9-Exhibit X - CJIS Security Policy v5-7 20180816.pdf

U. S. Department of Justice

Federal Bureau of Investigation

Criminal Justice Information Services Division

Criminal Justice Information Services (CJIS)

Security Policy

Version 5.7

08/16/2018

CJISD-ITS-DOC-08140-5.7

Prepared by:

CJIS Information Security Officer

Approved by:

CJIS Advisory Policy Board i

EXECUTIVE SUMMARY

Law enforcement needs timely and secure access to services that provide data wherever and whenever for stopping and reducing crime. In response to these needs, the Advisory Policy Board

(APB) recommended to the Federal Bureau of Investigation (FBI) that the Criminal Justice

Information Services (CJIS) Division authorize the expansion of the existing security management structure in 1998. Administered through a shared management philosophy, the CJIS Security

Policy contains information security requirements, guidelines, and agreements reflecting the will of law enforcement and criminal justice agencies for protecting the sources, transmission, storage, and generation of Criminal Justice Information (CJI). The Federal Information Security

Management Act of 2002 provides further legal basis for the APB approved management, operational, and technical security requirements mandated to protect CJI and by extension the hardware, software and infrastructure required to enable the services provided by the criminal justice community.

The essential premise of the CJIS Security Policy is to provide appropriate controls to protect the full lifecycle of CJI, whether at rest or in transit. The CJIS Security Policy provides guidance for the creation, viewing, modification, transmission, dissemination, storage, and destruction of CJI.

This Policy applies to every individual—contractor, private entity, noncriminal justice agency representative, or member of a criminal justice entity—with access to, or who operate in support of, criminal justice services and information.

The CJIS Security Policy integrates presidential directives, federal laws, FBI directives and the criminal justice community’s APB decisions along with nationally recognized guidance from the

National Institute of Standards and Technology. The Policy is presented at both strategic and tactical levels and is periodically updated to reflect the security requirements of evolving business models. The Policy features modular sections enabling more frequent updates to address emerging threats and new security measures. The provided security criteria assists agencies with designing and implementing systems to meet a uniform level of risk and security protection while enabling agencies the latitude to institute more stringent security requirements and controls based on their business model and local needs.

The CJIS Security Policy strengthens the partnership between the FBI and CJIS Systems Agencies

(CSA), including, in those states with separate authorities, the State Identification Bureaus (SIB).

Further, as use of criminal history record information for noncriminal justice purposes continues to expand, the CJIS Security Policy becomes increasingly important in guiding the National Crime

Prevention and Privacy Compact Council and State Compact Officers in the secure exchange of criminal justice records.

The Policy describes the vision and captures the security concepts that set the policies, protections, roles, and responsibilities with minimal impact from changes in technology. The Policy empowers

CSAs with the insight and ability to tune their security programs according to their risks, needs, budgets, and resource constraints while remaining compliant with the baseline level of security set forth in this Policy. The CJIS Security Policy provides a secure framework of laws, standards, and elements of published and vetted policies for accomplishing the mission across the broad spectrum of the criminal justice and noncriminal justice communities.

ii

CHANGE MANAGEMENT

Revision Change Description Created/Changed by Date Approved By

5 Policy Rewrite Security Policy

Working Group 2/9/2011

See Signature

Page

5.1

Incorporate Calendar

Year 2011 APB approved changes and administrative changes

CJIS ISO Program

Office 7/13/2012

APB & Compact

Council

5.2

Incorporate Calendar

Year 2012 APB approved changes and administrative changes

CJIS ISO Program

Office 8/9/2013

APB & Compact

Council

5.3

Incorporate Calendar

Year 2013 APB approved changes and administrative changes

CJIS ISO Program

Office 8/4/2014

APB & Compact

Council

5.4

Incorporate Calendar

Year 2014 APB approved changes and administrative changes

CJIS ISO Program

Office 10/6/2015

APB & Compact

Council

5.5

Incorporate Calendar

Year 2015 APB approved changes and administrative changes

CJIS ISO Program

Office 6/1/2016

APB & Compact

Council

5.6

Incorporate Calendar

Year 2016 APB approved changes and administrative changes

CJIS ISO Program

Office 6/5/2017

APB & Compact

Council

5.7

Incorporate Calendar

Year 2017 APB approved changes and administrative changes

CJIS ISO Program

Office 08/16/2018

APB & Compact

Council iii

SUMMARY OF CHANGES

Version 5.7

APB Approved Changes

1. Section 5.10.1.5 Cloud Computing: add language concerning data storage in cloud environments, Fall 2017, APB#17, SA#2, CJIS Security Policy Restriction for Criminal

Justice Information Stored in Offshore Cloud Computing Facilities.

2. Section 5.10.1.5 Cloud Computing: add language concerning authorized uses of metadata, Spring 2017, APB#16, SA#10, Collection and Use of Metadata by Cloud

Service Providers.

3. Section 5.12.1.2 Personnel Screening for Contractors and Vendors: add language allowing CSO delegation of duties, Spring 2017, APB#16, SA#7, CJIS Systems Officer

Delegation Authorization of Personnel Screening Requirements for Contractors and

Vendors.

4. Section 5.12.1 Personnel Security Policy and Procedures: rename section to “Personnel Screening Requirements for Individuals Requiring Unescorted Access to Unencrypted

CJI” and combine previous Sections 5.12.1.1 and 5.12.1.2 into the single section, Fall

2017, APB#17, SA#1, CJIS Security Policy Language Changes in Section 5.12.

