The Department of Veterans Affairs (VA) established CRISP as an information security program targeted at all VA personnel to progress the Department from a compliance-based culture to a security-conscious culture. In addition to fostering culture change, CRISP is also used to guide our work in establishing information security across the enterprise. It is the framework we use to develop plans, implement activities, and make continuous adjustments to our approach to meet the goal of protecting VA and Veteran information.