FY27 - CJIS Email & Document Encryption

Confidential

IT Governance Business Case Compliance Business Case CJIS Email & Document Encryption Police Department

Confidential

Background The Durham Police Department (DPD) shares thousands of criminal records annually with the Durham County District Attorney's Office and Magistrate's Office whenever it is relevant to criminal prosecution. Criminal Justice Information Services (CJIS) policy requires the data to be encrypted: - at-rest, when outside a physically secure location - in-transit, when leaving a physically secure location (See CJIS Policy SC-13 & SC-28, pgs. 243 & 246) DPD's current process is not standardized. It often begins with one team printing electronic data for distribution. From there, other teams deliver the criminal records to the County by hand, by fax, or by scanning and emailing in violation of CJIS standards.

Confidential

Current Business Problem DPD lacks CJIS-compliant encryption for sharing criminal data by email or electronic file.

While extensive security measures exist, they focus on at-rest and onlocation security. Transfers to the County take various paths, some of which are unencrypted both in-transit and at-rest.

Confidential

Current Pain Points • No encryption tools for email or file sharing • No standardized process leads to accidental CJIS violation • Complex internal sharing due to clearance levels • Reliance on paper copies slows transfers

Confidential

Future State Benefits • Automated encryption for email & file sharing • Standardized process for consistent CJIS compliance • Role-based access for internal sharing • Elimination of paper copies

Confidential

Strategic Alignment

Confidential

Analysis and Recommended Solution

Confidential

Market Analysis • Native: • Microsoft Purview: current subscription provides manual encryption tools, but lacks automation to consistently ensure CJIS compliance • Microsoft Information Protection & Governance (IP&G) add-on extends to DPD's needed level of encryption • Broad domain: Information Security & Data Protection • Industry-specific: CJIS-aligned encryption tools

Confidential

Solution Analysis Features

Microsoft Purview IP&G

Virtru

Customer-controlled encryption keys

✅

✅

Revoke / expire access after sharing

✅

✅

Automated encryption & classification

✅

❌

Accidental data loss prevention

✅

❌

Bonus - integrated compliance & lifecycle management

✅

❌

$45,183 / yr

$47,595 / yr

Cost

Confidential

Recommended Solution: implement Microsoft

Purview Information Protection & Governance (IP&G)

Description

Purchase IP&G add-on to ensure consistent CJIS compliance in sharing criminal data

•

Pros

Cons

•

Auto-tags and encrypts sensitive CJI data for consistent compliance Revoke / expire access after sharing Customer-controlled keys (protection even if Microsoft is breached) Bonus - document lifecycle & insider risk tools

•

N/A

• •

Confidential

TS Architecture Review The recommended solution meets the TS Architecture standards for the City of Durham.

Confidential

Cybersecurity Review The recommended solution meets the cybersecurity standards for the City of Durham.

Confidential

Recommended Solution - Project Financial Estimate COST ESTIMATES

FUNDING

Implementation Costs (Hours)

Post Implementation Run Costs (Hours)/ KTLO

Internal TS Department:

31 Hours

60 hours

Business Analysis

16 hours

Architecture Office

3 hours

Cloud & Legacy

15 hours

Cybersecurity

5 hours

Project Management Office

600 hours

Description

Departmental Funding Amount:

$0

Labor $ (Hours)

Police

90 hours

External Labor (professional services) - setup & configuration

$64,317

Funding Requested (Y/N): Internal Labor New FTE – Year 1 Costs

$0.00

10 hours

Project One Time Costs (External)

$0.00

50 hours

*Total Project Funding Requested for Year 1

$114,018.00

*Total Project Funding Requested for Years 2+

$49,701.00

110 hours

Non-Labor $ Software – 707 Microsoft IP&G licenses for entire DPD (+10% inflation)

$49,701

$49,701

$ * Total Project Funding Requested Year 1 includes New FTE Labor, External Labor and Non Labor

Budget Analyst confirmed funding is not available

Y

Confidential

Risk Identification Description of Risk

Risk Impact (High/Medium/Low)

Vendor performance

Low

Y

N

Cyber Security

Low

Y

N

Project Team Turnover

Low

Y

N

Poor Execution

Low

Y

N

Mitigated (Y/N) Contingency(Y/N)

Confidential

Mitigation Risk (Costs) •

N/A

Contingency Risk (Costs) •

N/A

Confidential

Our ask We are asking the IT Governance Steering Committee to approve and score the business case to implement Microsoft IP&G to ensure DPD's email & electronic document encryption. If approved, the business case will be submitted to the City Manager for final approval.