5. Appendix A Terms and Definitions: add definition of “Metadata”, Spring 2017, APB#16, SA#10, Collection and Use of Metadata by Cloud Service Providers.

6. Appendix B Acronyms: add “RCMP”, “Royal Canadian Mounted Police”, Fall 2017, APB#17, SA#2, CJIS Security Policy Restriction for Criminal Justice Information Stored in Offshore Cloud Computing Facilities.

7. Appendix J Noncriminal Justice Agency Supplemental Guidance: add language to clarify which personnel the requirements apply to and remove language referencing deleted language, Fall 2017, APB#17, SA#1, CJIS Security Policy Language Changes in Section

5.12.

Administrative Changes1

1. Section 1.4, add bullet concerning “References/Citations/Directives.”

2. Section 4.1, change “FNU” to “UCN.”

3. Section 5.1.1.2, remove reference to DOJ Order 0904.

4. Section 5.1.1.6, remove reference to DOJ Order 0904.

5. Section 5.1.5, remove this section and all other like sections in each policy area (5.2.3, 5.3.5, 5.4.8, 5.5.7, 5.6.5, 5.7.3, 5.8.5, 5.9.3, 5.10.5, 5.11.5, 5.12.5).

6. Section 5.4.1.1, add clarifying language to #4.

7. Section 5.5.2.4, change cross-reference in bullet #3

8. Section 5.5.4, change bullet for consistency throughout policy.

9. Section 5.6.2.1.2, change bullet(s) for consistency throughout policy.

10. Section 5.6.2.1.3, change bullet(s) for consistency throughout policy.

11. Section 5.6.2.2.1, change bullet(s) for consistency throughout policy.

12. Section 5.10.1.2.1, change bullet(s) for consistency throughout policy.

1 Administrative changes are vetted through the Security and Access Subcommittee and not the entire APB process.

iv

13. Section 5.10.1.2.2, change bullet(s) for consistency throughout policy.

14. Section 5.10.1.2.3, change bullet(s) for consistency throughout policy.

15. Section 5.13.2, change bullet(s) for consistency throughout policy.

16. Appendix A, change “FNU” to “UCN” in definition of Criminal Justice Information.

17. Appendix A, move “W” definitions to correct location alphabetically.

18. Appendix B, add acronym “UCN.”

19. Appendix F, update contact information on form.

20. Appendix G.2, change word “securities” to “security.”

21. Appendix I, remove reference for DOJ Order 0904.

22. Appendix J, remove reference to DOJ Order 0904.

KEY TO APB APPROVED CHANGES (e.g. “Fall 2013, APB11, SA6, Future CSP for Mobile

Devices”):

Fall 2013 – Advisory Policy Board cycle and year

APB## – Advisory Policy Board Topic number

SA# – Security and Access Subcommittee Topic number

Topic Title v

TABLE OF CONTENTS

Executive Summary ....................................................................................................................... i

Change Management .................................................................................................................... ii

Summary of Changes ................................................................................................................... iii

Table of Contents ...........................................................................................................................v

List of Figures .................................................................................................................................x

