The Virginia Association of Government Archives & Records Administrators (VAGARA) is a statewide, not-for-profit organization whose members are affiliated with state or local government and who are concerned with the management of public records.
The annual conference is an opportunity for members and friends to gather for education and networking with those who share an interest in government archives and records management issues. The 2026 Annual Conference will be hosted from Great Wolf Lodge in Williamsburg, October 21-23. Registration for the 2026 Annual Conference is now closed. We look forward to welcoming attendees to Great Wolf Lodge later this month! VAGARA wishes to extend its gratitude to Visit Williamsburg for generously supporting the 2026 Annual Conference.
No industry gets a pass when it comes to protecting sensitive data like personally identifiable information (PII) or criminal justice information (CJI).
Healthcare providers hold deeply personal medical histories. Financial institutions manage information about customers’ identities and assets. Employers are entrusted with confidential records about their people. When that information falls into the wrong hands or suddenly becomes unavailable, the impact reaches far beyond compliance.
Some of the most rigorous security standards pertain to government organizations, including the Criminal Justice Information Services (CJIS) Security Policy and GovRAMP. Although they were created to protect sensitive data within government agencies, many of the security principles behind them have much broader relevance because those standards were built based on global best practices like NIST. Across public and private sector industries, many of the same fundamentals apply to keeping sensitive information secure and available.
The security bar within every industry should reflect what’s at stake.
Document Management and Security: Where Gaps Can Take Hold
Security policies are only as effective as applied. As sensitive information, like PII and CJI, moves through a business, across different file types, and into unstructured data and documents, even routine activity can create gaps:
An employee changes roles but retains access to information they no longer need.
Sensitive records remain in a repository beyond their required retention period.
A security team investigating an incident can’t easily determine who accessed information or changed security settings.
Those gaps become harder to spot when information is scattered across systems or governed differently from one department to another.
Bringing sensitive information into a centralized document management system makes it easier to apply security and governance policies consistently. Access controls can limit who sees the data, while automated retention and disposition help prevent records from being kept longer than necessary. Auditing creates a record of activity that security teams can turn to when something goes wrong.
For organizations managing sensitive information under stringent security and regulatory requirements, Laserfiche Enterprise Security features extend these protections with additional security controls in Laserfiche Cloud.
Getting a Handle on Your Information
You can’t consistently protect sensitive information if you don’t know where it is or what it contains.
Customer, patient, constituent and employee information can be spread across forms, contracts, scanned documents and other business records. Consistent classification and metadata make that information easier to identify, so the right controls can be applied based on its contents and how it needs to be handled.
AI raises the stakes. AI tools and agents need clearly defined, role-appropriate access to this kind of information, just as employees do. Well-structured data provides the context AI needs to take action appropriately, while access controls determine what those tools can reach.
Knowing what information exists also helps teams determine when it no longer needs to be kept. Safely disposing of records at the appropriate time reduces the amount of sensitive data that needs to be protected long term.
A Clear Line of Sight
For the information that remains, it’s crucial to have a clear picture of who accesses it and how they use it. This visibility is especially important for privileged accounts, where elevated access can allow users to make changes across repositories, workflows and security settings.
With advanced audit tracking in Enterprise Security, organizations can capture user login activity, system changes and security events. This helps security teams trace suspicious activity and understand what happened when something goes wrong.
It can also take some of the work out of audits. Instead of piecing together evidence after the fact, organizations have a clearer record of how security controls are being applied.
Planning for the Unexpected
Protecting information also requires planning for what happens when systems go down. Critical information needs to stay accessible when the business depends on it. An outage can interrupt patient and customer services, or bring production and supply chain processes to a halt. The longer information remains unavailable, the greater the disruption.
Multi-region disaster recovery in Enterprise Security uses near real-time, account-level repository data replication and multi-region failover to help maintain access to critical information during a large-scale infrastructure failure. It also helps quickly restore operations following these incidents.
That resilience helps people keep working through disruptions and reduces the risk of an outage bringing mission-critical operations to a standstill.
Cloud Security to Support AI Governance
The right policies, regulations and protections will look different from one industry to the next. Organizations need to understand the security and compliance requirements that apply to them and configure their technology and policies accordingly.
