Top 7 State and Local Contract Vehicles to Support Your SLG Fiscal Year Requirements

Posted on by
Reply

As the end of the fiscal year approaches, State and Local Governments (SLG) and education institutions are ramping up purchasing to ensure every allocated budget dollar is spent and their organization is prepared for further IT advancements in the coming year. Leveraging the right contract vehicles can streamline procurement processes, ensuring timely and efficient acquisition of necessary technologies and services. These contracts can also provide technology vendors and resellers unique opportunities to expand their Public Sector businesses.  

Below, we explore the top contract vehicles that SLGs and education institutions are using as they close out their fiscal year with their preferred reseller partner this month.  

1. NASPO ValuePoint  

NASPO ValuePoint is the cooperative purchasing arm of the National Association for State Procurement Officials, designed to provide access to the best possible IT solutions. It is considered to be the nation’s most significant public contracting cooperative. The contract offers a wide variety of cloud solutions, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS).  

Carahsoft’s Contract: NASPO ValuePoint contract #AR2472 includes thousands of technology vendors.  

Who Can Use It: State and Local Governments, municipalities and public education entities (K-12 and higher education).  

2. GSA Cooperative Purchasing Program  

The General Services Administration (GSA) Cooperative Purchasing Program  grants SLGs access to Federal GSA Schedule contracts for IT solutions and professional services. The GSA Cooperative Purchasing Program provides a streamlined procurement process for SLGs to purchase IT solutions, often with pre-negotiated and cost-effective pricing structures.  

Carahsoft’s Contract: GSA Schedule #47QSWA18D008F, aggregates solutions from many technology vendors.  

Who Can Use It: State and Local Governments.  

3. Texas Department of Information Resources (TX DIR)  

The Texas Department of Information Resources (TX DIR) has established a Cooperative Contracts Purchasing Program which offers a wide range of product offerings, services and technology solutions to Public Sector customers in Texas and nationwide. The DIR contracts streamline the procurement process by handling all of the preliminary work upfront, making it easier for eligible entities to acquire a wide range of hardware, software, cloud solutions and professional IT services. Public organizations outside of Texas are also eligible to purchase through DIR contracts.  

Carahsoft Contract: Carahsoft holds eight TX DIR contracts, offering a wide variety of products and services from hundreds of technology vendors.  

Who Can Use It: State and Local Governments, public education and other public entities nationwide.  

Top 7 SLG Contracts Blog, embedded image, 2026

4. California Software Licensing Program (CA SLP)  

The California Software Licensing Program (CA SLP), established in 1994 and administered by the Department of General Services’ (DGS) Procurement Division provides SLGs within the state of California with access to discounted software licensing agreements. This vendor held contract expedites and simplifies the procurement process while supporting State Government modernization goals with a host of technology solutions.  

Carahsoft Contract: Carahsoft acts as a reseller on 19 CA SLP contracts, offering solutions ranging from data management to cybersecurity and more.  

Who Can Use It: State and Local Government agencies in California.  

5. E&I Cooperative Services  

E&I Cooperative Services is the largest and most experienced member-owned, non-profit purchasing cooperative focused on education. E&I provides education institutions with access to IT products and services, including learning management systems, classroom technologies and administrative software tailored to their unique needs.  

Carahsoft Contract: E&I Cooperative Services contract #EI00063-2021MA provides E&I members with cloud and managed service solutions and related IT products and services.  

Who Can Use It: E&I members and educational institutions, including K-12 schools, teaching hospitals, colleges, universities and some municipalities. 

6. OMNIA Partners Public Sector  

OMNIA Partners is one of the largest Public Sector cooperative purchasing organizations, providing comprehensive access to a wide variety of technology contracts across hardware, software and cloud solutions. The cooperative purchasing program is focused on efficiency, compliance and value, aiming to further streamline the procurement process for the Public Sector entities that leverage this contract.  

Carahsoft Contract: Carahsoft’s contracts with OMNIA Partners, #R240303 and #23-6692-01, provide SLGs and education institutions with access to technology from over 2000 vendors.  

Who Can Use It: State and Local Governments, public education institutions and nonprofits that are approved OMNIA partners.  

7. CoreTrust  

CoreTrust is a cooperative purchasing organization working together with public procurement leaders to create high quality, cooperative contracts that optimize cost savings, drive compliance and efficiency, providing effective outcomes to public sector agencies. CoreTrust cooperative contracts also actively support local labor markets, ensuring a holistic approach to sustainable growth and impact. 

By leveraging the CoreTrust suite of cooperative contracts, organizations gain access to contracts and discounts from leading suppliers of products and services across a wide variety of industries and benefit from a streamlined procurement process. 

Carahsoft Contract: CoreTrust 24COR-018GR offers members access to IT hardware, software, cloud solutions, compatible IT ancillary products, servers and professional IT services. 

Who Can Use It: State and Local Governments, K-12 and higher education, Tribal Governments in all 50 States/Commonwealths, D.C. and Puerto Rico 

Through leveraging these contract vehicles, SLGs and education institutions can easily find and purchase technologies that map to their modernization efforts while ensuring compliance and maximizing investments through their preferred resellers. As the fiscal year draws to a close, these contracts serve as a vital resource for timely and cost-effective procurement, driving end-of-year business to new heights and propelling Public Sector advancements.  

For more information on Carahsoft’s offerings under each of these contract vehicles, please reach out to contracts@carahsoft.com.  

The Top 5 Insights for Government from SOF Week 2026 

Posted on by
Reply

Defense leaders, industry innovators and policy experts converged at SOF Week 2026 with a shared urgency: the Special Operations Forces (SOF) enterprise is transforming to meet an era defined by overlapping threats, convergence and speed. From the Office of the Assistant Secretary of Defense (OASD) for Special Operations and Low-Intensity Conflict’s (SO/LIC) five-priority framework to discussions about an increasingly transparent battlespace, panels and keynotes showed an enterprise striving to modernize at the speed of relevance. 

Across sessions, discussions highlighted the structural challenges facing the SOF community and the solutions emerging to address them, from autonomous systems and open source intelligence (OSINT) to acquisition reform and deeper operator-industry collaboration.  

Five critical insights define the path forward for special operations amid intensifying power competition. 

A Restructured SO/LIC Enterprise Is Organized Around Five Strategic Priorities 

SO/LIC leadership articulated a clear vision for the SOF enterprise creating asymmetric advantages in multi-domain effects, so the joint force wins decisively across the conflict spectrum. Organized around five priorities—people, policies, pioneering, partnerships and prudence—the framework establishes a blueprint for how the enterprise will resource, evolve and operate. Central to this vision is empowering Theater Special Operations Commands (TSOCs) with the authorities, resources and decision-making space to synchronize operations and adapt to rapidly evolving theater conditions. 

Acquisition reform is a defining enabler. SOF is positioned as the department-wide pathfinder for requirements and acquisition reform, using mechanisms such as Middle Tier Acquisition (MTA), other transaction authorities and commercial solution openings to field capabilities faster than traditional processes allow. The recently launched SOF Ventures initiative connects TSOCs, science and technology partners and interagency stakeholders with venture capital and private equity, positioning private investment as a direct force multiplier for national security priorities. 

