[Navy blue CAI "We power the possible" logo appears on screen with white background, with www.cai.io below in black.]

[Title slide. The slide title reads: "Mastering Cloud Strategy: Exploring AWS and Azure Potential." Above the title in smaller teal text reads: "A NACo Webinar". Near the bottom of the slide, two logos are aligned horizontally. On the left under text that reads "CAI is a sponsor of" features the National Association of Counties logo, and on the right features the navy blue CAI logo with tagline "We power the possible".]

[The slide title in bold white font reads: "Mastering Cloud Strategy: Exploring AWS and Azure Potential". Below the title, the date "December 12, 2024" is displayed in bold white font. The background picture features a series of transposed lines and numerical data, indicating programming code or data streams. The name "Seamus Dowdall" appears in the top right corner of the slide, alongside a photo of a talking head, indicating the speaker.]

00:00:08 - 00:00:37
Seamus Dowdall
Well, hello everybody, good afternoon or good morning depending on where you are tuning in from. You are joining the National Association of Counties webinar titled Mastering Cloud Strategy: Exploring Amazon Web Services and Azure Potential. Welcome. My name is Seamus Dowdall, I serve as the legislative director for telecommunications and technology at the National Association of Counties or NACo. Pleased to have you here today.

[The slide title is "Speakers". Below the title, three sections are lined up vertically on the left. The first section includes an image of Elizabeth Lo with text: "Elizabeth Lo, Chief Operations Officer, Universal Services (HCUS) Harris County, Texas". Below that is an image of Sean Higginbotham with text: "Sean Higginbotham, IT Director Cascade County, Mont." On the right side, horizontally aligned is an image of Matt Peters with text: "Matt Peters, Chief Technology Officer CAI".]

00:00:38 - 00:01:19
Seamus
And with that I will jump into why we're here today before I introduce and pass along the baton to our speakers. So today's webinar is focused on cloud strategy, so as local governments increasingly turn to cloud services to enhance their technological capabilities, it is crucial for county leaders to make an informed decision. Different services are needed for different workloads. And it's challenging to balance the best choice for your overall technology portfolio. So today's webinar is going to delve into a lot of the essentials on selecting whatever the right cloud service provider may be for both your short and long-term government cloud objectives.

00:01:20 - 00:01:56
Seamus
And as a part of today's conversation, we're going to hear from two counties, one urban, one rural. The first will be from Harris County, we'll have Elizabeth Lo, who is the chief operations officer under the Universal Services division of Harris County, join us to share Harris County's strategy and perspective. And then we'll also have Sean Higginbotham join us from Cascade County, Montana, where he serves as the IT director. Of course, this conversation will be moderated by Matt Peters who serves as the chief technology officer at CAI.

00:01:57 - 00:02:57
Seamus
And I'll just share a few key takeaways that you can expect from this conversation before I pass it over to Matt. So first you'll get to understand the different cloud service providers that are out there, so you'll get an understanding of what some of the unique benefits are that they offer for government operations. You'll also get some key insights into security considerations. So how to understand the advanced security features and protocols that are necessary to protect sensitive government data and ensuring robust defense against cyber threats and compliance considerations. Cost management and efficiency, so we'll learn about some different strategy to manage licensing, migration and maintenance costs effectively while maximizing the efficiency and scalability of your cloud services. And then we'll talk about performance measures as well. So learning how to evaluate and monitor the performance of cloud services to ensure they're meeting the demanding needs of government operations and provide reliable service delivery.

00:02:58 - 00:03:09
Seamus
So with that, I'm going to pass it to our moderator here to kick off the conversation. Once again, thanks for joining this webinar today, and with that I will pass it over to Matt Peters.

[The name "Matt Peters" appears in the top right corner of the slide, alongside a photo of a talking head, indicating the speaker.]

00:03:10 - 00:03:48
Matt Peters
Thank you so much, Seamus, I appreciate it. Hello everybody. As Seamus said, my name's Matt, I'm the chief technology officer at CAI. If you are not familiar with us already, I'll tell you we are a professional services firm headquartered in Pennsylvania, and not exclusively but predominantly focused on state and local government, that is the vast majority of the business that we do. We've been partners with NACo for ... we're now actually going on a couple of years now. We were part of the founding team for the AI exploratory committee. We've had a lot of different vehicles for engagement with NACo. And glad to be here to get into another fun and interesting topic on NACo's behalf.

00:03:49 - 00:04:07
Matt
So in my seat as the chief technology officer for a professional services company that supports state and local government, we get to dive in and out of a lot of different kinds of tech, a lot of different methodologies and successes and failures for how governments try to get things off the ground, get them rolling.

00:04:08 - 00:05:01
Matt
I think cloud is actually a really interesting and a really timely one right now because we, even at just some of the most recent NACo events, we've been seeing a little bit of a shift in the way that a lot more of the local government seems to be thinking about cloud. A few years ago there was still a lot of language and a lot of attitude that was best summarized as cloud over my dead body. And I've seen a lot of that really start to fall away even at the local levels. And we're starting to see that now cloud has a potential role to play in your overall strategy for just staying not only modern but also secure. There are obviously cost benefits to keeping a lot of things on-prem, and there's just sort of a good feeling if you're a real nerd about being able to walk into a closet and see a bunch of servers and feel good that they're there, they're plugged in, they're running and this is great.

00:05:02 - 00:05:19
Matt
But when you need unpredictable flexibility in how things are going to perform and you need to, as all of you absolutely do, you need to stand up against a very dynamic and very rapidly shifting threat landscape cloud starts to bring a very different value prop into the conversation.