1 Introduction

1.1 Purpose

1.2 Scope

1.3 Relationship to Local Security Policy and Other Policies

1.4 Terminology Used in This Document

1.5 Distribution of the CJIS Security Policy

2 CJIS Security Policy Approach

2.1 CJIS Security Policy Vision Statement

2.2 Architecture Independent

2.3 Risk Versus Realism

3 Roles and Responsibilities

3.1 Shared Management Philosophy

3.2 Roles and Responsibilities for Agencies and Parties

3.2.1 CJIS Systems Agencies (CSA)

3.2.2 CJIS Systems Officer (CSO)

3.2.3 Terminal Agency Coordinator (TAC)

3.2.4 Criminal Justice Agency (CJA)

3.2.5 Noncriminal Justice Agency (NCJA)

3.2.6 Contracting Government Agency (CGA)

3.2.7 Agency Coordinator (AC)

3.2.8 CJIS Systems Agency Information Security Officer (CSA ISO)

3.2.9 Local Agency Security Officer (LASO)

3.2.10 FBI CJIS Division Information Security Officer (FBI CJIS ISO)

3.2.11 Repository Manager

3.2.12 Compact Officer

4 Criminal Justice Information and Personally Identifiable Information

4.1 Criminal Justice Information (CJI)

4.1.1 Criminal History Record Information (CHRI)

4.2 Access, Use and Dissemination of Criminal History Record Information (CHRI), NCIC

Restricted Files Information, and NCIC Non-Restricted Files Information

4.2.1 Proper Access, Use, and Dissemination of CHRI

4.2.2 Proper Access, Use, and Dissemination of NCIC Restricted Files Information

4.2.3 Proper Access, Use, and Dissemination of NCIC Non-Restricted Files

Information

4.2.3.1 For Official Purposes

4.2.3.2 For Other Authorized Purposes

4.2.3.3 CSO Authority in Other Circumstances

4.2.4 Storage

4.2.5 Justification and Penalties

vi

4.2.5.1 Justification

4.2.5.2 Penalties

4.3 Personally Identifiable Information (PII)

5 Policy and Implementation

Policy Area 1: Information Exchange Agreements

5.1.1 Information Exchange

5.1.1.1 Information Handling

5.1.1.2 State and Federal Agency User Agreements

5.1.1.3 Criminal Justice Agency User Agreements

5.1.1.4 Interagency and Management Control Agreements

5.1.1.5 Private Contractor User Agreements and CJIS Security Addendum

5.1.1.6 Agency User Agreements

5.1.1.7 Outsourcing Standards for Channelers

5.1.1.8 Outsourcing Standards for Non-Channelers

5.1.2 Monitoring, Review, and Delivery of Services

5.1.2.1 Managing Changes to Service Providers

5.1.3 Secondary Dissemination

5.1.4 Secondary Dissemination of Non-CHRI CJI

5.2 Policy Area 2: Security Awareness Training

5.2.1 Awareness Topics

5.2.1.1 Level One Security Awareness Training

5.2.1.2 Level Two Security Awareness Training

5.2.1.3 Level Three Security Awareness Training

5.2.1.4 Level Four Security Awareness Training

5.2.2 Security Training Records

5.3 Policy Area 3: Incident Response

5.3.1 Reporting Security Events

5.3.1.1 Reporting Structure and Responsibilities

5.3.1.1.1 FBI CJIS Division Responsibilities

5.3.1.1.2 CSA ISO Responsibilities

5.3.2 Management of Security Incidents

5.3.2.1 Incident Handling

5.3.2.2 Collection of Evidence

5.3.3 Incident Response Training

5.3.4 Incident Monitoring

5.4 Policy Area 4: Auditing and Accountability

5.4.1 Auditable Events and Content (Information Systems)

5.4.1.1 Events

5.4.1.1.1 Content

5.4.2 Response to Audit Processing Failures

5.4.3 Audit Monitoring, Analysis, and Reporting

5.4.4 Time Stamps

5.4.5 Protection of Audit Information

5.4.6 Audit Record Retention

5.4.7 Logging NCIC and III Transactions

5.5 Policy Area 5: Access Control

vii

5.5.1 Account Management

5.5.2 Access Enforcement

5.5.2.1 Least Privilege

5.5.2.2 System Access Control

5.5.2.3 Access Control Criteria

5.5.2.4 Access Control Mechanisms

5.5.3 Unsuccessful Login Attempts

5.5.4 System Use Notification

5.5.5 Session Lock

5.5.6 Remote Access

5.5.6.1 Personally Owned Information Systems

5.5.6.2 Publicly Accessible Computers

5.6 Policy Area 6: Identification and Authentication

5.6.1 Identification Policy and Procedures

5.6.1.1 Use of Originating Agency Identifiers in Transactions and Information

Exchanges

5.6.2 Authentication Policy and Procedures

5.6.2.1 Standard Authenticators

5.6.2.1.1 Password

5.6.2.1.2 Personal Identification Number (PIN)

5.6.2.1.3 One-time Passwords (OTP)

5.6.2.2 Advanced Authentication

5.6.2.2.1 Advanced Authentication Policy and Rationale

5.6.2.2.2 Advanced Authentication Decision Tree

5.6.3 Identifier and Authenticator Management

5.6.3.1 Identifier Management

5.6.3.2 Authenticator Management

5.6.4 Assertions

5.7 Policy Area 7: Configuration Management

5.7.1 Access Restrictions for Changes

5.7.1.1 Least Functionality

5.7.1.2 Network Diagram

5.7.2 Security of Configuration Documentation

5.8 Policy Area 8: Media Protection

5.8.1 Media Storage and Access

5.8.2 Media Transport

5.8.2.1 Digital Media during Transport

5.8.2.2 Physical Media in Transit

5.8.3 Digital Media Sanitization and Disposal

5.8.4 Disposal of Physical Media

5.9 Policy Area 9: Physical Protection

5.9.1 Physically Secure Location

5.9.1.1 Security Perimeter

5.9.1.2 Physical Access Authorizations

5.9.1.3 Physical Access Control

5.9.1.4 Access Control for Transmission Medium

viii

5.9.1.5 Access Control for Display Medium

5.9.1.6 Monitoring Physical Access

5.9.1.7 Visitor Control

5.9.1.8 Delivery and Removal

5.9.2 Controlled Area

5.10 Policy Area 10: System and Communications Protection and Information Integrity

5.10.1 Information Flow Enforcement

5.10.1.1 Boundary Protection

5.10.1.2 Encryption

5.10.1.2.1 Encryption for CJI in Transit

5.10.1.2.2 Encryption for CJI at Rest

5.10.1.2.3 Public Key Infrastructure (PKI) Technology

5.10.1.3 Intrusion Detection Tools and Techniques

5.10.1.4 Voice over Internet Protocol

5.10.1.5 Cloud Computing

5.10.2 Facsimile Transmission of CJI

5.10.3 Partitioning and Virtualization

5.10.3.1 Partitioning

5.10.3.2 Virtualization

5.10.4 System and Information Integrity Policy and Procedures

5.10.4.1 Patch Management

5.10.4.2 Malicious Code Protection

5.10.4.3 Spam and Spyware Protection

5.10.4.4 Security Alerts and Advisories

5.10.4.5 Information Input Restrictions

5.11 Policy Area 11: Formal Audits

5.11.1 Audits by the FBI CJIS Division

5.11.1.1 Triennial Compliance Audits by the FBI CJIS Division

5.11.1.2 Triennial Security Audits by the FBI CJIS Division

5.11.2 Audits by the CSA

5.11.3 Special Security Inquiries and Audits

5.11.4 Compliance Subcommittees

5.12 Policy Area 12: Personnel Security

5.12.1 Personnel Screening Requirements for Individuals Requiring Unescorted Access to

Unencrypted CJI

5.12.2 Personnel Termination

5.12.3 Personnel Transfer

5.12.4 Personnel Sanctions

5.13 Policy Area 13: Mobile Devices

5.13.1 Wireless Communications Technologies

5.13.1.1 802.11 Wireless Protocols

5.13.1.2 Cellular Devices

5.13.1.2.1 Cellular Service Abroad

5.13.1.2.2 Voice Transmissions Over Cellular Devices

5.13.1.3 Bluetooth

5.13.1.4 Mobile Hotspots

ix

5.13.2 Mobile Device Management (MDM)

5.13.3 Wireless Device Risk Mitigations

