Attachment C CJIS MOU Template 9.19.2025.docx

MEMORANDUM OF UNDERSTANDING

ACCESS TO FBI CRIMINAL JUSTICE INFORMATION

PROVIDED BY THE DEPARTMENT OF CRIMINAL JUSTICE INFORMATION SERVICES TO XXXXXXXXXXXXXXXXXXXXXXX ON BEHALF OF THE EXECUTIVE OFFICE OF TECHNOLOGY SERVICES AND SECURITY

This Memorandum of Understanding (“Agreement”) is made by and entered into by and between the Department of Criminal Justice Information Services (“DCJIS”), the Executive Office of Technology Services and Security (“EOTSS”) and EOTSS’s contractor, XXXXXXXXXX (the “Contractor”), to memorialize the terms and conditions under which the DCJIS will provide access to the criminal justice information (CJI) to EOTSS and the Contractor subject to a provisions provided in this Agreement.

WHEREAS, the DCJIS serves as the Criminal Justice Information System (CJIS) Systems Agency (“CSA”) in the Commonwealth on behalf of the Federal Bureau of Investigation (“FBI”) and, in this role, is authorized to grant and monitor access to CJI in accordance with applicable laws, regulations, and the FBI CJIS Security Policy;

WHEREAS, EOTSS and the DCJIS entered into a Management Control Agreement which establishes the rights and responsibilities of EOTSS and the DCJIS with respect to EOTSS’s access to CJI for such purpose;

WHEREAS, pursuant to a contract between EOTSS and Contractor, Contractor will XXXXXXXXXXXXXXXXXX to EOTSS;

WHEREAS, in performing such services, the Contractor requires access to CJI;

WHEREAS, the DCJIS has agreed to provide the Contractor with access to CJI for such purpose, subject to the terms and conditions set forth in this MOU; and

WHEREAS, the DCJIS, EOTSS and the Contractor are entering into this MOU to establish their respective rights and responsibilities with respect to the Contractor’s access to, and use of, CJI.

NOW, THEREFORE, in consideration of the mutual covenants and agreements contained herein, the DCJIS, EOTSS and the Contractor (each a “Party” and, collectively, the “Parties”) agree as follows:

Section 1. DEFINITIONS

The following terms or their abbreviations, when capitalized in this Memorandum of Understanding, are defined as follows, unless the context clearly indicates otherwise:

Criminal Justice Information (“CJI”)- As referenced in this agreement CJI includes any data furnished by DCJIS to said state agency and may include any of the following types of information: Criminal Offender Record Information (CORI), Federal Bureau of Investigation Criminal History Record Information (CHRI), Registry of Motor Vehicle (RMV) data, Warrant Management System (WMS) data, and/or any other information furnished to said state agency by DCJIS for the purposes authorized in the applicable laws and regulations.

CJIS Security Addendum – the CJIS Security Addendum included in Appendix H to the FBI CJIS Security Policy.

FBI CJIS Security Policy – the Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Security Policy that is in effect as of the effective date of this Agreement and any successor versions brought into effect by the FBI during the term of this Agreement.

Security Incident – a breach involving CJI data, including, but not limited to, the following:

(a) unlawful or unauthorized access to, and/or dissemination of, any such Data on the Contractor or equipment or in the Contractor or EOTSS’s facilities, resulting in access (other than a good faith but unauthorized acquisition of such Data by a person or agency, or employee or agent thereof, for the lawful purposes of such person or agency that is not otherwise used in an unauthorized manner or subject to further unauthorized disclosure), loss, disclosure, or alteration of said Data; or

(b) unlawful or unauthorized access to such facilities or equipment, resulting in access to (other than a good faith but unauthorized acquisition of such Data by a person or agency, or employee or agent thereof, for the lawful purposes of such person or agency that is not otherwise used in an unauthorized manner or subject to further unauthorized disclosure), loss, disclosure, or alteration of, said Data.

Section 2. DCJIS RESPONSIBILITIES

1. The DCJIS agrees to provide the Contractor, on behalf of EOTSS, CJI for the purpose authorized in M.G.L. c. 7D subject to the terms provided in this Agreement.

Section 3. EOTSS & CONTRACTOR RESPONSIBILITIES

A. Privacy Obligations

1. EOTSS and the Contractor agree to abide by all applicable laws, regulations, policies, and procedures regulating the collection, storage, and dissemination of CJI with respect to the data accessed and used to perform the Activities hereunder. Applicable laws and policies may include, but are not limited to, M.G.L. c.6, §§167-178B; 803 CMR 2.00 et. seq; 28 C.F.R. 20 et seq.; and the FBI CJIS Security Policy. Accordingly, the Contractor also agrees to complete the CJIS Security Addendum (Attachment A).

