Government Cloud in Cranbury, NJ

The obligations don’t scale down with the staff — the records duties, the resident data, the audit — so the discipline can’t either; what scales is the build. This programme’s public work is sized for the office that exists: a handful of systems and no map is a normal starting inventory, the phases are costed to a small budget process, and nothing enterprise-shaped is sold into a small office to impress anyone. The honest alternative to fitted government cloud isn’t a cheaper version of the same safety — it’s the current state (ageing hardware, unmapped access, records at excavation-depth) continuing until an incident or an audit reprices it. Start with the obligation inventory; its size will tell both of us what ‘enough’ means for your office.

Named precisely in the inventory, from your own facts: the records-retention schedules your state imposes, the public-records law’s duties, the data-protection obligations attaching to the resident and student information you hold, and the conditions inside your funding and insurance. What this programme will not do is sell you a framework your office doesn’t fall under — the fashionable certifications marketed to small government are a real industry, and the assessment’s written separation of what applies from what doesn’t is one of its most valuable pages. Controls are then engineered to the applicable set and evidenced as they operate, so the audit is answered from standing records.

By retrieval rather than excavation: the archive is structured by retention schedule and subject as it is built, records are indexed so a request is answered by search rather than by memory, and the production itself is logged — what was found, what was released, under whose review. The standing operation keeps the structure current (new records land in their places by the filing discipline, not by someone’s eventual tidying), so a request arriving in year three is answered at the same speed as one in month one. The office’s legal review of what must or must not be released remains entirely the office’s; the infrastructure’s job is to make the finding fast, complete and demonstrable.

Continuity is designed for exactly these rotations: every account is named and role-bounded, so a departure is closed in a single act and a successor is provisioned from the documentation — the same estate, legible to the new holder from its register rather than from the predecessor’s memory. Administrations change; the records, the access model and the operating reports persist as the office’s own property, maintained by the standing operation across the transitions. The estate’s documentation is deliberately written for the reader who wasn’t there when it was built, because in public service that reader always arrives.

It is planned inside one: phases costed a cycle ahead with documents a board can act on, each phase independently valuable (the archive structured first, the migration in waves the budget can pace), and the standing operation’s line reported monthly against the budget with waste named rather than buried. Procurement is treated as a discipline to satisfy — specifications written so they can be bid, comparisons documented — not an obstacle to route around. The discipline the programme refuses is the false economy: deferring the records and access work doesn’t save its cost, it converts it into incident and audit costs that arrive unscheduled and unbudgeted.

Named people, in named roles, listed in a register the office owns: that is the design’s whole point. Access is individual (no shared accounts), bounded by role, logged as it is used, and reviewed on cycle — so the answer to ‘who saw this record’ is a query, not an investigation. Vendors’ technicians get time-boxed access for specified work, closed when the work closes. The provider’s own access follows the same rules and appears in the same logs, available to the office’s auditor like everyone else’s. In public service, ‘trust us’ is not a control; the register is.

Phased to the budget: the obligation inventory as a fixed engagement (its separation of what applies from what doesn’t routinely saves more than it costs), the build and migration in board-approved phases, and the standing operation as a monthly line reported against its budget. The comparison is against the incumbent’s hidden ledger: staff weeks spent on excavations and workarounds, the incident priced at emergency rates, the audit finding answered in panic — costs the current arrangement pays irregularly and invisibly. Public money deserves the visible version: a line, a report, and evidence attached.