Enterprise Security helps put those policies into practice, extending Laserfiche Cloud with advanced security, auditing and disaster recovery capabilities designed for organizations with stringent information security requirements. Together, these added protections strengthen how sensitive information is secured as it moves through the business.
Ultimately, the sensitivity of the information should determine the security bar. When the stakes are high, the protections should be too.
State and local governments have more time to meet new federal requirements for digital accessibility. For many organizations, that extra year is welcome — but it shouldn’t be mistaken for a reason to wait.
The U.S. Department of Justice’s rule under Title II of the Americans with Disabilities Act (ADA) establishes Web Content Accessibility Guidelines (WCAG) 2.1 Level AA as the technical standard for web content and mobile applications provided by state and local governments. Following an extension announced earlier this year, the compliance deadline is now April 26, 2027, for larger public entities and April 26, 2028, for smaller ones.
The additional time recognizes the amount of work required to meet these requirements across websites, online forms, mobile applications and electronic documents. For agencies deciding how to use that time, one place to start is with the digital services residents depend on most.
What Accessibility Looks Like Across 300+ Forms
At first glance, a public form can seem like a relatively small piece of a government agency’s digital presence. But forms are how residents apply for services, submit information and complete everyday interactions with government. Residents who rely on screen readers or keyboard navigation need accessible forms to access those services.
As governments move more services online, accessibility becomes an important part of improving the digital experience for the entire community. The City of Tucson saw the scale of that challenge firsthand.
Tucson has more than 300 public-facing Laserfiche Forms across 18 departments. Residents use them for everything from starting or stopping water service to requesting disability-related transportation.
As the city worked toward ADA compliance, accessibility audits identified issues across its forms. Some were relatively small from a technical perspective, but meaningful to the people using them. Browser tabs, for example, displayed generic titles such as “New Submission.” This made it difficult for people using screen readers, or anyone navigating several forms at once, to identify which form was open. The city developed JavaScript that replaced the generic title with the actual form name.
The team also addressed skip links that allow keyboard and screen-reader users to bypass repetitive navigation, along with color contrast, form labels, radio buttons, checkboxes and other WCAG-related issues. Tucson ultimately implemented more than 20 accessibility fixes across its public-facing forms environment. Developing, testing and implementing those improvements required more thansignificant staff time. But that work gave Tucson a foundation it could use to address accessibility more consistently going forward.
Tucson’s experience illustrates one of the biggest accessibility challenges facing public organizations: scale. Digital content exists across departments, systems and formats, making accessibility improvements a significant undertaking.
From Remediation to Repeatable Practices
Finding and correcting existing issues is only part of the job. Agencies also need to prevent the same problems from appearing in the next form or digital service they publish. Tucson turned what it learned during remediation into repeatable practices built on governance.
Using custom JavaScript and CSS capabilities within Laserfiche Forms, the city incorporated its accessibility fixes into a standardized template for future development. It also established design guidance for areas such as approved colors, alt text and accessible form controls. Form designers verify accessibility before publication. The city’s governance, risk and compliance team uses tools to continuously monitor its digital environment.
These practices help Tucson address accessibility as teams develop and manage digital services, rather than fixing issues after the fact. Documenting those standards and fixes also provides a common reference for creating new forms and updating existing ones.
Beyond forms, agencies also need to consider how they create and manage other public-facing digital content. That includes establishing ownership and incorporating accessibility into the processes used to create, review and publish websites, PDFs and documents.
Knowing Where Responsibility Lies
As agencies review their broader digital environment, they must also distinguish between the accessibility of the technology they use and the accessibility of what they create with it.
Laserfiche documents accessibility across its products through Voluntary Product Accessibility Templates (VPATs), covering areas such as web content, user interface navigation and product documentation. Organizations remain responsible for the accessibility of the forms and content they create or store, and how they configure them.
Meeting that responsibility requires agencies to consider how people with disabilities interact with the digital services they provide. For public-facing forms, that means asking questions such as:
Can someone navigate the form without a mouse?
Will a screen reader provide meaningful information about each field?
Are instructions and error messages clear and accessible?
Can someone understand what information is required and successfully submit the form?
