IT Governance Business Case
Background
The Durham Police Department (DPD) shares thousands of criminal records annually with the Durham County District Attorney's Office and Magistrate's Office whenever it is relevant to criminal prosecution. Criminal Justice Information Services (CJIS) policy requires the data to be encrypted:
- at-rest, when outside a physically secure location
- in-transit, when leaving a physically secure location
(See CJIS Policy SC-13 & SC-28, pgs. 243 & 246)
DPD's current process is not standardized. It often begins with one team printing electronic data for distribution. From there, other teams deliver the criminal records to the County by hand, by fax, or by scanning and emailing in violation of CJIS standards.
Current Business Problem
DPD lacks CJIS-compliant encryption for sharing criminal data by email or electronic file.
While extensive security measures exist, they focus on at-rest and onlocation security. Transfers to the County take various paths, some of which are unencrypted both in-transit and at-rest.
Current Pain Points
• No encryption tools for email or file sharing
• No standardized process leads to accidental CJIS violation
• Complex internal sharing due to clearance levels
• Reliance on paper copies slows transfers
Future State Benefits
• Automated encryption for email & file sharing
• Standardized process for consistent CJIS compliance
• Role-based access for internal sharing
• Elimination of paper copies
Strategic Alignment
Analysis and Recommended Solution
Market Analysis
• Native:
• Microsoft Purview: current subscription provides manual encryption tools, but lacks automation to consistently ensure CJIS compliance
• Microsoft Information Protection & Governance (IP&G) add-on extends to DPD's needed level of encryption
• Broad domain: Information Security & Data Protection
• Industry-specific: CJIS-aligned encryption tools
Solution Analysis
Recommended Solution: implement Microsoft
Purview Information Protection & Governance (IP&G)
Description
Purchase IP&G add-on to ensure consistent CJIS compliance in sharing criminal data
Pros
• Auto-tags and encrypts sensitive CJI data for consistent compliance
• Revoke / expire access after sharing
• Customer-controlled keys (protection even if Microsoft is breached)
• Bonus - document lifecycle & insider risk tools
Cons
• N/A
TS Architecture Review
The recommended solution meets the TS Architecture standards for the City of Durham.
Cybersecurity Review
The recommended solution meets the cybersecurity standards for the City of Durham.
Recommended Solution - Project Financial Estimate
Risk Identification
Mitigation Risk (Costs)
• N/A
Contingency Risk (Costs)
• N/A
Our ask
We are asking the IT Governance Steering Committee to approve and score the business case to implement Microsoft IP&G to ensure DPD's email & electronic document encryption. If approved, the business case will be submitted to the City Manager for final approval.