This is a sample.
The system and the municipality are fictional, and nothing here comes from a client engagement. It shows the format of a real report for a Standard-tier assessment ($9,750). Real reports are confidential to the client, and name the people who did the work where this one says “Bluestone”.
Condition assessment report · Sample
Building permit and inspection system
- Prepared for
- The Municipality (fictional), Building and IT
- Prepared by
- Bluestone
- Assessment period
- 6 to 20 October 2026
- Report date
- 27 October 2026
- Version
- 1.1 final. The 1.0 draft (21 October) had the wrong user count and GIS import time; both corrected.
- Distribution
- Director of Development Services, IT Manager
1
Summary for decision-makers
The building permit and inspection system has been in service since 2009. Staff use it for every permit, from application to final inspection, and the public applies through it online.
We do not recommend replacing it. The permit records are complete, and the staff we interviewed did not report gaps in the workflow. The problems are in the platform and the support arrangements, not the application: an unsupported server and database, backups with no offsite copy that had never been restored, and one person who is the only one able to change it.
Five essential fixes, $32,150 in total, should give it an estimated four to six more years of reliable service. Microsoft licences are extra, estimated at $12,000 to $14,000 if bought outright (see R1), so the realistic total is about $44,000 to $46,000. Two further fixes, $4,800, can wait for the 2028 budget.
Whatever is decided about the rest, R3 should be done within a month and R1 within six months. The public portal should not stay on the current server.
2
What the system is
A web application built for the Municipality in 2009 by a local contractor that no longer trades. About 20 named staff in Building, Planning and Finance use it daily. The public uses one part of it, the online application form, roughly 1,400 times a year.
It runs on one Windows server and one SQL Server database in the Municipality’s server room. It exchanges data with GIS (parcels, nightly), the finance system (fee receipts, as they are paid) and a hosted mobile forms service that inspectors use in the field.
It holds about 31,000 permit records going back to 2009, and the personal information of applicants and property owners.
3
Condition summary
Seven areas. Sound: no action needed. Fair: works, with issues to watch. Poor: should be fixed within a year. Critical: the service or personal information is at risk now. Ratings reflect risk to the service, not the age of the technology.
| Area and rating | Finding |
|---|---|
| Platform and vendor supportPoor | Runs on Windows Server 2012 R2 (Microsoft support ended October 2023) and SQL Server 2012 SP4 (ended July 2022). The Municipality did not buy Extended Security Updates, so neither receives security fixes. |
| Security exposureCritical | The public application portal runs on the same server and is reachable from the internet. A scan of its public address on 14 October showed it still accepts TLS 1.0. The application uses one shared database account, also used by the finance integration; the password was last changed in 2014. Remote desktop to the server is open to the internal network only, with individual accounts but no multi-factor authentication. |
| Backup and recoveryPoor | Nightly backups run and succeed. No restore had been attempted before this assessment. The restore we ran into the test environment (Evidence E4) succeeded and took 9 hours 10 minutes, most of it spent working out which files were needed. Backups are written to a storage device in the same server room, with no offsite or offline copy, so a fire or a ransomware attack could take out the server and its backups together. |
| Data integrityFair | Permit and inspection records are complete and consistent. 1,108 of about 37,000 parcels (3%) have a manually entered address that no longer matches the GIS parcel layer. This causes extra work at the counter (Evidence E6). We found no case where it led to an error in a permit. |
| IntegrationsFair | Three: a nightly parcel import from GIS, fee receipts written to the finance system, and inspection results from a hosted mobile forms service. The server logs show the GIS import failed without any alert on 3 March and 19 August. |
| Knowledge concentrationCritical | One staff member understands how the system works and how to change it. The source code is on a file share but does not build with current tools. The fee schedule is hard-coded in a stored procedure that only this person edits, most recently for the January fee bylaw amendment. |
| Accessibility of public formsPoor | The online permit application fails WCAG 2.1 AA in three ways a screen-reader user cannot work around: unlabelled fields, a session time-out with no warning, and an image-based verification step. |
4
What matters and what does not
Several things about this system look worse than they are. They are listed so they do not end up in a budget request by mistake.