00:05:20 - 00:06:03
Matt
And so that was really why we wanted to talk about this particular topic today and talk, as Seamus said, pretty much about cloud implementation strategies and options. There are some elements of today's conversation that I think will be a little bit abstract and methodological. And others that are probably going to get into a little bit of the weeds and the nuts and bolts of some specific cloud deployments. And I'll rely on people that know more than me about that and have even more hands-on than me to talk a little bit more about that. As we get into that topic, I'll give Sean an opportunity to introduce himself to all of you.

[The name "Sear Higginbotham" appears in the top right corner of the slide, alongside a photo of a talking head, indicating the speaker.]

00:06:04 - 00:06:51
Sean Higginbotham
Well, good afternoon everyone. As Matt just noted, I'm Sean Higginbotham, I'm the information technology director for Cascade County, Montana. My department, the department of technology, is a centralized function within our organization and we provide the technical services for all offices within our political subdivision. We support a user base of approximately 450 people, in the summer that grows a little bit, but generally it's 450. Currently we have nine technical positions in our department and two administrative positions supporting all of the county's technical operations.

00:06:52 - 00:06:54 
Matt
Thank you, Sean. 

[Two speakers appear on screen. Sean Higginbotham is on the left and Matt Peters is on the right.]

00:07:15
Matt
I will tell all of you, not unlike most of you, Liz is also a leader in local government, and should be unsurprising, has a lot of things going on right now. And so she's going to be joining us a little bit late. So I think we're going to start off with a conversation just between me and Sean. And as soon as Liz pops in, we'll give her a chance to introduce herself and we'll get into some of the other aspects of the conversation.

00:07:16 - 00:07:43
Matt
I'll give a caveat real quick, I'm not necessarily an AWS evangelist by any means, but I have a feeling, at least for the short term, as Sean and I have a conversation around cloud options, I'm going to sound like one. But I'm a big believer in both. I'm a big believer that both of those platforms have really taken a lot of strong steps in the last couple of years toward a higher degree of feature parity.

00:07:44 - 00:08:19
Matt
There used to be, in my opinion, and I'll allow Sean to disagree with me if he wants to, a lot more differences between the two. And areas that were historically extreme strengths of Microsoft's, Amazon has started to catch up and vice versa. So I feel like the two environments, they're still different enough, they're very much worth talking about. And especially from a cost containment and an integration standpoint, they still feel very, very different from an administrative level. But we're going to get into a little bit more of the hows and whys if you will of how some of these cloud decisions get made.

00:08:20 - 00:08:39
Matt
All right, Sean, I'm going to try not to make it feel like it's me versus you right now, but I'm going to throw it to you anyway and start with a question to you about, can you tell us a little bit about the cloud decisions that you've made for your county and why and what influenced the decisions to take you to where you are today?

00:08:40 - 00:08:41
Sean
Oh boy, I think-

00:08:42 - 00:08:43
Matt
No wrong answers.

00:08:44 - 00:09:07
Sean
I feel like first, Matt, what I want to bring forth is there is a variety of cloud offerings out there. And the first models that I want to bring up are your platform as a service, your infrastructure as a service, your software as a service. These are three very different cloud models.

00:09:08 - 00:09:35
Sean
And when we were looking at our business strategy goals, we determined that the infrastructure as a service would really be the best choice for us as it gives us the most flexibility. And so as we were navigating who provides infrastructure as a service cloud offerings, we looked at Azure and we decided to go with them for several reasons.

00:09:36 - 00:10:25
Sean
The primary reason that we selected Azure was its ability to integrate into our technology stack. We are a Microsoft shop, and so it was really easy for us to integrate into that model. One of the other things, and full disclosure, we've been in Azure now for probably 12 years, one of the other things that really drove us to the Azure cloud environment was we needed to be able to meet certain regulatory requirements such as CJIS. And when we were looking at AWS at the time, they did not have the ability to provide us true CJIS compliance. And so we ended up jumping on the Azure bandwagon there.

00:10:26 - 00:10:51
Sean
The other big thing for us is really anytime we've had to deal with our regulatory compliance issues, whether it's CJIS or for example HIPAA, they got us a BAA within days. So I mean, it really just did the flexibility and the ability to meet those regulatory compliance issues.

00:10:52 - 00:11:37
Matt
Yeah, no, I take your point on that. Actually several counties that we work with are actually ... CJIS is an excellent example of an area where it, for all the right reasons, it sort of cripples a lot of your opportunities and a lot of your options when you need to adhere to it. And it's also, I'd argue, whether intentional or not, an extremely smart jumping off point as part of the evaluation process. Because it sounds to me like the evaluation criteria that you're describing is really, we leaned in on the hardest thing to accommodate. And if that works then the logical downstream effect is we can do everything else that we want to as well. Is that fair?

00:11:38 - 00:11:44
Sean
Absolutely. I mean, if you can meet CJIS, everything else is going to be pretty easy it seems like.

00:11:45 - 00:12:06
Matt
Yep. I feel very much like you're right. Within that deployment and that decision-making process, were there any other specific benefits that you were able to realize or anything like that, either something that you were looking for or maybe something that Microsoft brought to you or suggested to you that you weren't anticipating that was high value?

00:12:07 - 00:12:43
Sean
Again, it's that integration into our technology stack. For us, we are a very small shop, so the integration piece and the ease thereof was very important to us. We've got a lot of projects that are always ongoing. We just don't have the resources to sit there and baby a 10 to 12 month integration project. So what we did was we really focused on that seamless integration. And I can't stress enough how nice that is for a smaller environment like ours.

