IT Resource Center

A management-level checklist for reviewing the major components of an organization’s cybersecurity program, including account security, multifactor authentication, software updates, endpoint protection, email security, backups, employee awareness, access management, incident preparation, and technology oversight.

A repeatable technology checklist for employees joining, changing roles, or leaving an organization. Covers accounts, Microsoft 365 licensing, computers, authentication, application access, shared resources, equipment return, access removal, and documentation.

A planning guide for determining when workstations and laptops should be repaired, upgraded, replaced, or retired. Covers operating-system support, warranty status, workload requirements, reliability, standardization, budgeting, and replacement cycles.

A project-planning checklist for organizations moving, expanding, remodeling, or opening a facility. Covers internet service, networking, Wi-Fi, phones, workstations, printers, cabling, Microsoft 365, security systems, vendors, scheduling, and cutover planning.

A planning worksheet for identifying important systems and information, recovery priorities, acceptable downtime, data-loss tolerance, retention needs, recovery responsibilities, and questions that should be answered before a disruption occurs.

A structured worksheet for building an annual technology budget covering hardware replacements, licensing, subscriptions, projects, cybersecurity improvements, infrastructure upgrades, support costs, and anticipated organizational changes.

A blank inventory template for documenting computers, servers, network equipment, printers, mobile devices, technology ownership, warranty information, lifecycle status, and other assets that should be considered during technology planning.

Completed copies may contain sensitive infrastructure information and should be protected accordingly.

A checklist for reviewing vendors, consultants, contractors, applications, and service providers that receive access to organizational systems or information. Helps organizations consider account ownership, authorization, access duration, data handling, offboarding, authentication, and responsibility boundaries.

A quick-reference guide for recognizing legitimate support activity, verifying unexpected support requests, protecting passwords and authentication codes, and safely starting temporary remote-assistance sessions.

A printable employee reference covering common warning signs in email, text messages, account alerts, payment requests, shared-file invitations, credential prompts, unexpected attachments, and other suspicious communications.

A planning worksheet for documenting who should be contacted, who has decision-making authority, which systems are most important, where critical information is maintained, and what outside resources may be needed during a cybersecurity incident.

This is a preparedness tool, not a substitute for a formal incident-response plan appropriate to an organization’s risk and regulatory requirements.

A planning checklist covering tenant ownership, administrative accounts, licensing, user lifecycle management, authentication, security responsibilities, data retention considerations, and administrative continuity.

A planning resource for eligible organizations evaluating Microsoft 365 Government Community Cloud. Covers eligibility, users, licensing, migration considerations, identity, data requirements, administrative responsibilities, integrations, and government-specific requirements that may affect cloud selection.

Use of GCC does not by itself establish compliance with CJIS, CMMC, HIPAA, or another regulatory framework.

A public-sector planning worksheet for municipalities, administrative offices, and other government organizations developing annual technology budgets and multi-year replacement schedules.

The worksheet is designed to help connect equipment age, operating-system lifecycle, licensing, cybersecurity priorities, projects, and long-term capital planning.

A planning worksheet for organizations supporting systems that access, process, transmit, store, or otherwise support Criminal Justice Information.

The worksheet helps identify technology areas that may require further review against the current FBI CJIS Security Policy, Michigan requirements, contractual responsibilities, and agency-specific procedures. It is not a compliance certification or substitute for an agency’s required CJIS review.

A project-planning checklist covering coverage areas, entrances, retention objectives, lighting, network availability, power, user access, privacy considerations, building changes, expansion planning, and other information useful before beginning a camera or access-control project.

The FBI CJIS Security Policy establishes security requirements for protecting Criminal Justice Information throughout its lifecycle.

The current policy published by the FBI is CJIS Security Policy Version 6.1, dated June 25, 2026.

The FBI’s Security Policy Resource Center contains supporting material for understanding and applying CJIS requirements, including appendices, requirements information, use cases, agreements, security-addendum material, incident-response resources, and implementation guidance.

