sync: auto-sync from HOWARD-HOME at 2026-07-15 11:39:11

Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-15 11:39:11
2026-07-15 11:39:45 -07:00
parent aae897abfe
commit 71aa0da646
13 changed files with 3175 additions and 7 deletions
--- a/clients/cascades-tucson/docs/proposals/carf-technology-plan-intake.md
+++ b/clients/cascades-tucson/docs/proposals/carf-technology-plan-intake.md
@@ -75,9 +75,9 @@ For each area, fill the four input fields: **Responsible person**, **Estimated/a
 - Responsible person: **>> NEEDED <<** · Cost: minimal/internal · Target date: **>> NEEDED <<** · Completion: pending

 ### 5. Backup policy
- **Current:** cloud backup (MSP360) **verified running 2026-06-24** — last run succeeded, ~576 GB protected off-site, daily incrementals.
- **Unmet / projected needs:** confirm/extend to full system-image (bare-metal) backup for the server; **run and document a test restore** (CARF looks for this); set/confirm retention.
- **Possible vendor:** Az Computer Guru / MSP360.
+- **Current:** the server is backed up. The Synology NAS syncs its data to the server, and the server is backed up online (off-site) with daily incrementals — **verified running 2026-06-24**.
+- **Unmet / projected needs:** **run and document a test restore** (CARF looks for this); set/confirm retention.
+- **Possible vendor:** Az Computer Guru.
 - Responsible person: **>> NEEDED <<** (suggest ACG) · Cost: **[ACG TO PRICE]** · Target date: **>> NEEDED <<** · Completion: backup live; image + restore-test pending

 ### 6. Assistive technology (persons served) — **biggest input gap**
@@ -88,7 +88,7 @@ For each area, fill the four input fields: **Responsible person**, **Estimated/a

 ### 7. Disaster recovery preparedness
 - **Current:** documented power-outage runbook with scripted clean shutdown and **verified recovery** (June 2026); UPS protection; backup running.
- **Unmet / projected needs:** written DR/business-continuity plan with target recovery times (RTO/RPO); add server redundancy; complete the system-image backup + restore test (links to area 5).
+- **Unmet / projected needs:** written DR/business-continuity plan with target recovery times (RTO/RPO); add server redundancy; complete the restore test (links to area 5).
 - **Possible vendor:** Az Computer Guru.
 - Responsible person: **>> NEEDED <<** (suggest ACG) · Cost: **[ACG TO PRICE]** · Target date: **>> NEEDED <<** · Completion: procedure proven; written plan pending

@@ -134,7 +134,7 @@ For each area, fill the four input fields: **Responsible person**, **Estimated/a
 | Break-glass FIDO2 YubiKeys (5-series) | Confidentiality | 2 | **~$110** (already ordered per records) | Approximate |
 | Azure audit-log retention (Log Analytics 90 d + 6 yr archive) | Security | — | **~$50–120/mo** consumption (log-volume dependent) + one-time ACG build | Firm up after measuring actual audit-log volume |
 | Managed antivirus, all devices incl. server | Virus protection | — | **Included in existing ACG Bitdefender managed security** + ACG labor to enroll server / remove legacy Datto agents | **Client (Mike) is deploying AV** |
-| DR written plan + system-image confirm + restore test | DR | — | **ACG labor (prepaid block)** | Restore test **deferred** per client (revisit after AV + basic items) |
+| DR written plan + restore test | DR | — | **ACG labor (prepaid block)** | Restore test **deferred** per client (revisit after AV + basic items) |
 | Security risk assessment (dated package) + file-share audit logging | Security | — | **ACG labor (prepaid block); no license cost** | |
 | **Long-term server replacement (PowerEdge T360-class)** | Hardware / DR | 1 | **~$4,000–7,000 configured (formal quote required)** | Depends on spec + Windows Server licensing + CALs; separate project |

--- a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html
+++ b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html
@@ -0,0 +1,334 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Cascades of Tucson Technology Plan</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@500;600;700&family=Lexend:wght@300;400;500;600&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
+<style>
+  :root{
+    --paper:#F7F3EB; --surface:#EDE6D9; --surface-2:#E4DACA;
+    --ink:#2A2521; --ink-2:#5A5148; --ink-3:#6D6456;
+    --accent:#F2922E; --accent-ink:#BD5A00; --on-accent:#2A2521;
+    --good:#4F7A3F; --good-ink:#3C6230;
+    --rule:rgba(90,81,72,0.18); --rule-strong:rgba(90,81,72,0.34);
+    --f-display:"Barlow Condensed","Arial Narrow",system-ui,sans-serif;
