Build a CJIS compliance command center — a self-service web app that helps criminal justice agencies (State, Local, Tribal & Territorial), non-criminal-justice agencies with CJI access, and their vendors assess and continuously monitor their readiness against the FBI CJIS Security Policy. These teams rarely have dedicated compliance staff, so today they track this in spreadsheets and scramble to prove their posture at every audit. Replace that with an interactive assessment plus live, always-current evidence. Trigger it as a webpage served at an HTTP route (space-authenticated); the app runs client-side and keeps assessment answers in the browser, so it doesn't depend on any upstream step. The main pieces, at a high level: The app (a React step). Let the user declare which security tools they run, work through the policy's control families, and see the results in several tailored views: an executive readiness dashboard, an auditor findings matrix, and a remediation/POA&M roadmap. Include a monitoring tab that shows the health of the feeder workflows below. On load it should hydrate from the live evidence endpoint and let the user apply those signals to the relevant checks. A PDF audit report step. The app posts the computed assessment to an internal route that returns a designed, multi-page PDF the user can hand to an assessor. An evidence store + read API. One step owns a persisted evidence store (a named volume); a separate read-only route lets the app fetch the current live signals. Scheduled collector steps (cron). Several monitoring workflows each poll one category of security tool on its own schedule, normalize the results into a common control-signal shape, and feed them into the evidence store. Cover categories like SIEM/log audit, EDR, identity/directory, MFA, email security, mobile device management, vulnerability scanning, and backup. Build them so each collector is a clean swap point: start simulated if you like, but structure it so connecting a real tool's API later doesn't change the rest of the pipeline. For the tool integrations, I used Microsoft Sentinel (SIEM), CrowdStrike Falcon (EDR), Entra ID / Active Directory (directory), Duo / Entra MFA, Proofpoint (email), Microsoft Intune (MDM), Tenable (vulnerability), and Veeam (backup) — but treat each as a choice the builder can swap for whatever the agency actually runs (e.g. Splunk instead of Sentinel, SentinelOne instead of CrowdStrike, Okta instead of Entra). Wire real tools through connectors rather than hardcoding credentials. Tools used: Microsoft Sentinel, CrowdStrike Falcon, Entra ID / Active Directory, Duo / Entra MFA, Proofpoint, Microsoft Intune, Tenable, Veeam