00:12:44 - 00:13:19
Matt
Yeah, yeah, no, I can easily imagine. And then I guess, we're working with counties of all sizes on this front, but yeah, realistically, especially since for most government entities that we're working with across the board, we come in and we find at least a reasonable level of comfort and familiarity with active directory. And sort of spring-boarding from that and everything else, it does make Azure an easy road to go down comparatively speaking. Yeah, I understand that. I'm not at all surprised to hear it.

00:13:20 - 00:13:59
Matt
I will say, this isn't meant to sound as a judgment or a good or a bad thing, in talking to a lot of different counties that have gone with either Amazon or Microsoft as a solution in this space, I do hear a lot of variability in the ways and the degrees of support that they received in trying to get the initiative off the ground. I'd be curious if you could talk a little bit about what your experience was with Microsoft on that front. What was the support like? How did getting questions answered feel? And I'll just go ahead and speculate and think that it wasn't a perfectly clean and easy and on-time transition.

00:14:00 - 00:14:01
Sean
No, no, no.

00:14:02 - 00:14:06
Matt
You'd have been the first, that would've been awesome too, that could have changed the trajectory of this whole conversation.

00:14:07 - 00:14:48
Sean
No, it's obviously getting into the cloud always has some issues therein. One of the issues is we would be assigned technical project leads. And we would have to really slow down a lot of the conversations just due to some of the language translations that we would experience. And then we would bring up topic X, topic Y, and then we would have to get to a whole nother team to onboard topic X or topic Y. So those were the struggles that we had really getting into it.

00:14:49 - 00:15:20
Sean
When it comes to the support aspect that we have received, I've got to give the Azure team a little bit of kudos here. At some point in time they were decommissioning one of their data centers, and we had our data located in that data center, and they were like, "Hey, you've got a year to get this data out." Okay. So we tried to move our data to one of the different data centers and it wouldn't work. So we went round and round and round for this.

00:15:21 - 00:16:04
Sean
And Microsoft effectively had shut down that data center besides our data. So we had their technical team engaged for over five months to ensure that we were actually able to be successful in that migration to another data center. And when I talk about timelines of that length, most of our vendors go into the, "That's a development issue, we'll get somebody else after it," or you'll never hear back. It's good luck. So just to give them a little bit of credit, I mean, they really stepped their game up in ensuring that we kept our data.

00:16:05 - 00:16:50
Matt
Yeah, I'm glad and relieved to hear it. And I want to give Microsoft a bit of credit here too because I think it's fair, I mean, we certainly see AI, we interact with a lot of small counties. We hear an answer similar to yours much more often than not. And I think it's important to add a little bit of perspective to that and really think about what an investment and what a point of focus it is for a company the size of Microsoft, with everything that they have going on, that for a local government deployment of their services they're still throwing quality engineers at you, they're still giving you the support that you need. That's a hard thing to do for any company. But for Microsoft, there's that ... you would expect that added justification requirement of, well, how much money can we possibly squeeze out of them?

00:16:51 - 00:17:36
Matt
And at least within the government space, I don't really hear a lot of dialogue or narrative around that that makes me feel like the county was a victim of something like that. Which feels like evidence that Microsoft's really being a good and a healthy partner in this space. And I think it's neat because for the role that we tend to serve, a lot of the time it means counties are coming to us and saying, "Oh, hey, we put this platform XYZ in, I can't even get them to answer the phone. Can you please help?" And it's for the same reasons, well, they're a big company and we're a small engagement and they're just not going to pay attention to us. And not really the same problem with Microsoft. Not that I'm here to take sides for anybody, I'm from CAI, we have Azure deployments, we have AWS deployments, we do everything that we need to do.

00:17:37 - 00:18:00
Matt
But I'll say that Amazon is also, I feel like this is an area where they're really investing and they're really leaning in pretty hard right now and trying to get that same experience that Microsoft has created available for counties. So it wouldn't be a reason that I would advise anybody necessarily today to stay away from Amazon. If it's a concern or a consideration you've heard in the past, I feel like they're addressing it pretty well right now.

00:18:01 - 00:18:08
Matt
But with that, I'll actually, I'm going to, Sean, I was about to offer you to start asking me questions so it didn't feel like I was interrogating you. 

[Another speaker, Elizabeth Lo, appears on screen below Sean Higginbotham and Matt Peters in the center of the screen.]

00:18:09 - 00:18:17
Matt
But Liz is here, so I'm going to pause and give, for the benefit of the audience, I'll give Liz a chance to introduce herself.

00:18:18 - 00:18:20
Matt
Oh, we can't hear you though.

00:18:21 - 00:19:26
Elizabeth Lo
How do I ... there I am. I'm so sorry, I apologize, really. I've had quite a day already. My name is Liz Lo with Harris County Universal Services. Just started the job a little less than two months ago, so this has been a wild, wild ride. Harris County, Texas is the third-largest county in the United States, the largest county within Texas. So population wise, we're about 4.8 million according to the 2024 census. Seeing growth like everybody else. And the county itself contains about 33 cities and 12 large unincorporated populations. Just give an idea of the capacity and size and complexity. We have 70 different departments, about 18,000 employees, and we're looking at 3000 servers. So quite a bit, the scope is probably as big as I can imagine anybody getting. But I know there's always a number one-

00:19:27 - 00:19:28
Matt
Just a little bit bigger than Sean.

00:19:29 - 00:20:07
Elizabeth
Just a little bit bigger than Sean. And again, apologies for everything. So what we're looking at is our, not just scope, but budget. So for our fiscal year '25, our budget was about $96 million. So it is quite extensive. But what Universal Services does, in addition to technology, we do provide fleet services, 311, public safety technology, radio and all that. So it encompasses physical security and whatnot. So obviously the biggest part of what we do is technology, and that's why I am here today to speak to Harris County's journey to the cloud.

