Scaling Trust Through Security and Compliance Modernization

Presented by Google & Carahsoft

State and local governments are at a critical inflection point. The pressure to modernize legacy systems, deliver improved digital services, and meet evolving federal and citizen expectations is intensifying. At the same time, agencies must ensure that security, compliance, and public trust remain uncompromised. Keith Haugrud, Head of Security Sales for SLED at Google Public Sector, explains that the path forward lies in leveraging standardized frameworks, modern cloud technologies, and a more dynamic approach to risk management.

Across the country, many government organizations are still operating on infrastructure that dates back decades. These legacy systems, while still functional, present increasing risks and limitations. Agencies recognize the need to transition to modern environments, and cloud adoption has become a central strategy in that effort. However, modernization is not simply about moving faster—it is about moving smarter.

Historically, compliance has often been viewed as a bottleneck in government IT. Security reviews and authorization processes were seen as necessary but time-consuming hurdles that slowed innovation. Haugrud challenges that perspective, emphasizing that frameworks like FedRAMP and GovRAMP are now enabling speed rather than restricting it. By providing pre-established security controls and standardized validation processes, these frameworks allow agencies to adopt cloud solutions with greater confidence while significantly reducing the burden of independent assessments.

A major shift underway is the move from point-in-time compliance to continuous monitoring. In today’s environment, risks evolve rapidly, and static assessments are no longer sufficient. Continuous monitoring provides real-time insight into system vulnerabilities and overall security posture, allowing agencies to identify and remediate issues as they arise. This not only strengthens security but also gives leaders better visibility into the level of risk they are willing to accept.

Zero trust is another key component of this transformation. Rather than relying on traditional perimeter-based security models, zero trust assumes that threats can exist both inside and outside the network. This approach emphasizes identity, access control, and constant verification. Haugrud describes modern security as a layered model, where technologies like identity and access management, secure browsing, and privilege controls work together to protect data and systems. As awareness of zero trust continues to grow in the state and local space, agencies are increasingly incorporating it into their long-term strategies.

Artificial intelligence is also beginning to play a meaningful role in modernization efforts. Many government systems contain vast amounts of data spread across disparate legacy platforms. AI has the potential to bridge these gaps by identifying relevant information and making it actionable in real time. This allows agencies to improve service delivery without having to completely replace existing systems, creating a more efficient and user-friendly experience for citizens.

At the same time, external pressures are accelerating the pace of change. New federal mandates and policy requirements are forcing agencies to rethink how quickly they can adapt their systems. Cloud technologies provide the flexibility to deploy updates and new capabilities in weeks rather than years, helping governments meet these demands more effectively.

Looking ahead, the evolution of compliance frameworks will be critical. As emerging technologies like AI continue to develop, frameworks such as FedRAMP and GovRAMP will need to adapt to address new types of risk. Despite this uncertainty, one thing remains clear: standardized, scalable approaches to security and compliance will be essential to enabling innovation.

For state and local governments, the challenge is no longer whether to modernize, but how to do so in a way that maintains trust. By embracing cloud adoption, continuous monitoring, and zero trust principles, agencies can move faster while strengthening their security posture—delivering better outcomes for both government and the citizens they serve.