StateRAMP + CJIS + constituent services + FOIA + procurement + policy drafting. GCC or commercial cloud. 32 government deployments.
Last updated by Errin O'Connor, Founder & Chief AI Architect, EPC Group
State + local + municipal government Copilot: cloud selection commercial + GCC + GCC High (CJIS-connected law enforcement). Six use cases: constituent communication, FOIA + public records, meeting minutes, grant applications, procurement, policy + code drafting. StateRAMP Authorized for M365 + Copilot. CJIS for state/local law enforcement requires GCC High. Six frameworks: StateRAMP + state-specific (TX-RAMP, others) + CJIS + HIPAA (public health) + FERPA (public schools) + state + federal AI EOs. EPC Group tiers: StateRAMP + CJIS Readiness, Foundation, GCC Migration, Deployment and Full Rollout — each a fixed fee quoted after a scoping call. 32 federal + state + local + municipal deployments.
Yes. State + local + municipal governments can deploy Copilot via: (1) M365 commercial cloud — for jurisdictions without CJIS + no high-security data. (2) M365 GCC — for state agencies handling regulated data (not DoD-classified). (3) M365 GCC High — for state + local law enforcement handling CJIS data. Selection depends on data types + compliance obligations. StateRAMP authorization covers commercial + GCC for state/local use. Copilot for state/local government pricing: (1) Government Community Cloud pricing (15-25% premium over commercial). (2) Non-CJIS state/local can use commercial with standard pricing. (3) Some Microsoft Cooperative Purchasing Program discounts available.
Six proven state/local government Copilot use cases: (1) Constituent communication — respond to inquiries, permit questions, service requests. (2) FOIA + public records — draft responses to public records requests + redaction assistance. (3) Meeting notes + minutes — council meetings, board meetings, public hearings. (4) Grant applications — federal + state + foundation grants. (5) Procurement — RFP drafting + response analysis. (6) Policy + code drafting — municipal code, procedures, regulations. Avoid: benefits eligibility decisions, licensing decisions, code enforcement decisions — human-in-the-loop always required for citizen-affecting decisions.
StateRAMP is the state-government equivalent of FedRAMP that certifies cloud services for state + local government use. StateRAMP levels: (1) Ready — vendor has committed to StateRAMP process. (2) Authorized — full authorization for state/local use. Microsoft M365 has StateRAMP Authorized status covering commercial + GCC. Copilot is in scope of StateRAMP authorization. StateRAMP alignment matters for: (1) State agency procurement requirements. (2) Local government contract compliance. (3) Educational institutions with state contract requirements. Additional state-specific: many states have their own security requirements above StateRAMP (Texas TX-RAMP, California, New York).
CJIS (Criminal Justice Information Services) is the FBI standard for handling criminal justice information. Required for: (1) Local police departments accessing FBI NCIC (National Crime Information Center). (2) State criminal justice agencies. (3) Court systems accessing CJIS data. (4) Prosecutors + public defenders in CJIS-connected workflows. Microsoft compliance: GCC High is the primary CJIS-compliant M365 environment. Commercial cloud + Azure GCC High for adjacent CJIS workflows. Signed CJIS Security Addendum. Copilot for CJIS agencies: GCC High with agency-level CJIS ATO validation.
Copilot supports FOIA + public records work: (1) Records search — natural-language search across agency SharePoint + email + files. (2) Redaction assistance — identifies PII, PHI, exempt content requiring redaction (attorney-client privilege, security, personnel). (3) Response drafting — drafts response letters + supporting documentation. (4) Timeline tracking — identifies statutory response deadlines. (5) Fee estimation — calculates response fees per agency policy. (6) Denial letter drafting — for exempt records. Compliance requirement: final redaction + release decisions require human review by public records officer + potentially legal counsel; Copilot supports the workflow, does not replace responsible official judgment.
Six frameworks state + local gov navigate: (1) StateRAMP — cloud service authorization. (2) State-specific security (TX-RAMP, others). (3) CJIS if law enforcement — FBI security policy. (4) HIPAA — public health + Medicaid + state-run behavioral health. (5) FERPA — public schools + state education agencies. (6) State + federal AI EO (California SB 942, Colorado AI Act, EU AI Act if operating in EU). EPC Group state + local government engagements include framework mapping to Microsoft Purview Compliance Manager.
EPC Group state + local government portfolio: (1) StateRAMP + CJIS Copilot Readiness (fixed fee, 4 weeks) — regulatory audit + gap analysis + roadmap. (2) Foundation Hardening (fixed fee, 8 weeks) — labels + DLP + Insider Risk + StateRAMP framework mapping. (3) GCC Migration (12-16 weeks, fixed fee quoted after discovery) if commercial → GCC needed. (4) Foundation Copilot Deployment (12-20 weeks, quoted after discovery) — 200-500 user pilot + rollout + adoption program. (5) Full Enterprise Rollout (20-32 weeks, quoted after discovery) — city-wide or agency-wide adoption. Cooperative purchasing options + government-specific pricing. 32 federal + state + local + municipal deployments completed.
4-week fixed fee: regulatory audit + gap analysis + roadmap. Call (888) 381-9725.
Monday-Friday, 8 AM - 7 PM CT
We respond to all inquiries within one business day
AI assistant — not human