This should be the primary Michigan-specific CJIS and LEIN reference link on the page.

Michigan State Police maintains a central library containing the FBI CJIS Security Policy, Michigan Addendum, LEIN Policy Manual, CJIS administrative rules, sample required policies, agreements, Security Addendum material, and other LEIN documentation.

Michigan maintains additional state-specific requirements that must be considered together with applicable FBI CJIS requirements and Michigan rules.

The version currently published by MSP is dated May 28, 2021.

The LEIN Policy Manual provides Michigan-specific policy governing authorized LEIN use and related operating requirements.

Because Michigan may revise LEIN materials independently, users should also consult the main MSP LEIN resource library when relying on this document.

The Security Addendum addresses security requirements associated with private contractors and personnel supporting environments with access to Criminal Justice Information.

The FBI publishes use cases to help agencies understand how CJIS Security Policy concepts apply in practical circumstances.

State and local government organizations that receive Federal Tax Information may also be subject to IRS safeguarding requirements.

The IRS Office of Safeguards maintains Publication 1075 and additional technical guidance covering protection of Federal Tax Information, including operational security, encryption, network security, media sanitization, incident reporting, and contractor responsibilities.

NIST CSF 2.0 provides a widely used framework for managing cybersecurity risk across organizations of different sizes and sectors. Its six primary functions are Govern, Identify, Protect, Detect, Respond, and Recover.

NIST maintains practical Quick-Start Guides covering small businesses, organizational profiles, supply-chain risk management, enterprise risk, workforce management, and other CSF implementation topics.

NIST SP 1300 was developed specifically to help small and medium-sized organizations begin using the Cybersecurity Framework when they have modest or developing cybersecurity programs. NIST notes that the guide can also assist smaller government agencies, nonprofits, and schools.

CISA maintains resources covering phishing, multifactor authentication, software updates, logging, backups, encryption, incident response, vulnerability management, cybersecurity training, and other practical security topics for small and medium-sized organizations.

The Cross-Sector Cybersecurity Performance Goals provide a prioritized set of practices intended to help organizations focus security investments on actions with meaningful risk-reduction value.

They are particularly useful for smaller organizations and critical-infrastructure operators that need a practical baseline rather than another enormous control catalog.

The Known Exploited Vulnerabilities Catalog identifies vulnerabilities CISA has determined are being exploited in the wild.

It is useful for helping IT and security teams prioritize remediation based on actual exploitation rather than severity scores alone.

The CIS Critical Security Controls provide a prioritized and practical set of cybersecurity safeguards. CIS organizes implementation into groups so organizations can begin with foundational controls and progress based on complexity, risk, and resources.

The FTC maintains practical cybersecurity guidance for businesses covering access control, authentication, employee awareness, network security, vendor access, data protection, and incident preparation.

The FTC Safeguards Rule applies to financial institutions under FTC jurisdiction and requires covered organizations to maintain measures designed to protect customer information.

Organizations should determine applicability based on their activities and regulatory status rather than assuming the rule applies only to traditional banks.

Organizations that store, process, or transmit payment-card information may have responsibilities under the Payment Card Industry Data Security Standard.

The PCI Security Standards Council document library currently identifies PCI DSS v4.0.1 as the current published PCI DSS standard.

The HIPAA Security Rule establishes administrative, physical, and technical safeguards for protecting electronic protected health information maintained or transmitted by regulated entities.

HHS maintains educational and implementation guidance covering administrative safeguards, physical safeguards, technical safeguards, policies and procedures, risk management, remote use, mobile devices, and other Security Rule topics.

Risk analysis is a required component of the HIPAA Security Rule’s security-management process. HHS describes risk analysis as foundational to determining appropriate safeguards for electronic protected health information.

The federal Security Risk Assessment Tool is designed to assist small and medium-sized healthcare practices and business associates in performing security risk assessments.

