Second in a three-part series. Part one: Between the AI Strategy and the 911 Console
In 2022, two changes nobody in a 911 center asked for arrived within months of each other. In February, AT&T began shutting down its 3G network, and Verizon and T-Mobile followed later that year. Any patrol car or ambulance still reaching CAD through a 3G modem needed new hardware, on the carriers' schedule. In June, Microsoft retired Internet Explorer, and systems built around it had to adapt.
Neither date was set by an agency. Both became the agency's problem.
In part one, we looked at pressure from above: AI strategies written at the state level for systems that were never built to take part. This piece is about pressure from the side. The rest of the technology world keeps moving, and the system on the dispatch floor has to keep up whether or not anyone planned for it.
A CAD System Is Only as Current as What It Connects To
CAD doesn't run alone. It sits on servers and operating systems. It's reached through browsers and mobile devices. It talks to state databases, partner agencies, and the 911 network, and it carries data covered by federal security policy. Each of those layers has its own owner, and each owner has its own schedule.
That makes CAD readiness about more than the software itself. A dispatch system is ready for what's next when it can absorb changes in every layer it depends on, on the timeline those layers set.
What's on the Clock Now
- Operating systems. Microsoft ends support for Windows Server 2016 on January 12, 2027. After that date, there are no more security updates unless the agency pays for extended support. Any CAD environment still running on it has about three months.
- Security certificates. Certificates are the digital credentials that let systems verify each other and encrypt the connection between them, the same thing behind the padlock in a web browser. The industry rules that govern them now cap their lifespan at 200 days, dropping to 100 days in 2027 and 47 days in 2029. Any connection that relies on one now needs renewing far more often than it used to.
- The 911 network. Ohio is moving its counties onto a statewide Next-Generation 911 platform, and nearly a quarter have migrated so far. Arizona has all 78 of its 911 centers on one, according to the 2026 Digital States Survey. As those networks change, the systems connected to them have to follow.
Security Sets Its Own Clock
In August, the Cybersecurity and Infrastructure Security Agency added a critical flaw in VMware vCenter, a widely used server management layer, to its catalog of actively exploited vulnerabilities. It gave the agencies under its authority three days to secure their systems. By then, as Dan Lohrmann noted in GovTech, ransomware groups had joined the attacks. Most local agencies aren't bound by that directive, but attackers set the same pace for everyone.
Policy moves too. In 2024, the FBI's CJIS Security Policy began requiring multi-factor authentication for access to criminal justice information, a change that reached every sign-in touching that data. We looked at why resilience has to start with architecture in Endpoint Security Is Not Enough.
What Each Change Costs on Legacy CAD
On a legacy system, every one of those outside changes becomes a local project: testing, a vendor quote, a maintenance window planned around operations that never close, and a cutover. They don't arrive one at a time. They stack, and they land on the same small team, often a handful of IT generalists who also support every other department.
None of this reflects a lack of effort. It reflects an operating model where the agency owns every layer of the system, and so owns every clock attached to it.
Every system your CAD touches runs on someone else's clock.
How Cloud-Native CAD Keeps Time
In a cloud-native platform, the infrastructure under the CAD is run by the provider as part of the service. There are no agency-owned CAD servers to replace when an operating system reaches end of support. And because the platform is continuously updated with no downtime, changes in the layers underneath are handled as routine releases rather than local projects.
10-8 Systems is cloud-native on AWS GovCloud, infrastructure built for sensitive government workloads. It reduces an agency's reliance on locally managed servers and takes much of the maintenance burden off local IT teams.
You can't control the clocks. You can choose a system that keeps time for you.
Next in this series: why keeping the system you have isn't the low-cost option it looks like in a flat budget year.
Questions Worth Asking
Why do outside technology changes affect a CAD system?
A: Because CAD depends on layers it doesn't control: operating systems, browsers, mobile networks, security policy, and the 911 network. When any of those changes, the CAD environment has to change with it, on the schedule of whoever owns that layer.
What happens when a CAD server's operating system reaches end of support?
A: It stops receiving security updates from the maker unless the agency pays for extended support, which leaves known vulnerabilities unpatched. Ask your vendor and IT team which operating systems your CAD environment runs on and when each reaches end of support.
Do shorter certificate lifespans affect 911 centers?
A: Any connection that relies on a publicly trusted certificate does, such as a browser-based login or a link to an outside system. Ask IT which certificates the CAD environment depends on, how they're renewed, and who is alerted before one expires.
Who handles these changes on a cloud-native CAD platform?
A: The provider handles the infrastructure layers as part of running the service. Ask any vendor which layers stay with the agency, how quickly critical patches are applied, and whether updates require downtime.
Bring your list of the changes coming at your CAD environment. We'll walk through which ones stay with your team and which ones move to the platform.