for Public Safety Agencies
- Cloud and Enterprise IT for Water, Power, and Public Utilities
- Cloud and Enterprise IT for Transit and Transportation Agencies
- Cloud and Enterprise IT for State Agencies
- Cybersecurity for State Agencies
- Cybersecurity for Transit and Transportation Agencies
- Cybersecurity for Corporations and Private Sector Companies
- Data and Analytics for State Agencies
- Data and Analytics for Transit and Transportation Agencies
- Data and Analytics for Special Districts and Joint Powers Authorities
- Public Safety and Mission Software for Cities and Towns
- Public Safety Software for Fire Districts and Regional Dispatch
- Public Safety and Mission Software for Transit Agencies
- Technology Advisory and Systems Engineering for County Governments
- Technology Advisory for Water, Power, and Public Utilities
- Technology Advisory for School Districts and Colleges
- Software Development for Companies Selling to Government
- Technology Advisory and Systems Engineering for Transit and Transportation Agencies
- Cybersecurity for Federal Programs Through Teaming Partners
- Data and Analytics for Corporations and Private Companies
Counties
Communities
- All communities
- Areas we serve
- San Diego
- Chula Vista
- Oceanside
- Escondido
- Carlsbad
- El Cajon
- Riverside
- Corona
- Temecula
- Moreno Valley
- San Bernardino
- Ontario
- Rancho Cucamonga
- Anaheim
- Santa Ana
- Irvine
- Long Beach
- Los Angeles
- Pasadena
- Torrance
- San Marcos
- Vista
- National City
- Encinitas
- Santee
- La Mesa
- Poway
- Murrieta
- Coronado
- Menifee
- Jurupa Valley
- Indio
- Hemet
- Palm Springs
- Palm Desert
- Lake Elsinore
- Fontana
- Victorville
- Rialto
- Chino
- Upland
- Redlands
- Hesperia
- Huntington Beach
- Garden Grove
- Orange
- Fullerton
- Costa Mesa
- Mission Viejo
- Santa Clarita
- Newport Beach
- Glendale
- Pomona
- Burbank
- Santa Monica
- El Monte
- Inglewood
- Ventura
- Thousand Oaks
- Oxnard
- Simi Valley
- Santa Barbara
Topic hubs
- Government Cybersecurity
- Cloud for Government
- Software Delivery for Agencies
- Data and Analytics in Government
- Artificial Intelligence in Government
- Government Technology Procurement
- Digital Accessibility in Government
- Public Safety Technology
- Compliance and Public Records
- Infrastructure and Operational Technology
- IT Governance and Strategy
Who we serve
- All sectors
- State Agencies
- County Governments
- Cities & Towns
- Public Safety & Emergency Services
- Transit & Transportation
- Water, Power & Public Utilities
- School Districts & Public Higher Education
- Special Districts & Joint Powers Authorities
- Corporations & Private Sector
- Federal Agencies (Through Teaming Partners)
Articles: Contracts & Procurement
- All contracts & procurement
- Purchasing routes for technology services: a summary for agency staff
- The California Multiple Award Schedule: how agencies use it
- Cooperative purchasing: using contracts other agencies have already competed
- Writing a technology RFP that gets good proposals
- Choosing a pricing structure for technology work
- Due diligence before contracting with a technology vendor
- Federal grants that fund local technology, and what they require
- Contract terms agencies should include in technology contracts
- What an owner's technical representative does on an IT project
- Evaluating AI products: a guide for procurement and program staff
- Fixed price, time and materials, or staff augmentation: choosing a contract structure
- Market research before a solicitation: RFIs, demos, and fair dealing
- Scoring technology proposals: evaluation criteria, weights, and committees
- Bid protests: common grounds and how agencies reduce the risk
- Sole source justification for software: building a defensible record
- Change orders and amendments on technology contracts
- Software license models, metrics, and true-up audits
- Service level agreements and service credits in SaaS contracts
- Insurance and indemnification in technology contracts
- Subcontractor approval and flow-down terms on technology projects
- Software escrow agreements: when an agency actually needs one
- Total cost of ownership for an agency software system
- Working with a managed service provider: scope, service levels, and oversight
- Managing software licenses and SaaS subscriptions across an agency
- Procure to pay: requisitions, encumbrances, and three-way match
- Fit-gap analysis: documenting finance requirements before an ERP solicitation