5.13.4 System Integrity

5.13.4.1 Patching/Updates

5.13.4.2 Malicious Code Protection

5.13.4.3 Personal Firewall

5.13.5 Incident Response

5.13.6 Access Control

5.13.7 Identification and Authentication

5.13.7.1 Local Device Authentication

5.13.7.2 Advanced Authentication

5.13.7.2.1 Compensating Controls

5.13.7.3 Device Certificates

Appendices ................................................................................................................................. A-1

Appendix A Terms and Definitions ...................................................................................... A-1

Appendix B Acronyms ............................................................................................................B-1

Appendix C Network Topology Diagrams ........................................................................... C-1

Appendix D Sample Information Exchange Agreements ................................................... D-1

D.1 CJIS User Agreement ..................................................................................................... D-1

D.2 Management Control Agreement .................................................................................... D-9

D.3 Noncriminal Justice Agency Agreement & Memorandum of Understanding .............. D-10

D.4 Interagency Connection Agreement ............................................................................. D-16

Appendix E Security Forums and Organizational Entities .................................................E-1

Appendix F Sample Forms ..................................................................................................... F-1

F.1 Security Incident Response Form .................................................................................... F-2

Appendix G Best practices ..................................................................................................... G-1

G.1 Virtualization .................................................................................................................. G-1

G.2 Voice over Internet Protocol ........................................................................................... G-4

G.3 Cloud Computing .......................................................................................................... G-15

G.4 Mobile Appendix .......................................................................................................... G-32

G.5 Administrator Accounts for Least Privilege and Separation of Duties ......................... G-53

G.6 Encryption ..................................................................................................................... G-66

Appendix H Security Addendum .......................................................................................... H-1

Appendix I References ............................................................................................................ I-1

Appendix J Noncriminal Justice Agency Supplemental Guidance.................................... J-1

Appendix K Criminal Justice Agency Supplemental Guidance ........................................ K-1 x

LIST OF FIGURES

Figure 1 – Overview Diagram of Strategic Functions and Policy Components

Figure 2 – Dissemination of restricted and non-restricted NCIC data

Figure 3 – Information Exchange Agreements Implemented by a Local Police Department

Figure 4 – Security Awareness Training Use Cases

Figure 5 – Incident Response Process Initiated by an Incident in a Local Police Department

Figure 6 – Local Police Department's Use of Audit Logs

Figure 7 – A Local Police Department’s Access Controls

Figure 8 – Advanced Authentication Use Cases

Figure 9 – Authentication Decision for Known Location

Figure 10 – Authentication Decision for Unknown Location

Figure 11 – A Local Police Department’s Configuration Management Controls

Figure 12 – A Local Police Department’s Media Management Policies

Figure 13 – A Local Police Department's Physical Protection Measures

Figure 14 – System and Communications Protection and Information Integrity Use Cases

Figure 15 – The Audit of a Local Police Department

Figure 16 – A Local Police Department's Personnel Security Controls

1 INTRODUCTION

This section details the purpose of this document, its scope, relationship to other information security policies, and its distribution constraints.

1.1 Purpose

The CJIS Security Policy provides Criminal Justice Agencies (CJA) and Noncriminal Justice

Agencies (NCJA) with a minimum set of security requirements for access to Federal Bureau of

Investigation (FBI) Criminal Justice Information Services (CJIS) Division systems and information and to protect and safeguard Criminal Justice Information (CJI). This minimum standard of security requirements ensures continuity of information protection. The essential premise of the CJIS Security Policy is to provide the appropriate controls to protect CJI, from creation through dissemination; whether at rest or in transit.

The CJIS Security Policy integrates presidential directives, federal laws, FBI directives, the criminal justice community’s Advisory Policy Board (APB) decisions along with nationally recognized guidance from the National Institute of Standards and Technology (NIST) and the

National Crime Prevention and Privacy Compact Council (Compact Council).

1.2 Scope

At the consent of the advisory process, and taking into consideration federal law and state statutes, the CJIS Security Policy applies to all entities with access to, or who operate in support of, FBI

CJIS Division’s services and information. The CJIS Security Policy provides minimum security requirements associated with the creation, viewing, modification, transmission, dissemination, storage, or destruction of CJI.

Entities engaged in the interstate exchange of CJI data for noncriminal justice purposes are also governed by the standards and rules promulgated by the Compact Council.

1.3 Relationship to Local Security Policy and Other Policies

The CJIS Security Policy may be used as the sole security policy for the agency. The local agency may complement the CJIS Security Policy with a local policy, or the agency may develop their own stand-alone security policy; however, the CJIS Security Policy shall always be the minimum standard and local policy may augment, or increase the standards, but shall not detract from the

CJIS Security Policy standards.

The agency shall develop, disseminate, and maintain formal, documented procedures to facilitate the implementation of the CJIS Security Policy and, where applicable, the local security policy.

The policies and procedures shall be consistent with applicable laws, executive orders, directives, policies, regulations, standards, and guidance. Procedures developed for CJIS Security Policy areas can be developed for the security program in general, and for a particular information system, when required.

