Government & Law Enforcement

IT and cybersecurity for local government and law enforcement, built to the standard the audit actually uses.

Boroughs, townships, counties, authorities, and police departments do not get to treat IT as a back office concern. A CJIS audit, a Right-to-Know request, a public budget hearing, and a resident population that notices when something breaks all land on the same environment. All 3rd Element staff are CJIS cleared, and we manage the environment to a written standard built to hold up under audit.

3rd Element Consulting provides IT and cybersecurity for boroughs, townships, municipal authorities, and police departments across Central Pennsylvania, including Harrisburg, York, Carlisle, and the surrounding counties. Every member of our staff is CJIS cleared, and we manage each environment to a written standard built to hold up to a CJIS audit, a Right-to-Know request, and a public entity insurance pool renewal. We are based in Mechanicsburg and have been in business since 2005.

Schedule an IT Environment Review

The pattern

The environment is public. The controls usually aren't.

Most municipal environments were built one decision at a time. A part time vendor who handles the server. A borough secretary with domain admin rights because someone needed them years ago. A police network that was supposed to be segmented from the municipal side and quietly isn't. A CAD or RMS vendor who manages their piece and assumes someone else is managing everything around it.

The result is an environment where nobody can answer the questions that matter. Who has access to criminal justice information. Where body worn camera footage actually lives and whether it can be restored. What happens to tax collection and utility billing if the server is encrypted on a Friday afternoon. These are not hypotheticals. They are the questions an auditor, a carrier, or a solicitor asks, usually at the worst possible time.

Criminal justice agencies carry an obligation that private business does not. The CJIS Security Policy applies to every vendor with access to criminal justice information, and the agency is accountable for the vendor's failures, not just its own. That is why a chief cannot simply hire the cheapest available IT support. The standard has to be demonstrable before the audit, not asserted during it.

Where we focus

What we manage for public sector agencies.

7 areas, swipe or use arrows

CJIS aligned identity and access

Individual accounts, advanced authentication, admin separation, and access reviews that produce a record an auditor can read. Mobile data terminals in vehicles carry the same requirement as a desk in the station, and they are usually where the gap is.

Network segmentation

Separating criminal justice systems from general municipal operations, then documenting and verifying that separation. This is one of the most common audit findings and one of the easiest to leave half finished.

Digital evidence and retention

Body worn camera footage, case files, and digital evidence backed up, retained to your schedule, and restoration tested. Storage growth in this category outpaces every budget projection we have seen, so we plan for it rather than discover it.

Backup and recovery for public services

Tax collection, utility billing, permitting, GIS, and payroll are the systems residents notice immediately. Backups are encrypted, immutable, and tested, so recovery is a known quantity before a ransomware event makes it urgent.

Vendor coordination

CAD, RMS, e-ticketing, evidence platforms, and dispatch connections all have vendors who manage their own piece. We manage the environment around them and hold the seams together, which is where most problems actually live.

Records and Right-to-Know readiness

Email archiving, retention policy, litigation hold, and search configured so a records request or a discovery obligation can be answered without a scramble.

Audit and insurance evidence

Documentation maintained continuously for CJIS audit cycles, public entity insurance pool requirements, and grant reporting. The evidence exists on an ordinary Tuesday, not just when someone asks for it.

What should a municipality or police department look for in an IT provider?

A public sector IT provider has to meet requirements a general business MSP is never asked about. That means personnel who have cleared CJIS background screening before they touch the environment, documented controls that survive a triennial audit, retention and records handling that holds up to a Right-to-Know request, and the ability to work inside public procurement and budget cycles rather than around them. Ask any prospective provider to show you the evidence, not describe the intention. If a provider cannot tell you which of their technicians are cleared and what their screening process is, that answer is itself the answer.

CJIS

Every member of our team is CJIS cleared.

This is not a subset of our staff, and it is not handled case by case when a law enforcement client comes up. Our entire team has completed CJIS required background screening. That means the person who picks up your call, the person who touches the server, and the person on site at the station have all been through the same process.