- Running a purchasing card program: limits, reconciliation, and the GL
- Requirements for an agency HR, payroll, and time system replacement
- HCM implementation contracts: milestones, parallel payroll, and holdback
- Specifying an HVAC controls upgrade without a locked proprietary front end
- NDAA Section 889: banned cameras and access control gear in agency purchases
- Energy savings performance contracts for HVAC, lighting, and controls upgrades
- What to specify when you buy a 311 or service request system
- Advance planning documents and federal cost allocation for HHS systems
- Business associate and qualified service organization agreements
- Buying aerial imagery, lidar, and change detection services
- Asking vendors for an SBOM and actually using it
- Procurement language for AI features in software contracts
- Budgeting and capping AI usage costs: tokens, seats, and overage
- Two-step procurement: qualify vendors first, open prices second
- Competitive negotiation: discussions, revisions, and final offers
- Comparing proposals priced in different ways: a cost worksheet
- Best value award: defining it before you have to defend it
- Pilot and proof of concept agreements: scope, cost, and exit
- Continuity of service when a vendor is acquired or sunsets a product
- Data portability and exit terms to negotiate before you sign
- Contract administration after award: who owns the obligations
- Vendor performance management: scorecards, reviews, and records
- Terminating a technology contract: cause, convenience, and wind-down
- Disputes and remedies: cure notices, escalation, and claims
- Participating addenda: making a cooperative contract fit your agency
- Acceptance criteria, milestone payments, and holdbacks
- Order of precedence when vendor terms conflict with yours
- Who owns the code: IP and license rights in custom development
- Debriefing unsuccessful proposers after a technology award
- Technology under a declared emergency: authority and documentation
- Interlocal agreements for shared systems: governance and exit
Articles: Technology
- All technology
- IaaS, PaaS, SaaS: cloud service models for public agencies
- StateRAMP and FedRAMP, explained
- Zero Trust architecture for public agencies
- The NIST Cybersecurity Framework for local government
- The CJIS Security Policy: an overview for agencies and vendors
- DevSecOps pipelines for government software
- Legacy modernization strategies: rehost, refactor, rewrite, replace
- API design for public-sector integration
- Low-code platforms in government: benefits, risks, and governance
- Data warehouses, lakes, and lakehouses for agencies
- GIS in local government: what it does and how it is built
- Next Generation 911: an overview for agencies
- Web accessibility and WCAG for public agencies
- Operational technology security for utilities and public works
- Identity and access management for agencies
- Backup and ransomware recovery for public agencies
- Monitoring and observability for public-facing services
- Software supply chain security for agencies and vendors
- Containers and Kubernetes for agency applications
- Network segmentation for local government
- Passkeys and phishing-resistant authentication for agency staff
- Post-quantum cryptography: what agencies should do now
- Real-time data: streaming and IoT platforms for cities and utilities
- Serverless and managed services for resident-facing applications
- Digital twins for utilities and public infrastructure
- Platform engineering for agencies that build software
- Computer vision for infrastructure inspection
- A modern data stack for agency reporting
- SPF, DKIM, and DMARC: protecting an agency's email domain
- Endpoint detection and response: EDR and managed detection for agencies
- Security logging and SIEM: what to collect and how long to keep it
- Encryption and key management: what agencies should require
- Secure configuration baselines: CIS Benchmarks and system hardening
- Physical security for server rooms, network closets, and devices
- Software asset management and license audits for agencies
- One resident login across agency services: what it takes
- Accepting online payments: merchant services, gateways, and PCI scope
- Choosing a content management system for an agency website
- Technical debt in agency systems: how to name it and fund it
- Offline-capable field apps for inspectors and work crews