This document is a compendium of applicable policies in providing guidance on the minimum security controls and requirements needed to access FBI CJIS information and services. These policies include presidential directives, federal laws, FBI directives and the criminal justice community’s APB decisions. State, local, and Tribal CJA may implement more stringent policies and requirements. Appendix I contains the references while Appendix E lists the security forums and organizational entities referenced in this document.

1.4 Terminology Used in This Document

The following terms are used interchangeably throughout this document:

Agency and Organization: The two terms in this document refer to any entity that submits or receives information, by any means, to/from FBI CJIS systems or services.

Information and Data: Both terms refer to CJI.

System, Information System, Service, or named applications like NCIC: all refer to connections to the FBI’s criminal justice information repositories and the equipment used to establish said connections.

References/Citations/Directives: Appendix I contains all of the references used in this

Policy and may contain additional sources that could apply to any section.

Appendix A and B provide an extensive list of the terms and acronyms.

1.5 Distribution of the CJIS Security Policy

The CJIS Security Policy, version 5.0 and later, is a publically available document and may be posted and shared without restrictions.

2 CJIS SECURITY POLICY APPROACH

The CJIS Security Policy represents the shared responsibility between FBI CJIS, CJIS Systems

Agency (CSA), and the State Identification Bureaus (SIB) of the lawful use and appropriate protection of CJI. The Policy provides a baseline of security requirements for current and planned services and sets a minimum standard for new initiatives.

2.1 CJIS Security Policy Vision Statement

The executive summary of this document describes the vision in terms of business needs for confidentiality, integrity, and availability of information. The APB collaborates with the FBI CJIS

Division to ensure that the Policy remains updated to meet evolving business, technology and security needs.

2.2 Architecture Independent

Due to advancing technology and evolving business models, the FBI CJIS Division is transitioning from legacy stovepipe systems and moving toward a flexible services approach. Systems such as

National Crime Information Center (NCIC), National Instant Criminal Background Check System

(NICS), and Next Generation Identification (NGI) will continue to evolve and may no longer retain their current system platforms, hardware, or program name. However, the data and services provided by these systems will remain stable.

The CJIS Security Policy looks at the data (information), services, and protection controls that apply regardless of the implementation architecture. Architectural independence is not intended to lessen the importance of systems, but provide for the replacement of one technology with another while ensuring the controls required to protect the information remain constant. This objective and conceptual focus on security policy areas provide the guidance and standards while avoiding the impact of the constantly changing landscape of technical innovations. The architectural independence of the Policy provides agencies with the flexibility for tuning their information security infrastructure and policies to reflect their own environments.

2.3 Risk Versus Realism

Every “shall” statement contained within the CJIS Security Policy has been scrutinized for risk versus the reality of resource constraints and real-world application. The purpose of the CJIS

Security Policy is to establish the minimum security requirements; therefore, individual agencies are encouraged to implement additional controls to address agency specific risks. Each agency faces risk unique to that agency. It is quite possible that several agencies could encounter the same type of risk however depending on resources would mitigate that risk differently. In that light, a risk-based approach can be used when implementing requirements.

3 ROLES AND RESPONSIBILITIES

3.1 Shared Management Philosophy

In the scope of information security, the FBI CJIS Division employs a shared management philosophy with federal, state, local, and tribal law enforcement agencies. Although an advisory policy board for the NCIC has existed since 1969, the Director of the FBI established the CJIS

APB in March 1994 to enable appropriate input and recommend policy with respect to CJIS services. Through the APB and its Subcommittees and Working Groups, consideration is given to the needs of the criminal justice and law enforcement community regarding public policy, statutory and privacy aspects, as well as national security relative to CJIS systems and information.

The APB represents federal, state, local, and tribal law enforcement and criminal justice agencies throughout the United States, its territories, and Canada.

The FBI has a similar relationship with the Compact Council, which governs the interstate exchange of criminal history records for noncriminal justice purposes. The Compact Council is mandated by federal law to promulgate rules and procedures for the use of the Interstate

Identification Index (III) for noncriminal justice purposes. To meet that responsibility, the

Compact Council depends on the CJIS Security Policy as the definitive source for standards defining the security and privacy of records exchanged with noncriminal justice practitioners.

3.2 Roles and Responsibilities for Agencies and Parties

It is the responsibility of all agencies covered under this Policy to ensure the protection of CJI between the FBI CJIS Division and its user community. The following figure provides an abstract representation of the strategic functions and roles such as governance and operations.

Figure 1 – Overview Diagram of Strategic Functions and Policy Components

Governance Operations Policy Structure/Design

Security Policy and

Implementation Standards

Laws and Directives

Security Standards: National

Institute of Standards and

Technology, International

Standards Organization, Institute of Electrical and

Electronics Engineers

CJIS Systems Officers

FBI CJIS Information

Security Officer

CJIS Advisory Policy

Board

CJIS Working Groups

FBI Director

CJIS Subcommittees Local Agency Security

Officers

CSA Information

Security Officers

CJIS Systems Agencies

Repository Managers

Compact Officers

Terminal Agency

Coordinators

This section provides a description of the following entities and roles:

1. CJIS Systems Agency.

2. CJIS Systems Officer.

3. Terminal Agency Coordinator.

4. Criminal Justice Agency.

5. Noncriminal Justice Agency.

6. Contracting Government Agency.

7. Agency Coordinator.

8. CJIS Systems Agency Information Security Officer.

9. Local Agency Security Officer.

10. FBI CJIS Division Information Security Officer.

11. Repository Manager.

12. Compact Officer.

3.2.1 CJIS Systems Agencies (CSA)

The CSA is responsible for establishing and administering an information technology security program throughout the CSA’s user community, to include the local levels. The head of each CSA shall appoint a CJIS Systems Officer (CSO). The CSA may impose more stringent protection measures than outlined in this document. Such decisions shall be documented and kept current.

