It's called the North Shore IT Collaborative, and it's made up of seven communities — some with just a few thousand residents. Formed in 2021, it's already yielding results, enabling participants to punch above their individual IT weights, doing things like making bulk purchases and getting town-to-town support, among other benefits. They are, essentially, stronger together.
Buying as a collective, for example, can put otherwise-pricey services within the reach of small community budgets. As a result, the towns of the North Shore IT Collaborative have sped up their timelines for adopting new cybersecurity measures, sometimes beating out insurance provider requirements. Another benefit is that larger jurisdictions help the smaller communities. The most populous town is Danvers, Mass., home to 27,000, and it has a more-established IT setup, including a full-time IT director, which many of the smaller towns lack.
That director is Colby Cousens, who said he gives each municipality an hour of his time per week, focusing on its specific IT needs. Participants turn to Danvers for strategic IT management, space in its data center, or help deploying and managing new tech. Danvers then benefits because the other towns pay it fees to defray its own costs.
“[Small towns] have a bunch more confidence moving forward with a purchase or a plan or investing in their infrastructure when they have someone like [Cousens] who’s a municipal employee in a different town, who’s really ingrained in internal infrastructure,” said Brian Luther, who works for the Metropolitan Area Planning Council, a nonprofit that assists the collective. “He knows what's going on in their network and can make recommendations that they can trust. That’s not a vendor who's making more money off advice.”
While Danvers takes point in the collaborative, it doesn’t dictate the group’s work or aims. The smaller jurisdictions keep their own local control, and the collaborative also defines its annual goals as a group, with members having equal voting rights in decision-making.
It all adds up to an arrangement that many of the participants said is greatly beneficial, and one that could be a model for other areas of the United States.
“Considering shared services, or regionalization, can often be daunting … but I found with this collaborative in particular, I can much better serve my employees, and thus our residents, with the use of the collaborative than I could have on our own,” said Jackie Bresnahan, interim town administrator for Middleton, Mass.
While the group was officially formed about two years ago, the roots of their cooperation date back further.
HOW DID WE GET HERE?
The initiative perhaps grew out of a smaller collaboration in April 2011, when Essex, Mass. — home to about 3,600 residents — began direct computing out of the data center of Melrose, Mass., home to nearly 30,000.
Brendhan Zubricki is town administrator for Essex, handling the jurisdiction's IT as well. Zubricki said the partnership meant Essex didn’t need to buy its staff PCs, but it could instead purchase less expensive thin client devices that just needed to be able to connect to Melrose’s data center, where the actual processing would occur.
The setup was compelling from both a cost-savings and disaster recovery and resilience perspective, Zubricki said.
“Everything’s centralized, everything gets backed up … [and it] saves us primarily on life cycle costs on both PCs and servers,” Zubricki said. “We’re just renting space on a large data center. And the data center has budgets that replace equipment on a regular schedule … and we just benefit from their economy of scale.”
That relationship ended in 2018, however, when Melrose got a new IT director who chose to discontinue regional services, Zubricki said. But many staff who’d been involved in that project on the Melrose side moved to Danvers, where they continued the relationship with Essex.
Danvers began providing Essex with direct computing and data backups. The arrangement was similar, except that Essex aimed to connect to Danvers via fiber-optic cable, a change from before where it’d connected to Melrose over the Internet, via multiprotocol label switching (MPLS) circuit. That earlier approach had some resiliency limitations.
“Back when we were with Melrose, if we lost the MPLS circuit — which never happened by the way — [but] if we did, we would be kind of dead in the water,” Zubricki said.
Connection via municipally owned fiber makes remote computing fast and “extremely inexpensive,” Zubricki said. The current setup is also more resilient: "If we lose the municipally owned fiber, there's an automatic back channel now over the Internet, which means we would compute more slowly, but we're still up."
Getting to this point required first laying fiber, with the path between Danvers and Essex going through two other towns, said Cousens. That drew more attention to this partnership from other nearby communities, and both intermediate towns would ultimately join the collaborative.
The team in Danvers had started meeting with neighboring communities, and it discovered that many lacked internal IT departments. Those towns were instead relying on consultants and managed service providers for help, but the third-party assistance only went so far, Cousens said.
“That consultant approach was more of a break/fix approach than a strategic approach to IT,” Cousens said.
Danvers was significantly larger than many of the surrounding municipalities and better-resourced in IT. It had Cousens as IT lead, its own enterprise data center and a fiber-optic network throughout the town. Empowered by grant funding, Danvers began extending its fiber network to other communities and started hosting duplicate copies of neighboring communities’ servers in its data center as a disaster recovery measure, Cousens said.
But there was eagerness to see intermunicipal cooperation go further, and Danvers applied for grant monies to fund a feasibility study on regional IT. That study wrapped up in December of 2019.