Though SOF comprises just three percent of the joint force and less than two percent of the Department’s budget, it delivers outsized strategic impact. Every investment must be evaluated against clear objectives, including whether capabilities are properly resourced, effectively employed and aligned with long-term readiness and lethality requirements for active-duty forces and their families. The Center for Special Operations Analysis Capability (C-SOAC) team will bring independent, data-driven analysis of force design and investment to support those decisions. 

The Battlespace Has Become Fully Transparent and Adversaries Are Exploiting It 

Tom Swetman, Vice President of Janes, outlined how ubiquitous commercial data collection has rendered the battlespace transparent in ways legacy operational security frameworks were never designed to address. Satellite imagery, mobile device telemetry, social media metadata and commercially available information (CAI) now provide adversaries a persistent, low-cost intelligence capability that rivals traditional collection methods. Every environment is a collection environment, and the volume and fidelity of available data means hiding in the noise is no longer viable. 

Adversaries weaponize this environment through pattern-of-life and identity resolution, digital exhaust and metadata exploitation as well as pre-targeting individuals, families and supply chains. They treat OSINT as a formal discipline with dedicated methodology and resources, increasingly outpacing how U.S. forces integrate commercially available data into planning. Brandon Hough, Co-Founder of Anomaly Six, elaborated on the CAI layer, noting that procurement transparency requirements create a parallel vulnerability, enabling adversaries to map supply chains, identify critical suppliers and target the industrial base before a capability reaches deployment. 

Mitigation requires moving OSINT and CAI analysis from the margins into core mission planning. Signature management and intelligence collection plans must be developed collaboratively and red-teamed against real-world data environments from the outset of pre-deployment planning. Artificial intelligence (AI)-enabled auditing tools that continuously monitor the digital footprint of deploying forces are becoming operational necessities rather than optional enhancements. 

Agentic AI and Edge-Deployable Models Are Transforming Intelligence Delivery 

Across sessions, a clear consensus emerged: open source, commercially available and sensor data now exceed what human analysts can synthesize without AI. Agentic AI platforms that autonomously ingest, prioritize and deliver risk intelligence are moving from concept to operational deployment. New platforms enable real-time forecasting and interdiction analysis from mobile device and Software Development Kit (SDK) data. Leaders described the transition toward agentic risk intelligence as a fundamental shift in how the intelligence community approaches the volume and diffuse nature of modern signals. 

The practical insight centers on small language models (SLMs). Lightweight, hyper-tuned models deployable at the tactical edge—on vehicles, laptops or sensor platforms—compress the intelligence-to-action timeline without requiring connectivity to enterprise compute infrastructure. Panelists cited commercial platforms such as Snowflake, already used by defense partners for high-performance edge processing and operational environment modeling, as examples of commercial innovation outpacing Government-developed solutions. They called for those capabilities to be integrated into operational architectures rather than rebuilt from scratch. 

The integration challenge is equally important as the technology itself. Open source and commercially available intelligence capabilities must be embedded in the planning cycle from the outset, not layered on top of existing intelligence, surveillance and reconnaissance (ISR) collection. Delivering contextual, filtered and mission-relevant information through a unified interface is the operational standard industry partners and program offices must work toward to achieve meaningful decision advantage. 

Drone Dominance and Lethal Autonomy Define the Next Generation of SOF Lethality 

The Department of War’s (DoW) drone dominance initiative, backed by $1.1 billion to procure 200,000 small drones by 2027, reflects how drones are reshaping future conflict. SOF is positioned to play a pivotal role as an end-user and the pathfinder for validating autonomous systems before scaling across the joint force. The U.S. Special Operations Command’s (USSOCOM) designation as the joint force provider to the Defense Autonomy Working Group (DAWG)—a department-wide effort to integrate autonomous systems that solve combatant command problems—institutionalizes this role and places SOF at the center of autonomy doctrine development. 

Directed energy represents a complementary capability set. Leaders identified low-cost, small form factor laser systems and high-power microwave technologies as near-term priorities for counter-unmanned aerial system missions. With the underlying science largely proven, the remaining challenge is engineering systems with the cost, durability and range needed for distributed deployment across the force. The need to prioritize directed energy was established even before recent operational experience with drone swarms accelerated the timeline. 

AI’s role in targeting was addressed directly across panels. Aggregating intelligence at scale and speed, deconflicting with allied forces and streaming data into decision cycles enables a level of precision and lethality that was previously unattainable. Building the kill chain of the future means treating AI as an organizing principle for integrating intelligence, fires and maneuver from the outset of system design and operational planning. 

Closing the Industry-Operator Feedback Loop Accelerates Capability Delivery 

Dual-use technology developers showcased emerging capabilities, from piezoelectric energy harvesting systems that extend unmanned underwater vehicle endurance to AI-powered automatic target recognition platforms that reduce analysis timelines from hours to minutes. These companies share the challenge of navigating the gap between demonstrated capability and funded programs. Moving from proof of concept to fielded system remains one of the defense acquisition ecosystem’s most persistent friction points. 

Theater Edge Innovation Labs (TEILs) offer one structural response, moving problem-solving closer to the warfighter so industry partners can test and iterate against specific operational scenarios in days rather than months. The SOF enterprise extends this model into the private capital ecosystem, aligning venture and growth investment with urgent operational needs. Together with other rapid acquisition mechanisms, these initiatives are designed to keep the innovation pipeline flowing and compress the timeline from operator-identified gap to fielded solution. 

The critical enabler is a robust, structured feedback loop, which panelists argued that talent is as important as technology in sustaining it. Reducing friction in that pipeline, particularly around clearance timelines and accreditation processes, was identified as a high-priority structural change. Operators who engage directly with industry during testing create valuable data assets that accelerate model development and product refinement. Recognizing operational test data as a strategic asset is among the most consequential investments SOF can make. 

Pioneering the Path Forward for Special Operations 

SOF Week 2026 reinforced that SOF is not simply integrating new technologies onto existing formations. It is rethinking how it recruits, equips, trains and fights as a technologically advanced and strategically agile force. The five priorities articulated by SO/LIC leadership, the intelligence challenges of a transparent battlespace, the emergence of edge-deployable AI, the acceleration of lethal autonomous systems and the deepening of industry-operator partnerships represent interconnected pillars of a coherent modernization strategy. Sustained success will depend on aligned authorities, cultural transformation around data and technologies that translate strategic intent into operational and tactical advantage. 

As Carahsoft, The Trusted Government IT Solutions Provider®, continues supporting defense modernization, insights from SOF Week 2026 inform how industry can partner with SOF to deliver the capabilities required for operational advantage amid intensifying strategic competition. 

Explore Carahsoft’s Defense Technology portfolio of leading solutions that support SOF modernization priorities, including AI, cybersecurity, autonomous systems and advanced analytics. 