+    --f-body:"Lexend",system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
+    --f-mono:"JetBrains Mono",ui-monospace,"Cascadia Mono",Consolas,monospace;
+  }
+  *{box-sizing:border-box;}
+  html,body{margin:0;padding:0;}
+  body{
+    font-family:var(--f-body); font-weight:400; color:var(--ink);
+    background:var(--paper); font-size:10.2px; line-height:1.5;
+    -webkit-font-smoothing:antialiased; text-rendering:optimizeLegibility;
+    -webkit-print-color-adjust:exact; print-color-adjust:exact;
+  }
+  .sheet{ max-width:760px; margin:0 auto; padding:22px 30px 26px; }
+
+  /* ---- Masthead ---- */
+  .mast{ display:flex; justify-content:space-between; align-items:flex-end;
+    padding-bottom:10px; border-bottom:2px solid var(--ink); }
+  .brand__name{ font-family:var(--f-display); font-weight:700; font-size:20px;
+    letter-spacing:.02em; line-height:1; color:var(--ink); }
+  .brand__name b{ color:var(--accent-ink); font-weight:700; }
+  .brand__tag{ font-family:var(--f-mono); font-size:7.6px; letter-spacing:.26em;
+    text-transform:uppercase; color:var(--ink-3); margin-top:6px; }
+  .mast__meta{ font-family:var(--f-mono); font-size:7.6px; letter-spacing:.06em;
+    color:var(--ink-3); text-align:right; line-height:1.7; }
+  .mast__meta b{ color:var(--ink); font-weight:600; }
+
+  /* ---- Title block ---- */
+  .titleblock{ margin:15px 0 4px; }
+  .titleblock .eyebrow{ font-family:var(--f-mono); font-size:8px; letter-spacing:.24em;
+    text-transform:uppercase; color:var(--accent-ink); }
+  h1{ font-family:var(--f-display); font-weight:600; font-size:31px; line-height:1.0;
+    margin:6px 0 0; letter-spacing:.005em; }
+  .lede{ max-width:64ch; color:var(--ink-2); font-size:10.2px; margin:8px 0 0; }
+
+  /* ---- Governance ---- */
+  .gov{ display:grid; grid-template-columns:repeat(5,1fr); gap:0 18px; margin-top:12px;
+    padding:9px 12px; background:var(--surface); border-radius:2px; }
+  .gov div{ min-width:0; }
+  .gov .k{ font-family:var(--f-mono); font-size:7px; letter-spacing:.16em;
+    text-transform:uppercase; color:var(--ink-3); display:block; margin-bottom:2px; }
+  .gov .v{ font-size:9.2px; color:var(--ink); font-weight:500; line-height:1.35; }
+  .gov .v i{ color:var(--ink-3); font-style:italic; font-weight:400; }
+
+  /* ---- Areas ---- */
+  .band-label{ font-family:var(--f-mono); font-size:8px; letter-spacing:.22em;
+    text-transform:uppercase; color:var(--ink-3); margin:16px 0 6px;
+    padding-bottom:5px; border-bottom:1px solid var(--rule-strong); }
+  .area{ padding:11px 0 10px; border-top:1px solid var(--rule);
+    break-inside:avoid; page-break-inside:avoid; }
+  .area:first-of-type{ border-top:0; }
+  .area__head{ display:flex; align-items:baseline; gap:11px; margin-bottom:6px; }
+  .area__no{ font-family:var(--f-mono); font-weight:600; font-size:9.5px;
+    color:var(--ink-3); width:18px; flex:none; }
+  .area__title{ font-family:var(--f-display); font-weight:600; font-size:17px;
+    line-height:1; letter-spacing:.01em; margin:0; flex:1 1 auto; }
+
+  .lbl{ font-family:var(--f-mono); font-size:7.2px; font-weight:600; letter-spacing:.16em;
+    text-transform:uppercase; display:block; margin:6px 0 3px 29px; }
+  .lbl--done{ color:var(--good-ink); }
+  .lbl--todo{ color:var(--accent-ink); }
+  ul.done{ margin:0 0 0 29px; padding:0 0 0 14px; color:var(--ink-2); }
+  ul.done li{ margin:1.5px 0; font-size:9.6px; line-height:1.45; }
+  ul.done b{ color:var(--ink); font-weight:600; }
+
+  table.todo{ border-collapse:collapse; width:calc(100% - 29px); margin:2px 0 0 29px; }
+  table.todo th{ font-family:var(--f-mono); font-size:6.8px; font-weight:500;
+    letter-spacing:.14em; text-transform:uppercase; color:var(--ink-3);
+    text-align:left; padding:2px 8px 3px 0; border-bottom:1px solid var(--rule-strong); }
+  table.todo td{ font-size:9.3px; color:var(--ink-2); padding:3.5px 8px 3.5px 0;
+    border-bottom:1px solid var(--rule); vertical-align:top; line-height:1.4; }
+  table.todo tr:last-child td{ border-bottom:0; }
+  table.todo td.own{ font-family:var(--f-mono); font-size:8px; color:var(--ink);
+    white-space:nowrap; }
+  table.todo td.tgt{ font-family:var(--f-mono); font-size:8px; color:var(--accent-ink);
+    font-weight:500; white-space:nowrap; }
+  table.todo td.cost{ font-family:var(--f-mono); font-size:8px; color:var(--ink-2); white-space:nowrap; }
+
+  table.mach{ border-collapse:collapse; width:calc(100% - 29px); margin:3px 0 0 29px; }