00:20:08 - 00:20:23
Matt
Right on. Well, thanks for joining us. To catch you up really quick. Sean and I have been talking a little bit about just sort of cloud service providers a little bit more broadly speaking. Sean is here as an Azure customer, has yet to express any buyer's remorse or otherwise unhappiness.

00:20:24 - 00:20:38
Matt
So can you just also give us as a group a little bit of a background on exactly what platforms are you working with principally in the cloud space? And how did you come to the decisions to choose the ones that you did?

00:20:39 - 00:21:03
Elizabeth
Absolutely. Thank you. So Harris County is really trying to take a very strategic approach to our cloud journey. So our stance if you will is we're not going to put our eggs in all one basket. So we're looking at multiple cloud providers. Azure is obviously one of AWS, but we've got Oracle cloud infrastructure we're looking at as well as Google cloud. So those are the big players, the big names if you will.

00:21:04 - 00:21:24
Elizabeth
And so what we're doing is trying to be very strategic about it. So Azure, obviously a very common platform that Microsoft, Microsoft Outlook and whatnot. So it makes sense to ... that's a platform that's an easy lift and shift for a lot of people. So that is a provider we are definitely planning on working with. And we do currently for a number of our applications.

00:21:25 - 00:21:58
Elizabeth
AWS is another option that we're looking at as well. We have several of our applications on AWS. And part of it is about the fit, what fits the technology best. Some things that, just so you know, you're considering now, Harris County is a PeopleSoft client, so we use that for HR, payroll, financial system. So that being said, being on Oracle, OCI makes a lot of sense because of the licensing. So it would be a net-zero license for us to go to OCI. So those are the three different players we're looking at.

00:21:59 - 00:22:21
Elizabeth
And the other thing is that, this is not a we're throwing everything into cloud, very much a hybrid. So we have an on-prem instance for our primary, but we are planning on using the cloud for backup. So that's where we feel like there's a lot to leverage and there's a good solution for us. So that's how we're navigating this cloud journey if you will.

00:22:22 - 00:23:08
Matt
Awesome. And you mentioned a little bit about, I'm going to paraphrase and say cost sensitivity around what a lot of this means. I think you bring up a really interesting point because on the one side, you have a county as large as Harris County that has the budget to be able to do some risk mitigation and everything else through some vendor distribution. But on the flip side, I don't know what the distribution is big versus small counties on the call today looks like, but I'd also say there's room, especially with the major providers, that if you're focused and all of your buying is going into one, if you're a small county you get the most competitive pricing. You sort of create the most opportunities for your partner at the vendor side to give you the best pricing and the most options that they possibly can.

00:23:09 - 00:23:45
Matt
It is a little bit of a double-edged sword, because I take your point, Liz, it's great to be able to spread all of that out, do a lot of your, I guess, confidence of ownership by spreading that around a little bit. But I also, I'm speaking for Sean, and I don't mean to, I would imagine that with a smaller budget when you lean in on Microsoft, and it's everything that you're going to have and do, that does get you to the best negotiable price point per unit that you can get to. But I don't know if that was your experience or not, Sean. So I guess I'll take that halfway back and let you correct me if I'm wrong.

00:23:46 - 00:24:48
Sean
Oh, cost, cost, cost. One of the problems of being so small, and I get to work with larger counterparts throughout the States or throughout the United States, is we really don't have a lot of negotiation power with Microsoft directly. One of the things that we have found is to actually look at some of the tech giants that have larger negotiating or have large negotiation powers with Microsoft if you will. And we've also looked at the smaller value-added resellers. And one of the things that we have found as far as costing goes is that we've actually been able to drive down our cloud costs and increase services using our smaller VARs. And so that's one of the niceties of shopping around.

00:24:49 - 00:25:32
Sean
One of the other things that we have found is that, through our VARs and them being able to start getting our enterprise agreements set up and all of the stuff that goes along with that, is once those enterprise agreements are established it really starts to lock your costs in. So then it becomes more of an OPEX that you can actually calculate for. And that's not to say that it's not terrible going with the Dells and the whoever else is your partner, but we have found that some of the smaller value-added resellers can actually provide a little bit more in that space.

00:25:33 - 00:26:12
Matt
Yeah, I totally agree. And actually it's a nice springboard to talk a little bit about cost control and cost containment and predictability in cloud. So I'll actually, you started answering what would be my question already, Sean, but I'll ask it anyway in case there's anything you want to add before we throw to Liz. Are there any cost-saving measures, techniques, or anything else that you've learned along the way that have been valuable to you to help, not only make that a predictable cost, but also make it arguably the lowest cost it can be in the interest of all the other things that you need to do with the budget that you have? And then Liz, I'll ask you the same thing once Sean has a chance.

00:26:13 - 00:26:58
Sean
Oh boy, here we go. So the one thing that I have to talk about, the cloud, the cloud, the cloud, is it's really important to understand your service costs. The cloud service providers are going to charge you for your storage, they're going to charge you for your CPU, they're going to charge you for your memory, so on and so forth. One of the things that we found that we weren't ready for was that we're getting charged for data getting transported in and out of our cloud. And suddenly there was this cost there. And then there was power, and then there was some other things and it was like, what is all of this? I mean, why am I getting charged for that? But again, going back into that, once we got everything locked down, that OPEX model, it was a lot easier to work with.