Contact the Defense Team at DOW@carahsoft.com to discuss how Carahsoft’s technology partners can support your mission. 

Student Safety and Success: Secure Communications In Education

Posted on by
Reply

Teachers, administrators and other staff in education have many regulations to be aware of when communicating with and about students and parents. From the Health Insurance Portability and Accountability Act (HIPAA) and the Family Educational Rights and Privacy Act (FERPA) to a variety of regulations individual to each state, educators have both a legal and moral obligation to keep their communications transparent, auditable and policy compliant. MultiLine by Movius is a secure, cloud- based, cost-effective solution that provides a unique phone number for professional communications utilizing an educator’s personal device, all while establishing clear and strong boundaries between the two forms of communication.

Communication Channels: Not Just Between Teacher and Student

Communication is a vital part of an educator’s job. Being available for a student and for their parents or guardians to answer questions or address concerns strengthens that relationship and promotes a student’s growth and success. However, there are significant challenges that K-12 organizations face when utilizing unmonitored and unrecorded forms of communication. Without a way to monitor correspondence, organizations open themselves to liability risks with legal and compliance blind spots, especially with sensitive information.

In one case, a staff member inadvertently shared student updates with a non-custodial parent. When the issue came to light, it led to a FERPA review. Because the communication took place on a personal device, there was no accessible audit trail, making it difficult to fully document what occurred and increasing compliance risk for the district.

In another example, district leadership discussed an active investigation via personal text messages. When those messages were later requested, some were unavailable or incomplete, creating challenges with documentation and chain of custody. This situation introduced potential legal exposure, along with additional costs tied to e-discovery and review.

These incidents outline only a few ways K-12 institutions risk compliance violations when communication channels between education staff, students, parents and guardians go unmonitored.

The MultiLine Solution

Regarding mobile communications, there are two main modes that education staff utilize: personal devices or a district-issues device. Each come with their own drawbacks.  Personal devices are convenient and cost-effective, but lack the ability to log, audit and monitor correspondence. On the other hand, district-issued devices have some stricter monitoring capabilities; however, they are expensive to maintain and carrying two mobile devices is inconvenient to staff. An ideal solution to the communication challenges facing K-12 organizations balances the convenience of a personal device and the security of a district-issued device.

MultiLine by Movius is an artificial intelligence (AI)-powered mobile-first experience for voice, Short Message Service (SMS), social messaging and Microsoft Teams. Education staff can download the Movius application on any smartphone, tablet or desktop computer, including any device privately owned by the staff member. Through the application, the user is assigned a secure, district-owned number to the device. This number does not operate under the personal phone’s carrier and does not touch any personal emails, text messages or searches, creating clear separation of personal and professional lines.

MultiLine logs and audits all texts and calls for transparency and accountability, ensuring FERPA, HIPAA and district policy compliance. Every message and call is automatically logged, encrypted with AES-256 and stored in a secure cloud archive, which is accessible by district administrators for monitoring, auditing and parental review. Additionally, MultiLine preserves institutional knowledge through the application, even through staff turnover. As one staff member leaves, their MultiLine phone number can be reassigned to the incoming staff member through the Movius administrative portal. Overall, MultiLine reduces legal exposure and supports risk mitigation.

School districts face budget shortfalls and increasing pressure to stretch every dollar while providing the greatest educational experience possible for their communities. In addition to being secure and transparent, administrations need cost-effective communication solutions. Switching to MultiLine from cellular stipends cuts communication costs by over 50%, while adding policy protection, logging and auditability capabilities.

On June 27, 2025, Kentucky enacted Senate Bill 181 (SB 181), requiring public schools to use traceable, archivable and parent-accessible platforms for all electronic communications between staff and volunteers and students. While it is legally codified in Kentucky, there are several advantages to having strict delineations between personal and professional communication methods in education. Having thorough security, logging and monitoring of staff, parent and student digital correspondence not only minimizes noncompliance risk, but ensures that students are getting the most out of their education.

Watch Movius’ webinar “Improving K-12 Student Attendance and Engagement in 2026 with MultiLine” to further explore the advantages of fully monitored and logged communication channels for education professionals.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Movius, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Modernizing Higher Ed IT: Equinix for Research Universities

Posted on by
Reply

Leading research universities constantly push the boundaries of human knowledge. Your faculty and students rely on advanced technologies to make breakthrough discoveries, analyze massive datasets and collaborate with experts around the globe. But as these academic ambitions grow, the physical technology supporting them often struggles to keep up.

Legacy on-campus data centers often lack the capacity to handle the intense power and connectivity demands of modern computing. This infrastructure gap creates a severe bottleneck, slowing down critical research and complicating the pursuit of Federal funding.

Carahsoft and Equinix have partnered to help universities overcome these hurdles. By shifting from aging campus facilities to a colocation data center full of modern digital infrastructure, you can accelerate discovery, streamline hybrid cloud strategies and enhance your competitive edge for Federal grants.

Here is how you can design the digital foundation your university needs to thrive.

Powering the Next Generation of AI and HPC

The most complex research projects, particularly those involving artificial intelligence (AI) and High-Performance Computing (HPC), require unprecedented processing power. Legacy campus data centers were not built to support the dense, power-hungry servers necessary for these workloads. As a result, many universities face significant power and cooling limitations for modern GPU-based computing.

AI-ready data centers are built to handle these precise demands. Instead of sinking millions into renovating aging campus facilities, universities can leverage colocation services that provide the specialized cooling and energy density required to run high-performance supercomputers and deep learning models efficiently.

By offloading the physical infrastructure burden, your IT team can stop worrying about power outages or cooling failures and start focusing on what truly matters: empowering researchers to process massive datasets and reach conclusions faster.

Securing Grants with Strict Compliance

Federal grants are the lifeblood of university research programs and data sovereignty and privacy regulations increasingly shape how and where educational institutions can process AI data.

For IT and security leaders (CISOs), navigating frameworks like CMMC, FISMA High, HECVAT or HIPAA is a top priority.

Academic research often involves working with sensitive or Controlled Unclassified Information (CUI). Storing this data in vulnerable environments puts your institution at risk.

Utilizing colocation facilities can simplify the path to compliance by offering private, direct connectivity that bypasses the public internet. This ensures that sensitive research data remains protected both in transit and at rest. When your university can confidently demonstrate robust security controls and data sovereignty to Federal agencies, you gain a significant advantage in grant competitiveness.

Seamless Collaboration and Hybrid Cloud

Academic research is rarely an isolated effort. True innovation happens when universities collaborate with national labs, Federal agencies, private industry and peer institutions worldwide. This requires secure, high-speed data sharing across vast geographic distances.

Interconnected infrastructure offered by colocation providers allow universities to create secure physical and virtual links into a global ecosystem of research partners. This provides you with the ability to quickly transfer massive datasets to collaborating institutions without the frustrating latency or security risks associated with standard internet connections.

