"Civic-Secure" Microsoft 365

Moraph resells, deploys and manages Microsoft 365 in Microsoft's Government Community Cloud (GCC) for police departments, courts and other local agencies that handle criminal justice information. We configure identity, devices, labeling, data loss prevention, retention and logging to support the FBI CJIS Security Policy, document how each requirement is met, and keep the configuration in line as Microsoft changes the service. Your agency and your state's CJIS Systems Agency keep the policy decisions and the audit relationship.

The problem it solves

Local agencies want the same email, file sharing and chat tools everyone else uses, but criminal justice information comes with the FBI CJIS Security Policy attached. Microsoft 365 has the settings needed to support it, yet getting them right means working through multi-factor authentication, device controls, encryption, logging, retention and personnel requirements, then proving it all to the state CJIS auditor. Small IT teams rarely have the time to configure it, keep it configured as the service changes, and answer audit questions with evidence.

Who it’s for

• Police and sheriff's departments moving to cloud email and collaboration
• Courts, prosecutors and probation offices that receive criminal justice information
• City and county IT departments that support public safety agencies
• Local Agency Security Officers responsible for CJIS compliance
• Agency records and legal staff who manage retention and public records requests

1. DeployMoraph sets up your Microsoft 365 GCC tenant with a CJIS-oriented baseline, connects your directory and moves mail and files across.
2. ProtectThe configured tenant applies the agency's rules every time someone signs in, opens a file or shares information. Microsoft 365 enforces them; Moraph keeps them set correctly.
3. OperateMoraph watches the tenant day to day, triages security alerts with your staff, handles your change requests and checks the configuration against the agreed baseline.
4. EvidenceWhen your state CJIS Systems Agency audits, the agency has a current record of how each requirement is met in the tenant, with logs and access reviews to back it.

CJIS configuration baseline

A documented set of Microsoft 365 GCC settings chosen to support the CJIS Security Policy, applied at deployment and maintained by Moraph.

Multi-factor sign-in

Microsoft Entra ID requires multi-factor authentication for every user, with methods chosen to support the CJIS Security Policy's authentication requirements.

Conditional access

Entra ID Conditional Access allows access only from managed, compliant devices and locations the agency approves.

Device compliance

Microsoft Intune checks that laptops, phones and in-car computers meet the agency's device rules before they reach agency data.

Sensitivity labels

Microsoft Purview labels identify documents and email containing criminal justice information and apply protection that travels with them.

Data loss prevention

Purview data loss prevention policies detect labeled or sensitive content being shared outside allowed recipients and warn or block.

Retention and legal hold

Retention policies set to the agency's records schedule, with holds and eDiscovery for litigation and public records requests.

Audit logging

Microsoft 365 audit logging enabled and retained, so access to criminal justice information can be reviewed.

Controlled external sharing

Teams and SharePoint sharing limited to approved partner agencies and guests, reviewed periodically.

Least-privilege administration

Administrator roles split by task and kept to the people who need them, with Moraph's own access approved by the agency.

Configuration drift checks

Moraph compares the live tenant with the baseline and reviews Microsoft service changes that could affect it.

Audit evidence package

A requirement-by-requirement record of how the tenant is configured, with logs and access review results, ready for your CJIS auditor.

Agency user

Officer, clerk or staff member who uses email, Teams and files to do their job

Local Agency Security Officer

Owns CJIS compliance for the agency and approves security-relevant changes

Agency IT administrator

Manages users, devices and day-to-day support for the agency

Records and legal staff

Run retention, holds and searches for litigation and public records requests

Moraph M365 engineer

Configures and monitors the tenant under the agency's approved changes

Auditor (read-only)

Reviews configuration evidence, logs and access reviews

On-premises Active Directory

Users and groups synchronized to Microsoft Entra ID, or moved to cloud-only identities where the agency prefers.

Existing email system

Mailboxes migrated from on-premises Exchange or another email system in planned waves.

File shares

Departmental file shares migrated to SharePoint and Teams, with permissions reviewed as they move.

Mobile and in-car devices

Laptops, phones and mobile data computers enrolled in Microsoft Intune for compliance checks.

Partner agencies

Approved partner agencies and courts set up for controlled sharing in Teams and SharePoint.

Agency security monitoring

Microsoft 365 audit and alert data forwarded to the agency's or county's security monitoring tool where one exists.

Records management

Retention labels aligned with the agency's records schedule, with exports for public records responses.

Multi-factor sign-in

Every user signs in through Microsoft Entra ID with multi-factor authentication, under conditional access rules the agency approves.

Role-based administration

Administrator rights are split by task and limited to named people, and Moraph's access is approved by the agency.

Encryption and keys

Data is encrypted by Microsoft 365, and Moraph staff cannot access agency content without explicit, time-bound authorization from the agency.

Complete audit trail

Microsoft 365 audit logging is enabled and retained, and every Moraph administrative action is logged.

US-only hosting

Microsoft 365 GCC keeps customer data in the United States, and Moraph's operations for US government clients stay in the United States.

Screened personnel

Moraph staff with administrative access complete the screening and training your CJIS Systems Agency requires before access is granted.

Microsoft 365 GCC

Tenant in Microsoft's Government Community Cloud, which keeps customer data in the United States.

Hybrid identity

Users synchronized from on-premises Active Directory while the agency keeps its existing directory.

Existing GCC tenant

Where the agency already has a GCC tenant, Moraph assesses it against the baseline and takes over management after agreed remediation.

Assessment

We review your current email, files, devices and identity setup, and how criminal justice information flows through them. We need your LASO and IT lead involved.

Tenant and licensing

Moraph helps confirm GCC eligibility with Microsoft, arranges licences and sets up the tenant.

Baseline configuration

Identity, conditional access, devices, labels, data loss prevention, logging and retention are configured to the baseline and reviewed with your LASO.

Migration

Mailboxes and file shares move in planned waves, with permissions reviewed as content moves.

Training

Staff learn how to label and share criminal justice information, and agency IT learns its admin tasks.

Audit readiness and handover to operations

The CJIS requirement mapping is completed, and the tenant moves into Moraph's managed service.

• Moraph is not Microsoft. Microsoft's own service commitments, roadmap, service changes and outages apply to Microsoft 365.
• Licences are subject to Microsoft's terms, and GCC eligibility is decided by Microsoft.
• Configuring Microsoft 365 does not make an agency CJIS compliant on its own. Compliance depends on the agency's policies, personnel, physical security and audits by its state CJIS Systems Agency.
• Moraph does not hold a CJIS certification, because none exists; audits are between the agency and its state CJIS Systems Agency.
• Moraph does not decide whether to release criminal justice information or respond to public records requests. Those decisions stay with the agency.
• Devices must be enrolled and kept compliant by the agency; unmanaged devices are blocked rather than secured.
• This service covers Microsoft 365. Records management systems, computer-aided dispatch and evidence systems are separate.
• Higher Microsoft government clouds such as GCC High are not covered by this offering.

• Review the configuration baseline and requirement mapping with your LASO
• Sign in from a managed device and an unmanaged one and confirm what each can reach
• Try sharing a labeled document with an outside address and check the result and the log
• Walk through a change request from agency request to LASO approval
• Review a sample monthly service review and the responsibilities table
• Ask your CJIS Systems Agency what evidence it will expect, and check it against the evidence package