00:26:59 - 00:27:40
Sean
As far as direct cost savings, our Azure cloud, it's got some tools out there that allows you to do some cost comparisons on your resources, I guess, if you will to right-size it. Other things that we have found is that we've got workloads that don't need to be run during the prime time of the day during the normal business hours. And so certain things that we do is we schedule our servers to shut down at six o'clock in the evening, they'll power back on at seven A.M, so we're not using all of this compute.

00:27:41 - 00:28:12
Sean
As far as other things that we've been able to do, speaking of computational workloads, we've actually looked at or we have used, I guess, lack of better words, cheaper resources when it's not that prime time. So we've been able to negotiate using, I guess, dead time for when they still have to have this stuff available, but it comes into us [inaudible 00:28:14]

00:28:13 - 00:28:18
Matt
What about you, Liz, anything, what do you do to keep them from burning your whole budget?

00:28:19 - 00:28:41
Elizabeth
So I think that's really, take a step back, I mean, I agree with everything that Sean says, but it goes back to governance. So, we haven't really, one of the things that we are really looking at is an IT governance structure. So part of it is, what's really important? What really needs to be backed up? I mean, everything does, but is it 24 hours, is it seven hours, what are we looking at? And so that governance structure is really important.

00:28:42 - 00:29:13
Elizabeth
This cloud journey is not technology driven per se, it's actually in a number of different parties. You have your financial team, you have your departments, they need to be playing all in the same sandbox with what does this mean, what does it mean to, okay, what are your tier zero, tier one. I mean, not everybody, unfortunately, not everybody gets to be a tier one. We have to make some priority decisions and we all have to agree to that.

00:29:14 - 00:30:06
Elizabeth
This is an ongoing process for Harris County. I mean, we have a list of, oh my goodness, we were saying how many do we have? How many do we have? And it's always a, at this point in time. So we have about 656 apps, systems if you will, 534 are actually in use. So there are quite a few that are being retired, but hasn't quite left our infrastructure if you will. So those are the kinds of discussions that we're having right now with the department because it goes all the way back to COOP planning too. What's the continuity of operation? What has to come up when you have a hurricane, when you have a snowstorm, Sean? Those types of things that, natural disasters are easy, but there are things that are not as easy, cybersecurity attacks. So when that happens, I need to know what needs to come up first, what comes up second, what comes up third.

00:30:07 - 00:30:37
Elizabeth
And so that actually can help actually reduce some of your costs because not everything comes up. And where is it located? So there are certain places that we're, and it's fairly complicated methodology they got going, so I rely on my CTO to tell, he's got a grand plan. But there certain things that are on-prem, certain that are code, some things are hot backups and what does that look like? And then there's a whole thing with backup. How often are we backing up this data?

00:30:38 - 00:30:59
Elizabeth
I think about my experience with public safety, CAD, RMS, I mean, ERP systems, it's not good enough to be 24-hour backups. Now we're talking a one-hour backup, two-hour backups, four-hour backup. And then the moment that we have to restore, if they don't have that point in time, that's what we've got.

00:31:00 - 00:31:17
Elizabeth
So I would say that for the biggest part is yes, we can look at the cost, and you can start doing some trimming and streamlining if you will. But the hardest thing if you will is that whole governance process, making sure everybody is bought in and understands what that means.

00:31:18 - 00:31:43
Matt
Yeah. Also I appreciate you're running a very hybrid environment. And Sean, I'm guessing, we didn't explicitly talk about it, but I'm guessing that you have a combination of on-prem and in the cloud that you're working too. I'd be interested in, for either or both of you, what actually drives the decision for you, if this is what needs to be on-prem, this is what's going out into the cloud, is that purely just a sensitivity play or is there more to it than that? And I guess, I'll start with Sean, yeah.

00:31:44 - 00:32:24
Sean
I guess, Liz just touched on it quite well, it is a, it's about the availability aspect. So we have certain services up in the cloud that we need to have available 24/7. We have other services on-prem that we don't. And just going back to what Liz just talked about, we also have that COOP cog, that continuity of operations plan. As an organization we've defined what needs to come up first, second, third, and so on and so forth. So yes, we are definitely a hybrid environment.

00:32:25 - 00:33:02
Sean
The one thing that I need to stress, and Liz you just brought this up at the right time, is back-up. It is your responsibility to ensure that your systems are being backed up. It's not good enough to just think that, hey, my cloud provider is, they've got that handled because it's in the cloud. They don't. You specifically have to engage them for those types of services. So just to go back into what Liz was saying there on the backups.

00:33:03 - 00:33:07
Matt
Liz, anything else that drives your decision, on-prem, out in the cloud, which cloud, any of that?

00:33:08 - 00:33:33
Elizabeth
So this is what's really interesting. So a little bit about my background, born in Minneapolis, so I guess real city if you will, but I've also worked in southwest Virginia, and that's where I recently came from. So southwest Virginia, think about Roanoke, think about Lynchburg, think Blue Ridge Mountains, lots of mountains, lots of mountains. And broadband is an issue. They are still on their broadband journey to get broadband to the community.

00:33:34 - 00:34:00
Elizabeth
And when I started with Bedford County in 2020, I mean, I had a fairly small staff, and I was starting to hire folks and this and that. I had a project manager that did not have broadband at home. She was using the hotspot from her work phone to work remotely. Now, think what that means. So we're talking about a cloud journey. If I don't have broadband, the cloud doesn't do me any good.

00:34:01 - 00:34:18
Elizabeth
So there are things that, now I'm county, Houston, you think it's the hotspot of the world, I have connectivity 24/7. I think I've rebooted my own wifi router three times since I've been here. That's one thing. Those are easy fixes.