Many IT leaders are adopting hybrid cloud strategies to gain more efficient, cost-effective access to computing resources. To make that strategy work, it is essential to choose a colocation provider with a strong ecosystem that aligns with your specific requirements. That includes the right mix of cloud providers, networks, neoclouds and research partners to support your workloads, performance goals and growth plans. A well-connected provider does more than house infrastructure; it gives you the flexibility, reach and partner access needed to build a hybrid cloud environment that is resilient, scalable and fit for purpose.

Securing Your Digital Future with Equinix

The demands on university data centers will only increase as AI adoption grows and Federal grant requirements become more stringent. A strong digital foundation built on high-performance data centers like Equinix helps universities scale AI infrastructure globally with greater speed and efficiency. This enables institutions to run high-performance computing workloads, securely share sensitive data and connect more easily with the global research community.

Through software-defined, secure interconnection with Equinix Fabric, universities can connect directly to leading cloud and SaaS providers, including AWS, Microsoft Azure, Google Cloud, Salesforce and Workday. This gives research teams fast, reliable access to critical digital resources while reducing complexity and improving control. It also allows institutions to scale workloads to the public cloud during periods of peak demand and scale back when needed to improve performance and manage costs.

Optimize your Cloud Access Strategy

A strategic Carahsoft technology partner, Equinix is is committed to helping universities design future-ready IT infrastructure. Whether your top priority is optimizing your cloud access strategy, supporting your AI infrastructure goals or securing data for your next major research grant, Equinix provides the tools you need to succeed.

If you are exploring ways to modernize your digital infrastructure or want to learn how your peers are navigating these exact challenges, Carahsoft and Equinix are here to help. Reach out to the digital infrastructure specialists at Carahsoft to schedule a brief discussion or an executive briefing to dive deeper into your university’s specific goals.

Let us help you accelerate discovery and power the next generation of academic innovation.

Come meet Equinix at EDUCAUSE 2026 at Booth #210!

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Equinix, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Integrating NIST Supply Chain Risk Management into SLED Compliance Programs

Posted on by
Reply

From data breaches exposing citizen records to cloud outages halting Government portals, supply chain disruptions in State, Local and Education (SLED) institutions have been making headlines lately. According to a 2026 Black Kite report, Public Administration is the most vulnerable industry, with 68% of its vendors having critical vulnerabilities, followed by educational services at 65%.

To protect your institution from vendors’ cybersecurity risks and operational disruptions, your best approach is to implement gold-standard supply chain risk management practices within a cybersecurity framework. Here’s a breakdown of NIST supply chain risk management for SLED teams to help you connect each best practice to your organization’s compliance program.

Why Supply Chain Risk Is Now a SLED Compliance Concern

For SLED entities, supply chain risks have advanced from operational planning and now sit at the center of the compliance programs. Auditors and regulators are asking more pointed questions, going beyond cybersecurity concerns to establish that your organization can:

  • Maintain a secure global supply chain
  • Deliver uninterrupted public services
  • Protect sensitive citizen data
  • Operate as a reliable partner in Government infrastructure

Vendor Oversight Has Become an Audit and Grant Compliance Issue

During routine audit and grant compliance reviews, auditors and grant makers scrutinize your vendors and third-party systems to establish that you’re in control of supply chain risks. The same scrutiny extends to Federal grant applications, where reviewers assess whether your vendor management approach strengthens the overall project and supports your overall cybersecurity posture.

Cybersecurity Mandates Are Reaching Into the Supply Chain

Cybersecurity requirements at the State and Federal levels reference supply chain security expectations. Frameworks such as GovRAMP (fka StateRAMP) and FedRAMP, along with guidelines from the Cybersecurity and Infrastructure Security Agency (CISA), extend security protocol beyond your internal networks. These frameworks recognize that modern vendor networks rely heavily on external software and service providers and require you to implement a unified cybersecurity strategy to build resilient networks and reduce the risk of a supply chain compromise.

Education Institutions Face Distinct Vendor Obligations

If your educational institution manages student data, you have distinct vendor-related obligations under the Family Educational Rights and Privacy Act (FERPA) and various State-level privacy laws. When you partner with an external vendor for learning management platforms, communication tools or admin solutions, you must verify they match your organization’s data protection standards and broader information technology controls.

The Risk Extends Beyond Information Systems

The need for your SLED organization to manage supply chain risk goes well beyond securing digital information systems. Supply chain risks can:

  • Impact important community services
  • Compromise data integrity
  • Erode public trust
  • Create compliance and legal exposure
  • Disrupt operational continuity and service delivery

What NIST SP 800-161r1 Covers

The broader National Institute of Standards and Technology Risk Management Framework (NIST RMF) addresses how you can manage cybersecurity risks across your information systems. NIST SP 800-161r1 functions as the specialized cybersecurity supply chain risk management (C-SCRM) companion to the NIST RMF.

NIST has organized the NIST SP 800-161r1 recommendations into three sequential stages:

StageWhat It Covers
Foundational PracticesEstablishing governance structures, roles and supply chain risk frameworks
Sustaining PracticesBuilding operational maturity and integrating risk management into processes
Enhancing PracticesIntroducing automations and developing predictive risk capabilities

The institute updates the NIST SP 800-161 framework regularly to meet current data privacy and cybersecurity demands. However, your SLED organization doesn’t need to implement all three tiers of supply chain risk management at once. You can start with foundational practices and build incrementally and still meet NIST requirements.

Integrating NIST Supply Chain Risk Management in Your Compliance Program

NIST SP 800-161r1 offers a widely accepted framework aligned with established industry standards for building a supply chain risk management program for your SLED organization. While your approach may vary, here are the key steps to successfully integrate the NIST framework into your compliance program.

Step 1: Map Your Supply Chain and Assign Criticality

To manage supply chain risks, you need a complete picture of your supply network. Conduct a full inventory of your vendors and software providers in every department.

Then, categorize your suppliers based on how failure or disruption in their system could impact your operations or data. NIST SP 800-161r1 recommends you use FIPS 199 impact levels to categorize systems based on their impact (Low, Moderate, High) to inform the overall risk rating of the supplier..

Here are the main actions to execute at this step:

  • Establish a cross-functional team to oversee your vendor and technology risk.
  • Define clear roles and responsibilities for managing supply chain risk.
  • Secure executive support for proper funding.
  • Standardize how your organization identifies critical suppliers and assesses risk.
  • Put internal controls in place to monitor compliance and enforce policies.
  • Embed risk consideration into your supplier selection and procurement processes.
  • Promote organization-wide awareness of supply chain risk and its impact.

Step 2: Build a Risk Assessment Process for Vendors

Your next step in integrating NIST supply chain risk management into your compliance program is to establish risk management activities for determining whether to continue working with your vendors. The NIST SP 800-161r1 recommends the following best practices to build repeatable vendor risk assessments:

  • Conduct regular third-party risk assessments to identify emerging vulnerabilities.
  • Review vendor development practices and software supply chain controls.
  • Establish continuous monitoring criteria to track supplier performance and risk exposure.
  • Define a clear risk tolerance threshold and what constitutes acceptable risk.
  • Standardize how your organization will share risk information with every stakeholder.
  • Provide targeted training programs that focus on vendor and supply chain risks.
  • Involve suppliers in contingency planning and incident response readiness.

