One number to call
The front-desk computer that freezes, the password forgotten over the holidays. Staff reach a support line instead of pulling the colleague “who knows computers” off their own file.
Municipalities
IT for municipalities: support, security and continuity of services to residents
In many municipalities, IT belongs to no one. The director general restarts the server, the treasurer phones the Internet provider, and the rest waits. Meanwhile town hall issues permits, collects taxes and holds records on its residents.
IT for a municipality brings together employee support, monitoring of workstations and servers, links between buildings, protection of residents’ personal information and verified backups. OKTO Solutions offers these services to municipalities in Quebec on a monthly plan, remotely and on site.
What is needed
What IT services does a municipality need?
A municipality needs IT services that hold four things together: employees who get help when they are stuck, buildings connected to one another, residents’ information kept protected, and services that carry on through an outage. On a small team, nobody is in charge of IT full time. The job lands on the director general, the clerk or the treasurer. OKTO Solutions, an IT services company based in Trois-Rivières, offers municipalities in Quebec a monthly arrangement that covers monitoring of workstations and servers, employee support, cybersecurity, backups and planning. Most of the work is done remotely, with a scheduled visit when equipment has to be handled at town hall, the garage, the fire hall or the library. A municipality is also a public body, subject to Quebec’s access to information and privacy legislation. OKTO puts in place the technical measures that support those obligations, and does not stand in for a legal advisor.
Buildings that talk to each other
The garage, the fire hall and the library share neither a network nor an Internet link with town hall. Employees still need the same files.
Residents’ records kept safe
Tax accounts, permits, complaints, recreation sign-ups: nearly everything a municipality stores carries a name and an address.
Municipal software that runs
Taxation, payroll, permits: the management suite, from PG Solutions for instance, stays supported by its publisher. Around it you need a monitored server, tidy access and a copy of the data.
Copies already restored once
A backup nobody has tried to restore is a guess. Council minutes cannot be typed again from memory.
A plan that fits the budget
Workstations all age together. Better to learn it in the fall, while council is working on its numbers.
A public body
What does the law say about the information a municipality holds?
A municipality is a public body under the Act respecting Access to documents held by public bodies and the Protection of personal information, tightened by Law 25. Five of its obligations land squarely on IT.
| What the Act provides | Reference | The technical measure behind it |
|---|---|---|
| Take reasonable security measures, given how sensitive and how numerous the records are | s. 63.1 | Multi-factor authentication, encrypted laptops, tracked patching, monitored endpoint protection |
| Publish governance rules for personal information on the municipal website | s. 63.3 | An inventory of systems and access, the raw material for what the municipality writes |
| Run a privacy impact assessment before acquiring, developing or overhauling an information system | s. 63.5 | A technical sheet for the project: where the data sits, who reaches it, how it is copied |
| After a confidentiality incident, reduce the risk, then notify the Commission d’accès à l’information and the people affected if serious injury is a risk | s. 63.8 | Workstations isolated, access cut, logs read to establish what was touched |
| Keep a register of confidentiality incidents | s. 63.11 | The technical trail of each incident, which the municipality files in its register |
Who is responsible? The person with the highest authority in the body acts as the person in charge of access to documents and of the protection of personal information. Those functions can be delegated in writing, for example to a member of the management personnel (s. 8). OKTO is not a law firm and does not audit: the technical measures are ours to set up, and reading the Act stays with your clerk. Our page on Law 25 for small businesses covers the neighbouring regime for private companies.
Several buildings
How do you connect town hall, the garage, the fire hall and the library?
Take a typical picture. A server sits in a back room at town hall. The garage has a single computer on a different Internet link. The library offers Wi-Fi to the public, on the same network as the circulation desk.
Two principles settle most of it. First, files stop living in one particular building: each employee signs in with the same identity wherever they are, and documents sit in a shared space. That is the job of our Microsoft 365 services. Second, whatever is open to the public stays apart from administration. The resident checking email at the library does not share a network with the taxation software.
Every workstation, at the garage or in the clerk’s office, reports to the same console: that is what our managed IT services cover.
- One account per employee, valid in every building
- The library’s public network isolated from the administrative one
- A backup Internet link, to be planned where downtime costs the most
Three addresses, one system: when one building loses its link, the other two keep working.
