Government Cloud in Lawrenceville, NJ

The duties decide that, and they are not scaled to your headcount: the retention schedule, the records-request clock, the resident data’s sensitivity bind the small office exactly as they bind the city. What scales is the design and the price: the governed ground is structured to your records’ real classes and your actual load, the operation is shared as a service rather than staffed as a department, and the migration is staged to your calendar. Overkill would be a platform built for a ministry; this is proportionality engineered the other way — full governance, village weight. The honest comparison is not against doing nothing; it is against the small office’s actual current position, which the discovery documents: most find the duties already assume a ground they don’t yet have, and the gap — not the cloud — is the extravagance.

As a procedure instead of an excavation. The records live in classes with retention built into the platform, so what should exist does exist, and what should have been disposed of has been — both halves matter to a lawful answer. Search reaches across the governed estate (mail, files, the records systems) from one place, so the responsive set can be assembled and its completeness stated honestly; productions are logged, and the clock is met from standing capability rather than heroics. The office’s own policies still govern what is released — the platform changes the mechanics, not the judgement, which stays with the officer where the law puts it. Offices usually feel this benefit at the first request after migration: an afternoon’s administration where a fortnight’s archaeology used to be.

They are treated as the trust they are, with the chain documented: every class inventoried before it moves, moved in rehearsed stages, and reconciled at landing — counts, samples and integrity checks proven and recorded — before the source is retired. Nothing is deleted in transit; the old ground remains until its replacement has carried the work through a full cycle of the office’s real life (a meeting cycle, a records request, a month-end). Access during the move is named and logged, and the sequence is planned around the public calendar so no statutory deadline ever sits inside a migration window. If a stage’s reconciliation fails, the stage reverses — the records stay where they were, whole, and the stage is re-planned. The standard is the one a clerk would apply to moving a records room: nothing leaves a shelf until its new shelf is proven.

Named officers, in roles fitted to their actual duties — and nobody else, including, by design, the platform’s own operators beyond their governed support access. The discovery maps who genuinely needs what (the clerk who answers requests, the officer who maintains the register, the part-timer who must not reach the sensitive class), and the platform enforces that map: individual identities, no shared logins, leavers’ access ending the day they leave, every access logged so the office can answer ‘who saw this’ with evidence. Residents’ data is the office’s trust, not its asset, and the design treats it accordingly. The access map is reviewed on cadence with the office, because duties change faster than configurations do.

In the shapes public money requires: the discovery as a fixed engagement with its report as the deliverable; the build and migration priced in stages against the design, each stage separately fundable across budget cycles without stranding the whole; the standing operation as a predictable line, itemised, with the tenancy’s own costs (the cloud rent) shown separately and optimised on cadence — public money accounted for in public form. The design also respects the budget’s reality in its proportions: retention and governance automated by the platform instead of purchased as staff hours, capacity sized to the office’s true load. What the programme won’t do is hide the whole-life cost inside a low first figure; the proposal prints the tenancy, the operation and the stages together, because that is how a responsible officer has to present it.

The office follows a sequence that was written before it was needed: the platform’s copies — governed, separate, and proven by scheduled restoration — bring the records and systems back within the recovery order the plan sets (public-facing duties first), while the access discipline limits any single compromise’s reach. The standing operation carries the technical response; the office’s part is communication, and it gets the facts in plain language as they are established: what happened, what data was touched, what is restored, what happens next — the material for the statement the office will have to make, accurate in the meeting where it’s made. Afterwards, the incident enters the record with its lessons engineered into the platform. Small offices cannot staff this capability; they can, on governed ground, genuinely have it.

Proportionately, and in the open: discovery fixed; the governed build and the migration stages priced against the design before each begins, separately fundable; the standing operation as a predictable line scaled to the office’s estate, with the cloud tenancy’s own rent itemised beside it and optimised on cadence. Against the total, the honest counterfactual for a public body is not a competitor’s quote — it is the cost of the duties discharged the current way (the clerk’s evenings inside a records clock, the recovery that exists as a hope), and the unpriceable one: the public failure, in public minutes, of a duty the office owed. The programme’s figures are presented whole-life and itemised, because public money is spent in the open or not at all — a discipline this village’s offices will find entirely familiar.