Security, data and compliance in "Civic-Secure" Microsoft 365

How "Civic-Secure" Microsoft 365 protects data and supports your compliance obligations.

Security controls

Multi-factor sign-in

Every user signs in through Microsoft Entra ID with multi-factor authentication, under conditional access rules the agency approves.

Role-based administration

Administrator rights are split by task and limited to named people, and Moraph's access is approved by the agency.

Encryption and keys

Data is encrypted by Microsoft 365, and Moraph staff cannot access agency content without explicit, time-bound authorization from the agency.

Complete audit trail

Microsoft 365 audit logging is enabled and retained, and every Moraph administrative action is logged.

US-only hosting

Microsoft 365 GCC keeps customer data in the United States, and Moraph's operations for US government clients stay in the United States.

Screened personnel

Moraph staff with administrative access complete the screening and training your CJIS Systems Agency requires before access is granted.

Requirements it supports

• FBI CJIS Security Policy
• CJIS Security Addendum
• 28 CFR Part 20 (Criminal Justice Information Systems)
• State public records and records retention laws, as they apply to your agency
• ADA Title II web and mobile accessibility rule (28 CFR Part 35, Subpart H)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Microsoft 365 GCC: Tenant in Microsoft's Government Community Cloud, which keeps customer data in the United States.
• Hybrid identity: Users synchronized from on-premises Active Directory while the agency keeps its existing directory.
• Existing GCC tenant: Where the agency already has a GCC tenant, Moraph assesses it against the baseline and takes over management after agreed remediation.

Limitations

• Moraph is not Microsoft. Microsoft's own service commitments, roadmap, service changes and outages apply to Microsoft 365.
• Licences are subject to Microsoft's terms, and GCC eligibility is decided by Microsoft.
• Configuring Microsoft 365 does not make an agency CJIS compliant on its own. Compliance depends on the agency's policies, personnel, physical security and audits by its state CJIS Systems Agency.
• Moraph does not hold a CJIS certification, because none exists; audits are between the agency and its state CJIS Systems Agency.
• Moraph does not decide whether to release criminal justice information or respond to public records requests. Those decisions stay with the agency.
• Devices must be enrolled and kept compliant by the agency; unmanaged devices are blocked rather than secured.
• This service covers Microsoft 365. Records management systems, computer-aided dispatch and evidence systems are separate.
• Higher Microsoft government clouds such as GCC High are not covered by this offering.