00:34:19 - 00:34:52
Elizabeth
But in all sincerity, Harris County, you would think, wow, huge, huge, cosmopolitan, urban, the definition of urban. No, there are pockets where there is no broadband. And that is really something that folks should think about. It's like, yeah, okay, this is great, but if I can't get to it, I mean, does a cloud journey make sense to me or does it make sense to keep it on-prem? And so that's some of the things that I was dealing with at Bedford County is like everybody's saying let's go to the cloud. I'm like, okay.

00:34:53 - 00:35:12
Elizabeth
I'm working on a one gig circuit. I'm not talking a 10 gig circuit, a one gig. I mean, that was sufficient. I mean, we talk about 500 gig and all these kinds of ... keeps on going higher and higher. And it's great, seems like you could use for a lot of productivity. But for these smaller localities, it's not a reality yet.

00:35:13 - 00:35:47
Matt
Yep, totally agree, yeah. I mean, yeah, it's fascinating to me because I didn't know that that was even afflicting Harris County, because it seems like it should be solvable there. But I get that it's true everywhere. I mean, I don't live that far from the nearest pharmacy, but there's very little broadband where I actually live, and just in central Pennsylvania, which doesn't even feel as rural as the parts of Virginia as you're describing, but it is. And yeah, there's a lot of people that really just don't have access, it's true everywhere. It's worth all of us remembering. It's a great point. Thanks.

00:35:48 - 00:36:46
Elizabeth
And so what I would think about that, so when we talk about moving our services online, I mean, that was a big push. I can recall a county administrator and he says, "I need to meet where my constituents are." So at Bedford County, I guarantee you, December 5th, there was a line out the door to pay for taxes. Now, we were looking at obviously putting a portal on and things like that. But were they actually going to use that? Is the taxpayer, is the community ready for that? I mean, that becomes a whole different discussion that we're talking about, digital education, what that means, what that looks like. Cyber security, how do you know that I'm getting ... am I getting a real tax bill from Bedford County or am I getting some kind of, I don't know, I don't want to name names, but like a phish, spook? So that's something else to consider. I know we're all going there. And eventually we will all be connected to the matrix, but not yet for some places.

00:36:47 - 00:37:24
Matt
Yeah. I think it's timely, it's important. You both brought up the criticality of backups. And obviously sometimes that's just critical because things fail. Not everything that you plug into the wall works every single time. But they're also particularly significant because, as I know both of you are aware of, I assume everyone on this is aware, you are the ideal target for a foreign entity trying to attack the United States. Local and county government, you're seen as some of the most vulnerable, but still have extremely critical and valuable data. You're such a great way in.

00:37:25 - 00:37:48
Matt
And I see it firsthand because as a supporter of local government, CAI, we are always in the blast radius of all the attacks that you get. I don't know what the attack is right now, I just know we're under attack right now. So there's the other side of cloud concern and benefit, which is really that that threat landscape is so dynamic, it's changing all the time. It's almost impossible for anyone to keep up with it.

00:37:49 - 00:38:08
Matt
But I would like to talk a little bit about security specific to cloud right now. And I'd say let's just start that conversation with, for either of you, Liz, I'll start with you on this one, are there any specific security features that are made available to you through the cloud vendors that you work with that are particularly important to Harris County that you rely on?

00:38:09 - 00:38:31
Elizabeth
Well, I mean, I think we try to hold the vendor to the same standard that we hold ourselves. So having a security policy, I mean, you would think that's the basic fundamental thing, what is your security policy? What's your incident response plan? Do you have vulnerability scanning? What about MSA? I mean, those are the things that the vendors, you assume they have. Not necessarily.

00:38:32 - 00:38:53
Elizabeth
For me, when I was at Bedford County, the easiest way for me to maintain at least some semblance of security was through active directory SSO. If I had that integration and the user access control was that way, the moment somebody left the county, I could flip off the switch, deactivate, they lost connectivity to that.

00:38:54 - 00:39:33
Elizabeth
When it becomes so diversified, now I'm looking at like, okay, I got to remember this app is different, this app is different. And that's where it gets hard to manage if you will. So I think that the biggest for me is what is the vendor doing? What are they doing to protect the environment that we're putting our data in? And making sure they're meeting those SOC, standard 12, SOC 2. I mean, there's a lot of software as a service being thrown out there and they say, "Hey, we've got all the SOC compliances." But do you really? Is it really just more of, I don't want to say, is that high level operational, but did you actually dig into what that SOC 2 looks like?

00:39:34 - 00:39:59
Elizabeth
So for Universal Services, they spent some time, a lot of time putting together a, what they call USRA, so a US referential architecture, is basically a 15 page document, boom, boom, boom, boom. Do you guys do this? Yes, no, we can manage the risk. Is this some risk that we want to take on? No, this is not a risk we want to take on. So for every app that's coming in, for every solution that's being proposed, we are looking at it that way.

00:40:00 - 00:40:00
Matt
Sean?

00:40:00 - 00:40:38
Sean
Well, as Liz just brought up, I was going to talk about the SOC reports. Every cloud service provider is going to have the SOC 2 reports, and you need to spend time to read them. I don't know how else to say this. But you have to spend the time to read those. That's really the only assurance that you have that the vendors are actually meeting some sort of security standards with your data.

00:40:39 - 00:41:00
Sean
And it covers a lot of things. It covers the confidentiality, it covers the integrity, it covers the availability. And there is a third party which is testing these vendors. And so they all have them. And if they're not going to give you that SOC 2 report, you probably don't want to choose them as a provider.

00:41:01 - 00:41:42
Sean
That being said, with our cloud environment, we did review the Microsoft SOC 2 that we were provided, but we also get some additional features in there. We have our Azure security center, we have our Azure active directory in place, we have, what else do we have, we've got our, I guess, if you will our journey to zero trust is starting with our Azure environment because they have the ability to always do that re-authentication, re-authentication to where it's a little bit harder to do on-prem. So that's where we're moving with that.