Automated accessibility scanners can help identify issues such as missing labels, color contrast problems and heading structure. True accessibility also requires understanding how well a digital experience works for the person using it.
Putting the Extra Time to Work
The compliance deadlines have moved, but the obligation hasn’t. Title II still requires equal access to services today, and governments can face legal exposure before the new compliance dates.
Agencies can use the extension to assess their digital assets, prioritize services with the greatest impact on residents and address accessibility gaps. Establishing standards now can also make accessibility easier to maintain once the immediate remediation work is complete.
Public-facing forms are a good place to apply that thinking because they sit directly between government services and the people trying to use them. Tucson’s experience shows what that can look like in practice. Agencies can put the additional time to good use by learning from its experience, addressing existing issues while improving how they develop digital services for the future.
LONG BEACH, CALIFORNIA, Sept. 29, 2026 — Laserfiche — the leading SaaS provider of intelligent content management and business process automation — today announced the appointment of Garrett Boss as chief information officer. Boss will oversee Laserfiche’s global IT services team and business transformation office, including deployment of internal Laserfiche solutions and all other enterprise-wide IT systems. In this role, he will also oversee governance, risk, and compliance, supporting Laserfiche’s mission to scale AI innovation while safeguarding the critical content and lifecycle tools customers rely on.
“Laserfiche’s own technology infrastructure and security posture are central to how we deliver an exceptional product and responsive services,” said CEO Karl Chan. “Garrett is a proven leader with a track record of leading global IT and governance teams as they scale and accelerate innovation. I am confident his leadership will help move Laserfiche forward as we shape the future of our platform.”
Boss has over 20 years of experience aligning digital transformation initiatives with business outcomes. Most recently, as executive vice president, Enterprise & Data Platforms at FOX Corporation, he led efforts to integrate agentic workflows across FOX’s application portfolio, to accelerate product updates and feature releases, and reduce time-to-market for software improvements. He is passionate about making a positive impact enterprise-wide, building delivery-focused teams that operate with clarity, and providing technology solutions that create measurable value. At Laserfiche, Boss will support Laserfiche’s continuous innovation and delivery of seamless experiences to partners and customers.
“I’m honored to join Laserfiche at such a pivotal moment in the company’s journey,” said Boss. “Laserfiche has long been a leader in helping organizations manage information and automate critical business processes, and I’m especially excited about the company’s strategy for AI and context management. The value of enterprise AI depends heavily on the quality and context of the information that grounds it. Laserfiche is uniquely positioned to help organizations transform their unstructured content into trusted, actionable context that can be securely integrated into AI-powered workflows. I look forward to working alongside Karl and the entire leadership team to advance our technology strategy, accelerate innovation and deliver intuitive, seamless experiences that empower our customers and partners to thrive.”
Laserfiche provides enterprise-scale, AI-driven content management solutions to more than 10 million users globally. The company is headquartered in Long Beach, California.
About Laserfiche
Laserfiche is the leading enterprise platform that helps organizations digitally transform operations and manage their content with AI-powered solutions. Through scalable workflows, customizable forms, no-code templates and AI-enabled capabilities, the Laserfiche® document management platform accelerates how business gets done. Trusted by organizations of all sizes — from startups to Fortune 500 enterprises — Laserfiche empowers teams to boost productivity, foster collaboration, and deliver a superior customer experience at scale. Headquartered in Long Beach, California, Laserfiche operates globally, with offices and partners across the Americas, Europe, the Middle East and Asia.
GITEX GLOBAL stands as the world’s most established and iconic large-scale tech exhibition. For over four decades, it has been the premiere gateway for tech creators, investors and enthusiasts to collaborate.
Laserfiche self-hosted includes a host of integration tools that you can leverage to connect external third-party systems to your automated Laserfiche solutions. Learn how to use web requests and database connections to tap into data in another system to streamline and simplify your Laserfiche automated processes.
Laserfiche Cloud includes a host of integration tools that you can leverage to connect external third-party systems to your automated Laserfiche solutions. Learn how to use web requests, direct database connections, and lookup tables to tap into data in another system and streamline your automation.
New to working with documents in Laserfiche? In this hands-on lab, follow along with our expert instructors to learn how to use the Laserfiche repository.