3.2.2 CJIS Systems Officer (CSO)

The CSO is an individual located within the CSA responsible for the administration of the CJIS network for the CSA. Pursuant to the Bylaws for the CJIS Advisory Policy Board and Working

Groups, the role of CSO shall not be outsourced. The CSO may delegate responsibilities to subordinate agencies. The CSO shall set, maintain, and enforce the following:

1. Standards for the selection, supervision, and separation of personnel who have access to

CJI.

2. Policy governing the operation of computers, access devices, circuits, hubs, routers, firewalls, and other components that comprise and support a telecommunications network and related CJIS systems used to process, store, or transmit CJI, guaranteeing the priority, confidentiality, integrity, and availability of service needed by the criminal justice community.

a. Ensure appropriate use, enforce system discipline, and ensure CJIS Division operating procedures are followed by all users of the respective services and information.

b. Ensure state/federal agency compliance with policies approved by the APB and adopted by the FBI.

c. Ensure the appointment of the CSA ISO and determine the extent of authority to the CSA ISO.

d. The CSO, or designee, shall ensure that a Terminal Agency Coordinator (TAC) is designated within each agency that has devices accessing CJIS systems.

e. Ensure each agency having access to CJI has someone designated as the Local

Agency Security Officer (LASO).

f. Approve access to FBI CJIS systems.

g. Assume ultimate responsibility for managing the security of CJIS systems within their state and/or agency.

h. Perform other related duties outlined by the user agreements with the FBI CJIS

Division.

3. Outsourcing of Criminal Justice Functions

a. Responsibility for the management of the approved security requirements shall remain with the CJA. Security control includes the authority to enforce the standards for the selection, supervision, and separation of personnel who have access to CJI; set and enforce policy governing the operation of computers, circuits, and telecommunications terminals used to process, store, or transmit CJI; and to guarantee the priority service needed by the criminal justice community.

b. Responsibility for the management control of network security shall remain with the CJA. Management control of network security includes the authority to enforce the standards for the selection, supervision, and separation of personnel who have access to CJI; set and enforce policy governing the operation of circuits and network equipment used to transmit CJI; and to guarantee the priority service as determined by the criminal justice community.

3.2.3 Terminal Agency Coordinator (TAC)

The TAC serves as the point-of-contact at the local agency for matters relating to CJIS information access. The TAC administers CJIS systems programs within the local agency and oversees the agency’s compliance with CJIS systems policies.

3.2.4 Criminal Justice Agency (CJA)

A CJA is defined as a court, a governmental agency, or any subunit of a governmental agency which performs the administration of criminal justice pursuant to a statute or executive order and which allocates a substantial part of its annual budget to the administration of criminal justice.

State and federal Inspectors General Offices are included.

3.2.5 Noncriminal Justice Agency (NCJA)

A NCJA is defined (for the purposes of access to CJI) as an entity or any subunit thereof that provides services primarily for purposes other than the administration of criminal justice.

3.2.6 Contracting Government Agency (CGA)

A CGA is a government agency, whether a CJA or a NCJA, that enters into an agreement with a private contractor subject to the CJIS Security Addendum. The CGA entering into an agreement with a contractor shall appoint an agency coordinator.

3.2.7 Agency Coordinator (AC)

An AC is a staff member of the CGA who manages the agreement between the Contractor and agency. The AC shall be responsible for the supervision and integrity of the system, training and continuing education of employees and operators, scheduling of initial training and testing, and certification testing and all required reports by NCIC. The AC shall:

1. Understand the communications, records capabilities, and needs of the Contractor which is accessing federal and state records through or because of its relationship with the CGA.

2. Participate in related meetings and provide input and comments for system improvement.

3. Receive information from the CGA (e.g., system updates) and disseminate it to appropriate

Contractor employees.

4. Maintain and update manuals applicable to the effectuation of the agreement, and provide them to the Contractor.

5. Maintain up-to-date records of Contractor’s employees who access the system, including name, date of birth, social security number, date fingerprint card(s) submitted, date security clearance issued, and date initially trained, tested, certified or recertified (if applicable).

6. Train or ensure the training of Contractor personnel. If Contractor personnel access NCIC, schedule the operators for testing or a certification exam with the CSA staff, or AC staff with permission from the CSA staff. Schedule new operators for the certification exam within six (6) months of assignment. Schedule certified operators for biennial re-certification testing within thirty (30) days prior to the expiration of certification. Schedule operators for other mandated class.

7. The AC will not permit an untrained/untested or non-certified Contractor employee to access CJI or systems supporting CJI where access to CJI can be gained.

8. Where appropriate, ensure compliance by the Contractor with NCIC validation requirements.

9. Provide completed applicant fingerprint cards on each Contractor employee who accesses the system to the CGA (or, where appropriate, CSA) for criminal background investigation prior to such employee accessing the system.

10. Any other responsibility for the AC promulgated by the FBI.

3.2.8 CJIS Systems Agency Information Security Officer (CSA ISO)

The CSA ISO shall:

1. Serve as the security point of contact (POC) to the FBI CJIS Division ISO.

2. Document technical compliance with the CJIS Security Policy with the goal to assure the confidentiality, integrity, and availability of criminal justice information to the user community throughout the CSA’s user community, to include the local level.

