Government Cloud in Princeton North, NJ

That mismatch is exactly the design brief: the obligations — records retention and production, privacy, audit, open government — do not scale down with the staff, so the machinery must supply what headcount cannot: retention applied by rule, evidence collected as controls operate, access governed by register rather than memory. The estate is sized to the office (its real workloads, its budget’s real shape) while the disciplines are kept at the standard an auditor applies. Small offices that adopt this posture stop experiencing their obligations as a series of ambushes and start answering them from standing records — which is the entire difference between a scramble and a system.

As a designed workflow rather than an emergency: the archive is indexed by custodian, matter and date as it accrues; retention rules keep what the schedules require (and dispose, provably, of what they release); a request becomes a search with the responsive set assembled and the potentially exempt material flagged for counsel’s review before anything leaves. Response time collapses from weeks of excavation to hours of retrieval and review, and the body’s answer carries its own evidence — the search recorded, the set defined. Where the body already has a process, the estate is fitted to it; the machinery serves the duty, never the reverse.

It closes, in one act, by register: every identity is individual and inventoried — employees, officials, the vendor’s technicians — so a departure, a lost election or an ended contract maps to a defined set of closures executed the same day, with the closure itself logged. The recurring discovery in the obligations inventory is the opposite state: accounts of the departed still live, vendor access granted for a project three years finished, shared logins nobody can attribute. That is the finding the identity work exists to eliminate permanently, because in a public body an unrevocable access is not an inconvenience — it is an audit paragraph.

The programme is planned around both: phases scoped and costed as documents a board or council can act on, timed to the budget calendar rather than a vendor’s quarter, with the estate’s running costs stated as a managed monthly line and its waste reported like any public expenditure. Where cooperative or state contract vehicles simplify the purchase, the plan uses them; where the body’s own procurement requires competition, the specifications are written so the body can run it. Nothing in the engagement requires the office to contort its rules — public procurement discipline is treated as a design constraint of the same dignity as the records law.

The applicable set depends on the body’s work — the records and open-government duties of New Jersey public bodies, privacy obligations for resident and student data, the security expectations carried in insurance and in state guidance, and any sector regimes the body’s functions touch (payments, health-adjacent services, education records). The obligations inventory names the regimes that actually bind the body — including, honestly, where duties are ambiguous and counsel’s reading governs — and the controls are engineered and evidenced against that named set. What is never sold is a blanket certification claim: the deliverable is controls mapped to your obligations with evidence an auditor can follow, which is what compliance, examined closely, actually is.

In the archive strategy, which the inventory prices honestly: the retention schedules decide what must be digitised (the actively requested, the permanently retained), what can remain physical under proper indexing, and what the schedules already release for disposition. Digitisation, where justified, is done as records work — indexed, quality-checked, chain of custody kept — not as a scanning bulk purchase. The aim is a single retrievable estate across eras: the 1998 resolution and yesterday’s email answerable from the same search, each with its provenance intact.

Phased to the budget process: the obligations inventory as a defined first engagement; the build and migration in board-approvable phases, each with its deliverable and its price; operations as a plain monthly line with usage and waste reported. Priced against the body’s real alternatives — the scramble costs of the unrehearsed audit or the badly answered request, the staff hours the manual machinery consumes, the risk carried uninsured in an unexamined estate — which the inventory states in the body’s own figures where they exist. No phase is proposed whose predecessor’s evidence does not justify it, and the specifications are the body’s property throughout.