+  table.mach th{ font-family:var(--f-mono); font-size:6.8px; font-weight:500;
+    letter-spacing:.14em; text-transform:uppercase; color:var(--ink-3);
+    text-align:left; padding:2px 8px 3px 0; border-bottom:1px solid var(--rule-strong); }
+  table.mach td{ font-size:9.3px; color:var(--ink-2); padding:3.5px 8px 3.5px 0;
+    border-bottom:1px solid var(--rule); }
+  table.mach tr:last-child td{ border-bottom:0; }
+  table.mach td b{ color:var(--accent-ink); font-weight:600; }
+  table.mach td.m{ font-family:var(--f-mono); font-size:8.4px; color:var(--ink); }
+
+  .supp p{ margin:2px 0 0 29px; font-size:9.6px; color:var(--ink-2); line-height:1.5; max-width:72ch; }
+  .supp p b{ color:var(--ink); font-weight:600; }
+
+  /* ---- Footer ---- */
+  .foot{ margin-top:15px; padding-top:10px; border-top:2px solid var(--ink);
+    display:flex; justify-content:space-between; align-items:flex-end; gap:20px; }
+  .foot__note{ font-size:8.6px; color:var(--ink-3); max-width:54ch; line-height:1.5; }
+  .foot__balance{ text-align:right; font-family:var(--f-mono); flex:none; }
+  .foot__balance .k{ font-size:7.4px; letter-spacing:.18em; text-transform:uppercase; color:var(--ink-3); }
+  .foot__balance .v{ font-size:15px; font-weight:600; color:var(--accent-ink);
+    font-variant-numeric:tabular-nums; margin-top:2px; }
+
+  @page{ size:Letter; margin:13mm 14mm; }
+  @media print{ .sheet{ padding:0; max-width:none; } body{ font-size:10px; } }
+</style>
+</head>
+<body>
+<div class="sheet">
+
+  <header class="mast">
+    <div>
+      <div class="brand__name">Az Computer <b>Guru</b></div>
+      <div class="brand__tag">Managed IT &amp; Security · Tucson · Since 2001</div>
+    </div>
+    <div class="mast__meta">
+      Prepared for &nbsp;<b>Cascades of Tucson</b><br>
+      Attn: Business Office<br>
+      Drafted &nbsp;<b>July 15, 2026</b>
+    </div>
+  </header>
+
+  <div class="titleblock">
+    <div class="eyebrow">Technology Plan · FY 2026–2027</div>
+    <h1>Cascades of Tucson Technology Plan</h1>
+    <p class="lede">A living action document: for each area of the facility's technology, what has
+      been done and what is planned, with an owner, cost, and target for every action. Prepared with
+      Az Computer Guru. Reviewed and updated at least annually.</p>
+  </div>
+
+  <div class="gov">
+    <div><span class="k">Plan owner</span><span class="v">Cascades of Tucson</span></div>
+    <div><span class="k">Prepared with</span><span class="v">Az Computer Guru</span></div>
+    <div><span class="k">Plan period</span><span class="v">FY 2026–2027</span></div>
+    <div><span class="k">Adopted by / date</span><span class="v"><i>at adoption</i></span></div>
+    <div><span class="k">Next annual review</span><span class="v"><i>adoption + 12 months</i></span></div>
+  </div>
+
+  <div class="band-label">The eight areas</div>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">01</span><h2 class="area__title">Hardware</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Full managed network deployed: UniFi with <b>77 access points and 12 managed switches</b>; business firewall with dual internet connections and automatic failover.</li>
+      <li>Server storage verified healthy; enterprise SSDs purchased for a planned upgrade.</li>
+      <li>Windows Pro upgrades completed on nearly all workstations for domain readiness.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Install the purchased enterprise SSDs (scheduled window)</td><td class="own">ACG</td><td class="cost">purchased</td><td class="tgt">30–60 days</td></tr>
+      <tr><td>Replace workstations marked for replacement (list below, 5 + spare)</td><td class="own">ACG</td><td class="cost">~$700–950 ea</td><td class="tgt">60–90 days</td></tr>
+      <tr><td>Scope and quote a server refresh project</td><td class="own">ACG + Cascades</td><td class="cost">formal quote</td><td class="tgt">90 days</td></tr>
+      <tr><td>Bring remaining switch ports up to full gigabit speed</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
+    </table>
+    <span class="lbl lbl--todo">Workstations marked for replacement</span>
+    <table class="mach">
+      <tr><th style="width:30%">Machine</th><th style="width:26%">User / role</th><th>Plan</th></tr>
+      <tr><td class="m">DESKTOP-TRCIEJA</td><td>Lupe Sanchez</td><td><b>Replace</b> (end of life)</td></tr>
+      <tr><td class="m">ASSISTMAN-PC</td><td>Meredith Kuhn</td><td><b>Replace</b> (2015-era processor, cannot run Windows 11)</td></tr>
