CDCR Technology Landscape

The Mandate: EO N-30-25

Governor Newsom signed Executive Order N-30-25 in July 2025 — "Efficient and Effective Government" — directing every state agency to streamline operations, improve performance, and cut red tape.

Three tracks are converging on CDCR:

• Governor's Innovation Fellows — embedded in departments to identify and fix systemic inefficiencies from the ground up
• BCG / Dept. of Finance — 3-month scoping contract evaluating HQ operations, contract management, overtime, and healthcare delivery; $20M follow-on requested for on-site implementation
• California Breakthrough Project — tech industry task force (Snap, Instacart, Twilio, Anduril) advising on procurement modernization and AI strategy

Note: Full EO text: gov.ca.gov/wp-content/uploads/2025/07/2025-7-15.Efficient-and-Effective-Government-EO.FINAL_.signed-1.pdf

What Cohort 1 Discovered

Two PODs worked August 2025 through February 2026 across hundreds of documents of discovery, interviews, and site visits:

• "Digitize Paper Records" — ducats, scheduling, movement passes
• "Digitizing Internal Processes" — grievances, temperature monitoring, internal workflows

Core Finding

Fragmented legacy systems that don't talk to each other. SOMS, BIS, and SAP each operate independently. Five separate Wi-Fi networks per institution, none communicating. Paper forms everywhere.

Cohort 1 Deliverables

• Piloted: Temperature Log App (Microsoft Power Apps, replacing paper Forms 2030/2031)
• Established: Governance frameworks, steering committee cadence, Incarcerated Technology Governance Charter

The Landscape at a Glance

System Architecture Overview

CDCR Data Architecture — The Silo Problem

The SOMS Problem

CDCR's 800-lb gorilla: 42 modules, one vendor, one-way data.

• Sole vendor: Marquis Software Development — builds, maintains, and controls the entire platform
• One-way API: Data can be pushed out of SOMS, but the vendor will not allow writes back in. This is the single most cited technical blocker across all digitization initiatives.
• Staffing crisis: Only 5 FTE + 6 contractors to support the entire platform
• Infrastructure complexity: 11 environments managed by 3 vendors (Marquis, Quest, Red River)
• Version backlog: Team wants to upgrade but lacks capacity (estimated 1 year to convert)
• Update cadence: 4–6 updates per year

eOMIS Module Status

Enterprise & Analytics Silos

Healthcare Systems (CCHCS)

CCHCS operates completely separate IT infrastructure — own network, own ServiceNow instance, own CIO.

Core Systems

• EHRS — Central electronic health record system
• Quality Management Portal — Heat Medications Registry, Heat Meds Custody Report
• CCHCS Lifeline Patient Safety — Heat Alert Medication List
• Cerner / HealtheLife — Patient portal (voted approved for tablets, 3/7/2024)

Emerging Healthcare Tech (September 2025 Tech Fair)

• Oracle Health Clinical AI Agent — Streamlined medical request processing
• Ameelio Connect — Secure video medical consultations
• UniDoc Virtual eHealth Clinics — Remote health delivery

Temperature Monitoring

• SensoScientific — Automated sensors, piloting at Calipatria and Mule Creek (~$1.3M for all 30 institutions)
• Astute / DwyerOmega — Alternative at 1/3 to 1/2 the cost, still being evaluated
• Temperature Log App — Microsoft Power Apps pilot (May 2025), replacing paper Forms 2030/2031

Tablet Platforms

The Wi-Fi Problem

5 siloed networks per institution — none communicate with each other

Emerging Solutions

• Starlink — Satellite connectivity for conservation camps and remote facilities
• WAN Transformation — Wide Area Network overhaul across institutions, in progress
• LoRa (Long Range) — Low-power mesh networking for data coverage in areas where Wi-Fi cannot reach (thick concrete, outdoor yards, remote buildings)

Security & Data Protection

Any cross-boundary data exchange between CCHCS and CDCR must meet strict security requirements:

• HIPAA compliance is non-negotiable — all Protected Health Information (PHI) remains under CCHCS governance and CIO authority
• Role-based access controls (RBAC) — clinical data visible only to authorized healthcare staff; custody staff see only what's operationally necessary (e.g., heat alert medication schedules), never diagnostic or treatment data
• End-to-end encryption for all data in transit between systems
• Full audit trails — every access logged, reviewable, and auditable
• Zero Trust architecture — already being piloted at CDCR (per September 2025 tech fair); continuous verification of every user and device
• Firewall segmentation — strict separation between clinical and custody networks is maintained
• CCHCS retains governance authority — no integration bypasses their approval chain; their CIO and IT team approve all data sharing decisions

Tip: Any proposed cross-system data exchange goes through CCHCS IT governance first. Clinical data stays clinical.

Vendor Ecosystem

18+ vendors across six categories. The two largest contracts dominate the landscape:

Key Barriers for Cohort 2

1. One-Way API — SOMS vendor will not allow writes back into the system. Every integration is read-only. This blocks real-time scheduling, grievance auto-population, and tablet-to-SOMS data flow.

1. Network Segmentation — Five Wi-Fi silos per institution with no cross-network communication. Any integration requires firewall changes, security review, and cooperation across organizational boundaries.

1. Vendor Lock-In — Securus operates on 3-year contract cycles with complete rebuild required at re-bid. Marquis is the sole SOMS vendor. Mitigation: EIS builds internal proof-of-concepts, then vendors scale proven designs — already demonstrated with Cell Search App and Temperature Log App.

1. Organizational Boundaries — EIS and CCHCS IT are completely separate organizations with separate infrastructure, governance, and compliance requirements (HIPAA). Cross-boundary work requires dual approval chains.

1. Union Resistance — Technology changes that affect staff workflows (digital ducats, tablet-based reporting, automated scheduling) can trigger union pushback if labor representatives are not engaged early. Mitigation: Bring union stakeholders to the table during design, not after deployment. Frame changes as reducing administrative burden on officers, not replacing roles.

Warning: SOMS is supported by only 5 FTE + 6 contractors for the entire platform. Any initiative touching SOMS competes for this scarce capacity.

Opportunities Aligned to EO N-30-25

Prioritized opportunities for Cohort 2, mapped to Executive Order pillars:

• Streamline Operations: Grievance digitization — 602-1 submission via tablet, auto-populating OGT metadata, eliminating manual data entry
• Improve Service Delivery: E-Ducating and incarcerated scheduling on tablets; leverage CONNECTUS and Securus platform capabilities
• Modernize Infrastructure: Snowflake data warehouse evaluation; WAN transformation; Zero Trust security rollout
• Reduce Paper: Ducat digitization (movement passes → barcode/RFID scanning at checkpoints)
• Secure Cross-Boundary Data: HIPAA-compliant, RBAC-protected data exchange between CCHCS and CDCR — under CCHCS governance authority, with end-to-end encryption and full audit trails
• Build Internal Capacity: Expand EIS's proof-of-concept development capability — prototype solutions in-house, then hand proven designs to vendors for enterprise scaling. Reduces lock-in, accelerates innovation, retains institutional knowledge. The Cell Search App is the model.
• Leverage BCG Findings: Align GIF digital transformation priorities with BCG's HQ efficiency recommendations for maximum combined impact

What's In Place & Next Steps

What's Already In Place

• Governance frameworks — Incarcerated Technology Governance Charter established
• Steering committee — cadence already running with Directors-level participation
• Relationships — SME network and department contacts preserved in Cohort 1 handoff documents; Cohort 2 will not be first contact with key stakeholders
• BCG engagement — $20M implementation phase may create parallel workstreams; coordinate early

The Model Going Forward

EIS builds the proof-of-concept. Vendors scale the proven design. CDCR retains the IP, the knowledge, and the leverage.