When a regulated Central Valley organization is mid-CAD-swap, mid-EHR-downtime, or mid-wire-cutover, the real question isn’t who set up the system - it’s who picks up the phone. Datapath’s 24/7 named team, CJIS-fluent workflow, and Central Valley roots mean we answer before the auditor and the shift-change both arrive.
The 3 a.m. page that exposed the seams at Stanislaus Regional 9-1-1
In August 2025, Stanislaus Regional 9-1-1 stood up a board action to update the Stanislaus County Board of Supervisors on a CAD system swap that had quietly been running for over a year. The existing dispatch software (Dispatch Now) was being replaced by a CentralSquare CAD. One-time startup costs were tallied at about $1.7 million; an underlying Oracle agreement carries a stated value of $7.5M but a stated county cost of $1.1 Two years after procurement, the project had advanced - and stalled. The Stanislaus County Sheriff’s Office was, per the CEO letter to the Sheriff, the “sole agency not yet configured” at the time of the letter. Modesto PD and Modesto Fire were coordinating with the project team but still running their own timeline. The CAD-to-CAD handoff between agencies was the next 6-12 months of work.2
For IT, none of this is a software problem. It is a regulated, multi-agency change running on a CJIS-tracked network. CLETS-bound traffic. Background-checked staff in secured rooms. Access logs an FBI CJIS auditor could pull on demand. And a phone tree that, on the wrong night, slows a 9-1-1 call long enough that leadership writes a memo about it.
That - not antivirus, not Microsoft licensing, not “fast tickets” - is what IT support in Fresno actually looks like when the work is real.
What does a CAD swap actually change for our IT?
This is the version of the question a buyer types when they’re choosing between vendors and the salespeople keep saying “managed IT.” It is worth answering plainly.
The CAD swap is the audit moment, not just the tech moment
Every CAD migration in a CJIS environment is two projects glued together. One is an IT project: networks, authentication, image deployment, database migration, cutover plan. The other is a compliance project: every device that touches CJI needs to be on a current FBI CJIS Security Policy baseline (the published Policy sits in the 5.9 release series as of writing, with a 6.0 update under discussion), backing up audit logs in a way the auditor accepts, and proving that staff using it have current background checks and training.3 The agencies that pass audits are the ones that run those two projects in parallel and treat the cutover night like a recovery exercise, not a celebration.
Section 5.6.2.2 advanced authentication became auditable, not optional
The CJIS Security Policy’s advanced authentication requirement reached real audit teeth in late 2024. Multi-factor authentication on every account that can reach CJI is no longer a forward-looking project - it is what an auditor verifies first, with a sample of recent logins, on day one of a review.4 If your IT partner cannot tell you, in writing and within 30 minutes, which of your dispatch accounts have MFA enforced and which still have a single-factor path to production, the swap is already at risk before it starts.
”Vendor background checks” lands on IT last - and lands hard
A CAD swap pulls in a dozen vendors. The recurring CJIS audit finding is the same on every list: were vendors vetted, signed to compliance addenda, and tracked in your personnel screening record?5 IT gets the question at the very moment the dispatcher is asking why their new screen layout is slow.
Three Fresno-area verticals where the same 3 a.m. moment shows up
We work across the same region as the dispatch swap story - Modesto, Ceres, Manteca, Merced, the wider Fresno and Central Valley - across K-12, healthcare, public safety, finance, and mid-market businesses with about 100 or more employees. The 3 a.m. moment takes a different shape in each. Once you have seen it once, you recognize it everywhere:
- A Fresno-area K-12 district running a summer 1:1 Chromebook refresh across thousands of students, where every device has to land with the right student profile, the right content filter, and the right loaner-document trail before the first bell.
- A Central Valley clinic finishing an EHR downtime rehearsal before a planned outage, with paper downtime forms staged, role-based access tested, and a downtime notification procedure staff can actually follow at shift change.
- A Central Valley credit union standing up ACH positive pay on a new core, where dual-control wire approval, exception decisioning, and audit retention need to be the same on day 90 as they were on day one.
If the people running the CAD swap, the Chromebook refresh, the EHR rehearsal, and the positive-pay cutover all carry the same pager, your IT partner is doing what we do. If they do not - if each of those projects lands on a different internal team with no central accountability - the seams are exactly where the audit will land.
What kind of IT partner actually answers when this hits?