+      <tr><td class="m">MDIRECTOR-PC</td><td>Shelby Trozzi (MC Director)</td><td><b>Replace</b> (insufficient memory)</td></tr>
+      <tr><td class="m">MEMRECEPT-PC</td><td>Memory Care front desk</td><td><b>Replace</b> (oldest machine in the fleet)</td></tr>
+      <tr><td class="m">Spare unit</td><td>New hire</td><td><b>Deploy spare</b></td></tr>
+      <tr><td class="m">CHEF-PC</td><td>Culinary</td><td><b>Replace</b></td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">02</span><h2 class="area__title">Software</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Microsoft 365 Business Premium across the organization (45 seats enabled).</li>
+      <li>ALIS clinical record connected to company sign-in (<b>single sign-on live</b>).</li>
+      <li>Domain migration underway: about half of staff PCs on the company domain with department structure and drive mapping built.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else</td><td class="own">ACG</td><td class="cost">reduces monthly cost</td><td class="tgt">30 days</td></tr>
+      <tr><td>Complete staff domain migration + department drives</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr>
+      <tr><td>Final Windows Pro upgrade (1 deferred device)</td><td class="own">ACG</td><td class="cost">~$99</td><td class="tgt">next window</td></tr>
+      <tr><td>Retire the per-PC Synology sync client as machines migrate</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">with migration</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">03</span><h2 class="area__title">Security (sensitive data / HIPAA)</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Multi-factor sign-in for all staff; identity-based conditional access live.</li>
+      <li>Caregiver accounts restricted to the building network (<b>credentials unusable off-site</b>), live since July 1, 2026.</li>
+      <li>Auto-lock and auto-sign-out policy on shared care devices.</li>
+      <li>Segmented network: voice isolated, per-room isolation, resident devices separated.</li>
+      <li>Email authentication (SPF, DKIM, DMARC) enforced.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Create emergency break-glass admin accounts with hardware security keys</td><td class="own">ACG</td><td class="cost">~$110 keys</td><td class="tgt">30 days</td></tr>
+      <tr><td>Enforce the caregiver device allow-list (final enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr>
+      <tr><td>Limit trusted-network sign-in to approved devices (next enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr>
+      <tr><td>Enable file-access audit logging with 90-day / 6-year retention</td><td class="own">ACG</td><td class="cost">~$50–120/mo</td><td class="tgt">60–90 days</td></tr>
+      <tr><td>Formalize a same-day offboarding checklist</td><td class="own">Cascades HR + ACG</td><td class="cost">none</td><td class="tgt">30 days, standing</td></tr>
+      <tr><td>Package the dated security risk assessment</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">04</span><h2 class="area__title">Confidentiality</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>PHI access limited by role and security group; single sign-on to the clinical record.</li>
+      <li>Shared care devices auto-lock; resident and voice traffic isolated on the network.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Complete the Business Associate Agreement inventory (every vendor touching PHI)</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">60 days</td></tr>
+      <tr><td>Move ALIS fully to single sign-on (retire the separate native login)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td></tr>
+      <tr><td>Enable encryption on the resident-data file share</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr>
+      <tr><td>Maintain a one-page contract / renewal / BAA tracker</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">90 days, standing</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">05</span><h2 class="area__title">Backup</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li><b>The server is backed up.</b> The Synology NAS syncs its data to the server, and the server is backed up online (off-site) with daily incrementals, verified running.</li>
+      <li>Firewall and network configuration backed up.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr>
+      <tr><td>Run and document a test restore</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