3. Document and provide assistance for implementing the security-related controls for the

Interface Agency and its users.

4. Establish a security incident response and reporting procedure to discover, investigate, document, and report to the CSA, the affected criminal justice agency, and the FBI CJIS

Division ISO major incidents that significantly endanger the security or integrity of CJI.

3.2.9 Local Agency Security Officer (LASO)

Each LASO shall:

1. Identify who is using the CSA approved hardware, software, and firmware and ensure no unauthorized individuals or processes have access to the same.

2. Identify and document how the equipment is connected to the state system.

3. Ensure that personnel security screening procedures are being followed as stated in this

Policy.

4. Ensure the approved and appropriate security measures are in place and working as expected.

5. Support policy compliance and ensure the CSA ISO is promptly informed of security incidents.

3.2.10 FBI CJIS Division Information Security Officer (FBI CJIS ISO)

The FBI CJIS ISO shall:

1. Maintain the CJIS Security Policy.

2. Disseminate the FBI Director approved CJIS Security Policy.

3. Serve as a liaison with the CSA’s ISO and with other personnel across the CJIS community and in this regard provide technical guidance as to the intent and implementation of operational and technical policy issues.

4. Serve as a point-of-contact (POC) for computer incident notification and distribution of security alerts to the CSOs and ISOs.

5. Assist with developing audit compliance guidelines as well as identifying and reconciling security-related issues.

6. Develop and participate in information security training programs for the CSOs and ISOs, and provide a means by which to acquire feedback to measure the effectiveness and success of such training.

7. Maintain a security policy resource center (SPRC) on FBI.gov and keep the CSOs and

ISOs updated on pertinent information.

3.2.11 Repository Manager

The State Identification Bureau (SIB) Chief, i.e. Repository Manager or Chief Administrator, is the designated manager of the agency having oversight responsibility for a state’s fingerprint identification services. If both state fingerprint identification services and CJIS systems control are managed within the same state agency, the SIB Chief and CSO may be the same person.

3.2.12 Compact Officer

Pursuant to the National Crime Prevention and Privacy Compact, each party state shall appoint a

Compact Officer who shall ensure that Compact provisions and rules, procedures, and standards established by the Compact Council are complied with in their respective state.

4 CRIMINAL JUSTICE INFORMATION AND PERSONALLY

IDENTIFIABLE INFORMATION

4.1 Criminal Justice Information (CJI)

Criminal Justice Information is the term used to refer to all of the FBI CJIS provided data necessary for law enforcement and civil agencies to perform their missions including, but not limited to biometric, identity history, biographic, property, and case/incident history data. The following categories of CJI describe the various data sets housed by the FBI CJIS architecture:

1. Biometric Data—data derived from one or more intrinsic physical or behavioral traits of humans typically for the purpose of uniquely identifying individuals from within a population. Used to identify individuals, to include: fingerprints, palm prints, iris scans, and facial recognition data.

2. Identity History Data—textual data that corresponds with an individual’s biometric data, providing a history of criminal and/or civil events for the identified individual.

3. Biographic Data—information about individuals associated with a unique case, and not necessarily connected to identity data. Biographic data does not provide a history of an individual, only information related to a unique case.

4. Property Data—information about vehicles and property associated with crime when accompanied by any personally identifiable information (PII).

5. Case/Incident History—information about the history of criminal incidents.

The following type of data are exempt from the protection levels required for CJI: transaction control type numbers (e.g., ORI, NIC, UCN, etc.) when not accompanied by information that reveals CJI or PII.

The intent of the CJIS Security Policy is to ensure the protection of the aforementioned CJI until the information is: released to the public via authorized dissemination (e.g. within a court system;

presented in crime reports data; released in the interest of public safety); purged or destroyed in accordance with applicable record retention rules.

4.1.1 Criminal History Record Information (CHRI)

Criminal History Record Information (CHRI), sometimes informally referred to as “restricted data”, is a subset of CJI. Due to its comparatively sensitive nature, additional controls are required for the access, use and dissemination of CHRI. In addition to the dissemination restrictions outlined below, Title 28, Part 20, Code of Federal Regulations (CFR), defines CHRI and provides the regulatory guidance for dissemination of CHRI. While the CJIS Security Policy attempts to be architecturally independent, the III and the NCIC are specifically identified in Title 28, Part 20, CFR, and the NCIC Operating Manual, as associated with CHRI.

4.2 Access, Use and Dissemination of Criminal History Record

Information (CHRI), NCIC Restricted Files Information, and NCIC Non-Restricted Files Information

This section describes the requirements for the access, use and dissemination of CHRI, NCIC restricted files information, and NCIC non-restricted files information.

4.2.1 Proper Access, Use, and Dissemination of CHRI

Information obtained from the III is considered CHRI. Rules governing the access, use, and dissemination of CHRI are found in Title 28, Part 20, CFR. The III shall be accessed only for an authorized purpose. Further, CHRI shall only be used for an authorized purpose consistent with the purpose for which III was accessed. Dissemination to another agency is authorized if (a) the other agency is an Authorized Recipient of such information and is being serviced by the accessing agency, or (b) the other agency is performing personnel and appointment functions for criminal justice employment applicants.