Priority risks
- ·The internet-facing portal on an unsupported server that holds applicants' personal information (R1, R3).
- ·Backups with no offsite or offline copy, and a restore that had never been tested and took over nine hours when it was (R2).
- ·One person, without written procedures, responsible for every change to the system (R4).
- ·A public application form that screen-reader users cannot complete (R5).
Lower priority, no action needed
- ·The interface is dated. Staff are used to it and the people we interviewed did not report gaps in the workflow.
- ·The code uses ASP.NET Web Forms and about 140 stored procedures. It is an old approach, but we found few defects in the code itself.
- ·Field names are inconsistent between screens and reports.
- ·Three of the monthly reports take over a minute to run.
- ·The mismatched parcel addresses described under data integrity. GIS staff could correct them in about five days if the counter work becomes a burden.
5
Failure modes
Likelihood is over the next three years. Impact is on the permit service. Both are rated low, medium or high, and the list is ranked by impact, then likelihood.
| Failure | Likelihood | Impact |
|---|---|---|
The staff member who maintains the system leaves or is unavailable for an extended period No changes could be made. The next fee bylaw amendment could not be loaded, and fees would be calculated by hand until someone worked out the stored procedure. | High | High |
The public portal is compromised through the unsupported server Online permit intake would go offline. Applicants' personal information could be exposed, which would trigger breach-reporting obligations under FOIPPA. | Medium | High |
The server fails, or is hit by ransomware With the current procedure, at least one full working day without permit processing and possible loss of that day's applications. With ransomware, the backups could be lost as well. | Low | High |
An accessibility complaint about the online application The form would have to be fixed on someone else's deadline. | Medium | Medium |
The nightly parcel import fails and nobody notices It has happened twice this year. We checked the 23 permits issued in the days after each failure; none was affected (Evidence E7). | High | Low |
6
Remediation menu
Each fix is scoped and priced on its own and can be bought, deferred or given to another supplier, with two dependencies: R2 should come before R1, so a restore has been rehearsed before the migration, and R4 before R5 and R6, because the code has to build before it can be changed. Prices are not-to-exceed, in Canadian dollars, before tax. Only R6 changes anything staff see: a new screen for updating fees. The Municipality’s IT staff should expect about four days across all seven fixes.
| Fix | Priority | Not to exceed |
|---|---|---|
R1Move to supported versions of the server and the database Windows Server 2022 and SQL Server 2022 Standard, either on the Municipality's hardware or in a Canadian cloud region. No change to how the application looks or behaves. Includes a rehearsal in the test environment and a rollback plan. Essential. Result: Vendor support to October 2031 (Windows Server) and January 2033 (SQL Server). | Essential | $11,500 |
R2Written and tested restore procedure A nightly offsite copy of the backups, a step-by-step restore runbook, a restore rehearsed with the Municipality's IT staff, and a quarterly test they can run without us. Storage for the offsite copy is billed by its provider, about $20 a month. Essential. Result: Backups survive the loss of the server room; expected restore time under three hours. | Essential | $2,800 |
R3Separate accounts and current encryption One account per integration with only the access it needs, TLS 1.0 and 1.1 disabled, every stored credential rotated. Essential. Result: Shared account removed; portal accepts TLS 1.2 and above only. | Essential | $3,200 |
R4Make the system buildable and documented Get the source building with current tools, move it into a repository the Municipality owns, and write maintenance notes covering deployment, the integrations and the fee procedure. Includes three days training a second person, either Municipal staff or another supplier. Essential. Result: Reduces dependence on one person. It does not remove it until the second person has made a change on their own. | Essential | $8,750 |
R5Bring the online application to WCAG 2.1 AA Fix the labelling, the time-out and the verification step, then test with a screen reader and with keyboard only. Supports the accessibility plan the Municipality maintains under the Accessible British Columbia Act. Essential. Result: Public form passes WCAG 2.1 AA checks. | Essential | $5,900 |
R6Move the fee schedule out of the code A simple admin screen where finance staff update fees when the bylaw changes, with a log of who changed what. Recommended. Result: Fee changes no longer need a developer. | Recommended | $2,900 |
R7Alert when the parcel import fails An email to a named mailbox when the nightly import fails or brings in no records. Recommended. Result: Failed imports reported the same morning. | Recommended | $1,900 |
| Essential, R1 to R5 | $32,150 | |
| Recommended, R6 and R7 | $4,800 |
Not included in R1. Microsoft licences, which the Municipality would buy through its own agreement. For a four-core SQL Server 2022 Standard and a Windows Server 2022 Standard licence we estimate $12,000 to $14,000, depending on the agreement. If the system moves to a cloud provider instead, hosting would be roughly $500 to $900 a month in a Canadian region, and the licences may be included in that.