00:41:43 - 00:42:30
Sean
There's some other advanced features with Azure that I like. They do have what they call the Azure Sentinel. And so it is a SIEM/SOAR solution. And with some of our other technologies, as we're exploring this, what we're finding is that solution can actually help protect our entire environment. And by that, whether it's on-prem or in the cloud, because of the security technology that we use, that Azure Sentinel product, that SOAR can actually get into our firewalls and rewrite the rules to address these new threats that it's seeing. So there are definitely some advantages to using these advanced security products that are available.

00:42:31 - 00:42:43
Matt
Yeah, yeah, no question. I'll pause really quickly and I'll let the audience know, if there are any questions that you want the panel to ... please feel free to put them in the chat. I can see it, I'll make sure that they get asked.

00:42:44 - 00:43:40
Matt
But while you're thinking about that, I'll throw another question at the both of you. I'm interested in, if there are any, any lessons learned from a security standpoint around your cloud implementations, anything that caught you by surprise? And I'll lead the witnesses and just say one of the things that, as I've talked to other counties that are not as far along on the journey as both of you are, one of the things that is overlooked or is invisible to a lot of potential buyers is the fact that depending on the cloud choices that you make, your data may go just about anywhere. And that's not the feel that you necessarily get from a vendor. I'm not saying it's intentional. It's just not the way it's presented. So all that said, I'm interested in any lessons learned, any particular incredible technical gymnastics that you had to do to get to a good outcome I think that's beneficial to everybody?

00:43:41 - 00:44:04
Sean
I'll just jump on that. And I started out this way, and it was meeting those regular requirements. And again, when Azure was around or when we were sourcing, and Azure could offer us that CJIS requirement of maintaining your data within the United States, that was critical to us.

00:44:05 - 00:44:51
Sean
Other things that we learned though as we were moving into the cloud, and it's really all about cloud selection, is it's knowing where the cloud service provider's responsibilities start and stop, where your responsibilities start and stop. For example, we are an IAAAS shop, and that means that Microsoft is responsible for the data centers, they're responsible for the networks, they're responsible for all the hardware, the virtualization. We are still ultimately responsible for our architectures. We're still ultimately responsible for our data and application security patching, we're still responsible for all about that.

00:44:52 - 00:45:24
Sean
One of the things that I always try to keep up front is regardless of what happens, we are ultimately liable. So if there is a data leak, whatever, it's going to be our responsibility. It's not going to be Microsoft's, it not going to be somebody else's because it's our data that we are in charge of being secure for or secure of. So lessons learned, know where the responsibility starts and stops.

00:45:25 - 00:45:34
Matt
Yep, something goes wrong, your constituents are not going to call Microsoft, they're going to call you. Yep, I get it. What about you, Liz?

00:45:35 - 00:45:57
Elizabeth
Yeah, absolutely. And so one of the things I didn't mention, and we talk about SOC compliance, the other thing, what is an easy checkbox is if it's FedRAMP certified. We all know what that means and say, okay, that's one less thing that I need to worry about. So for us, there's a lot of cloud solutions there, commercial cloud, dah, dah, dah. So when it's GovCloud, then we breathe a little bit easier, and it's a different level of scrutiny if you will.

00:45:58 - 00:46:12
Elizabeth
I think some of the other lessons learned that when you're going through this, it's like what are your KPIs? What is it that you're actually trying to accomplish? In terms of obviously availability time, we're all looking for those three nines availability, but latency, you're looking ...

00:46:13 - 00:46:17
Elizabeth
Sorry, I've got to do a little dance here. You're going to see some lights going off. Anyway.

00:46:18 - 00:46:42
Elizabeth
And for Harris County, we're looking for scalability, we're not getting smaller, it seems like we're creeping a little bit larger and larger, so we need to make sure there's some minimal latency, otherwise you'd see some performance degradation. Data transfer fee is really important. So if you've got broadband, you're good, but if you don't, then you're looking at something different. So having those KPIs, what's important? And those are technical KPIs.

00:46:43 - 00:47:19
Elizabeth
Then I would always think about, okay, take another lens, what's your operational KPIs? What's the business, what are they wanting coming out of that? And those are some discussions that need to happen so that you know what is success. Is this actually a successful endeavor that I did? So we're paying this much money, did we get this much benefit out of it or is it enough? So lessons learned for us is, we're still doing that too, I mean, we have these regular conversations about KPIs. What are we judging here? What does success look like?

00:47:20 - 00:47:35
Matt
We did get a question from the audience, so I'm going to throw that into the conversation real quick. It was a question about, can you talk a little bit about what training might've been necessary to support this transition over to start using cloud services? And I guess, Sean, if we can start with you, that'd be great.

00:47:36 - 00:48:15
Sean
Absolutely. So one of the knowns with technology, in fact with anything, is things are going to advance all the time, and we have had to ensure that we are upskilling our staff and we're upskilling them continually to be able to utilize these cloud services. It's that going back to that principle of you don't know what you don't know. And so we invest heavily in our employee base to ensure that they are actually capable and competent of handling our cloud services as we need them.

00:48:16 - 00:49:02
Elizabeth
Yes, I would agree. So staff training is really important. I mean, these things change so fast. Harris County has been looking at, how do we train our staff up? Yes, there's different things, and this is not cloud specific. I mean, we've moved forward a PMP certification, ITIL certification, so we're all talking the same language, and that's fundamental. I know that sounds really basic, but you'd be surprised. I mean, if you don't understand what risk is, and people talk about risk, well, I just had this, sorry, prior to this meeting, I was looking at a risk log and I'm like where's the probability? All they're talking about is impact. Risk is combination of risk probability times impact. So having a foundational training is really important. So what that looks like.