Having the research in hand helped “solidify” the partnerships and approach, Cousens said. Next up: making the collaboration more official. Danvers turned to the Metropolitan Area Planning Council (MAPC) for assistance with administrative support, including with communications and running meetings. The MAPC also helped craft a formal memorandum of understanding among Danvers and the other towns. Cousens said this more official approach prompted one town, Marblehead, to drop out of the collaboration. Six other towns, however, were ready to commit.
Modified Google Maps screenshot
BULK PURCHASING, IT SUPPORT AND OTHER BENEFITS
The shift to remote work during the pandemic expanded towns’ attack surfaces and upended traditional approaches to network security. That inspired the collaborative to make cybersecurity one of its first focuses, Cousens said.
The group entered into a joint purchasing agreement for a suite of cybersecurity products, including endpoint detection and response (EDR), multifactor authentication and other defenses, Cousens said. Danvers deployed the tools across communities to bring them all to a baseline of protection.
Towns that might otherwise have struggled to afford the suite of cyber tools had an easier time acquiring them through the collaborative. For one, Danvers put down the capital for the purchase, with a grant covering half that cost. The bulk purchasing deal also saw each town save 25 percent on annual renewal costs compared to what they’d face if paying for renewals individually, Cousens said.
Plus, tech assistance from Danvers has meant that communities without IT departments could hand off much of the work of managing the tools.
“I don't need to worry about it: We pay the collaborative, they run the [cybersecurity] fabric, they update it, they keep it in place,” Zubricki said. “We are the smallest player. We only have 3,600 people in this whole town. But we are benefiting from IT hosting and a regional security fabric as if we’re a giant in the industry, because we’re participating in something that's much bigger than ourselves.”
The cyber bulk purchase was also particularly timely: Around that time, the nonprofit insurance provider serving many Massachusetts local governments announced that cyber insurance applicants would soon need to have EDR, Cousens said.
Cybersecurity isn’t the only procurement area, either. The collaborative is also purchasing IT help desk services, as well as looking to acquire physical security devices like cameras and door access control tools, Cousens said.
And, of course, another main benefit is the IT support Danvers offers its smaller partners.
Middleton’s Bresnahan said that the collaboration has essentially let her town “utilize [Danvers’] IT department as our IT department,” and get advice in thinking through projects, such as considering IT systems for Middleton’s forthcoming municipal complex.
“That expertise and guidance alone has been invaluable,” Bresnahan said.
Her town can call up Danvers’ team for troubleshooting and to talk through ideas. The collaborative has also made it easier to learn about how other participants are responding to similar challenges, Bresnahan said.
Danvers is continuing to expand its work for the collaborative and is now taking on two local university students as cybersecurity interns. The interns will spend six months assisting with external attack surface scanning for the collaborative, while a vendor will offer a vulnerability assessment of the collaborative’s internal attack surface, Cousens said.
Other collaborative participants have been able to offer support, too: Middleton can use Danvers’ fiber network to connect other members to its regional 911 dispatch center, for example, Bresnahan said.
MAKING THE MODEL WORK
Zubricki believes a regional IT model like this could benefit other municipalities throughout the country.
Making a group like the North Shore IT Collaborative work requires an anchor town like Danvers that has the IT capacity and in-house knowledge to offer support and take point on projects, Luther said. That town’s leadership also must be willing to make its staff available to help other communities, a nontraditional approach.
There’s always a risk that the anchor town might eventually pull out of the initiative, but the fact that the North Shore IT Collaborative has an official agreement adds stability and indicates Danvers intends this project to last, Zubricki said.
A collaborative like this is “a lot of work,” Cousens noted, but it’s rewarding, too.
“I’ve made lot more progress at my main job in Danvers because of all the interaction I’ve had with other communities [and] the insights I’ve had on different IT environments and different ways of doing things,” Cousens said. He’s become connected with regional advisory groups and the like through his work with the collaborative, too.
To get a project like this off the ground, start small, Cousens advised. Once a regional IT collaboration has a solid handle on delivering some offerings, it can always expand its scope.
Goals and needs will also change over time, and it’s important for the work to evolve, Bresnahan said. Middleton hadn’t initially expected to receive strategic IT management from Danvers, but proposed the idea when Middleton's needs changed. Communities interested in regional partnerships shouldn’t feel locked into maintaining the same setup they start with, and can revisit the arrangement to adjust.
“The best advice I can give is that you have to be thinking in the beginning that it's OK if this is not the final version. You have to kind of prepare to evolve with the program as your needs change [and] as your fellow collaborators’ needs change,” she said. “You have to be OK with going back to the table six months in, [or] a year in, and really having a good check-in and not being afraid of amending the program based on your experiences.”
