Professional Services Proposal - Criminal Justice Information Security Compliance Gap Assessment

Home Browse Search

Proposal to Provide CJIS Gap Assessment City of South Bend CJIS Gap Assessment Crowe Integrated Cybersecurity Framework Determining an appropriate control framework for cybersecurity is challenging for even mature organizations. The complexities and nuances with existing regulatory requirements (e.g. HIPAA) combined with industry standards (e.g. NIST Cybersecurity Framework) make managing control expectations nearly impossible. To help address this challenge, Crowe has established the Crowe Integrated Cybersecurity Framework (CICF). Defining a comprehensive cybersecurity risk and control framework that seamlessly integrates with existing regulatory and industry guidance is integral for organizations looking to efficiently evaluate and manage their cybersecurity risk. The framework was established by mapping controls across common regulatory standards and industry frameworks to correlate controls. Controls could be categorized based on like themes, and these themes were utilized to create an integrated control requirement. By correlating the controls, this integrated control can be defined in a way that includes a single test procedure that allows the organization to understand compliance with all common control requirements across the different standards. For example, password policies are addressed within the majority of cybersecurity regulatory standards and industry frameworks. Leveraging the CICF, Crowe will test this control one time, but be able to conclude on organizational compliance across the different standards, allowing for an efficient, but comprehensive evaluation process. Crowe's framework includes: • Regulatory requirements, such as the Criminal Justice Information Security Policy (CJIS), FFIEC Cybersecurity Assessment Tool (FFIEC CAT), and the Health Insurance Portability and Accountability Act (HIPAA) • Industry frameworks, such as NIST 800-53 r4 and the NIST Cybersecurity Framework (NIST CSF) The CICF is a dynamic framework, continually being modified to accommodate changes in standards and to incorporate additional standards as necessary. Currently, Crowe's CICF consists of fourteen unique control domains defining a comprehensive cybersecurity risk and control universe. (02019 Crowe LA F' www,crowre. cam