- Master data management: one record for a person, place, or asset
- Address data: building and maintaining an authoritative address list
- Geospatial metadata and data standards for agency GIS
- Data catalogs and data inventories: making agency data findable
- Measuring data quality: completeness, accuracy, and timeliness
- Getting data out of a vendor system you do not control
- Running an agency service desk: tiers, service catalog, and metrics
- IT change management: approvals, maintenance windows, and freeze periods
- Device refresh cycles: planning, funding, and secure disposal
- Planning a network refresh: switches, wireless, and what to replace first
- Redesigning your chart of accounts before an ERP replacement
- Budget preparation software: what it does that spreadsheets cannot
- Centralized cash receipting: counters, deposits, and daily reconciliation
- Capital improvement program tracking from budget to capitalized asset
- Applicant tracking systems that fit civil service hiring rules
- Civil service testing platforms: item banks, proctoring, and eligible lists
- Learning management systems for mandated training in agencies
- Certification and license tracking for sworn and licensed staff
- Scheduling software for 24/7 shift workforces: police, fire, and dispatch
- Position control: budgeted positions, vacancies, and the HR-finance link
- Employee and manager self-service for a deskless public workforce
- Building automation systems on the agency network: BACnet, ownership, and remote access
- Energy management information systems: utility bills, interval data, demand charges
- Replacing an access control system: credentials, readers, and a phased cutover
- Space and lease management systems: floor plans, occupancy, and GASB 87 data
- Designing a 311 service request catalog: types, routing, and response times
- Open311 and standards-based interfaces for service requests
- Closing the loop between 311 requests and public works work orders
- Constituent relationship management: what a CRM adds beyond 311
- Building a notification preference center residents will actually use
- Contact center technology for resident services: IVR, routing, and queues
- Appointment scheduling for agency counters and clinics
- HL7, FHIR, and health information exchange for agency systems
- Benefit eligibility interfaces: verification hubs and state system links
- Building a public zoning lookup map residents can actually use
- Air quality monitoring data: low-cost sensors, calibration, and publishing
- Managing water quality sampling data and lab electronic deliverables
- Stream and rain gauge telemetry for flood warning programs
- Capacity planning for agency systems: storage, compute, and seasonal peaks
- Setting RTO and RPO targets for each agency system
- Choosing a disaster recovery site: distance, hosting, and network paths
- Database administration for agency systems on a small team
- Patching systems you cannot reboot: rings, windows, and exceptions
- Building a CMDB a small agency IT team can actually maintain
- Mapping application dependencies before a migration or an outage
- Alert fatigue: tuning monitoring so real outages get noticed
- Network monitoring for a small agency: what to watch and why
- On-call rotations for small agency IT teams: schedules, pay, escalation
- TLS certificates and domain renewals: the expirations that cause outages
- Endpoint imaging and zero-touch provisioning for agency devices
- Service account hygiene: inventory, ownership, and rotation
- Privileged access management for agencies: vaults, sessions, and rollout
- Removing local admin rights from staff computers without breaking work
- Active Directory tiering: protecting domain admin in a small agency
- Certificate lifecycle management: ending expired certificate outages
- Web application firewalls and DDoS protection for agency websites
- Protective DNS for local government networks
- Finding the agency systems you forgot: external attack surface reviews
- API security testing before an agency endpoint goes public
- Data lineage for agency reporting: tracing a number to its source
- Impact analysis before you change a field, report, or source system
- Reference data and code lists: keeping shared values consistent
- Geocoding accuracy: match rates, match types, and handling failures
- Storing sensor time series: retention, downsampling, and rollups
- Dashboard governance: owners, certification tiers, and retirement
