Topic hub
Compliance and Public Records
Public records law, retention, open meetings, privacy regimes, and the system design decisions each one drives.
Every system an agency runs creates records, and those records carry obligations: retain them for a set period, produce them on request, withhold what the law exempts, and dispose of them only when permitted. Email, chat, cloud storage, and now AI assistants each made that harder.
The pages here connect the legal requirements to the design decisions they drive. Retention labels and search configuration, redaction workflows with audit trails, contract language that guarantees data export, meeting technology and its own records, and the privacy regimes that govern health, student, and criminal justice data.
Services
- Records & Public Records Support
- Cloud Architecture & Migration
- Security Assessments
- CJIS & Regulatory Compliance
- Open Data & Transparency Portals
- Digital Evidence & Records Workflows
- Security Awareness Programs
- Project & Program Management Support
- Low-Code Platforms
- Accessibility Remediation
- Data Center Consolidation
- Security Monitoring & Incident Response
Solutions by agency type
- Cybersecurity for Cities and TownsPractical security programs for municipal IT teams that support finance, public works, police, and fire with limited staff.
- Cybersecurity for County GovernmentsSecurity programs spanning health, human services, justice, elections, and public works, each with its own regulatory obligations.
- Software Development for Cities and TownsResident-facing services, staff tools, and integrations between the platforms a city already owns.
- Software Development for County GovernmentsModernizing case management, integrating departmental systems, and building the tools commercial platforms leave out.
- Cloud and Enterprise IT for Cities and TownsGetting city systems out of the basement, modernizing networks across facilities, and keeping cloud costs predictable.
- Cloud and Enterprise IT for County GovernmentsConsolidating departmental infrastructure and running enterprise services across dozens of independent departments.
- Data and Analytics for County GovernmentsCross-departmental reporting, outcome measurement, and data sharing that respects confidentiality rules.
- Data and Analytics for Cities and TownsCouncil reporting, open data, and operational dashboards built on definitions everyone agrees with.
- Public Safety and Justice Software for CountiesIntegration across sheriff, probation, jail, courts, and prosecutors, and the reporting that spans them.
- Technology Advisory for Cities and TownsIndependent help specifying, buying, and overseeing the systems a city will live with for a decade.
Step-by-step guides
- How to prepare for a CJIS auditPreparation steps for agencies and their IT departments ahead of a CJIS Security Policy audit, covering scope, evidence, and common findings.
Reference articles
- Where to run a language model: a decision guide for agenciesHow agencies choose among a commercial AI service, a provider model in their own cloud tenancy, and a self-hosted open model.
- Data classification and handling rules for agency recordsHow to build a short data classification scheme, map it to the records agencies actually hold, and attach handling rules at each level.
- Interagency data sharing agreements: what to put in writingThe clauses that make an interagency data sharing agreement workable, from legal authority and field lists to breach notice and termination.
- Data catalogs and data inventories: making agency data findableHow agencies separate a technical data catalog from a statutory data inventory, what a minimum entry in each contains, and who keeps them current.
- Privacy impact assessments before launching a new agency systemWhat a privacy impact assessment answers, and how to make it a gate in procurement rather than paperwork filed after go-live
- Constituent relationship management: what a CRM adds beyond 311How a constituent relationship system differs from a 311 service request tool, and how to scope one without starting an enterprise data program.
- Security logging and SIEM: what to collect and how long to keep itA practical order for onboarding log sources into a SIEM, how to set retention periods, and why ingestion volume drives cost
- Writing a generative AI use policy for agency staffWhat a staff generative AI policy has to decide: approved tools, data limits, review obligations, disclosure, and personal accounts.
- Homeless Management Information Systems: what HMIS requiresHow a Continuum of Care runs an HMIS: federal data standards, coordinated entry, data quality, consent, and comparable databases.
- Applicant tracking systems that fit civil service hiring rulesWhat an applicant tracking system must do under merit system rules, from requisition approval through eligible lists, certification, and audit trails.
- AI scribes and ambient documentation in agency health clinicsHow public health, behavioral health and correctional clinics should evaluate AI scribes: review, consent, recordings, and contract terms.
- Ransomware negotiation and payment policy: decide before the incidentHow state and local agencies should set ransom payment decision rights, sanctions screening, insurance, and disclosure in advance.
- Computer vision for code enforcement: imagery, privacy, and due processHow agencies use vehicle, drone, and aerial imagery to detect code violations, and the privacy, retention, and due process rules that govern it.
- Vendor AI disclosure: what to require about AI inside products you already ownHow agencies can require vendors to disclose AI features added to software they already own, and act on the answers.
- Integrated suite or best-of-breed systems: how to decideA comparison of single-vendor suites and best-of-breed systems, with the questions an agency should answer before choosing.
- A go-live readiness checklist for a new agency systemA checklist for agency project managers and department leads deciding whether a new system is ready to go live on its scheduled date.
- A data sharing agreement checklist for agencies exchanging recordsA working checklist for program, legal, and IT staff negotiating or reviewing an interagency data sharing agreement.
- Setting up a data governance program in a public agencyThe parts of a working data governance program in a public agency, and the order to put them in place without new headcount.
- Parks and recreation registration and reservation systemsHow cities and counties evaluate recreation management platforms: registration, reservations, permits, payments, and finance reconciliation.
- How long to keep surveillance video: retention schedules and litigation holdsHow agencies set camera retention periods, place litigation holds, and document auto-overwrite as an approved records disposition.
- Writing a surveillance technology use policy and impact reportA section-by-section guide to drafting the surveillance impact report and use policy your governing body will review.
- Body-worn camera video: retention, release, and storage costsHow to set body-worn camera retention by category, manage holds and redaction, and forecast what those choices cost.
From the blog
- An acceptable use policy for generative AI should govern data, not tools
- A SOC 2 report is evidence, not a certificate
- Your vendor's new AI feature is a new system, not an update
- Design audit logs around the questions you will be asked
- Three integration failures that nobody notices until the data is wrong
- Retrieval quality, not the model, decides whether an AI assistant is useful
- Five terms we think every agency AI contract should include
- CJIS for software teams: what actually changes when you touch criminal justice data
- The questions that expose a weak architecture before award
- Low-code or custom code? A decision guide for agencies
- Stop testing with production data
- Shared responsibility: what your cloud provider will not do for you
- Open data as a public records strategy
- Acceptance criteria that a tester can execute and a contract can rely on