How familiar is your team with the FBI CJIS Security Policy?
We're familiar with the basics — the FBI's Criminal Justice Information Services (CJIS) Security Policy applies to any agency or service provider with access to criminal justice information (CJI), and it has specific requirements for MFA, encryption, audit logging, personnel security, and physical protection. We're not your CJIS Security Officer (CSO) and we're not a CJIS audit firm. What we are is the IT and security team that works alongside your agency's CJIS Security Officer or state CJIS coordinator — we own the technical safeguards (encryption, MFA, access controls, audit logging, off-site backup, endpoint protection) those professionals need to be in place; they own the CJIS policy interpretation and the audit response.
Have you worked with Arkansas law enforcement agencies and municipal clients?
Yes — we support a range of Arkansas public-sector clients including city departments, advertising and promotion commissions, and other municipal entities. The IT and security work for law enforcement adds CJIS-specific considerations on top of general public-sector IT (segmented networks for criminal-justice information, more rigorous audit logging, personnel screening on technical staff with access to CJI systems). We work alongside your agency's CJIS Security Officer and any state-level CJIS coordinator to make sure the technical side is lined up with what those professionals expect to see.
What about non-law-enforcement municipal clients — cities, water utilities, school districts?
Most of our public-sector clients are non-law-enforcement: city halls, advertising and promotion commissions, water and wastewater utilities, school districts, county offices, and parks departments. The IT and security work is the same foundation as any business client (managed IT, cybersecurity, backup, email security, MFA, training) with some public-sector-specific overlays: FOIA-ready email and record preservation, public-records retention scheduling, multi-department network segmentation, and the budget and procurement timeline differences that come with municipal work.
How do you handle FOIA-compliant email archiving and public-records preservation?
Arkansas's Freedom of Information Act sets broad transparency requirements, including for electronic records. On the IT side we implement email archiving with documented retention (so messages that fall under FOIA scope can be retrieved on demand), document-management retention policies aligned with your records-retention schedule, audit logging on record access, and the technical evidence chain your records officer or FOIA-response counsel needs. We're not your records officer and we don't make FOIA scope determinations — that's your records officer and city attorney — but we make sure the technical archive is intact and discoverable when they need it.
What's your role if a city department or police agency has a breach or ransomware incident?
We're the technical first-responders. On suspected breach: contain the scope (isolate affected systems, preserve forensic evidence, change credentials), identify what data was accessed and by whom, document the timeline, coordinate with state and federal partners (Arkansas State Police Cybercrime Unit, FBI Little Rock field office, CISA Region 6) when appropriate, and provide the technical record your agency's leadership and outside breach counsel need. We don't make the notification call to the public, the attorney general, or state and federal regulators — that's your agency's leadership and counsel — but we make sure they have what they need to make those calls correctly within the applicable notification windows.
Do you provide public-sector-specific staff training and phishing simulations?
Yes. Generic phishing-simulation content catches some attacks but misses the public-sector-specific ones: fake vendor-invoice notifications, fake grant-payment confirmations, fake state-agency directives, fake citizen-complaint forwards. We build phishing simulations around the scenarios your department actually sees, document training records (so they're available for any state or federal audit), and report measurable improvement in your team's detection rate over time.
How do you handle the slower municipal procurement timeline?
Municipal procurement is its own discipline — competitive bidding requirements, council or board approval cycles, fiscal-year budgeting, and required documentation that private-sector buyers don't deal with. We're set up for it: detailed scopes of work suitable for council packets, fixed-fee proposals that respect your fiscal-year planning, flexible engagement structures (managed services agreement, project-based work, or hourly retainers), and the patience to move through your procurement process rather than around it.
How are you different from a public-sector-IT consultancy?
Most public-sector-IT consultancies deliver a written assessment and an invoice, then leave you to find an MSP to actually implement and operate the controls. We're the operator — we do the IT and security work day-to-day, alongside whatever public-sector-IT consultancy, CJIS Security Officer, or state coordinator your agency works with for the regulatory and policy interpretation. Plus we're locally based in Arkansas with same-day on-site response across 10 counties, not a national consultancy billing $300+/hour out of a different time zone.
