Topic hub
Cloud for Government
Cloud service models, authorization programs, migration strategy, cost governance, and the operational practices that follow.
Nearly every agency is somewhere in a cloud transition: a few systems moved, several vendor-hosted platforms adopted department by department, and a server room that still runs something important. The questions that matter are not whether to move but which workloads, under what security model, at what cost, and who operates the result.
These pages cover the service models and what each one leaves to the agency, the authorization programs that let agencies reuse someone else's security assessment, migration approaches that do not require a single large cutover, and the cost controls that keep a consumption bill inside an annual appropriation.
HQT capabilities in this area
- Cloud & Enterprise ITCloud architecture, migration, and operations, plus the networks, identity, and end-user services that agencies run every day.
Services
- Cloud Architecture & Migration
- Data Center Consolidation
- Landing Zones & Infrastructure as Code
- Cloud Cost Management
- Disaster Recovery & Continuity
- Identity & Access Management
- Network Engineering & Operations
- End-User Computing
- DevSecOps & Delivery Pipelines
Solutions by agency type
- Cybersecurity for Cities and TownsPractical security programs for municipal IT teams that support finance, public works, police, and fire with limited staff.
- Cybersecurity for County GovernmentsSecurity programs spanning health, human services, justice, elections, and public works, each with its own regulatory obligations.
- Software Development for Cities and TownsResident-facing services, staff tools, and integrations between the platforms a city already owns.
- Software Development for County GovernmentsModernizing case management, integrating departmental systems, and building the tools commercial platforms leave out.
- Cloud and Enterprise IT for Cities and TownsGetting city systems out of the basement, modernizing networks across facilities, and keeping cloud costs predictable.
- Cloud and Enterprise IT for County GovernmentsConsolidating departmental infrastructure and running enterprise services across dozens of independent departments.
- Cloud and Enterprise IT for Special DistrictsRight-sized infrastructure, identity, and support for agencies without a full IT department.
- Data and Analytics for County GovernmentsCross-departmental reporting, outcome measurement, and data sharing that respects confidentiality rules.
- Data and Analytics for Cities and TownsCouncil reporting, open data, and operational dashboards built on definitions everyone agrees with.
- Public Safety and Justice Software for CountiesIntegration across sheriff, probation, jail, courts, and prosecutors, and the reporting that spans them.
Step-by-step guides
- How to plan a cloud migration for an agencyA practical sequence for moving agency workloads to cloud services, from inventory and disposition through cutover and cost control.
Reference articles
- Cloud, SaaS, colocation, or on-premises: choosing where agency workloads runHow public cloud, vendor-hosted SaaS, colocation, and on-premises infrastructure differ, and the criteria an agency uses to choose.
- IaaS, PaaS, SaaS: cloud service models for public agenciesWhat each cloud service model means, who is responsible for what, and how agencies typically use them.
- Setting RTO and RPO targets for each agency systemA practical guide to assigning recovery time and recovery point objectives to agency systems and using them to drive backup, replication, and contract terms.
- Legacy modernization strategies: rehost, refactor, rewrite, replaceThe main approaches to modernizing an old application, and how to choose among them.
- Containers and Kubernetes for agency applicationsWhat containers are, when orchestration is worth it, and a right-sized approach for public agencies.
- Replace the system or modernize around it: a decision guideFull replacement, incremental modernization, re-platforming, or an API layer: how to compare four options for an aging system.
- Secure configuration baselines: CIS Benchmarks and system hardeningHow CIS Benchmarks and DISA STIGs give an agency a defensible hardening standard, and how to handle levels, exceptions, and drift
- Business associate and qualified service organization agreementsWhen a health and human services vendor needs a HIPAA business associate agreement, a Part 2 QSOA, or both, and what each must say.
- Choosing a disaster recovery site: distance, hosting, and network pathsHow agencies weigh separation distance, hosting options, and network paths when choosing a disaster recovery site.
- Running a disaster recovery failover test without breaking productionHow to escalate from tabletop to live failover, scope a test to one maintenance window, and close the findings.
- Finding the agency systems you forgot: external attack surface reviewsHow state and local agencies can find internet-facing systems nobody remembers owning, and keep that inventory current each quarter.
- Continuity of service when a vendor is acquired or sunsets a productHow to write and use contract clauses that keep a government system running when the vendor is acquired or retires the product.
- Serverless and managed services for resident-facing applicationsHow agencies can run online services that scale for deadlines and cost little when idle, without managing servers.
- Who does the work: in-house staff, a managed service, or project vendorsHiring staff, contracting a managed service, or buying project by project: what each model costs an agency in money, risk, and retained knowledge.
- Vendor offboarding checklist for agencies changing technology suppliersA checklist for IT and contracting staff closing out a technology contract: notice, data return, access shutdown, and handover to the next supplier.
- Software escrow agreements: when an agency actually needs oneWhat a source code escrow deposits, what triggers release, and when export rights or ownership terms serve an agency better
- Integrated library systems and library services platformsHow integrated library systems and cloud library services platforms work, and what agencies should weigh before migrating.
- Capacity planning for agency systems: storage, compute, and seasonal peaksHow agencies can forecast storage, compute, and license growth on a budget cycle and size systems for predictable seasonal peaks.
- Data portability and exit terms to negotiate before you signHow to negotiate export formats, schema delivery, API access, and post-termination data rights before signing a SaaS contract.
- StateRAMP and FedRAMP, explainedWhat the two cloud security authorization programs are, how they differ, and what an authorization actually tells an agency.
- Backup and ransomware recovery for public agenciesWhat a backup strategy must include to survive ransomware, and how to know it works before it is needed.
- Vendor security questionnaires: what agencies ask and how vendors should answerThe purpose of security questionnaires, common questions, and how to make the process useful for both sides.
From the blog
- Shared responsibility: what your cloud provider will not do for you
- A plain-language glossary of the technology terms in your next IT solicitation
- Model the cloud bill before you move the workload
- Why we would build a permit portal on serverless services
- The questions that expose a weak architecture before award
- Cloud cost surprises and public budgets do not mix
- A SOC 2 report is evidence, not a certificate
- Boring technology is the right default for systems that must run for a decade
- How a council member reads your IT budget request
- The uptime number is the least important part of a service level agreement
- If you only do one security project this year, make it multi-factor authentication
- Infrastructure as code is for small teams too
- CJIS for software teams: what actually changes when you touch criminal justice data
- What we mean when we say DevSecOps