For this step, you can use a Government GRC software to centralize documentation and automate workflows. The right tools help reduce the manual overhead that makes vendor risk management difficult to sustain at scale.

Step 3: Integrate Supply Chain Risk Into Ongoing Compliance Programs

Embed supply chain risk management into your compliance lifecycle so it aligns with the governance processes of your SLED organization. This step will look different depending on your organization’s existing control frameworks and compliance requirements.

Map your vendor risk findings to NIST 800-53, GovRAMP or other compliance requirements so your supply chain risk data flows in the reporting you use for compliance purposes. Include your vendor risk status in regular risk management reporting for leadership and the audit committee to have risk visibility. 

You can also coordinate vendor review cycles with grant renewal calendars and audit preparation timelines so they double as compliance deliverables. Additionally, incorporate supply chain risk expectations into vendor contracts to formalize security requirements and incident notification obligations at the agreement level.

Step 4: Move Toward Continuous Monitoring

Your last step to integrate NIST supply chain risk management into your compliance program is to build ongoing visibility into vendor risk:

  • Establish supplier risk metrics and track them.
  • Introduce automated alerts or workflow triggers when vendor status changes.
  • Use insights from assessments you conduct to identify patterns and develop more predictive approaches to vendor risk before issues escalate.
  • Automate cybersecurity oversight procedures wherever possible to reduce manual burden and improve consistency.

Treat your supply chain security as a living program that evolves with emerging threats, changing vendor relationships and shifting regulatory requirements.

Build a Program That Serves Both Compliance and Resilience

When your organization offers important State, Local or education services that communities rely on, it’s important to recognize and address supply chain risks. The NIST SP 800-161r1 framework provides the best structure to build your vendor oversight program. A structured platform helps SLED teams manage supply chain risks while remaining compliant with relevant authorities.

See how Onspring’s platform supports supply chain risk management efforts and get a demo today.

Better Together: How Nutanix and AccuKnox Are Securing the Tactical Edge, and Beyond

Posted on by
Reply

Modern defense operations demand more than connectivity; they demand resilience. As mission environments grow increasingly contested and disconnected, the ability to process intelligence, deploy applications and enforce security at the edge has become a strategic imperative. Nutanix and AccuKnox have built a compelling answer: a tightly integrated platform that pairs the Nutanix Kubernetes Platform (NKP) with AccuKnox’s Zero Trust security layer to deliver a complete, hardened stack, from the software factory to forward-deployed vessels to orbiting satellites. This hardened stack is also hardware agnostic and can be deployed on bare metal tactical servers, and up to IL6+ Govcloud instances. For the Department of War (DoW) architects, system integrators and space operations professionals, the critical question is no longer whether to modernize, but how to do it in environments where reach back is unreliable, swap space is constrained and the cost of failure is operational.

Kubernetes as the Foundation for Tactical Edge Operations

Delivering enterprise-grade infrastructure to physically remote, resource-constrained environments requires more than Kubernetes alone. Kubernetes represents roughly 30% of the solution; the remainder is a curated ecosystem of microservices, service mesh, observability tools and storage integrations that together form a complete operational platform. Without that full stack, organizations risk spending months assembling disparate open source components, only to find that their workloads are still unable to reach production. The NKP addresses this by delivering a pre-integrated, hardware-agnostic solution deployable on bare metal, in the cloud or fully air-gapped at the tactical edge. Whether the use case is a carrier strike group operating disconnected at sea, a forward-deployed Army unit running legacy virtual machines (VMs) alongside containers, or an Unmanned Aerial Vehicle (UAV) requiring a minimal footprint, NKP provides a single platform capable of self-healing, automated scaling and continuous operation, regardless of connectivity status.

AI Delivery and Agentic Capabilities in Disconnected Environments

In contested environments, artificial intelligence (AI) cannot depend on cloud inference. It must run locally, reliably and securely. Nutanix Enterprise AI layers on top of NKP to provide a managed platform for running Large Language Models (LLMs), Retrieval-Augmented Generation (RAG) systems and agentic AI applications with full GPU support, all within disconnected environments. At a recent TechNet San Diego demonstration, RAG AI was used to surface answers from complex naval system maintenance manuals in seconds, a direct application for shipboard readiness operations. Agentic platforms are now deployed with Army units and fielding requests from naval activities, running fully on NKP hardware aboard vessels and mobile command centers without internet dependency. AI models trained at core installations are pushed to forward-deployed assets, where they run locally and queue updates for synchronization upon reconnection, preserving operational continuity without compromising security or model integrity.

Zero Trust Security Woven Into Every Layer

Security at the tactical edge requires continuous policy enforcement at every layer of the software stack, from code commit to container runtime in the field. AccuKnox integrates below the application layer to enforce least-permissive security policies at the kernel level using eBPF-based telemetry. Its Discovery Engine analyzes applications both statically and dynamically, automatically generating security manifests that accompany each application throughout its full deployment lifecycle. These policies define exactly where an application can communicate, what data it can access and how it may interact with adjacent system components—creating enforcement that is architectural rather than reactive. For acquisition officials and Authorizing Officials (AOs) managing distributed mission systems, the platform also automates the generation of compliance evidence covering Security Technical Implementation Guides (STIGs), Common Vulnerabilities and Exposures (CVEs) and relevant security frameworks, compressing what has historically been a months-long manual process into continuous, audit-ready assurance.

Extending the Stack to Orbit: DevSpaceOps

The Nutanix and AccuKnox partnership extends beyond the terrestrial edge to software-defined satellites and orbital platforms. Modern satellite platforms support containerized payloads, multi-tenancy and high-tempo software updates, and they carry significant security exposure. A representative sample of open source software deployed across current satellite initiatives contains more than 60 million lines of code and upwards of 20,000 CVEs. Unlike ground-based nodes, satellites cannot rely on real-time downlink for security decisions; they require local policy enforcement, runtime monitoring and eventually consistent posture reporting to the ground. The concept of DevSpaceOps, modeled on DevSecOps but adapted to the constraints of orbit, addresses how development teams can certify, deploy and manage satellite software with verifiable confidence, leveraging lightweight versions of KubeArmor, automated SPARTA TTP mapping and orbital security dashboards that give Space Operations Center (SOC) teams constellation-wide visibility into STIG compliance, CVE exposure and runtime violations.

One Stack, Every Domain

NKP delivers the hardware-agnostic, cloud-native platform that enables continuous operations across disconnected, multi-domain environments, from carrier strike groups to Army forward units to orbital constellations. AccuKnox ensures that everything running on that platform is secured, monitored and compliant at every layer of the stack. For defense organizations looking to reduce decision latency, accelerate the Authorization to Operate (ATO) lifecycle and ensure security travels with every workload, this joint solution offers a proven, fielded path forward.

