In the last 90 days, we’ve sat down with multiple counties across Oklahoma.
Different commissioners.
Different sheriffs.
Different budgets.
Same invisible competitor every time.
It’s not another Managed Service Provider or IT provider.
It’s not internal IT or lack thereof.
It’s not a lower bid.
It’s not a new software platform.
It’s this sentence:
“We know it’s not ideal… but it works.”
In county government, that sentence usually applies to two things:
IT infrastructure and or the phone system.
What “It Works” Usually Means
When a county tells us their IT “works,” here’s what we often find:
- Backups haven’t been tested in years.
- Firewall rules haven’t been reviewed.
- Admin passwords are shared.
- CJIS documentation is assumed, not validated — and that obligation doesn’t stop at the Sheriff’s office. The DA, the court clerk, and any county IT infrastructure that touches criminal justice data are all in scope.
- No real penetration test has ever been performed.
Nothing has blown up. So it feels stable.
Now let’s talk about phones.
When a county says the phones “work,” here’s what that usually means:
- Calls drop randomly in certain buildings.
- Voicemail routing is inconsistent.
- There’s no redundancy if the internet goes down.
- Call reporting is limited or nonexistent.
- 911 transfers rely on manual processes.
- The system can’t scale without buying more aging hardware.
But it hasn’t been tested during a storm, an election cycle, or a high-volume emergency.
So it feels fine.
Stability vs. Stagnation
Counties are built on trust and longevity. Loyalty matters. Relationships matter.
But stability is not the same thing as leaving things untouched.
Stability means:
- Systems are actively monitored.
- Backups are tested, not assumed.
- Phone failovers are documented and proven.
- Stability means CJIS controls are validated across the Sheriff, the District Attorney, the court clerk, and the IT team supporting them.
Stagnation is something different.
Stagnation is when nothing has failed yet — so nothing changes.
Stagnation is:
- A firewall that hasn’t been reviewed in years.
- A phone system that drops calls in certain buildings but “mostly works.”
- Shared credentials because that’s how it’s always been done.
- A lack of redundancy because “we’ve never needed it.”
Ransomware doesn’t respect loyalty.
CJIS doesn’t make exceptions for tenure.
And citizens don’t differentiate between a vendor issue and a county issue.
They just know when they can’t get through to someone.
When a patrol deputy misses a critical call, that’s not an inconvenience.
When a resident gets stuck in an auto-attendant loop, that’s not a minor glitch.
When the clerk’s office is overwhelmed because routing fails during high call volume, that’s not a small problem.
That’s operational exposure.
And here’s the uncomfortable truth:
Stagnation feels calm — right up until the moment it doesn’t.
True stability requires movement.
Controlled upgrades.
Measured modernization.
Intentional oversight.
Comfort feels stable.
Accountability is what creates stability.
The Political Reality No One Says Out Loud
Leadership would rather manage 15 known inefficiencies than risk one visible disruption during a migration.
That’s human. That’s political. That’s real life.
So counties tolerate:
- Manual workarounds.
- Aging on-prem servers.
- Legacy PBX phone systems.
- Shadow IT.
- Deferred upgrades.
- Security gaps that “haven’t been a problem yet.”
Comfort feels safe.
But comfort compounds.
A legacy phone system that requires expensive parts no one manufactures anymore.
A server warranty that expired three budget cycles ago.
A firewall that technically functions — but hasn’t been hardened to current standards.
That’s not stability.
That’s deferred cost.
And deferred cost always shows up at the worst time — usually during an audit, election season, or after a neighboring county gets hit and commissioners start asking uncomfortable questions.
The Real Competitor in County Government
The real competitor isn’t another IT company.
It’s organizational comfort with inefficiency.
It’s the belief that:
“We haven’t been hit yet.”
“The phones haven’t completely gone down.”
“We’ll deal with it next fiscal year.”
But here’s the truth.
When one county experiences ransomware, commissioners talk.
When one county’s phones fail during a storm, sheriffs talk.
When your residents can’t reach you they lose trust, and talk.
You can be the county that modernized intentionally.
Or the one everyone references at the next ACCO meeting.
What Modernization Actually Looks Like
Modernization is not ripping everything out overnight.
It’s controlled improvement.
It’s:
- Tested backups with documented results.
- Active monitoring, not passive hope.
- Role-based access controls aligned with CJIS.
- Penetration testing that validates your posture.
- Cloud-based VoIP systems with redundancy and failover.
- Call reporting and analytics.
- Scalable infrastructure without massive hardware refreshes every few years.
No drama.
No political chaos.
No scare tactics.
Just measurable risk reduction.
Because in county government, mistakes don’t just cost money. They cost public trust.
When phones stop working or systems get locked up, citizens don’t blame the vendor.
They blame leadership.
Comfort feels inexpensive.
Until it isn’t.
If your county’s IT and phone system “mostly work,” that’s not a reason to panic. But it is a reason to look under the hood.
Controlled modernization protects budgets.
Protects deputies.
Protects public trust.
And that’s leadership in 2026.
Five Questions Every County Should Be Able to Answer
These are not technical questions. They are governance questions.
- When was the last time our backups were fully restored and documented in a test environment?
Not “Are backups running?”
When were they tested end-to-end — and can you produce proof? - Can we clearly document how CJIS requirements are being met across the Sheriff’s Office, District Attorney, Court Clerk, and supporting IT infrastructure?
Not just policies on paper.
Documented controls, access reviews, encryption standards, and monitoring procedures. - If our internet provider goes down during a storm or high-volume event, what happens to our phone system?
Is there automatic failover?
Can deputies, clerks, and administrative offices continue operating without interruption? - When was the last time an independent penetration test attempted to break into our network?
Not a vulnerability scan.
A real-world simulation of how an attacker would move through your environment. - If we experience a breach tomorrow, who owns the response plan — and how quickly could we execute it?
Do you have a documented incident response plan?
Has leadership reviewed it?
Has it ever been tested?
“If any of these questions require guesswork instead of documentation, it may be time for a structured assessment. We’re here when you are ready!
