Why security-focused cloud is becoming the foundation of modern public safety systems

This is a guest post from Carbyne, an AWS Partner

Public safety is at a crossroads. A rising wave of cyber attacks on mission-critical public safety systems has spurred agencies across the country to modernize their infrastructure. This journey involves adopting new technology, but it’s also about building trust, resilience, and agility into the heart of 911 operations. Recent milestones by Carbyne—culminating in renewed Amazon Web Services (AWS) Government Competency status—showcase how a next-generation approach can help agencies stay ahead.

A decade ago, talking about moving mission-critical 911 infrastructure off premises felt aspirational. Today, it’s the minimum requirement. Federal grants for Next Generation 911 (NG911) explicitly call for IP-based architecture. The Federal Communications Commission (FCC) June 2025 Notice of Proposed Rulemaking (NPRM) details reliability rules that assume cloud-based geographic diversity and failover capabilities for NG911 facilities.

But public safety leaders aren’t adopting the cloud to check a compliance box. You need elastic performance when call volumes spike, ubiquitous access for distributed teams, and rapid innovation to add new channels such as real-time video without needing to completely overhaul the infrastructure. None of those are feasible on single-site, hardware-bound tech stacks.

Migrating to the cloud doesn’t automatically solve security challenges—it changes their nature. In December 2024, the Cyber and Infrastructure Security Agency (CISA) issued Binding Operational Directive 25-01 (BOD 25-01), which prompts federal agencies to implement cloud security practices ranging from continuous activity monitoring to zero-trust identity controls. State and local public safety answering points (PSAPs) aren’t subject to BOD 25-01, but they face similar threats—such as ransomware, distributed denial-of-service (DDoS), and insider misuse—often with fewer resources.

The lesson is shared responsibility. Cloud providers handle the physical layer, hypervisor, and global network, but agencies still control security for data and processes.

How Carbyne approaches cloud security

Carbyne was architected from day one with zero trust, least privilege, and continuous monitoring as foundational principles, not afterthoughts. Data is encrypted at rest and in transit, multi-factor authentication (MFA) is standard, access controls are managed, and events are logged and reviewed by our around-the-clock network operations center. Regular third-party penetration testing and real-time vulnerability scanning are integral to our operations. For public safety agencies, this means security is a continuous, living process, not a checkbox after deployment.

Cloud security myths debunked

Skeptics sometimes argue that keeping 911 on-premises is safer because data doesn’t leave the building. But in 2025, isolation usually equates to technical debt characterized by slower patching cadences, single points of failure, and talent shortages for legacy hardware. AWS invests billions annually in guardrails, from AWS Nitro Enclaves to quantum-safe VPNs that far exceed what most agencies can reproduce onsite.

The real risk isn’t moving to the cloud, it’s staying stuck on outdated systems that can’t keep up with today’s security and reliability needs. Environments built for the cloud are more reliable and compliant than legacy on-premises systems, making them the wise choice for modern emergency communications.

Myth: The cloud is less secure than on-premises systems

Truth: Cloud providers invest billions in security, employ specialized teams, and offer advanced protections that most PSAPs can’t match. Modern cloud environments provide 99.999 percent uptime, far surpassing the reliability of traditional systems.

Myth: You lose control over your data in the cloud

Truth: You retain full ownership of your data. Cloud services offer more control, granular permissions, and better transparency through audit trails compared to on-premises solutions.

Myth: Cloud systems are more vulnerable to outages

Truth: Cloud environments use redundancy, failover systems, and geographically distributed data centers, resulting in uninterrupted operations during local outages or disasters.

Myth: Compliance requirements prevent cloud adoption

Truth: Leading cloud providers are Criminal Justice Information Services (CJIS)-compliant and regularly audited. They simplify compliance with automated updates, centralized logging, and enhanced security features, often outperforming legacy systems.

Myth: Cloud migration is too complex and disruptive

Truth: Modern cloud migrations are gradual and customizable, integrating with current systems. With proper planning, they reduce operational complexity and improve efficiency over time.

Carbyne’s advantage: Security and resilience for real-world NG911

In practice, these pillars are already included in Carbyne’s daily operations. Our active-active, multi-Region failover architecture helps keep 911 running in the face of regional outages or cyber events. Encryption protocols and customer managed keys keep sensitive data protected. Our seamless single sign-on and MFA integrations minimize credential risk, and real-time audit logging is available for agency compliance needs. Carbyne’s cloud-centered model provides continuous delivery of security updates and new features, which means agencies don’t need to choose between innovation and safety.

Carbyne’s core mission of providing a faster, frictionless connection between callers and responders doesn’t change because it’s selling in AWS Marketplace. What does change is the activation energy for agencies:

• Streamlined budgeting – Many organizations, especially public sector entities, operate on a cloud-first or AWS first budget. By purchasing Carbyne in AWS Marketplace, you can use these preallocated funds, avoiding the need for a separate, time-consuming procurement cycle for a new vendor.
• Simplified invoicing and financial management – Purchasing Carbyne in AWS Marketplace consolidates billing. Instead of managing separate invoices from Carbyne and AWS, you receive a single, unified bill from AWS. This simplifies accounts payable and financial reporting, reducing administrative overhead and the potential for errors. It also provides a clear, consolidated view of your cloud-related expenditures.
• Existing AWS credits and discounts – If you’ve committed to a certain level of AWS spending (such as an AWS enterprise discount program or other agreement), you can often apply your existing AWS credits or use your volume discounts to purchase Carbyne. This can result in significant cost savings.

For agencies still midway through NG911 migrations, this matters because you can modernize step by step. You can augment legacy call handling with cloud-based video or AI transcription today and move the core call handling later without reopening a seven-figure procurement.

What’s next: AI, data fusion, and the policy horizon

The same cloud foundations that keep voice traffic encrypted also facilitate the next frontier. It’s AI that triages low-priority calls, synthesizes sensor data, and predicts resource allocation. As policymakers debate nationwide NG911 funding and the FCC frames new reliability rules, agencies that prioritize security-focused cloud architecture today are poised to adopt AI responsibly tomorrow.

Public safety organizations no longer need to choose between cutting-edge functionality and strong, verifiable security. With the right cloud scaffolding—and partners that meet security competencies—you can have both. Carbyne’s latest AWS milestones are one proof point, but the broader message is that security-focused, resilient cloud environments are fast becoming the default foundation for emergency call handling.

Agencies with access to AWS Marketplace can review Carbyne’s offerings and deployment guides. If you’re still mapping your cloud-migration path, start with CISA’s BOD 25-01 guidance to benchmark your security posture.