+      <tr><td>Confirm and document the retention policy</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">60 days</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">06</span><h2 class="area__title">Assistive technology (persons served)</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Helpany "Paul" resident-safety sensors: ceiling radar fall and motion detection with <b>no camera and no microphone</b>, rolling out floor by floor.</li>
+      <li>Building-wide WiFi supporting resident and family connectivity.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Complete the Helpany rollout; move sensors to their own protected network segment</td><td class="own">Helpany + ACG</td><td class="cost">vendor + labor</td><td class="tgt">90 days</td></tr>
+      <tr><td>Inventory all resident-facing technology (nurse-call / pendants, assistive listening, resident WiFi for telehealth) into this plan</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">next review</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">07</span><h2 class="area__title">Disaster recovery &amp; continuity</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Documented, proven power-outage procedure: scripted clean shutdown of core systems and <b>verified clean recovery</b> (exercised June 2026).</li>
+      <li>UPS battery backup installed on core equipment and all network switches; off-site backup running.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Write the formal disaster-recovery / business-continuity plan with recovery-time targets</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
+      <tr><td>Documented restore test (with area 5)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
+      <tr><td>Server redundancy (pairs with the server refresh project)</td><td class="own">ACG + Cascades</td><td class="cost">project quote</td><td class="tgt">FY project</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">08</span><h2 class="area__title">Virus &amp; threat protection</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Managed endpoint detection &amp; response (EDR) on every managed device (about 35), <b>including the main server</b> (completed July 2026).</li>
+      <li>Microsoft Defender and Exchange Online Protection on email; managed monitoring and patching on all devices.</li>
+      <li>Legacy agents from the previous IT provider removed from the server.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr>
+      <tr><td>Standing coverage audit: every device reporting into managed security</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">quarterly</td></tr>
+    </table>
+  </section>
+
+  <div class="band-label">Supplementary areas</div>
+
+  <section class="area supp">
+    <div class="area__head"><span class="area__no">+</span><h2 class="area__title">Communication technology</h2></div>
+    <p><b>Done:</b> voice system consolidated onto an isolated voice network (37 devices); WiFi optimized building-wide; email authentication enforced.</p>
+    <p><b>To do:</b> dedicated 5&nbsp;GHz network for phones and Helpany sensors (improves call reliability); replace the Bistro phone; voice quality-of-service; then the supervised move to next-generation WiFi (WPA3 / 6&nbsp;GHz). Owner: ACG + Vertical + Helpany; 90 days.</p>
+  </section>
+
+  <section class="area supp">
+    <div class="area__head"><span class="area__no">+</span><h2 class="area__title">Services purchased / contracted</h2></div>
+    <p>Managed IT (ACG, prepaid block), Microsoft 365, ALIS (Medtelligent), hosted voice (Vertical), dual-WAN internet (Cox), online backup, firewall &amp; network (Netgate / UniFi), managed security, resident safety sensors (Helpany), plus line-of-business software.</p>
+    <p><b>To do:</b> the renewal / BAA tracker (area 4) becomes the single register for all vendors.</p>
+  </section>
+
+  <section class="area supp">
+    <div class="area__head"><span class="area__no">+</span><h2 class="area__title">Use of AI</h2></div>
+    <p><b>To do:</b> adopt an AI acceptable-use policy for staff (30 days); evaluate Microsoft 365 Copilot under HIPAA guardrails; build the cross-system KPI dashboard (ALIS, QuickBooks, Bill.com, Relias, CRM, TELS, Focus HR) as the sanctioned analytics path: Phase 1 scheduled exports to SharePoint and Power BI, Phase 2 automated data feeds.</p>
+  </section>
+
+  <footer class="foot">
+    <div class="foot__note">
+      Cascades of Tucson's technology plan, prepared with Az Computer Guru. Reviewed at least
+      annually by Cascades leadership; updated as projects complete. Confidential to Cascades of Tucson.