Not recommended: replacing the interface or moving off Web Forms. Either would cost more than all seven fixes together and would not reduce the risks in section 5.
7
Remaining working life
With R1 to R5 done: four to six years. The upper end assumes the department’s process does not change substantially and that the Municipality keeps a second person trained on the system.
With nothing done: the system will keep working day to day, but the security and staffing risks grow each year. We recommend taking the public portal off the current server by the end of 2027 at the latest.
What would bring replacement forward. The province’s digital permitting work, including the Building Permit Hub, may change what local permitting systems need to exchange with the province. If it requires an integration this system cannot support at reasonable cost, replacement becomes the better option. We found no such requirement in effect as of this report, and recommend the Municipality review it each budget year.
A
What we could not confirm
- ·Whether the finance system's vendor will keep supporting the fee-receipt integration after its own upgrade, planned for 2027. The Municipality has asked; there is no answer yet. If support ends, the integration would need a new connection method, which is not priced in this report.
- ·How long the mobile forms service keeps inspection photos and in which country they are stored. Its terms were not available during the assessment. We recommend a privacy impact assessment for that service.
- ·Whether the shared database password is used anywhere outside this system. Staff believe not. R3 rotates it either way.
B
Method, access and disclosures
- What we looked at
- A read-only copy of the database in the Municipality's test environment, the source code from the file share, server and application logs for the past nine months, and the documentation that exists.
- Who we spoke to
- Three staff: the person who maintains the system, the Building department lead and a finance analyst. About four hours of interviews in total. Separately, the IT team spent about a day setting up the test copy and supervising the restore test.
- Active tests
- Two, both authorized in writing before they ran: the TLS scan (E2) and the restore test (E4). Nothing was changed in production.
- Personal information
- The test copy contained unmasked personal information of applicants and property owners. It stayed in the Municipality's test environment and was reached only through one named account. The IT team deleted the copy and removed our access on 24 October, and the IT manager confirmed both in writing.
- Limits
- This is not a penetration test. Some findings rely on what staff told us, and are marked that way. We did not review the GIS, finance or mobile forms systems themselves, only their connections to this one.
- Interest in the work
- Bluestone has priced the fixes in section 6 and may bid on them. The Municipality owns this report and may give it to any supplier.
C
Evidence
- E1 · Server inventory
- Windows Server 2012 R2 Standard (build 6.3.9600), SQL Server 2012 SP4 (11.0.7001), IIS 8.5, .NET Framework 4.5.2. Collected 8 October from the server, read-only.
- E2 · TLS scan
- One non-intrusive scan of the portal's public address on 14 October, authorized in writing in advance by the IT manager. Result: TLS 1.0, 1.1 and 1.2 accepted.
- E3 · Integration logs
- Application and task-scheduler logs, 1 January to 7 October. GIS import failures on 3 March and 19 August, with no alert sent on either day.
- E4 · Restore test
- 16 October, into the Municipality's test environment, with written approval. Started 08:05, completed 17:15. Supervised by the Municipality's IT staff.
- E5 · Accessibility check
- Online application tested 20 October with NVDA and keyboard only, against WCAG 2.1 AA. Three blocking failures, listed in the condition summary.
- E6 · Parcel address comparison
- Permit system addresses compared with the GIS parcel layer on 9 October: 1,108 of 37,214 parcels differ. List supplied to GIS staff.
- E7 · Permit check
- The 23 permits issued in the three working days after each import failure, checked against the parcel layer as it stood on those days. No permit was affected.
In a real report, the raw scan output, log extracts and restore record are attached as files.