4.2.2 Proper Access, Use, and Dissemination of NCIC Restricted Files Information

The NCIC hosts restricted files and non-restricted files. NCIC restricted files are distinguished from NCIC non-restricted files by the policies governing their access and use. Proper access to, use, and dissemination of data from restricted files shall be consistent with the access, use, and dissemination policies concerning the III described in Title 28, Part 20, CFR, and the NCIC

Operating Manual. The restricted files, which shall be protected as CHRI, are as follows:

1. Gang Files

2. Known or Appropriately Suspected Terrorist Files

3. Supervised Release Files

4. National Sex Offender Registry Files

5. Historical Protection Order Files of the NCIC

6. Identity Theft Files

7. Protective Interest Files

8. Person With Information (PWI) data in the Missing Person Files

9. Violent Person File

10. NICS Denied Transactions File

The remaining NCIC files are considered non-restricted files.

4.2.3 Proper Access, Use, and Dissemination of NCIC Non-Restricted Files Information

4.2.3.1 For Official Purposes

NCIC non-restricted files are those not listed as restricted files in Section 4.2.2. NCIC non-restricted files information may be accessed and used for any authorized purpose consistent with the inquiring agency’s responsibility. Information obtained may be disseminated to (a) other government agencies or (b) private entities authorized by law to receive such information for any purpose consistent with their responsibilities.

4.2.3.2 For Other Authorized Purposes

NCIC non-restricted files may be accessed for other purposes consistent with the resources of the inquiring agency; however, requests for bulk data are discouraged. Information derived from

NCIC non-restricted files for other than law enforcement purposes can be used by authorized criminal justice personnel only to confirm the status of a person or property (i.e., wanted or stolen).

An inquiring agency is authorized to charge a nominal administrative fee for such service. Non-restricted files information shall not be disseminated commercially.

A response to a NCIC person inquiry may include NCIC restricted files information as well as

NCIC non-restricted files information. Agencies shall not disseminate restricted files information for purposes other than law enforcement.

4.2.3.3 CSO Authority in Other Circumstances

If no federal, state or local law or policy prohibition exists, the CSO may exercise discretion to approve or deny dissemination of NCIC non-restricted file information.

4.2.4 Storage

When CHRI is stored, agencies shall establish appropriate administrative, technical and physical safeguards to ensure the security and confidentiality of the information. These records shall be stored for extended periods only when they are key elements for the integrity and/or utility of case files and/or criminal record files. See Section 5.9 for physical security controls.

4.2.5 Justification and Penalties

4.2.5.1 Justification

In addition to the use of purpose codes and logging information, all users shall provide a reason for all III inquiries whenever requested by NCIC System Managers, CSAs, local agency administrators, or their representatives.

4.2.5.2 Penalties

Improper access, use or dissemination of CHRI and NCIC Non-Restricted Files information is serious and may result in administrative sanctions including, but not limited to, termination of services and state and federal criminal penalties.

4.3 Personally Identifiable Information (PII)

For the purposes of this document, PII is information which can be used to distinguish or trace an individual’s identity, such as name, social security number, or biometric records, alone or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. Any FBI CJIS provided data maintained by an agency, including but not limited to, education, financial transactions, medical history, and criminal or employment history may include PII. A criminal history record for example inherently contains PII as would a Law Enforcement National Data Exchange (N-DEx) case file.

PII shall be extracted from CJI for the purpose of official business only. Agencies shall develop policies, based on state and local privacy rules, to ensure appropriate controls are applied when handling PII extracted from CJI. Due to the expansive nature of PII, this Policy does not specify auditing, logging, or personnel security requirements associated with the life cycle of PII.

Figure 2 – Dissemination of restricted and non-restricted NCIC data

A citizen of Springfield went to the Springfield Police Department to request whether his new neighbor, who had been acting suspiciously, had an outstanding warrant. The Springfield Police

Department ran an NCIC persons inquiry, which produced a response that included a Wanted

Person File (non-restricted file) record and a Known or Appropriately Suspected Terrorist File

(restricted file) record. The Springfield Police Department advised the citizen of the outstanding warrant, but did not disclose any information concerning the subject being a known or appropriately suspected terrorist.

5 POLICY AND IMPLEMENTATION

The policy areas focus upon the data and services that the FBI CJIS Division exchanges and provides to the criminal justice community and its partners. Each policy area provides both strategic reasoning and tactical implementation requirements and standards.

While the major theme of the policy areas is concerned with electronic exchange directly with the

FBI, it is understood that further dissemination of CJI to Authorized Recipients by various means

(hard copy, e-mail, web posting, etc.) constitutes a significant portion of CJI exchanges.

Regardless of its form, use, or method of dissemination, CJI requires protection throughout its life.

Not every consumer of FBI CJIS services will encounter all of the policy areas therefore the circumstances of applicability are based on individual agency/entity configurations and usage. Use cases within each of the policy areas will help users relate the Policy to their own agency circumstances. The policy areas are:

Policy Area 1—Information Exchange Agreements

Policy Area 2—Security Awareness Training

Policy Area 3—Incident Response

Policy Area 4—Auditing and Accountability

Policy Area 5—Access Control

Policy Area 6—Identification and Authentication

Policy Area 7—Configuration Management

Policy Area 8—Media Protection

Policy Area 9—Physical Protection

Policy Area 10—Systems and Communications Protection and Information Integrity

Policy Area 11—Formal Audits

Policy Area 12—Personnel Security

Policy Area 13—Mobile Devices

Policy Area 1: Information Exchange Agreements

The information shared through communication mediums shall be protected with appropriate security safeguards. The agreements established by entities sharing information across systems and communications mediums are vital to ensuring all parties fully understand and agree to a set of security standards.

5.1.1 Information Exchange

Before exchanging CJI, agencies shall put formal agreements in place that specify security controls. The exchange of information may take several forms including electronic mail, instant messages, web services, facsimile, hard copy, and information systems sending,…