2. EOTSS and Contractor agree that their access to, and use of, the Data constitutes their status as "Holder'' of Personal Data, as such terms are used within M.G.L. c.66A. EOTSS and Contractor agree that they shall comply with M.G.L. c.66A and M.G.L. c. 93H and any other applicable laws, rules, and policies governing use, disclosure, and maintenance of any Data under this Agreement.

3. EOTSS and the Contractor agree to only access the Data and use it for its intended purpose as provided in this Agreement.

4. Neither EOTSS nor the Contractor shall provide access to, or assign the duties provided under this Agreement to, a third party without the express written consent of the DCJIS. Any sub-contractors or agents provided access to the Data under this Agreement shall be approved by the DCJIS and are subject to the background check, training, and non-disclosure requirements set forth in paragraph 5 of this section.

5. Any employee, contractor, sub-contractor, or agent of EOTSS or the Contractor who has access to any unencrypted CJI shall complete an FBI fingerprint based criminal background check, CJIS Security Awareness online training once a year, the CJIS Security Addendum and complete an individual agreement of non-disclosure whereby said individuals agree to comply with the laws and regulations relating to access to, and dissemination of, CJI. Once the criminal background check, training, and signed agreements are successfully completed, employees will be “authorized” to access the Data. The employee training and completion of said agreements shall be coordinated by the Contractor through EOTSS.

B. Security Obligations

1. The Data shall be secured when not being viewed or used. CJI that is electronically stored shall be secured in accordance with the FBI CJIS Security Policy. If Contractor should maintain paper copies of CHRI, such copies shall be stored in a locked file cabinet or other suitable, locked storage container.

2. Contractor agrees to notify the DCJIS Information Security Officer, in writing, of any Security Incident pertaining to CJI within forty-eight (48) hours of becoming aware of the Security Incident.

3. All CJI may only be accessed and stored with the continental United States in compliance with the FBI CJIS Security Policy.

C. Audit

1. As a recipient and/or holder of CJI, EOTSS and the Contractor are subject to compliance audits by the DCJIS and by the FBI. Upon request, EOTSS and the Contractor shall make their internal practices, books, and records (including policies and procedures relating to the use and disclosure of the Data) related to the performance of the Activities contemplated by this Agreement available to DCJIS and/or FBI auditors.

Section 4. TERM & TERMINATION

A. General

1. This Agreement shall be effective on the date that it has first been executed by each Party’s authorized signatory and shall remain in effect until such time as it is terminated by any Party or by operation of law when the purpose for which the agreement was executed ceases to exist. Written notice of any termination of this agreement will be sent to the business address of the undersigned Parties.

B. Violation of Law

1. The DCJIS may suspend or terminate the furnishing of any information provided for in this Agreement pending an investigation into whether EOTSS and/or the Contractor violated state or federal law, rule, policy, or procedure regulating the collection, storage, and dissemination of the Data. The DCJIS may reinstate privileges when violations are resolved to the satisfaction of the DCJIS.

Section 5. AMENDMENT

1. This Agreement may be amended by the Parties at any time; provided, that any amendment must be in writing and must be signed by each Party.

Section 6. CONTACTS

1. Notices and other communications to a Party as to any matter hereunder will be sufficient if given in writing and sent by certified mail (return receipt requested), postage prepaid, by e-mail, or delivered in hand with acknowledgement of receipt to the Party’s contact person(s) identified below.

DCJIS:

Jamison R. Gagnon Commissioner MA Department of Criminal Justice Information Services 200 Arlington Street, Suite 2200 Chelsea, MA 02150 Jamison.r.gagnon@mass.gov

EOTSS:

CONTRACTOR:

Section 7. MISCELLANEOUS TERMS

1. If any provision of this Agreement is unenforceable, invalid, or violates applicable law, such provision shall be deemed stricken and shall not affect the enforceability of any other provisions of this Agreement.

2. This Agreement may be executed in two (2) or more counterparts, each of which is an original, and all of which together constitute only one agreement between the Parties. The signatures of the Parties do not need to be on the same counterpart for it to be effective.

Commissioner MA Department of Criminal Justice Information Services

ATTACHMENT A

FEDERAL BUREAU OF INVESTIGATION CRIMINAL JUSTICE INFORMATION SERVICES SECURITY ADDENDUM (V5.9.2)

The goal of this document is to augment the CJIS Security Policy to ensure adequate security is provided for criminal justice systems while (1) under the control or management of a private entity or (2) connectivity to FBI CJIS Systems has been provided to a private entity (contractor). Adequate security is defined in Office of Management and Budget Circular A-130 as “security commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information.”