To explore these capabilities in greater depth, including live demonstrations of sensor-to-shooter workflows, orbital security posture management and agentic AI in disconnected environments, watch the full webinar presented by Nutanix and Carahsoft.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Nutanix, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Third-Party Risk Management in the Public Sector: Lessons from Recent SLED Breaches

Posted on by
Reply

Many high-impact breaches affecting State agencies, municipalities and school districts have originated from third-party vendors. According to a 2025 Verizon report, breaches involving third parties doubled from 15% to 30% in just one year. So even while you’re updating your internal security measures, somewhere in your supply chain, attackers are finding ways in through indirect access points by exploiting vendor vulnerabilities often outside the visibility of internal security teams.

A practical starting point for third-party risk management in the Public Sector is to examine recent breaches and identify the blind spots that threat actors continue to exploit. With the right understanding, you can develop a third-party risk management program that addresses security gaps in public entities.

Why Third Parties Are the Biggest Threat Vector in the Public Sector

State, Local and Educational (SLED) institutions rely on dense vendor ecosystems that usually exceed available oversight capacity. Procurement processes tend to prioritize price and functionality, with security requirements treated as secondary. Once your organization signs the contract, visibility often drops off.

Without continuous monitoring, your vendors retain access to your systems and sensitive data, even as they change their security postures without your re-evaluation. These changes introduce new, often undetected security gaps.

Recent Breaches in the Public Sector That Started With a Third-Party

Adversaries continue to exploit vendor vulnerabilities to breach sensitive Public Sector data. Here are a few recent third-party exposures.

Oregon Department of Transportation and the MOVEit Exploit

On June 1, 2023, the Oregon Department of Transportation (ODOT) learned that it was part of the global breach of the file transfer tool MOVEit. A ransomware gang called Cl0p exploited a vulnerability in the third-party tool ODOT used to send and receive data in its routine operations.

The breach exposed the credentials of approximately 3.5 million Oregonians, including:

  • Full names
  • Date of birth
  • Physical address
  • Partial Social Security numbers
  • Driver’s license or identification card number

Although ODOT stated that the data was encrypted, the attackers were still able to access sensitive information due to a previously unknown vulnerability in MOVEit. The takeaway? ODOT’s exposure stemmed from a vulnerability in a third-party tool outside its direct control.. 

State of Maine and the MOVEit Supply Chain Impact

The same MOVEit exploit impacted several Maine State and Local Government agencies. By the time the State became aware of the breach on May 31, the ransomware gang had downloaded approximately 1.3 million records, essentially the entire Maine population.

More than half of Maine’s exposed data came from the Department of Health and Human Services, and another 10-30% from the Department of Education. Stolen data included:

  • Full names
  • Social Security numbers
  • Date of birth
  • Driver’s license number
  • Medical and health insurance information

While the vulnerability didn’t originate from the Maine systems, the State had no mechanism to detect flaws in the vendor’s software in advance.

PowerSchool and the K-12 Data Exposure

On December 28, 2024, PowerSchool, an education technology company, uncovered a breach affecting over 62 million students and 9.5 million educators worldwide. Unlike attacks that visibly disrupt operations, this intrusion went undetected for nine days.

Malicious actors used compromised subcontractor credentials to access PowerSchool’s customer support portal. PowerSchool’s engineers used this portal to access school districts’ student information for troubleshooting.

Because the portal didn’t require multi-factor authentication, a stolen username and password were all it took to gain administrative-level access across thousands of school districts. By the time PowerSchool identified the breach, the hackers had conducted the largest breach of children’s data in U.S. history.

Some districts later confirmed that hackers had accessed records dating back to 1995. PowerSchool paid approximately $2.85 million ransom and the attackers provided a video purportedly showing the deletion of the stolen data, but extortion attempts against individual school districts continued months later. For thousands of districts that trusted PowerSchool with their students’ most sensitive records, the issue wasn’t with the security practices but a vendor security gap they had no visibility into.

The Common Third-Party Risk Blind Spots in SLED

Across recent third-party data breaches, you can spot similar risk-management gaps. Your first step to improve vendor oversight is to identify the blind spots so you can close them before malicious actors exploit them.

No Formal Third-Party Risk Assessment at Onboarding

Many SLED entities rely on third-party-supplied questionnaires or attestations without independently verifying controls. Yet only 4% of organizations have high confidence that these questionnaires reflect the reality of third-party risk. Without independent vetting, you risk trusting controls that don’t reflect real-world security, leaving you exposed.

Point-in-Time Reviews Instead of Continuous Monitoring

Annual risk assessments capture a vendor’s security posture on a single day. Without continuous monitoring, you lack visibility into security control drifts and emerging risks between review cycles.

Contracts Without Security Baselines

In the Public Sector, procurement staff often negotiate contracts without cybersecurity expertise. Your SLED entity might onboard vendors without clearly defining security requirements, leaving you with limited options to enforce security controls later.

No Visibility Into Subcontractor Relationships

When Government agencies sign contracts with vendors, they rarely have visibility into the parties which that vendor relies on to deliver its services. However, exposure extends to everyone your vendor works with.

Supply Chain Risk Management Treated as an IT Issue

If your IT team is the only one responsible for third-party risk management (TPRM), other departments remain unaware of vendor exposure until an incident happens. You’ll have limited visibility across your organization and weaker accountability for vendor risk management.

How to Build a TPRM Program That Works for Public Sector Reality

As regulators and compliance bodies intensify scrutiny of supply chain risk management, your SLED institution needs a program that meets auditors’ requirements and protects sensitive data. Here are the primary steps to building an effective TPRM program that maintains constituent confidence.

Classify Vendors by Risk Tier

Your vendors carry different cybersecurity risks. For instance, a cloud provider that handles sensitive data requires a deeper assessment than a landscaping contractor. Your best approach is to classify vendors by:

  • The data they access
  • Criticality to operations
  • Regulatory exposure
  • Level of system or network access

This classification will allow you to focus on the highest-risk areas.

Standardize Risk Assessment at Onboarding and Throughout the Vendor Lifecycle

Assess your vendors’ security posture during onboarding to establish a clear baseline of cybersecurity risk from the start. After onboarding, set up ongoing monitoring processes to continuously detect changes in third parties’ security practices.

Set Contractual Security Baselines and Right-to-Audit Clauses

Your procurement and GRC team should work from a contract template that includes:

  • Minimum security control requirement
  • Right to audit vendor security practices
  • Data handling and retention requirements
  • Obligation to comply with regulatory changes
  • Subcontractor disclosure and flow-down security obligations
  • Breach notification timelines that meet Government agencies’ cybersecurity requirements

Implement Continuous Monitoring Through Automated Tools

Manual spreadsheet tracking cannot scale across a modern vendor ecosystem. To maintain ongoing visibility into your vendor security posture without requiring staff to manually chase each data point, use automated Government compliance software platforms to centralize vendor data, monitor risk signals and reduce manual tracking.