- Automated data tests that run before a dashboard refresh publishes
- When two systems report different counts: a reconciliation method
- Synthetic data for testing agency systems without using real records
- Website governance: page ownership, content standards, and review
Articles: AI & Automation
- All ai & automation
- Responsible AI in the public sector: principles and practice
- Generative AI in agency operations: where it helps today
- Retrieval-augmented generation: AI assistants that cite agency sources
- AI-assisted redaction for public records requests
- Intelligent document processing: turning forms and PDFs into data
- AI security: prompt injection and other risks agencies should plan for
- Automating agency workflows with integration and AI
- Virtual agents for 311 and resident services
- Building an AI inventory: tracking where AI is used in your agency
- AI impact assessments: a practical process before a system goes live
- Writing a generative AI use policy for agency staff
- Bias testing for agency AI: what to measure and how often
- Designing human review for AI outputs in agency workflows
- Machine translation and language access for agency communications
- AI coding assistants on agency software projects: policy and review
- AI transcription for public meetings: minutes, captions, and the record
- AI agents that take actions: permissions, logging, and limits
- Automating accounts payable: invoice capture, routing, and controls
- Automating reconciliations: bank, cash receipts, and subledger matching
- Onboarding automation: HR as the source of truth for accounts and access
- Fault detection and diagnostics: turning building automation data into work orders
- Video analytics and license plate readers: accuracy, alerts, and policy limits
- Triaging resident messages with AI: classification, routing, confidence
- AI scribes and ambient documentation in agency health clinics
- Using AI to sort and summarize public comments on environmental documents
- RPA bots or a real integration: cost, fragility, and when each fits
- Automating document intake: classification, routing, and exception queues
- Entity resolution: matching people and businesses across agency systems
- Forecasting demand and staffing levels with your own agency data
- Anomaly detection in agency financial transactions and card spend
- AI-assisted plan review: what it can check and what it cannot
- Computer vision for code enforcement: imagery, privacy, and due process
- Model drift monitoring: watching an AI system after go-live
- Automate it or staff it: deciding when a workflow is worth automating
- From AI pilot to production: ownership, runbooks, and funding
- Text analytics on 311 comments, complaints, and survey responses
Articles: Sectors
- All sectors
- Technology in county health and human services
- Municipal permitting and licensing systems
- Public safety data transparency: reporting that informs without exposing
- Smart meter data: what utilities can do with it
- Student data privacy for school districts
- Shared IT services and joint powers authorities
- Transit technology and open data
- Parks and recreation registration and reservation systems
- Asset management and work order systems for public works
- Integrated library systems and library services platforms
- Court case management and e-filing: what a replacement involves
- Code enforcement case management: from inspection to abatement
- Homeless Management Information Systems: what HMIS requires
- Fleet management systems: maintenance, fuel, and telematics data
- Emergency operations center software and mass notification systems
- CAD and RMS: how dispatch and records systems work together
- Fire and EMS records reporting: NFIRS, NERIS, and NEMSIS
- Water and wastewater compliance reporting and operations data
- Transit fare systems: account-based ticketing and open payments
- Student information system migrations for districts and colleges
- Timekeeping and overtime rules for 24/7 public safety departments
- Replacing a utility customer information and billing system
- Collecting business tax, TOT, and short-term rental revenue
- Peace officer training records and state POST reporting interfaces
- Substitute and temporary staffing systems for school districts
- Construction project management software for public owners: RFIs to pay apps
- 811 one-call tickets: managing locate requests and positive response