00:49:03 - 00:49:52
Elizabeth
Now for the other thing which I say with a grain of salt is that we have the opportunity to work with the vendors. Now, the vendors, we pair up our implementations with the vendors. So they bring on staff, they are training our staff on how to do this work, how they're doing the configurations. That pairing is really important so that it's not the vendors, they do all the work and then they leave us with the bag. So that pairing is really important. And I know that some organizations don't have that opportunity to pay them additional costs. But implementation services are important. I mean, if you can do it and you want to do it, and they are the experts. So if you've done your due diligence, you've done the RFP, you've done the reference check, and you've talked to people and said is this vendor a good partner to work with, that can accelerate your learning immensely.

00:49:53 - 00:50:14
Matt
Yeah, that's a great point. And I mean, it's also, if you think about it as, to my knowledge, it's very rare that an organization makes the decision we're going to cloud, and then they turn around and go back. So that principle of we got to get it right as we're coming out of the gate, that really does hugely impact your total cost of ownership for the implementation and everything else downstream from that constituent experience, everything.

00:50:15 - 00:50:45
Matt
Well, I know that both of you are busy, I know that both of you have staff and citizens that need other things from you than just this. So I'm going to start wrapping it up. But I want to give both of you a chance to hit one more item. Liz, I'll start with you. But if there's any particular tool or method that you have found is particularly useful in ensuring the performance and reliability of your cloud environment that you can share with the audience, I think that's also another thing that's just valuable for everybody to hear. Because this is one of those things where we're all in it together.

00:50:46 - 00:51:10
Elizabeth
So I've gone down that one. So in terms of a specific tool, I know we're looking for a technical tool, I would say, I'm going to steal something from Sean, because he said something really important, and it sounds really basic, it's like know where your roles and responsibilities are. You got to know what you're responsible for, what the vendor is responsible for.

00:51:11 - 00:51:25
Elizabeth
The RACI matrix, it sounds very simplistic, but there's only one A, And I've had these conversations with my project manager. If I see three As, nobody's in charge, nobody's accountable. And that's a problem for me because then there is no ownership.

00:51:26 - 00:51:47
Elizabeth
So when you're looking at your cloud journey, who's going to be responsible for what is really important. Because otherwise you might be ending up holding the bag as opposed to the vendor. Because we all think that, oh, I'm going to cloud, I'm transferring risk and transferring to the vendor. Not necessarily. If you're not careful, you might be actually holding the bag.

00:51:48 - 00:52:06
Matt
Yeah, no, I'm glad to hear you say it because it's one that I end up saying to our customers an awful lot, it's the simple things that will get us, because those are the things that people feel like we can skip. The complicated stuff is not where we're actually going to get burned. So I'm glad to hear someone else say it because I feel like I'm blue in the face a lot of the time. But Sean, I'll throw it over to you.

00:52:07 - 00:52:39
Sean
I like this question, because it's fine, you can look at all of the technical stuff, there's so much technical stuff that goes into this, throughput, resources, that at the end of the day none of that is going to matter if the user experience is poor. And so that is what I would use as the metric of how are we doing, how's the performance of our cloud service provider?

00:52:40 - 00:53:21
Matt
Yep, totally agree. Well, I appreciate this very much, I appreciate both of your time. I know that you're both extremely busy. I do think this is one of those big and meaty and difficult topics, no matter where you are in the journey, especially for somebody who's getting started, if you're paying any attention, it's scary. But even for folks that have been on this journey for a decade or more, there's still just, it's always changing, there's always a lot to learn. The more that we talk to each other about it, the better we all end up doing and the better all of our citizens and constituents end up experiencing. So I appreciate you both being willing to share your expertise, your extremely varied needs and backgrounds I think is all the more valuable. Really, really appreciate your time for this.

00:53:22 - 00:53:27
Matt
For the audience, thank you for your time. I hope this was helpful to you. 

[The slide is divided vertically into two sections. The left section features the CAI logo and tagline "We power the possible" in white text. Below, there's a QR code with the instruction "Scan to learn more about us," followed by contact information: Website: "www.cai.io," Email: "inquire@cai.io," Phone: "+1 (888) 824-8111," LinkedIn: "@CAI," and X: "@CAI_Insights". The right section poses the question, "Why choose CAI?", followed by a list of features: "Extensive team experience" with "40+ years serving government and public services," "Proven track record of success" with "Robust portfolio of successful client outcomes," "Committed, dedicated partners" with "Top 25 clients' average partner tenure over 15 years," "Innovative technology vision" with "Leading the conversation on AI and other technologies," and "Unmatched customer service" with "Great teams are built with great people," each accompanied by illustrative icons.]

00:53:28 - 00:53:35
Matt
And to NACo, thank you for a platform to talk about this because I do think it's important. And I'm really glad that we had an opportunity to do it. Seamus, if there's anything that you want to try to close with, you're welcome to.

00:53:36 - 00:54:01
Seamus
Thank you, Matt. And I think the only remaining piece to do is to thank you for moderating a great session here today and to CAI for organizing this webinar. It looks like there's more information on your screen if you do want to learn more about CAI. But on behalf of NACo as well, thank you all for joining for such a great conversation. And we will see you for the next webinar soon. So thanks again and take care everybody.

[Blue CAI "We power the possible" logo appears in middle of screen. Company website www.cai.io appears at the bottom center of the screen.]