Professional Services Proposal - Criminal Justice Information Security Compliance Gap Assessment

Home Browse Search

Proposal to Provide CJIS Gap Assessment City of South Bend Project Approach Crowe anticipates each project will consist of three phases. / //%ORMYi r r // ii i %� /�OG �i/ R 0 c. d V All key planning activities may include internal stakeholders or (if applicable) third parties. • Confirm scope and approach for the engagement • Define Communications Plan • Identify Key Stakeholders • Finalize project timeline, target dates, and execution strategy • Discuss testing approach, sampling method, and determine sample • Develop and delivery requested items • Finalize a Project Plan • Conduct Kick-off Meeting • Plan logistics for fieldwork • Finalize format for final deliverables • Requested Items • Initial Interview Schedule • 3 weeks (includes time to respond to requested item) • 4 hours: Client will need to spend approximately 4 total hours for kick-off meeting and to gather requested materials. All key fieldwork activities may include internal stakeholders or (if applicable) third parties. • Review requested items • Conduct interviews with Key Stakeholders in order to assess the design of the control environment • Document design control gaps • Coordinate with Key Stakeholders to conduct testing • Conduct testing to evaluate control effectiveness (see potential testing approaches below) • Assess results of control testing and document gaps • Evaluate gaps against CJIS requirements • Completed work programs • Scan results from automated testing • 2 - 3 weeks • 4 — 6 hours per week: Key stakeholders will need to commit approximately 4 - 6 hours a week to participate in interviews and so support testing procedures. 10 • Create Exit Document • Conduct Exit Meeting with Key Stakeholders • Create and deliver technical document summarizing the engagement results in a spreadsheet (if applicable) • Document the Security Assessment Report with Gap Analysis, including: • Executive Summary • Dashboard of CJIS Compliance • Discussion of the Procedures Performed • Prioritized List of Gaps • Remediation Plan of Action with Milestones • Exit Meeting Document • Technical Document, spreadsheet summarizing any technical results of the engagement • Security Assessment Report, including Remediation Plan of Action • 3 weeks • 2 — 4 hours: Client will spend 2 — 4 hours participating in exit meetings, reviewing deliverables, and responding (if necessary) to the report. Providing a comprehensive solution is critical to the success of this project. Providing a combination of testing approaches will provide maximum value to validate the effectiveness of the control environment. The specific procedures to be performed will be determined during scoping and the initial interviews with Key Stakeholders. Some of the test procedures that could be included as part of the testing are: 0 Penetration Testing. Testing designed to mimic an attacker in an attempt to validate information