Create your first electronic form and process in this hands-on lab! Perfect for anyone new to Laserfiche and automation, this session will show how you can use Laserfiche to increase efficiency and streamline work with electronic forms and automated processes.
Criminal justice agencies have plenty of reasons to modernize aging information systems. But what often stands in their way is cost.
Federal funding is available, but there’s no single grant dedicated specifically to CJIS (Criminal Justice Information Services) modernization. Instead, the dollars are spread across criminal justice, technology and cybersecurity programs with different priorities and eligibility requirements.
That makes the way agencies define their modernization projects especially important. CJIS modernization can take many forms, from replacing aging document repositories and automating case workflows to strengthening records governance, security and continuity of operations. These investments can give investigators faster access to records, improve CJIS audit readiness and help authorized justice partners share information more securely.
Connecting technology investments to outcomes like these can help agencies identify funding programs that align with what they want to achieve.
Broad CJIS Modernization: Byrne JAG
The Edward Byrne Memorial Justice Assistance Grant (Byrne JAG) Program is one of the broadest funding opportunities for CJIS modernization. Its expansive scope makes it a potential funding source for CJIS modernization products involving secure records management, digital case files, automated workflows and information sharing.
Eligible cities and counties receive JAG awards directly from the U.S. Department of Justice, while funding also reaches state and local governments through state-administered programs. This gives agencies multiple avenues to explore for CJIS modernization projects.
Improving Criminal Justice Records with NCHIP and NARIP
Projects focused on criminal history information have more targeted options.
The National Criminal History Improvement Program (NCHIP) supports improvements to criminal history records and disposition reporting, as well as information sharing and integration among courts, prosecutors and law enforcement.
Similar in scope is the NICS Act Record Improvement Program (NARIP), which focuses on records supporting the National Instant Criminal Background Check System. Eligible projects can include protection order automation, court disposition reporting, improvements to record completeness and workflow automation.
Both programs are generally administered at the state level, so municipal agencies typically participate through statewide initiatives.
Supporting Pilots and Technology Projects with COPS Funding
For those looking to test a new approach, the Community Policing Development Microgrants Program can support demonstration and pilot projects. Current FY2026 awards provide up to $200,000 for potential initiatives supporting digital investigative case management, secure collaboration with prosecutors, cybercrime documentation or CJIS-secure information sharing.
The COPS Technology and Equipment Program provides another option for law enforcement technology projects. Eligible investments range from secure cloud modernization to regional information sharing and disaster recovery. Funding comes through Congressionally Directed Spending, so agencies must work with their Congressional delegation during the appropriations process.
Connecting CJIS Modernization to Cybersecurity
Some CJIS modernization projects may fall under the umbrella of broader cybersecurity funding.
The State and Local Cybersecurity Grant Program supports initiatives such as secure cloud migration, identity management and disaster recovery. Funding can also extend to secure storage and audit capabilities when the work aligns with a state’s approved cybersecurity plan. For criminal justice agencies, these priorities translate into stronger access controls and clear audit histories, as well as maintaining reliable access to critical information during disruptions.
The Homeland Security Grant Program offers another potential funding source, particularly for projects that strengthen regional intelligence sharing or improve the security and availability of critical information. Continuity-of-operations investments may also qualify.
More Specialized Funding Opportunities
Depending on the project, organizations can also explore programs aimed at specific areas of the criminal justice system.
Paul Coverdell Forensic Science Improvement Grants: Forensic operations, including digital records, evidence documentation and audit history.
Office on Violence Against Women funding: Protection orders, victim services and confidential information management.
Coordinated Tribal Assistance Solicitation and Tribal Access Program: Tribal justice organizations and initiatives involving secure records and criminal justice information.
State Justice Institute grants: Court modernization planning, process redesign and information governance planning.
Connecting Funding to CJIS Modernization
Funding opportunities and eligibility evolve from one cycle to the next. Agencies can navigate these changing opportunities more effectively by first defining what they want to improve.
Laserfiche supports these efforts by helping organizations securely manage criminal justice records, automate workflows, govern access and maintain audit histories. Together, these capabilities provide an information foundation for technology investments tied to public safety and operational goals.
Modernization is the project, but the outcome is what ultimately makes the case for funding.