The current resource page provides the downloadable SRA workbook, user guide, and supporting training material.

The HIPAA Breach Notification Rule establishes notification requirements following certain breaches of unsecured protected health information.

Organizations dealing with an actual or suspected breach should determine the requirements that apply to their circumstances and should involve appropriate legal, compliance, technical, and regulatory resources.

The official CMMC program site should be the starting point for current Cybersecurity Maturity Model Certification program information.

CMMC requirements and implementation details can change, so Computer Ties should link to the current government program rather than reproduce rollout schedules that may become outdated.

DFARS Subpart 204.75 contains current Defense Federal Acquisition Regulation Supplement policies and procedures concerning CMMC requirements in applicable contracts.

This clause addresses contractor compliance with required Cybersecurity Maturity Model Certification levels when incorporated into an applicable contract.

DFARS 252.204-7012 addresses safeguarding covered defense information and cyber-incident reporting requirements for applicable contracts.

NIST SP 800-171 Revision 3 provides recommended security requirements for protecting Controlled Unclassified Information in nonfederal systems and organizations when those requirements are incorporated through federal agreements or contractual mechanisms.

The federal CUI Registry is the government-wide repository for federal-level guidance regarding Controlled Unclassified Information categories, authorities, markings, dissemination controls, and handling requirements.

Organizations should also follow agency-specific CUI implementing policies applicable to their contracts or work.

Microsoft’s Office 365 US Government service description explains the characteristics of GCC, GCC High, and DoD environments and the commitments specific to Microsoft’s government cloud offerings.

Microsoft currently documents U.S.-based storage of government-cloud customer content, logical separation from commercial customer content, and restricted access by screened Microsoft personnel among the distinguishing characteristics of the government environments.

Microsoft maintains eligibility-validation requirements for organizations seeking GCC or GCC High environments.

This resource also explains differences among GCC, GCC High, and DoD offerings and the purchasing channels available to eligible organizations.

Microsoft Windows Release Health provides current information on Windows releases, servicing milestones, known issues, safeguards, and update guidance.

This is a useful resource when evaluating whether an update issue is widespread, documented, or under active investigation by Microsoft.

Microsoft publishes support and retirement dates for currently supported Windows 11 Home and Pro releases.

Organizations using Windows Enterprise or Education editions should review the separate Microsoft lifecycle because support periods can differ from Home and Pro releases.

Existing Computer Ties customers experiencing an active technology or cybersecurity issue should contact the Help Desk rather than relying only on a web resource.

Help Desk: 517-905-3168

The FBI Internet Crime Complaint Center, or IC3, is the federal government’s central reporting hub for cyber-enabled crime.

The FTC’s Data Breach Response guide provides businesses with general guidance regarding securing operations, preserving evidence, assembling an appropriate response team, understanding notification responsibilities, communicating with affected parties, and involving law enforcement and legal counsel.

IdentityTheft.gov allows individuals to report identity theft and receive a personalized recovery plan. It also provides guidance for people responding to exposed personal information and data breaches.

Technology standards, regulations, security policies, product requirements, and government guidance change over time. Computer Ties maintains this collection to make authoritative information easier to locate, but the original publisher remains the source of truth for externally published requirements.

Whenever possible, this Resource Center links to the organization responsible for the policy, standard, regulation, or technology rather than relying on third-party summaries.

Computer Ties can help organizations understand the technology implications of these requirements and implement appropriate technology solutions. Questions involving legal interpretation, formal regulatory determinations, contractual certification, agency authorization, or assessment requirements should also be reviewed with the appropriate authority, legal counsel, compliance professional, contracting official, or qualified assessor.

External references last reviewed: September 2026

For a new project or technology-planning discussion:

Schedule a Consultation

For an existing customer support issue:

Contact the Help Desk

Computer Ties
2903 W Michigan Ave
Jackson, MI 49202
(517) 788-6393

Serving Jackson since 1990.