The intent of this Security Addendum is to require that the Contractor maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed), as well as with policies and standards established by the Criminal Justice Information Services (CJIS) Advisory Policy Board (APB).

This Security Addendum identifies the duties and responsibilities with respect to the installation and maintenance of adequate internal controls within the contractual relationship so that the security and integrity of the FBI's information resources are not compromised. The security program shall include consideration of personnel security, site security, system security, and data security, and technical security.

The provisions of this Security Addendum apply to all personnel, systems, networks and support facilities supporting and/or acting on behalf of the government agency.

0. Definitions

0. Contracting Government Agency (CGA) - the government agency, whether a Criminal Justice Agency or a Noncriminal Justice Agency, which enters into an agreement with a private contractor subject to this Security Addendum.

0. Contractor - a private business, organization or individual which has entered into an agreement for the administration of criminal justice with a Criminal Justice Agency or a Noncriminal Justice Agency.

0. Responsibilities of the Contracting Government Agency.

0. The CGA will ensure that each Contractor employee receives a copy of the Security Addendum and the CJIS Security Policy and executes an acknowledgment of such receipt and the contents of the Security Addendum. The signed acknowledgments shall remain in the possession of the CGA and available for audit purposes. The acknowledgement may be signed by hand or via digital signature (see glossary for definition of digital signature).

0. Responsibilities of the Contractor.

0. The Contractor will maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed and all subsequent versions), as well as with policies and standards established by the Criminal Justice Information Services (CJIS) Advisory Policy Board (APB).

0. Security Violations.

0. The CGA must report security violations to the CJIS Systems Officer (CSO) and the Director, FBI, along with indications of actions taken by the CGA and Contractor.

0. Security violations can justify termination of the appended agreement.

0. Upon notification, the FBI reserves the right to:

3. Investigate or decline to investigate any report of unauthorized use;

3. Suspend or terminate access and services, including telecommunications links. The FBI will provide the CSO with timely written notice of the suspension. Access and services will be reinstated only after satisfactory assurances have been provided to the FBI by the CGA and Contractor. Upon termination, the Contractor's records containing CHRI must be deleted or returned to the CGA.

0. Audit

0. The FBI is authorized to perform a final audit of the Contractor's systems after termination of the Security Addendum.

0. Scope and Authority

0. This Security Addendum does not confer, grant, or authorize any rights, privileges, or obligations on any persons other than the Contractor, CGA, CJA (where applicable), CSA, and FBI.

0. The following documents are incorporated by reference and made part of this agreement: (1) the Security Addendum; (2) the NCIC 2000 Operating Manual; (3) the CJIS Security Policy; and (4) Title 28, Code of Federal Regulations, Part 20. The parties are also subject to applicable federal and state laws and regulations.

0. The terms set forth in this document do not constitute the sole understanding by and between the parties hereto; rather they augment the provisions of the CJIS Security Policy to provide a minimum basis for the security of the system and contained information and it is understood that there may be terms and conditions of the appended Agreement which impose more stringent requirements upon the Contractor.

0. This Security Addendum may only be modified by the FBI, and may not be modified by the parties to the appended Agreement without the consent of the FBI.

0. All notices and correspondence shall be forwarded by First Class mail to: Information Security Officer Criminal Justice Information Services Division FBI 1000 Custer Hollow Road Clarksburg, West Virginia 26306

FEDERAL BUREAU OF INVESTIGATION CRIMINAL JUSTICE INFORMATION SERVICES SECURITY ADDENDUM

CERTIFICATION

I hereby certify that I am familiar with the contents of (1) the Security Addendum, including its legal authority and purpose; (2) the NCIC Operating Manual; (3) the CJIS Security Policy; and (4) Title 28, Code of Federal Regulations, Part 20, and agree to be bound by their provisions.

I recognize that criminal history record information and related data, by its very nature, is sensitive and has potential for great harm if misused. I acknowledge that access to criminal history record information and related data is therefore limited to the purpose(s) for which a government agency has entered into the contract incorporating this Security Addendum. I understand that misuse of the system by, among other things: accessing it without authorization; accessing it by exceeding authorization; accessing it for an improper purpose; using, disseminating or re-disseminating information received as a result of this contract for a purpose other than that envisioned by the contract, may subject me to administrative and criminal penalties. I understand that accessing the system for an appropriate purpose and then using, disseminating or re- disseminating the information received for another purpose other than execution of the contract also constitutes misuse. I further understand that the occurrence of misuse does not depend upon whether or not I receive additional compensation for such authorized activity. Such exposure for misuse includes, but is not limited to, suspension or loss of employment and prosecution for state and federal crimes.

Printed Name/Signature of Contractor Employee Date

Printed Name/Signature of Contractor Representative Date

Organization and Title of Contractor Representative Date