- Street light inventories and networked controls before an LED retrofit
- Traffic signal systems: controllers, ATMS software, and cabinet communications
- Right of way management: encroachment permits, dig once, and small cell shot clocks
- Casework and correspondence tracking for elected offices
- Outage communication: maps, restoration estimates, and proactive alerts
- Payment plans and hardship arrangements in agency billing systems
- Running a device and hotspot lending program at a public agency
- Choosing a behavioral health EHR for a county or CCBHC clinic
- WIC management information systems and EBT for state agencies
- Medical examiner and coroner case management systems
- Electronic lab reporting, eCR, and syndromic surveillance feeds
- 988 and mobile crisis technology: call handling, dispatch, and bed data
- Electronic death registration and vital records systems
- Jail medical records: integrating health care with the jail system
- Case management for a county veterans services office
- Adult protective services and aging case management, plus NAMRS
- Keeping zoning, the general plan, and the permit system in sync
- Stormwater MS4 compliance tracking: inspections, BMPs, and the annual report
- Park asset inventories and playground inspection records
- Wildfire risk data and defensible space inspection programs
- Groundwater monitoring data and SGMA annual reporting
- Agricultural commissioner systems: permits, pesticide use reports, and inspections
- Vendor remote access to SCADA and OT systems: rules and controls
- Predictive maintenance for agency fleets, facilities, and equipment
- Body-worn camera video: retention, release, and storage costs
- Drone program policy for local agencies: flight logs and imagery
- License plate reader data: retention, sharing, and audits
Articles: Government & Compliance
- All government & compliance
- Public records law and technology systems
- Open meeting laws and technology projects
- Fiscal year cycles and technology project timing
- Cybersecurity grant programs for local government
- Vendor security questionnaires: what agencies ask and how vendors should answer
- Digital service standards: what good public services look like online
- HIPAA for public agencies: who is covered and what it requires
- Election technology security: what county IT should know
- Prevailing wage and public works rules in technology contracts
- Buying with federal funds: procurement thresholds and required clauses
- Surplus IT equipment: disposal, data sanitization, and records
- Data breach notification: what agencies must do after an incident
- Cyber insurance for public agencies: coverage, exclusions, and controls
- Data classification and handling rules for agency records
- Checking a vendor's accessibility claims: VPATs and real testing
- Open source software in agencies: policy, licenses, and support
- Interagency data sharing agreements: what to put in writing
- Records retention schedules and the systems that hold the records
- Deidentification and suppression before releasing agency data
- Open data licensing and terms of use for agency datasets
- AI prompts and chat logs as public records: retention and disclosure
- Automated decision systems: notice, explanation, and appeal rights
- AI screening tools in public sector hiring: what to check first
- IT chargeback and cost allocation between agency departments
- E-rate: how schools and libraries fund broadband and network equipment
- Fund accounting, encumbrances, and budgetary control in a government ERP
- Subrecipient monitoring under Uniform Guidance: risk, reviews, records
- Segregation of Duties and Access Reviews in a Financial System
- GASB 96 SBITAs and GASB 87 leases: getting the data out of your contracts
- Turning MOU language into HR system rules: seniority, bidding, premiums
- Overtime, callback, and FLSA 7(k) rules in agency timekeeping systems
- Pension reporting interfaces between payroll and retirement systems
- Leave management: FMLA, workers' comp, and intermittent leave tracking
- How long to keep surveillance video: retention schedules and litigation holds
- Capital asset registers: capitalization thresholds, depreciation, and reconciliation
- Publishing 311 data without exposing residents' personal information
- Texting residents: 10DLC registration, consent, and opt-out rules
- Convenience fees and surcharges on online government payments
- Choosing which languages to support and what to translate first
