Government Cloud in Hightstown, NJ

The obligations don’t scale down with the staff — the records duties, the resident data, the audit — so the discipline can’t either; what scales is the build. This programme’s public work is sized for the office that exists: a handful of systems and no map is a normal starting inventory, the phases are costed to a small budget process, and nothing enterprise-shaped is sold into a small office to impress anyone. The honest alternative to fitted government cloud isn’t a cheaper version of the same safety — it’s the current state (ageing hardware, unmapped access, records at excavation-depth) continuing until an incident or an audit reprices it. Start with the obligation inventory; its size will tell both of us what ‘enough’ means for your office.

Only the named roles the inventory assigns it to — and the proof is structural: every account individual, access bounded per role, the vendor’s technician admitted for the task and closed after it, the whole register reviewable on demand and reviewed on schedule. When a role ends, one act revokes it everywhere, and the revocation itself is logged. The office can therefore answer the resident’s or the auditor’s question — who could see this record, and when — from records rather than from recollection. In small offices the honest incumbent state is usually ‘whoever has the password’, which is exactly the sentence this programme exists to retire.

It is planned inside it rather than against it: the phases are costed against the budget calendar, each with documents a board or council can act on, procurement routes respected, and no phase’s commencement dependent on another’s emergency. The standing operation is a legible monthly line with its state reported in minutable language, and the optimization step’s whole job is to keep that line fitted — waste named and removed in the open. Where grant or shared-service funding is in play, the documentation is produced in the formats those processes expect. Public money’s discipline is treated as a design material: an estate that cannot be defended in the budget meeting is, whatever its engineering, unfinished.

The public record is made survivable independently of the building: protected copies held apart from the primary estate, restoration tested on schedule against the records’ own priorities (the counter’s systems first, the archive whole), and the recovery order rehearsed rather than theorised. A borough’s records are its memory and its legal evidence; the design treats their survival as the first requirement, ahead of convenience features, and the tests are reported in the monthly state like everything else. The flood, the fire and the ransomware note are all answered by the same exhibit: the last successful restoration, dated.

Designed around that fact: the inventory is built from short structured conversations and the estate’s own artefacts, not from homework; the migration waves run outside counter hours and are verified by the programme, with the office’s role being decisions, not labour; and the standing operation’s reporting arrives written for the meeting, not as a second job. The clerk’s local knowledge is the project’s most valuable input — where things actually live, who actually needs what — and it is harvested respectfully, in hours, once. Thereafter the arrangement returns time to exactly that person: retrievals in hours, access questions answered from the register, the excavation weekends ended.