For an agency, that removes an entire category of risk and paperwork. There is no scrambling to get a technician cleared before a project starts. There is no escorting a vendor who was never screened. There is no discovering during an audit that remote access was granted to someone who should not have had it.

We operate against the CJIS Security Policy as written: signed security addendum, personnel screening, security awareness training on schedule, FIPS validated encryption in transit and at rest, advanced authentication, defined incident reporting, and documentation that can be handed to an auditor. In Pennsylvania that means working with your agency's Terminal Agency Coordinator and supporting the audit cycle rather than reacting to it.

HOW WE WORK

One environment, two sets of obligations, one standard.

In a municipality the police department and the business side of the operation share a building, often share a network, and absolutely do not share the same requirements. Criminal justice information carries obligations that the tax office does not. Treating the whole thing as one flat network is the most common finding we see.

We manage the full environment against a documented baseline. Identity, devices, email, file systems, backup, cloud, and network segmentation are each set to a standard and reviewed on a schedule. When something falls out of standard it gets corrected. Nobody is closing tickets and assuming the underlying condition is resolved.

We work alongside your existing CAD and RMS vendors, your evidence platform, your 911 or county dispatch connection, and your insurance pool. We do not require you to replace relationships that work. We manage the parts that need managing and coordinate the rest.

For agencies across Central Pennsylvania, Harrisburg, Mechanicsburg, Carlisle, York, Lancaster and the surrounding counties, we are local enough to be on site when it matters and structured enough to handle everything else remotely.

3rd Element monitoring dashboards used to hold client environments to a documented standard.

WHAT CHANGES

What looks different once the environment is under management.

The audit has an evidence package. Access records, training records, encryption configuration, and incident response documentation exist before the auditor asks, not assembled in a panic the week before.
The police network is actually separated. Segmentation between criminal justice systems and general municipal operations is designed, documented, and verified, not assumed because it was set up that way once.
Evidence retention is a control, not a hope. Body worn camera and digital evidence storage is backed up, retention aligned to your schedule, and restoration tested. You know what you have and how long it takes to get it back.
Nobody shares a login. Shared accounts in the squad room and on mobile data terminals are replaced with individual identities and advanced authentication, which is both a CJIS requirement and the only way an access log means anything.
Offboarding closes the same day. When an officer, employee, or elected official leaves, access ends that day. Not at the end of the month.
Right-to-Know requests have a process. Email retention, archiving, and search are configured so a records request is a task, not an emergency.
The insurance and pool renewal has answers. The control questions carriers and public entity pools are tightening every year have documented evidence behind them.

Skip this and nothing looks wrong, right up until it does. A shared login stays in use. An unsegmented network stays unsegmented. Evidence storage that was never tested fails when a case depends on it. An audit finding, a records request, or an incident is usually what brings it to the surface.

LOCAL COVERAGE

The same standard, applied across the region.

See how this work applies to government and police IT in Harrisburg, government and police IT in York, and government and police IT in Carlisle.

For more detail, compare HIPAA, CJIS, and CMMC at a high level, read the deep guide to CJIS compliance requirements, or see how the work held up during a police department move without downtime.

To check where your agency stands today, download our CJIS Readiness Checklist.

Who we work best with

Built for government & law enforcement that want IT held to a standard.

Something brought you here. If you're with an organization of about 10 to 250 employees, headquartered in or operating across Central PA, that depends on its technology to operate and is ready to hold its IT to a written standard, you've probably outgrown whoever was managing IT before or something specific made the gap visible.

A strong fit

Boroughs, townships, and municipal authorities that have outgrown a part time IT arrangement
Municipal and regional police departments that need CJIS aligned support with cleared personnel
County agencies and public authorities running systems residents depend on
Agencies preparing for a CJIS audit or a public entity insurance pool renewal
Public entities where one person has been holding the whole environment together and everyone knows it

How we work

We price for the outcome, not the lowest monthly rate. If price is the only deciding factor, we're probably not the best match.
We'll tell you when something needs attention, even if you didn't ask.
Every client runs to a security baseline: MFA, patching, and tested backups. We don't make exceptions, because we're accountable for the result.