Establish Cross-Functional Ownership in Your SLED

Every department plays a role in your TPRM program. Procurement identifies new vendors, legal negotiates contracts, IT evaluates security controls and leadership sets the risk appetite. Your program should coordinate all these departments to create shared accountability and a unified approach to third-party risk decisions.

Strengthen Your Public Sector TPRM Program

As an SLED organization, your constituents expect you to protect their sensitive information while delivering essential services. An effective TPRM program will help you maintain public trust while meeting compliance requirements.

Learn how to strengthen your Public Sector TPRM program with Onspring’s platform and book a demo today.

From Compliance Checkbox to Mission Enabler: How the Department of War is Redefining Records and Information Management

Posted on by
Reply

In late 2025, the Department of War (DoW) created a new, sharply defined agenda: modernize the department’s network backbone, replace legacy IT systems, strengthen cybersecurity and build up the workforce. Underlying each of these priorities is a single, foundational requirement—clean, structured, enterprise-grade data. That requirement runs directly through Records and Information Management (RIM). This discipline has long been treated as a compliance afterthought but is now emerging as a strategic cornerstone of the DoW’s broader modernization effort.

A Strategic Shift in How the DoW Thinks About RIM

For years, RIM operated in silos, funded project by project, shaped by the priorities of large system integrators (SIs) and measured against narrow compliance benchmarks rather than mission outcomes. The DoW’s updated Central Program Guidelines represent a fundamental departure from that model. The new directives reframe RIM not as a standalone compliance function but as an integral component of Enterprise Data Management, a shift with far-reaching implications for how agencies prioritize funding, evaluate technology and structure their vendor relationships.

The driving insight is straightforward: every emerging technology that supports the warfighter, from artificial intelligence (AI)-driven analytics to autonomous systems, depends on accurate, well-structured data. If that data lacks proper governance, metadata and organization, AI cannot perform its intended function. By positioning RIM as a subsection of a broader data management strategy, the DoW is signaling that information governance is not a back-office concern. It is a mission-critical capability.

Automation as the Path to Seamless Compliance

One of the most consequential changes embedded in the DoW’s updated guidelines is a decisive push toward automated information management. Rather than placing the compliance burden on individual knowledge workers, the new model asks end users to simply perform their jobs while technology handles governance, metadata tagging, elimination of Redundant, Obsolete and Trivial (ROT) content and structured delivery to backend data lakes. This “one-click records management” philosophy reflects a broader trend across Federal technology: compliance infrastructure should be invisible to the user and automatic in its execution.

AI and automation are making this possible at scale. Modern RIM platforms can ingest unstructured content, apply the correct governance frameworks in real time and curate clean data for downstream mission applications, all without requiring manual intervention at the point of creation. The result is leaner workflows, reduced cybersecurity exposure, consolidated storage and a data foundation strong enough to support the advanced technologies warfighters increasingly depend on.

Overcoming the Barriers to Enterprise RIM Adoption

Despite the strategic clarity of the DoW’s new direction, agencies face meaningful challenges in modernizing their RIM programs. Historically, funding for Environmental Resources Management (ERM) initiatives was limited; guidance existed, but enforcement did not. This allowed agencies to defer implementation in favor of more visible mission priorities. That dynamic created a fragmented market where point solutions proliferated but enterprise-level deployments remained rare. Several persistent challenges continue to shape the modernization landscape:

  • Funding gaps driven by years of deprioritized ERM investment and limited central mandates
  • Perception barriers that kept RIM outside of strategic IT conversations and budget cycles
  • System integrator dominance, which means RIM solutions must be embedded within broader SI solution sets to gain enterprise-level traction
  • FedRAMP certification requirements that have limited the pool of cloud-ready RIM vendors eligible for DoW opportunities
  • Legacy point-solution mindsets that must evolve toward integrated, enterprise-wide approaches encompassing the Freedom of Information Act (FOIA), privacy, governance, compliance and legal holds

Vendors that learn to align their value propositions with agency mission language, framing RIM capabilities in terms of warfighter readiness, reduced legal costs, faster response times and data quality for AI, will find a far more receptive audience than those leading with traditional compliance messaging.

Carahsoft’s Role in Meeting This Moment

As demand for enterprise RIM capabilities accelerates, Carahsoft is uniquely positioned to connect agencies, technology vendors and system integrators around comprehensive, end-to-end solutions. Rather than advocating for any single point product, Carahsoft’s approach centers on identifying how RIM capabilities can extend and strengthen existing enterprise deployments, creating meaningful cross-sell and upsell opportunities that benefit agencies, integrators and vendors alike.

This Better Together model is particularly powerful in the current environment. When a technology partner holds an enterprise relationship with a Federal agency, there is a clear opportunity to layer in RIM capabilities that address records governance, privacy compliance, FOIA workflows and legal holds as integrated functions of a unified data management strategy. Carahsoft’s breadth of vendor relationships, extensive contract vehicle portfolio and deep agency knowledge makes this type of coordinated solutioning achievable at scale.

The DoW has historically led Federal technology adoption, with Public Sector and State and Local agencies following its lead. The enterprise RIM transformation underway at the department signals where the broader Government technology market is heading. Organizations that align their strategies now will be positioned to deliver mission value as that momentum builds across the Public Sector.

Whether your agency is beginning the journey toward enterprise RIM or looking to integrate AI-driven automation into existing workflows, Carahsoft and its partner ecosystem are ready to help.

Visit Carahsoft’s Records and Information Management portfolio to explore available solutions, or contact the team directly at RIMMarketing@Carahsoft.com to start the conversation.

The Top 5 Insights for Government from GSMCON 2026

Posted on by
Reply

As expectations evolve, Government agencies are redefining how they communicate with the public online. The Government Social Media Conference 2026 (GSMCON) highlighted how Public Sector organizations are adapting their approaches to constituent engagement. The conference gathered over 1,000 Government communicators, senior leaders and social media professionals from across the country in New Orleans, LA to learn strategies on how to build trust, deliver meaningful experiences and demonstrate value across the organization through social channels. 

This year, speakers highlighted how Government agencies can better serve their communities while navigating resources, evolving leadership priorities and platform changes from multilingual communication strategies to stronger internal alignment. 

Here are the top takeaways from the conference. 

Human-Centered Storytelling Builds Trust and Engagement 

Across all sessions, the importance of authenticity emerged as a consistent theme. Constituents are more likely to engage with content that reflects real people and real experiences rather than overly polished messaging. 

Leading agencies are prioritizing: 

  • Frontline individuals who represent the day-to-day work of Government 
  • Simple, approachable content that removes barriers to participation 
  • Internal recognition to encourage staff involvement and ownership 

Whether highlighting public safety personnel, infrastructure teams or community outreach efforts, these human moments strengthen credibility and foster meaningful connections. 

For Public Sector organizations, storytelling is a strategic tool for reinforcing transparency, trust and genuine relationships with the community. 

Effective Content Must Capture Attention Immediately 

Today’s digital environment requires Government communicators to deliver significant impact quickly. Agencies have just a few seconds to capture attention and communicate mission-critical messages. 