- CCWIS: federal requirements for a child welfare information system
- AFCARS and NCANDS: federal child welfare data reporting
- 42 CFR Part 2: consent and redisclosure for substance use records
- CEQA document management and the administrative record
- Tracking mitigation measures and conditions of approval
- Data behind the housing element and general plan annual progress report
- Hazardous materials business plans, CUPA inspections, and CERS reporting
- Floodplain records: elevation certificates, LOMAs, and CRS credit
- A coordinated vulnerability disclosure policy for a public agency
- Ransomware negotiation and payment policy: decide before the incident
- Insider risk in a public agency: separation of duties and monitoring
- Data retention in analytics platforms is not your records schedule
- Small number suppression in recurring public reports and dashboards
- Vendor AI disclosure: what to require about AI inside products you already own
- How a technology policy gets adopted by a council or board
- Surveillance technology ordinances: what they require of staff
- Bring your own device: stipends, enrollment, and records risk
- Text messages and chat apps as agency records
- Comment moderation on agency social media: what the law allows
- Social media governance: account ownership, archiving, and handoff
- Website privacy notices, analytics, and third-party trackers
Articles: Guides & Checklists
- All guides & checklists
- Cloud, SaaS, colocation, or on-premises: choosing where agency workloads run
- Build, buy, or configure: choosing an approach for an agency system
- Integrated suite or best-of-breed systems: how to decide
- Who does the work: in-house staff, a managed service, or project vendors
- Replace the system or modernize around it: a decision guide
- Run your own security operations or buy monitoring as a service
- Where to run a language model: a decision guide for agencies
- A go-live readiness checklist for a new agency system
- A pre-solicitation readiness checklist for technology purchases
- Vendor offboarding checklist for agencies changing technology suppliers
- Cyber insurance readiness: a checklist for public agencies
- A new IT director's first ninety days: a checklist
- Accessibility conformance checklist before launching a public service
- A data sharing agreement checklist for agencies exchanging records
- Public records readiness checklist for agency technology systems
- SaaS renewals: what to do in the year before the term ends
- Writing an incident response plan a small agency team can follow
- Privacy impact assessments before launching a new agency system
- Scoping a penetration test: rules of engagement and deliverables
- Security awareness training and phishing simulations for agency staff
- Data migration when replacing an agency system
- User acceptance testing before a government system goes live
- Replacing PDF forms with online forms staff can maintain
- Native app, mobile web, or PWA: choosing for resident services
- Setting up a data governance program in a public agency
- Choosing performance measures a department will actually use
- Benchmarking your agency against other jurisdictions
- Building an AI test set from your own records to measure accuracy
- What belongs in a technology strategic plan, and how to keep it current
- IT steering committees: charter, intake, and project prioritization
- Recruiting and retaining IT staff at a public agency
- Preparing staff for a new system: training, super users, and go-live support
- Parallel payroll testing before a payroll system go-live
- Year-end close and audit readiness: what your systems must produce
- Employee offboarding checklist: access, assets, pay, and records
- Parallel payroll testing checklist before an HR system go-live
- Sizing video surveillance storage and bandwidth before you buy cameras
- Construction closeout data: as-builts, O&M manuals, and new asset records
- Kiosks and assisted self-service in agency lobbies
- A confidentiality checklist for health and human services systems
- Specifying a tree inventory and urban forestry management system
- Restore drills: proving your backups actually come back
- Running a disaster recovery failover test without breaking production
- Vulnerability remediation: from scan report to closed ticket
- Incident postmortems after an outage: blameless review and follow-through
- Writing runbooks your staff will actually use at 2 a.m.