A regulated Fresno-area buyer has, in practice, four types of options in front of them. They are not equal. We lay them out side by side, because the wrong choice here quietly inflates your audit risk over the next three years.
| Provider type | Best fit | Specialty / strength | Where it breaks at 3 a.m. | Accountability mechanism |
|---|---|---|---|---|
| Solo break-fix shop | 5-15 employee offices with no regulated data | Fast on-site attention for single-issue tickets | No on-call coverage; lacks CJIS/HIPAA/FERPA fluency; one person carries the pager | Named owner, but no bench |
| National MSSP call center | Distributed environments, primarily cloud workloads | Mature ITSM, deep tooling, standardized playbooks | Tickets triage in another state; change-control overworked; the client is a ticket number | SLA-based; rarely a named team |
| Generalist regional MSP | Mid-market 100+ with mixed regulated and non-regulated workloads | Local presence, broad stack help, occasional compliance workshops | Compliance posture is shallow; CAD/EHR/wire workflows are not their center of gravity | Mixed: some named contacts, some ticket queues |
| Regulated-vertical specialist (Datapath) | Public safety, K-12, healthcare, finance, mid-market 100+ in Central Valley and Ohio | CJIS / FERPA / HIPAA / NCUA-fluent, named on-call team, 24/7 emergency line staffed locally | Less suited to one-off break/fix outside regulated verticals; capacity is purpose-built, not generalist | Named team, on-call rotation, audit-ready artifacts on demand |
The first three can all give you a nice monthly executive summary. None of them reliably answers when a CAD cutoff happens, an auditor samples a forced MFA, or a school district needs thousands of Chromebooks reconfigured by Friday.
Why the other archetypes break at 3 a.m.
A solo shop has one person who knows the network. They are asleep. The call rolls to voicemail, and the dispatcher loses an hour figuring out a workaround. A national call center answers the phone and reads a changelog. They do not know your CAD vendor’s escalation channel or whether the sheriff’s MFA exemption was ever revoked. A generalist regional MSP will respond - but is more likely to ask you “what’s the priority?” than to walk in with a pre-staged CLI session on the right firewall. The seams show up precisely where these archetypes do not have the regulated workflow pre-rehearsed.
What we ship at Datapath during a moment like this
We are a Modesto-headquartered MSP with a Fresno office serving the 93728 zip code and the wider San Joaquin Valley, a Columbus-area office, and a 24/7 emergency line that is staffed, not outsourced. Our services stack is built around the calibrated version of the regulated workflow above, and it pulls together in three deliberate ways:
- A named, on-call Datapath team that owns the cutover night. Not a rotation of subs. The same engineers who built the environment.
- Our AI Suite, layered into every Datapath service, that reads alerts across the network, isolates suspicious traffic, and pages the human team with the right context before the shift-change call ends.6
- Audit-ready artifacts on demand: MFA enforcement reports, access logs, training records, vendor compliance addenda, and downtime procedures drafted and tested against the actual standard - not a guess.
If you are weighing IT support in Fresno, that last bullet is what you should be testing in conversation. Ask the prospective partner to show you, on a sample account, exactly what the CJIS MFA evidence trail looks like at your dispatch center. If the answer is “we can pull that up,” you are still early in the evaluation. If the answer is a one-paragraph narrative plus a screenshot, you are talking to a regulated-vertical specialist.
What’s the first thing a Fresno-area IT partner should be able to show you?
A buyer-side checklist, in the order we use it on our own engagements:
- A current network diagram with the regulated environment color-coded separately from the guest/business network.
- A one-page summary of the CJIS / FERPA / HIPAA / NCUA controls each user class touches, signed by the partner’s compliance lead.
- A sample after-hours ticket, with the actual named engineer in the closeout notes, not a tier label.
- A documented cutover rehearsal from the last 12 months, with timestamped screenshots of the team on call.
- A vendor compliance addendum template, plus the list of vendors currently signed to it.
If any of those are missing, ask why - before the CAD swap, the 1:1 refresh, the EHR rehearsal, or the wire cutover makes the answer obvious.
If you’re shopping for IT support in Fresno right now, what should you actually ask?
These four questions are the ones that sort real partners from sales decks. Don’t be shy:
- “Show me your on-call escalation list, by name, for a regulated-vertical account of our size.”
- “On a CAD / EHR / core cutover night, who is physically present, and what did the post-cutover checklist look like the last time you ran it?”
- “If a CJIS auditor emails us about advanced authentication today, what is the first artifact you hand me?”
- “What regulated-vertical accounts in Fresno zip 93710 (or 93720 / 93728), Modesto 95354, or the surrounding counties can you describe in confidence, and why?”
Talk to us
If your district, municipality, clinic, credit union, or 100-plus mid-market team is staring down a regulated change - CAD swap, 1:1 refresh, EHR rehearsal, wire cutover, audit cycle - the right move is a 30-minute call, not a 30-page proposal. Our Fresno office covers the 93728 zip code and the wider San Joaquin Valley, and we run a 24/7 emergency line for regulated clients across the Central Valley. We will walk through the questions above with you, on your environment, and let you judge whether the named team and the audit-ready artifacts are real.
For a deeper look at our regulated vertical coverage and what the engagement model looks like end-to-end, take a look at our managed IT, cybersecurity, and compliance solutions. If you want to see what the Fresno-side engagement looks like specifically, our Fresno, California location page has the on-site coverage map. We have also written a working checklist of what a CJIS audit actually asks for - it is on the blog and it pairs well with the questions above.