The municipal calendar
Which times of year cannot afford an outage?
A municipality’s calendar is written into legislation. Major IT work gets planned around these dates, never on top of them.
- November 15 to December 31: the budgetCouncil prepares and adopts next year’s budget inside that window. Not the week to replace the treasurer’s server.
- December 31 at the latest: the capital programIt spans three fiscal years. Replacing workstations or a server belongs in it, provided you show up with numbers. A three-year IT plan supplies them.
- Before March 1: tax billsThe Act respecting municipal taxation sets that deadline for sending the bill for a property tax already imposed. Producing the bills, then taking payments, puts the taxation software, the printer and online payment under load at once.
- Every month: the council sittingA regular sitting is held at least once a month, and the documentation council members need is available to them no later than 72 hours ahead, barring an exceptional situation. Projection and file sharing have to work the first time. The notice and the agenda go on the website: our municipal website examples show how to make them easy to find.
- Every four years: the general electionPolling day is the first Sunday of November. It brings temporary staff, so accounts to create and then close. That year, the deadlines for the budget and the capital program move to January 31.
Continuity
What happens if the server at town hall goes down?
With a copy that was never tested, the municipality finds out that same day whether it works. Our backup and disaster recovery service follows the rule of three copies on two types of media, one of them off site. That last copy is made immutable, because ransomware goes for the backups first.
A copy is not enough. You need a written plan: the order in which things restart, who decides, which numbers to call. A resident can wait two days for a pool permit. Payroll cannot. The plan ranks systems in that order, and it is put to the test before anyone needs it.
Backup is not archiving: the Archives Act requires every public body to keep a retention schedule, so how long copies are kept gets settled with your clerk. The worst case, the whole network encrypted, is covered on our page about ransomware protection.
A recovery plan fits in a few pages: the restart order, the people responsible and the date of the last test.
Sharing the roles
Who does what between the municipality and OKTO?
What stays with the municipality
Administrator accounts, the domain name, licences and documentation are in its name, and it takes them along if it changes providers. Council decides on purchases. The clerk carries the legal obligations.
What OKTO offers
Three monthly plans, billed per workstation or server. Employee support starts at Standard. Endpoint protection is part of all three, and managed cybersecurity has its own page. If an employee already handles the day-to-day, co-managed IT leaves that person in place. The vCIO module adds the plan and the budget.
Visits leave from our office: see our IT services in Trois-Rivières, in the Mauricie and in the other areas we serve.
Questions and answers
Questions municipalities ask
Does a municipality with a handful of employees need an IT provider?
Headcount matters less than what stops when IT stops. Six people who issue permits and collect taxes depend on a server, a management application and a mailbox. If nobody owns that, a monthly plan or a prepaid bank of hours fills the gap.
Does Law 25 apply to municipalities?
Yes, through the Act respecting Access to documents held by public bodies and the Protection of personal information, which Law 25 amended. A municipality is a public body under that Act. Security measures, the incident register and the assessment before an information system project all apply to it. How to read them is a question for your legal advisor.
Does a small municipality have to set up an access to information committee?
The Act provides for that committee, but a regulation in force since June 1, 2023 exempts a municipal body with 50 employees or fewer. In that case the director general carries out the functions assigned to the committee.
Do you work with our municipal management software?
Its publisher supports it. Our share is everything around it: workstations, the server, the network, accounts and backups. With the vCIO module, available from ten workstations or servers, vendor management, billed separately, also takes on the technical conversations with that publisher.
Do you travel to the municipal garage or the fire hall?
Yes, when hands are needed on equipment: cabling, a switch, a wireless access point. Our office is in Trois-Rivières and the service is offered across Quebec. Most requests are settled remotely, and visits are booked with you ahead of time.
What does a municipality have to do after a confidentiality incident?
The Act asks it to reduce the risk, enter the incident in its register and, where there is a risk of serious injury, notify the Commission d’accès à l’information and the people concerned. On the technical side we isolate workstations, cut compromised access and document what was touched. The decision to notify belongs to the municipality.
We walk through your buildings with you
Tell us how many workstations, how many addresses and which management software you run. We tell you what is urgent and what can wait for the next budget.
Reviewed by Antonio Pazzi, president of OKTO Solutions · updated