- Keeping system documentation and network diagrams current
- Tabletop exercise: a SCADA compromise at a water utility
- Tabletop Exercise: A Student Data Breach at a School District
- Security metrics that a city council or board can act on
- Tabletop exercise: a CAD outage at a 911 center
- Resident survey data: sampling, weighting, and margin of error
- Form design that produces clean data: pick lists, validation, free text
- Rates and denominators: getting per-capita numbers right
- Averages hide response times: medians, percentiles, and what to publish
- Is that change real? Small counts, noise, and year-over-year swings
- Before-and-after comparisons: what a pre/post number cannot tell you
- A data literacy program for agency staff: scope and curriculum
- Analytics staffing: central team, embedded analysts, or contracted
- Process mining and time studies: picking which workflow to automate first
- Reference checks that produce real information about a vendor
- Running an evaluation committee: conflicts, confidentiality, records
- Writing a surveillance technology use policy and impact report
- Writing an acceptable use policy for agency devices and networks
- The information security policy suite a small agency needs
- Building a records management program: roles, policy, and training
- Legal holds in agency systems: issuing, scoping, and releasing
Careers
- All openings
- Electrical Engineer, Controls and SCADA
- Electrical Engineer, Power and Facilities Systems
- Systems Engineer
- Cloud Infrastructure Engineer
- Network Engineer
- DevSecOps Engineer
- Senior Software Engineer, Backend and APIs
- Software Engineer, Front End and Accessibility
- Full Stack Software Engineer
- Mobile and Field Applications Engineer
- QA and Test Engineer
- Data Engineer
- GIS Developer
- Cybersecurity Engineer
- Security Analyst
- Solutions Architect
- Technical Writer
- Bid and Proposal Specialist
- Marketing Manager, Public Sector
- Contracts Administrator
Roles
Guides
- All guides
- How to run a technology RFP, from planning to award
- How to prepare for a CJIS audit
- How to plan a cloud migration for an agency
- How to test an agency website for accessibility
- How to run a ransomware tabletop exercise
- How to roll out multi-factor authentication across an agency
- How to plan a data migration you can defend
- How to evaluate an AI feature before you enable it
Blog
- All posts
- Engineering posts
- AI posts
- Public Sector posts
- Security posts
- Data posts
- Cloud posts
- Company posts
- Observability: knowing your application is broken before residents tell you
- Retrieval quality, not the model, decides whether an AI assistant is useful
- Small open models are good enough for many agency tasks
- Designing agency software for the counter and the phone at the same time
- Five terms we think every agency AI contract should include
- A plain-language glossary of the technology terms in your next IT solicitation
- Prompt injection is the new SQL injection, and we test for it
- An acceptable use policy for generative AI should govern data, not tools
- Patching is boring, and that is the point
- Your vendor's new AI feature is a new system, not an update
- Every model we deploy for an agency ships with a model card
- Notes on rolling out passkeys to a workforce
- How we treat AI-generated code in delivery pipelines
- Open data as a public records strategy
- Address data is the hardest data a local government owns
- Running a ransomware tabletop exercise with city leadership
- Data conversion is the project, not the last two weeks of it
- API-first integration for agencies that own a dozen vendor systems
- Using AI to triage service requests without losing the human
- Shared responsibility: what your cloud provider will not do for you
- Boring technology is the right default for systems that must run for a decade
- Stop testing with production data
- Model the cloud bill before you move the workload
- Cloud cost surprises and public budgets do not mix
- Running language models inside the agency's cloud boundary
- What we mean when we say DevSecOps
- Why we write the runbook before we write the feature
- GIS data quality becomes a life-safety issue under NG911
- Lessons from building a streaming pipeline for sensor data
- Zero Trust without buying a Zero Trust platform
- Run the tabletop for an outage, not just a breach
- What we learned building an assistant that answers questions from a municipal code
- Low-code or custom code? A decision guide for agencies
- Why dashboards go unused, and what to do about it
- A SOC 2 report is evidence, not a certificate
- We are implementing the NIST Cybersecurity Framework on ourselves first
- A one-page Zero Trust progress report for a council or board
- CJIS for software teams: what actually changes when you touch criminal justice data
- Publish DMARC at reject, then keep the callback rule anyway
- Replacing a legacy application without a big-bang cutover
- A digital twin starts with the GIS, not the platform
- The accessibility rule for state and local websites is not a future problem
- A project is not finished until the agency can run it without the vendor
- Infrastructure as code is for small teams too
- If you only do one security project this year, make it multi-factor authentication
- Why we would build a permit portal on serverless services
- What a good statement of work looks like for a software project
- Three integration failures that nobody notices until the data is wrong
- Why we started HQT
- Acceptance criteria that a tester can execute and a contract can rely on
- The questions that expose a weak architecture before award
- How a council member reads your IT budget request
- The uptime number is the least important part of a service level agreement
- Discovery should be a small fixed-price project, not a free sales exercise
- What a screen reader finds that an accessibility scanner does not
- Design audit logs around the questions you will be asked