+      Revision: initial draft, July 15, 2026.
+    </div>
+    <div class="foot__balance">
+      <div class="k">Prepaid support balance</div>
+      <div class="v">37.5 hrs</div>
+      <div class="k" style="margin-top:4px;letter-spacing:.1em;">as of Jul 10, 2026</div>
+    </div>
+  </footer>
+
+</div>
+</body>
+</html>
--- a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
+++ b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
@@ -0,0 +1,179 @@
+# Cascades of Tucson Technology Plan
+
+> A living action document: for each area, what has been done and what is planned.
+> Prepared with Az Computer Guru. Reviewed and updated at least annually.
+
+| Governance | |
+|---|---|
+| Plan owner | Cascades of Tucson |
+| Prepared with | Az Computer Guru (Mike Swanson, Howard Enos) |
+| Plan period | FY 2026–2027 |
+| Adopted by / date | *[at adoption]* |
+| Next annual review | *[adoption + 12 months]* |
+
+---
+
+## 1. Hardware
+
+**Done**
+- Full managed network deployed: UniFi with 77 access points and 12 managed switches;
+  business firewall with dual internet connections and automatic failover.
+- Server storage verified healthy; enterprise SSDs purchased for a planned upgrade.
+- Windows Pro upgrades completed on nearly all workstations for domain readiness.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Install the purchased enterprise SSDs (scheduled window) | ACG | already purchased | 30–60 days |
+| Replace workstations marked for replacement (list below, 5 + spare) | ACG | ~$700–950 ea | 60–90 days |
+| Scope and quote a server refresh project | ACG + Cascades | formal quote | 90 days |
+| Bring remaining switch ports up to full gigabit speed | ACG | labor | 90 days |
+
+**Workstations marked for replacement**
+| Machine | User / role | Plan |
+|---|---|---|
+| DESKTOP-TRCIEJA | Lupe Sanchez | **Replace** (end of life) |
+| ASSISTMAN-PC | Meredith Kuhn | **Replace** (2015-era processor, cannot run Windows 11) |
+| MDIRECTOR-PC | Shelby Trozzi (MC Director) | **Replace** (insufficient memory) |
+| MEMRECEPT-PC | Memory Care front desk | **Replace** (oldest machine in the fleet) |
+| Spare unit | New hire | **Deploy spare** |
+| CHEF-PC | Culinary | **Replace** |
+
+## 2. Software
+
+**Done**
+- Microsoft 365 Business Premium across the organization (45 seats enabled).
+- ALIS clinical record connected to company sign-in (single sign-on live).
+- Domain migration underway: about half of staff PCs on the company domain with
+  department structure and drive mapping built.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else | ACG | reduces monthly cost | 30 days |
+| Complete staff domain migration + department drives | ACG | labor | 60–90 days |
+| Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window |
+| Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration |
+
+## 3. Security (sensitive data / HIPAA)
+
+**Done**
+- MFA for all staff; identity-based conditional access live.
+- Caregiver accounts restricted to the building network (credentials unusable off-site),
+  live since 2026-07-01.
+- Auto-lock and auto-sign-out policy on shared care devices.
+- Segmented network: voice isolated, per-room isolation, resident devices separated.
+- Email authentication (SPF, DKIM, DMARC) enforced.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Create emergency break-glass admin accounts with hardware security keys | ACG | ~$110 keys | 30 days |
+| Enforce the caregiver device allow-list (final enforcement phase) | ACG | labor | 30–60 days, after break-glass |
+| Limit trusted-network sign-in to approved devices (next enforcement phase) | ACG | labor | 30–60 days |
+| Enable file-access audit logging with 90-day/6-year retention | ACG | ~$50–120/mo + build | 60–90 days |
+| Formalize a same-day offboarding checklist | Cascades HR + ACG | none | 30 days, then standing |
+| Package the dated security risk assessment | ACG | labor | 60 days |
+
+## 4. Confidentiality
+
+**Done**
+- PHI access limited by role and security group; single sign-on to the clinical record.