Common questions

Questions leadership usually asks first.

Are your technicians CJIS cleared?

Yes. Every member of our team has completed CJIS required background screening, not just a designated few. That means there is no delay getting someone cleared before a project starts, no escorted vendor access, and no gap between who is on your account and who was actually screened. We can provide documentation of our screening process and our signed security addendum as part of your vendor file.

What does CJIS compliance actually require from an IT vendor?

More than a statement on a website. It requires a signed CJIS Security Addendum, fingerprint based background screening for every person with access to criminal justice information, security awareness training on a defined schedule, FIPS validated encryption, advanced authentication, defined incident reporting timelines, and documentation an auditor can review. The agency remains accountable for the vendor's compliance, which is why the evidence has to exist before the audit rather than being assembled during it.

Can you work with our existing CAD and RMS vendors?

Yes, and we expect to. We do not replace your records management, computer aided dispatch, or evidence platform vendors. We manage the environment those systems run in: identity, access, network, backup, patching, and the security configuration around them. Most of the problems we find in agency environments are not inside the specialty applications. They are in the seams between them, where each vendor assumed someone else was responsible.

How do you handle body worn camera and digital evidence storage?

We treat it as a retention and recovery problem rather than a storage problem. That means backup that is encrypted and tested, retention aligned to your records schedule and any active case holds, access controlled and logged, and capacity planned ahead of growth rather than discovered when a drive fills up. Chain of custody requirements mean an untested backup is not a control, it is an assumption.

Do you support municipalities as well as police departments?

Yes. Most of the agencies we work with are both. A borough or township running a police department has one building, often one network, and two sets of obligations. We manage the whole environment to a documented standard and design the separation between criminal justice systems and general municipal operations so that each side meets its own requirements.

How does contracting work with a municipality?

We are used to public sector procurement rhythms: agreements that need solicitor review and approval by resolution at a public meeting, budget cycles that are set months in advance, and invoicing approved on a monthly warrant. We plan engagements around those timelines rather than expecting an agency to work around ours. If you need our agreement in a specific format for your solicitor or your board packet, we will provide it.

Can you help with cyber insurance questions?

Yes. Most insurance applications ask about controls leadership has never had to think about before. We translate the questions, review the environment against them, and help you answer with evidence instead of guesswork. If there are gaps, we'll tell you what they are and what it takes to close them. We also work with an insurance partner who specializes in cyber coverage - if you want additional options or a second set of eyes on the technical requirements, we can bring them in without replacing your existing broker relationship.

What is an IT Environment Review?

The IT Environment Review is free and takes about 30 minutes by video or phone. We ask a set list of questions about your environment, answer yours, and send you a written summary afterward.

Get a clearer view of your IT environment.

Find out what is working, where the risks are, and what needs attention next.

Schedule an IT Environment Review

IT and cybersecurity for local government and law enforcement, built to the standard the audit actually uses.

The environment is public. The controls usually aren't.

What we manage for public sector agencies.

CJIS aligned identity and access

Network segmentation

Digital evidence and retention

Backup and recovery for public services

Vendor coordination

Records and Right-to-Know readiness

Audit and insurance evidence

What should a municipality or police department look for in an IT provider?

Every member of our team is CJIS cleared.

One environment, two sets of obligations, one standard.

What looks different once the environment is under management.

The same standard, applied across the region.

Built for government & law enforcement that want IT held to a standard.

Questions leadership usually asks first.

Related work and reading.

CJIS Readiness Checklist

Client Story: Moving a Regional Police Department Without Stopping a Shift

HIPAA, CJIS and CMMC Compliance Explained

CJIS Compliance Requirements for IT Providers

Standards and Security Baseline

Compliance and Governance

Backup and Recovery

Cybersecurity

AI Readiness and Governance

IT Support for Local Government and Police Departments in Harrisburg, PA

IT Support for Local Government and Police Departments in York, PA

IT Support for Local Government and Police Departments in Carlisle, PA

Get a clearer view of your IT environment.