High-performing content typically: 

  • Begins with the most compelling moment or insight 
  • Uses clear, concise visual and text elements 
  • Creates curiosity that encourages continued engagement 

Short-form video remains one of the most effective formats for reaching constituents. Successful execution depends on pacing, clarity and intentional storytelling that aligns with how audiences consume information. 

Agencies should focus on designing content that is both efficient and engaging while maintaining accuracy and professionalism. 

A Structured Campaign Approach Improves Results 

As Government social media programs develop, a more intentional and consistent campaign approach is becoming essential for sustaining effective communication over time. Zack Seipert, Marketing and Communications Specialist at the Central Utah Water Conservancy District, highlighted the value of the Plan-Build-Run (PBR) framework as a reliable, repeatable model for planning and executing these efforts: 

  • Plan: Define clear objectives, identify your audience, establish Key Performance Indicators (KPIs) and select the right channels based on where constituents engage 
  • Build: Develop compelling creative, implement tracking tools and refine audience targeting for accuracy and relevance 
  • Run: Monitor performance, optimize in real time and apply insights to strengthen future campaigns 

This structured approach helps Public Sector teams create more data-driven campaigns aligned with organizational priorities while delivering measurable results. 

With social media management solutions from our partners at Hootsuite, Public Sector social media teams can maximize limited resources by streamlining workflows and gaining clearer visibility into performance across channels. 

Internal Alignment Strengthens External Impact  

When a Public Sector agency is imparting the same message internally as it is to the public, the impact delivered is much stronger. In the session “This is How We Do It: How to Turn Employees into the Stars of Our Social Story”, Charles Newman of the City of Columbus Department of Public Service emphasized that strong internal alignment starts with bringing employees into the communication process, helping connect day-to-day work to broader messaging goals. 

In “Managing Social Media Response Through Crisis and High-Pressure Events”, Kate Stegall of the Louisiana State Police highlighted the importance of clear internal coordination during high-pressure situations to ensure messaging remains consistent across teams and aligned with agency priorities. 

Effective strategies include: 

  • Delivering regular reports that clearly link performance to agency priorities  
  • Using clear language that supports informed decision-making  
  • Providing actionable insights and recommendations alongside metrics  
  • Building relationships through cross-department collaboration 

Short-Form Video Plays a Key Role in Government Communication  

Multiple sessions emphasized that short-form video has become a core channel for effective Government communication and audience reach. In “60-Second Stories: Trim the Fat & Hold Attention”, Daniel Robinson of the Wisconsin Department of Natural Resources (DNR) highlighted how concise storytelling is essential for maintaining viewer attention in fast-moving social feeds, especially when communicating public updates and educational content. 

Similarly, in “Reels for Social Recruitment”, Wendy Aguilar of the Sacramento Fire Department demonstrated how short-form video can be used strategically for workforce recruitment. Aguilar showed that authentic, behind-the-scenes content often outperforms highly produced messaging when building trust and interest. 

In “Strategy, Workflow & Team Culture for Consistent Reel Creation,” Meredith Haynes and Tony Adamo of the City of McKinney, TX, reinforced that success with short-form video depends less on one-off content and more on building repeatable workflows and cross-team collaboration. 

Across these breakouts, speakers consistently pointed to short-form video as a high-impact tool for storytelling, recruitment and public information, especially when supported by clear strategy, consistent execution and content designed for how audiences consume information today. 

GSMCON 2026 highlighted a continued evolution in how Government and Public Sector organizations approach social media. The focus is shifting toward intentional, strategic communication that prioritizes trust, clarity and measurable impact. 

By applying these best practices, Government organizations can build a stronger social media presence and foster stronger, more meaningful relationships with the constituents they serve. 

To further explore the tools, trends and strategies shaping digital engagement in Government, visit Carahsoft’s Customer Experience and Engagement Solutions page and see our portfolio of Government Social Media solutions. 

Contact the Hootsuite Team at Hootsuite@Carahsoft.com to learn more about how Carahsoft’s Government social media management tools can support your organization’s digital strategy. 

OSINT and Executive Protection: A Critical Capability for Modern Security Operations

Posted on by
Reply

As threats to executives, public officials and high-profile individuals continue to evolve, Executive Protection (EP) programs are increasingly reliant on Open Source Intelligence (OSINT) to anticipate, detect and mitigate risk. From online harassment and doxxing to geopolitical instability and lone-actor threats, the modern threat landscape is shaped—and often signaled—by publicly available information.

OSINT has emerged as a foundational capability for EP teams, enabling proactive, intelligence-led security decisions that are faster, more adaptive and more comprehensive than traditional approaches alone.

Why OSINT Matters for Executive Protection

EP is no longer limited to physical security and close-in protection. Today’s threats often originate in the digital domain before manifesting in the physical world. OSINT allows EP teams to monitor and assess:

  • Online threats, grievances and fixation behaviors
  • Social media activity and emerging narratives targeting executives
  • Event-driven risks tied to protests, activism or geopolitical developments
  • Travel-related threats, including local crime trends and unrest
  • Digital exposure, doxxing risks and personal data leakage

By analyzing these open-source signals, EP teams gain early warning indicators that can inform protective posture, travel planning and resource allocation.

Supporting Proactive, Intelligence-Led Protection

OSINT enables a shift from reactive protection to proactive threat management. Rather than responding only after an incident or credible threat emerges, EP teams can continuously assess risk and identify patterns that indicate escalation.

Key benefits include:

  • Threat Identification & Prioritization: Distinguishing between credible threats and background noise
  • Advance Planning: Enhancing route selection, venue security and travel assessments
  • Protective Intelligence Integration: Feeding OSINT into broader intelligence and security workflows
  • Scalability: Supporting protection for multiple executives across global environments

This intelligence-driven approach is especially critical as executives maintain a growing digital presence and operate in increasingly complex security environments.

Ethical, Legal and Privacy Considerations

As with any intelligence activity, OSINT for EP must be conducted responsibly. EP programs must balance threat awareness with privacy, civil liberties and legal compliance, ensuring that collection and analysis focus on publicly available, lawful sources.

Clear governance-defined use cases and analyst training are essential to maintaining ethical OSINT practices while still delivering actionable security insights.

The Growing Role of OSINT in Executive Protection Programs

Across Government, Private Sector and critical infrastructure organizations, OSINT is becoming a standard component of mature EP programs. Whether supporting senior Government officials, corporate leadership or high-visibility executives, OSINT enhances situational awareness and strengthens protective outcomes.

As digital information continues to expand and threats grow more asymmetric, OSINT will remain a vital tool—helping EP teams stay ahead of risk, adapt to change and protect their principals in an increasingly interconnected world.

Ready to Strengthen Your Executive Protection Program with OSINT?

As The Trusted Government IT Solutions Provider™, Carahsoft helps Government agencies, defense organizations and critical infrastructure teams access the OSINT tools and expertise needed to build proactive, intelligence-led protection programs.