+- Shared care devices auto-lock; resident and voice traffic isolated on the network.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Complete the Business Associate Agreement inventory (every vendor touching PHI) | Cascades + ACG | none | 60 days |
+| Move ALIS fully to single sign-on (retire the separate native login) | ACG | labor | 60 days |
+| Enable encryption on the resident-data file share | ACG | labor | 60–90 days |
+| Maintain a one-page contract / renewal / BAA tracker | Cascades + ACG | none | 90 days, then standing |
+
+## 5. Backup
+
+**Done**
+- **The server is backed up.** The Synology NAS syncs its data to the server, and the
+  server is backed up online (off-site) with daily incrementals, verified running.
+- Firewall and network configuration backed up.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing) | ACG | labor | 60–90 days |
+| Run and document a test restore | ACG | labor | 90 days |
+| Confirm and document the retention policy | ACG | none | 60 days |
+
+## 6. Assistive technology (persons served)
+
+**Done**
+- Helpany "Paul" resident-safety sensors: ceiling radar fall and motion detection with
+  **no camera and no microphone**, rolling out floor by floor.
+- Building-wide WiFi supporting resident and family connectivity.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Complete the Helpany rollout; move sensors to their own protected network segment | Helpany + ACG | vendor-billed + labor | 90 days |
+| Inventory all resident-facing technology (nurse-call/pendants, assistive listening, resident WiFi for telehealth) into this plan | Cascades + ACG | none | next review |
+
+## 7. Disaster recovery & continuity
+
+**Done**
+- Documented, proven power-outage procedure: scripted clean shutdown of core systems and
+  verified clean recovery (exercised June 2026).
+- UPS battery backup installed on core equipment and all network switches; off-site backup running.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Write the formal disaster-recovery / business-continuity plan with recovery-time targets | ACG | labor | 90 days |
+| Documented restore test (with area 5) | ACG | labor | 90 days |
+| Server redundancy (pairs with the server refresh project) | ACG + Cascades | project quote | FY project |
+
+## 8. Virus & threat protection
+
+**Done**
+- Managed endpoint detection & response (EDR) on every managed device (about 35),
+  **including the main server** (completed July 2026).
+- Microsoft Defender and Exchange Online Protection on email; managed monitoring and
+  patching on all devices.
+- Legacy agents from the previous IT provider removed from the server.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup | ACG | labor | 30–60 days |
+| Standing coverage audit: every device reporting into managed security | ACG | none | quarterly |
+
+---
+
+## Supplementary areas
+
+### Communication technology
+**Done:** voice system consolidated onto an isolated voice network (37 devices); WiFi
+optimized building-wide; email authentication enforced.
+**To do:** dedicated 5 GHz network for phones and Helpany sensors (improves call
+reliability); replace the Bistro phone; voice quality-of-service; then the supervised
+move to next-generation WiFi (WPA3 / 6 GHz). Owner: ACG + Vertical + Helpany; 90 days.
+
+### Services purchased / contracted
+Managed IT (ACG, prepaid block), Microsoft 365, ALIS (Medtelligent), hosted voice
+(Vertical), dual-WAN internet (Cox), online backup, firewall & network (Netgate/UniFi),
+managed security/EDR, resident safety sensors (Helpany), plus line-of-business software.
+**To do:** the renewal/BAA tracker (area 4) becomes the single register for all vendors.
+
+### Use of AI
+**To do:** adopt an AI acceptable-use policy for staff (30 days); evaluate Microsoft 365
+Copilot under HIPAA guardrails; build the cross-system KPI dashboard (ALIS, QuickBooks,
+Bill.com, Relias, CRM, TELS, Focus HR) as the sanctioned analytics path: Phase 1
+scheduled exports to SharePoint and Power BI, Phase 2 automated data feeds.
+
+---
+
+## Review & maintenance
+
+Reviewed at least annually by Cascades leadership with ACG; updated as projects complete.
+
+| Revision | Date | By |
+|---|---|---|
+| Initial draft | 2026-07-15 | ACG (prepared for Cascades adoption) |
--- a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf
+++ b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf