CJIS_Security_Policy_v5-9-5.pdf

U. S. Department of Justice

Federal Bureau of Investigation

Criminal Justice Information Services Division

Criminal Justice Information Services (CJIS) Security Policy

Version 5.9.5 07/09/2024

Prepared by:

FBI CJIS Information Security Officer

Approved by:

CJIS Advisory Policy Board

CJISSECPOL v5.9.5 i

EXECUTIVE SUMMARY

Law enforcement needs timely and secure access to services that provide data wherever and whenever for stopping and reducing crime. In response to these needs, the Advisory Policy Board (APB) recommended to the Federal Bureau of Investigation (FBI) that the Criminal Justice Information Services (CJIS) Division authorize the expansion of the existing security management structure in 1998. Administered through a shared management philosophy, the CJIS Security Policy contains information security requirements, guidelines, and agreements reflecting the will of law enforcement and criminal justice agencies for protecting the sources, transmission, storage, and generation of Criminal Justice Information (CJI). The Federal Information Security Management Act of 2002 provides further legal basis for the APB approved management, operational, and technical security requirements mandated to protect CJI and by extension the hardware, software and infrastructure required to enable the services provided by the criminal justice community.

The essential premise of the CJIS Security Policy (CJISSECPOL) is to provide appropriate controls to protect the full lifecycle of CJI, whether at rest or in transit. The CJIS Security Policy provides guidance for the creation, viewing, modification, transmission, dissemination, storage, and destruction of CJI. This Policy applies to every individual—contractor, private entity, noncriminal justice agency representative, or member of a criminal justice entity—with access to, or who operate in support of, criminal justice services and information.

The CJIS Security Policy integrates presidential directives, federal laws, FBI directives and the criminal justice community’s APB decisions along with nationally recognized guidance from the National Institute of Standards and Technology. The Policy is presented at both strategic and tactical levels and is periodically updated to reflect the security requirements of evolving business models. The Policy features modular sections enabling more frequent updates to address emerging threats and new security measures. The provided security criteria assists agencies with designing and implementing systems to meet a uniform level of risk and security protection while enabling agencies the latitude to institute more stringent security requirements and controls based on their business model and local needs.

The CJIS Security Policy strengthens the partnership between the FBI and CJIS Systems Agencies (CSA), including, in those states with separate authorities, the State Identification Bureaus (SIB).

Further, as use of criminal history record information for noncriminal justice purposes continues to expand, the CJIS Security Policy becomes increasingly important in guiding the National Crime Prevention and Privacy Compact Council and State Compact Officers in the secure exchange of criminal justice records.

The Policy describes the vision and captures the security concepts that set the policies, protections, roles, and responsibilities with minimal impact from changes in technology. The Policy empowers CSAs with the insight and ability to tune their security programs according to their risks, needs, budgets, and resource constraints while remaining compliant with the baseline level of security set forth in this Policy. The CJIS Security Policy provides a secure framework of laws, standards, and elements of published and vetted policies for accomplishing the mission across the broad spectrum of the criminal justice and noncriminal justice communities.

ii

CHANGE MANAGEMENT

Revision Change Description Created/Changed by Date Approved By

5.0 Policy Rewrite Security Policy Working

Group 2/9/2011 See Signature

Page

5.1 Incorporate Calendar

Year 2011 changes CJIS ISO Program Office 7/13/2012 APB & Compact

Council

5.2 Incorporate Calendar

Year 2012 changes CJIS ISO Program Office 8/9/2013 APB & Compact

Council

5.3 Incorporate Calendar

Year 2013 changes CJIS ISO Program Office 8/4/2014 APB & Compact

Council

5.4 Incorporate Calendar

Year 2014 changes CJIS ISO Program Office 10/6/2015 APB & Compact

Council

5.5 Incorporate Calendar

Year 2015 changes CJIS ISO Program Office 6/1/2016 APB & Compact

Council

5.6 Incorporate Calendar

Year 2016 changes CJIS ISO Program Office 6/5/2017 APB & Compact

Council

5.7 Incorporate Calendar

Year 2017 changes CJIS ISO Program Office 8/16/2018 APB & Compact

Council

5.8 Incorporate Calendar

Year 2018 changes CJIS ISO Program Office 6/1/2019 APB & Compact

Council

5.9 Incorporate Calendar

Year 2019 changes CJIS ISO Program Office 6/1/2020 APB & Compact

Council

5.9.1 Incorporate Calendar

Year 2021 changes CJIS ISO Program Office 10/1/2022 APB & Compact

Council

5.9.2 Incorporate CJIS APB

Spring 2022 changes CJIS ISO Program Office 12/7/2022 APB & Compact

Council

5.9.3 Incorporate CJIS APB

Fall 2022 changes CJIS ISO Program Office 9/14/2023 APB & Compact

Council

5.9.4 Incorporate CJIS APB

Spring 2023 changes CJIS ISO Program Office 12/20/2023 APB & Compact

Council

5.9.5 Incorporate CJIS APB

Fall 2023 changes CJIS ISO Program Office 07/09/2024 APB & Compact

Council iii

SUMMARY OF CHANGES

Version 5.9.5 APB Approved Changes

1. Section 5.6 Identification and Authentication, IA-5(1)a Authenticator Management | Authenticator Types, Memorized Secret Authenticators and Verifiers, Fall 2023, APB#15, SA#1, Create a Sunset Date for “Basic Password Standards” in the CJISSECPOL: add a note to provide a sunset date for the “Basic Password Standards” in IA-5(1)(a)(5) and renumber the remaining controls.

2. Section 5 Policy and Implementation, Fall 2023, APB#15, SA#2, CJISSECPOL Security Control Priority and Implementation Deadlines.

Note: Refer to Section 1.4 Terminology Used in this Document for instructions on reading the priority and implementation control markings.

Note: There is a “List of Priorities” at the front of the document below the table of contents.

3. Section 5.7 Configuration Management, Fall 2023, APB#15, SA#3, Modernizing Configuration Management (CM) in the CJISSECPOL: modernize the CJIS Security Policy requirements for

Configuration Management Policy and Procedures Baseline Configuration Configuration Change Control Impact Analyses Access Restrictions for Change Configuration Settings Least Functionality System Component Inventory Configuration Management Plan Software Usage Restrictions User-Installed Software Information Location

Administrative Changes 0F0F0F

1. There are no Administrative Changes in this version.

Note: Administrative changes are vetted through the Security and Access Subcommittee and not the entire APB process.

KEY TO APB APPROVED CHANGES (e.g., “Section 5.13 Mobile Devices, Fall 2013, APB#11, SA#6, Future CSP for Mobile Devices: add language”):

Section Number and Name Fall 2013 – Advisory Policy Board cycle and year APB# – Advisory Policy Board Topic number iv

SA# – Security and Access Subcommittee Topic number Topic Paper Title Summary of change v

TABLE OF CONTENTS

Executive Summary ....................................................................................................................... i Change Management .................................................................................................................... ii Summary of Changes ................................................................................................................... iii Table of Contents ...........................................................................................................................v List of Figures ............................................................................................................................. xvi 1 Introduction

1.1 Purpose

1.2 Scope

1.3 Relationship to Local Security Policy and Other Policies

1.4 Terminology Used in This Document

1.5 Distribution of the CJIS Security Policy

2 CJIS Security Policy Approach

2.1 CJIS Security Policy Vision Statement

2.2 Architecture Independent

2.3 Risk Versus Realism

3 Roles and Responsibilities

3.1 Shared Management Philosophy

3.2 Roles and Responsibilities for Agencies and Parties

3.2.1 CJIS Systems Agencies (CSA)

3.2.2 CJIS Systems Officer (CSO)

3.2.3 Terminal Agency Coordinator (TAC)

3.2.4 Criminal Justice Agency (CJA)

3.2.5 Noncriminal Justice Agency (NCJA)

3.2.6 Contracting Government Agency (CGA)

3.2.7 Agency Coordinator (AC)

3.2.8 CJIS Systems Agency Information Security Officer (CSA ISO)

3.2.9 Local Agency Security Officer (LASO)

3.2.10 FBI CJIS Division Information Security Officer (FBI CJIS ISO)

3.2.11 Repository Manager

3.2.12 Compact Officer

4 Criminal Justice Information and Personally Identifiable Information

4.1 Criminal Justice Information (CJI)

4.1.1 Criminal History Record Information (CHRI)

4.2 Access, Use and Dissemination of Criminal History Record Information (CHRI), NCIC

Restricted Files Information, and NCIC Non-Restricted Files Information

4.2.1 Proper Access, Use, and Dissemination of CHRI

4.2.2 Proper Access, Use, and Dissemination of NCIC Restricted Files Information

4.2.3 Proper Access, Use, and Dissemination of NCIC Non-Restricted Files Information

4.2.3.1 For Official Purposes

4.2.3.2 For Other Authorized Purposes

4.2.3.3 CSO Authority in Other Circumstances

4.2.4 Storage

4.2.5 Justification and Penalties

vi

4.2.5.1 Justification

4.2.5.2 Penalties

4.3 Personally Identifiable Information (PII)

5 Policy and Implementation

5.1 Policy Area 1: Information Exchange Agreements

5.1.1 Information Exchange

5.1.1.1 Information Handling

5.1.1.2 State and Federal Agency User Agreements

5.1.1.3 Criminal Justice Agency User Agreements

5.1.1.4 Interagency and Management Control Agreements

5.1.1.5 Private Contractor User Agreements and CJIS Security Addendum

5.1.1.6 Agency User Agreements

5.1.1.7 Outsourcing Standards for Channelers

5.1.1.8 Outsourcing Standards for Non-Channelers

5.1.2 Monitoring, Review, and Delivery of Services

5.1.2.1 Managing Changes to Service Providers

5.1.3 Secondary Dissemination

5.1.4 Secondary Dissemination of Non-CHRI CJI

5.2 AWARENESS AND TRAINING (AT)

AT-1 POLICY AND PROCEDURES

AT-2 LITERACY TRAINING AND AWARENESS

(2) LITERACY TRAINING AND AWARENESS | INSIDER THREAT

(3) LITERACY TRAINING AND AWARENESS | SOCIAL ENGINEERING AND

MINING

AT-3 ROLE-BASED TRAINING

(5) ROLE-BASED TRAINING | PROCESSING PERSONALLY IDENTIFIABLE

INFORMATION

AT-4 TRAINING RECORDS

5.3 INCIDENT RESPONSE (IR)

IR-1 POLICY AND PROCEDURES

IR-2 INCIDENT RESPONSE TRAINING

(3) INCIDENT RESPONSE TRAINING | BREACH

IR-3 INCIDENT RESPONSE TESTING

(2) INCIDENT RESPONSE TESTING | COORDINATION WITH RELATED PLANS

IR-4 INCIDENT HANDLING

(1) INCIDENT HANDLING | AUTOMATED INCIDENT HANDLING PROCESSES 31

IR-5 INCIDENT MONITORING

IR-6 INCIDENT REPORTING

(1) INCIDENT REPORTING | AUTOMATED REPORTING

(3) INCIDENT REPORTING | SUPPLY CHAIN COORDINATION

IR-7 INCIDENT RESPONSE ASSISTANCE

(1) INCIDENT RESPONSE ASSISTANCE | AUTOMATION SUPPORT FOR

AVAILABILITY OF INFORMATION AND SUPPORT10F

IR-8 INCIDENT RESPONSE PLAN

(1) INCIDENT RESPONSE PLAN | BREACHES

vii

5.4 AUDIT AND ACCOUNTABILITY (AU)

AU-1 POLICY AND PROCEDURES

AU-2 EVENT LOGGING

AU-3 CONTENT OF AUDIT RECORDS

(1) CONTENT OF AUDIT RECORDS | ADDITIONAL AUDIT INFORMATION

(3) CONTENT OF AUDIT RECORDS | LIMIT PERSONALLY IDENTIFIABLE

INFORMATION ELEMENTS

AU-4 AUDIT LOG STORAGE CAPACITY

AU-5 RESPONSE TO AUDIT LOGGING PROCESS FAILURES

AU-6 AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING

(1) AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | AUTOMATED

PROCESS INTEGRATION

(3) AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | CORRELATE

AUDIT RECORD REPOSITORIES

AU-7 AUDIT RECORD REDUCTION AND REPORT GENERATION

(1) AUDIT RECORD REDUCTION AND REPORT GENERATION | AUTOMATIC

PROCESSING

AU-8 TIME STAMPS

AU-9 PROTECTION OF AUDIT INFORMATION

(4) PROTECTION OF AUDIT INFORMATION | ACCESS BY SUBSET OF

PRIVILEGED USERS

AU-11 AUDIT RECORD RETENTION

AU-12 AUDIT RECORD GENERATION

5.5 ACCESS CONTROL (AC)

AC-1 POLICY AND PROCEDURES

AC-2 ACCOUNT MANAGEMENT

(1) ACCOUNT MANAGEMENT | AUTOMATED SYSTEM ACCOUNT

MANAGEMENT

(2) ACCOUNT MANAGEMENT | AUTOMATED TEMPORARY AND

EMERGENCY ACCOUNT MANAGEMENT

(3) ACCOUNT MANAGEMENT | DISABLE ACCOUNTS

(4) ACCOUNT MANAGEMENT | AUTOMATED AUDIT ACTIONS

(5) ACCOUNT MANAGEMENT | INACTIVITY LOGOUT28

(13) ACCOUNT MANAGEMENT | DISABLE ACCOUNTS FOR HIGH-RISK

INDIVIDUALS

AC-3 ACCESS ENFORCEMENT

(14) ACCESS ENFORCEMENT | INDIVIDUAL ACCESS

AC-4 INFORMATION FLOW ENFORCEMENT

AC-5 SEPARATION OF DUTIES

AC-6 LEAST PRIVILEGE

(1) LEAST PRIVILEGE | AUTHORIZE ACCESS TO SECURITY FUNCTIONS

(2) LEAST PRIVILEGE | NON-PRIVILEGED ACCESS FOR NONSECURITY

FUNCTIONS

(5) LEAST PRIVILEGE | PRIVILEGED ACCOUNTS

(7) LEAST PRIVILEGE | REVIEW OF USER PRIVILEGES

(9) LEAST PRIVILEGE | LOG USE OF PRIVILEGED FUNCTIONS

viii

(10) LEAST PRIVILEGE | PROHIBIT NON-PRIVILEGED USERS FROM

EXECUTING PRIVILEGED FUNCTIONS

AC-7 UNSUCCESSFUL LOGON ATTEMPTS

AC-8 SYSTEM USE NOTIFICATION

AC-11 DEVICE LOCK

(1) DEVICE LOCK | PATTERN-HIDING DISPLAYS

AC-12 SESSION TERMINATION

AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR

AUTHENTICATION

AC-17 REMOTE ACCESS

(1) REMOTE ACCESS | MONITORING AND CONTROL

(2) REMOTE ACCESS | PROTECTION OF CONFIDENTIALITY AND INTEGRITY

USING ENCRYPTION

(3) REMOTE ACCESS | MANAGED ACCESS CONTROL POINTS

(4) REMOTE ACCESS | PRIVILEGED COMMANDS AND ACCESS

AC-18 WIRELESS ACCESS

(1) WIRELESS ACCESS | AUTHENTICATION AND ENCRYPTION

(3) WIRELESS ACCESS | DISABLE WIRELESS NETWORKING

AC-19 ACCESS CONTROL FOR MOBILE DEVICES

(5) ACCESS CONTROL FOR MOBILE DEVICES | FULL DEVICE OR

CONTAINER-BASED ENCRYPTION

AC-20 USE OF EXTERNAL SYSTEMS

(1) USE OF EXTERNAL SYSTEMS | LIMITS ON AUTHORIZED USE

(2) USE OF EXTERNAL SYSTEMS | PORTABLE STORAGE DEVICES —

RESTRICTED USE

AC-21 INFORMATION SHARING

AC-22 PUBLICLY ACCESSIBLE CONTENT

5.6 IDENTIFICATION AND AUTHENTICATION (IA)

IA-0 USE OF ORIGINATING AGENCY IDENTIFIERS IN TRANSACTIONS AND

INFORMATION EXCHANGES

IA-1 POLICY AND PROCEDURES

IA-2 IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)

(1) IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) |

MULTI-FACTOR AUTHENTICATION TO PRIVILEGED ACCOUNTS

(2) IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) |

MULTI-FACTOR AUTHENTICATION TO NON-PRIVILEGED ACCOUNTS ..69

(8) IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) |

ACCESS TO ACCOUNTS — REPLAY RESISTANT

(12) IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) |

ACCEPTANCE OF PIV CREDENTIALS

IA-3 DEVICE IDENTIFICATION AND AUTHENTICATION

IA-4 IDENTIFIER MANAGEMENT

(4) IDENTIFIER MANAGEMENT | IDENTIFY USER STATUS

IA-5 AUTHENTICATOR MANAGEMENT

(1) AUTHENTICATOR MANAGEMENT | AUTHENTICATOR TYPES

(a) Memorized Secret Authenticators and Verifiers:

ix

(b) Look-Up Secret Authenticators and Verifiers

(c) Out-of-Band Authenticators and Verifiers

(d) OTP Authenticators and Verifiers

(e) Cryptographic Authenticators and Verifiers (including single- and multi-factor cryptographic authenticators, both hardware- and software-based)

(2) AUTHENTICATOR MANAGEMENT | PUBLIC KEY BASED

AUTHENTICATION

(6) AUTHENTICATOR MANAGEMENT | PROTECTION OF AUTHENTICATORS

IA-6 AUTHENTICATION FEEDBACK

IA-7 CRYPTOGRAPHIC MODULE AUTHENTICATIONF

IA-8 IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL

USERS)

(1) IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL

USERS) | ACCEPTANCE OF PIV CREDENTIALS FROM OTHER AGENCIES

(2) IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL

USERS) | ACCEPTANCE OF EXTERNAL AUTHENTICATORS

(4) IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL

USERS) | USE OF DEFINED PROFILES

IA-11 RE-AUTHENTICATION

IA-12 IDENTITY PROOFING

(2) IDENTITY PROOFING | IDENTITY EVIDENCE

(3) IDENTITY PROOFING | IDENTITY EVIDENCE VALIDATION AND

VERIFICATION

(5) IDENTITY PROOFING | ADDRESS CONFIRMATION

5.7 CONFIGURATION MANAGEMENT (CM)

CM-1 POLICY AND PROCEDURES

CM-2 BASELINE CONFIGURATION

(2) BASELINE CONFIGURATION | AUTOMATION SUPPORT FOR ACCURACY

AND CURRENCY

(3) BASELINE CONFIGURATION | RETENTION OF PREVIOUS

CONFIGURATIONS

(7) BASELINE CONFIGURATION | CONFIGURE SYSTEMS AND COMPONENTS

FOR HIGH-RISK AREAS

CM-3 CONFIGURATION CHANGE CONTROL

(2) CONFIGURATION CHANGE CONTROL | TESTING, VALIDATION, AND

DOCUMENTATION OF CHANGES

(4) CONFIGURATION CHANGE CONTROL | SECURITY AND PRIVACY

REPRESENTATIVES

CM-4 IMPACT ANALYSES

(2) IMPACT ANALYSES | VERIFICATION OF CONTROLS

CM-5 ACCESS RESTRICTIONS FOR CHANGE

CM-6 CONFIGURATION SETTINGS

CM-7 LEAST FUNCTIONALITY

(1) LEAST FUNCTIONALITY | PERIODIC REVIEW

x

(2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION

(5) LEAST FUNCTIONALITY | AUTHORIZED SOFTWARE — ALLOW-BY-

EXCEPTION

CM-8 SYSTEM COMPONENT INVENTORY

(1) SYSTEM COMPONENT INVENTORY | UPDATES DURING INSTALLATION

AND REMOVAL

(3) SYSTEM COMPONENT INVENTORY | AUTOMATED UNAUTHORIZED

COMPONENT DETECTION

CM-9 CONFIGURATION MANAGEMENT PLAN

CM-10 SOFTWARE USAGE RESTRICTIONS

CM-11 USER-INSTALLED SOFTWARE

CM-12 INFORMATION LOCATION

(1) INFORMATION LOCATION | AUTOMATED TOOLS TO SUPPORT

INFORMATION LOCATION

5.8 MEDIA PROTECTION (MP)

MP-1 POLICY AND PROCEDURES

MP-2 MEDIA ACCESS

MP-3 MEDIA MARKING

MP-4 MEDIA STORAGE

MP-5 MEDIA TRANSPORT

MP-6 MEDIA SANITIZATION

MP-7 MEDIA USE

5.9 PHYSICAL AND ENVIRONMENTAL PROTECTION (PE)

PE-1 POLICY AND PROCEDURES

PE-2 PHYSICAL ACCESS AUTHORIZATIONS

PE-3 PHYSICAL ACCESS CONTROL

PE-4 ACCESS CONTROL FOR TRANSMISSION

PE-5 ACCESS CONTROL FOR OUTPUT DEVICES

PE-6 MONITORING PHYSICAL ACCESS

(1) MONITORING PHYSICAL ACCESS | INTRUSION ALARMS AND

SURVEILLANCE EQUIPMENT

PE-8 VISITOR ACCESS RECORDS

(3) VISITOR ACCESS RECORDS | LIMIT PERSONALLY IDENTIFIABLE

INFORMATION ELEMENTS 87F87F87F

PE-9 POWER EQUIPMENT AND CABLING

PE-10 EMERGENCY SHUTOFF

PE-11 EMERGENCY POWER

PE-12 EMERGENCY LIGHTING

PE-13 FIRE PROTECTION

(1) FIRE PROTECTION | DETECTION SYSTEMS — AUTOMATIC ACTIVATION

AND NOTIFICATION

PE-14 ENVIRONMENTAL CONTROLS

PE-15 WATER DAMAGE PROTECTION

PE-16 DELIVERY AND REMOVAL

PE-17 ALTERNATE WORK SITE

5.10 SYSTEMS AND COMMUNICATIONS PROTECTION (SC)

xi

SC-1 POLICY AND PROCEDURES

SC-2 SEPARATION OF SYSTEM AND USER FUNCTIONALITY

SC-4 INFORMATION IN SHARED SYSTEM RESOURCES

SC-5 DENIAL-OF-SERVICE PROTECTION

SC-7 BOUNDARY PROTECTION

(3) BOUNDARY PROTECTION | ACCESS POINTS

(4) BOUNDARY PROTECTION | EXTERNAL TELECOMMUNICATIONS

SERVICES

(5) BOUNDARY PROTECTION | DENY BY DEFAULT — ALLOW BY

EXCEPTION

(7) BOUNDARY PROTECTION | SPLIT TUNNELING FOR REMOTE DEVICES ..177

(8) BOUNDARY PROTECTION | ROUTE TRAFFIC TO AUTHENTICATED PROXY

SERVERS

(24) BOUNDARY PROTECTION | PERSONALLY IDENTIFIABLE INFORMATION

SC-8 TRANSMISSION CONFIDENTIALITY AND INTEGRITY

(1) TRANSMISSION CONFIDENTIALITY AND INTEGRITY | CRYPTOGRAPHIC

PROTECTION

SC-10 NETWORK DISCONNECT

SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT

SC-13 CRYPTOGRAPHIC PROTECTION

SC-15 COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS

SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES

SC-18 MOBILE CODE

SC-20 SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE

SOURCE)

SC-21 SECURE NAME/ADDRESS RESOLUTION SERVICE (RECURSIVE OR

CACHING RESOLVER)

SC-22 ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION

SERVICE

SC-23 SESSION AUTHENTICITY

SC-28 PROTECTION OF INFORMATION AT REST

(1) PROTECTION OF INFORMATION AT REST | CRYPTOGRAPHIC

PROTECTION

SC-39 PROCESS ISOLATION

5.11 Policy Area 11: Formal Audits

5.11.1 Audits by the FBI CJIS Division

5.11.1.1 Triennial Compliance Audits by the FBI CJIS Division

5.11.1.2 Triennial Security Audits by the FBI CJIS Division

5.11.2 Audits by the CSA

5.11.3 Special Security Inquiries and Audits

5.11.4 Compliance Subcommittees

5.12 Policy Area 12: Personnel Security

5.12.1 Personnel Screening Requirements for Individuals Requiring Unescorted Access to

Unencrypted CJI

5.12.2 Personnel Termination

xii

5.12.3 Personnel Transfer

5.12.4 Personnel Sanctions

5.13 Policy Area 13: Mobile Devices

5.13.1 Wireless Communications Technologies

5.13.1.1 802.11 Wireless Protocols

5.13.1.2 Cellular Devices

5.13.1.2.1 Cellular Service Abroad

5.13.1.2.2 Voice Transmissions Over Cellular Devices

5.13.1.3 Bluetooth

5.13.1.4 Mobile Hotspots

5.13.2 Mobile Device Management (MDM)

5.13.3 Wireless Device Risk Mitigations

5.13.4 System Integrity

5.13.4.1 Patching/Updates

5.13.4.2 Malicious Code Protection

5.13.4.3 Personal Firewall

5.13.5 Incident Response

5.13.6 Access Control

5.13.7 Identification and Authentication

5.13.7.1 Local Device Authentication

5.13.7.2 Advanced Authentication

5.13.7.2.1 Compensating Controls

5.13.7.3 Device Certificates

5.14 SYSTEM AND SERVICES ACQUISITION (SA)

SA-22 UNSUPPORTED SYSTEM COMPONENTS

5.15 SYSTEM AND INFORMATION INTEGRITY (SI)

SI-1 POLICY AND PROCEDURES

SI-2 FLAW REMEDIATION

(2) FLAW REMEDIATION | AUTOMATED FLAW REMEDIATION STATUS

SI-3 MALICIOUS CODE PROTECTION

SI-4 SYSTEM MONITORING

(2) SYSTEM MONITORING | AUTOMATED TOOLS AND MECHANISMS FOR

REAL-TIME ANALYSIS

(4) SYSTEM MONITORING | INBOUND AND OUTBOUND COMMUNICATIONS

TRAFFIC

(5) SYSTEM MONITORING | SYSTEM-GENERATED ALERTS

SI-5 SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

SI-7 SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY

(1) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRITY

CHECKS

(7) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRATION

OF DETECTION AND RESPONSE

SI-8 SPAM PROTECTION

(2) SPAM PROTECTION | AUTOMATIC UPDATES

SI-10 INFORMATION INPUT VALIDATION

SI-11 ERROR HANDLING

xiii

SI-12 INFORMATION MANAGEMENT AND RETENTION

(1) INFORMATION MANAGEMENT AND RETENTION | LIMIT PERSONALLY

IDENTIFIABLE INFORMATION ELEMENTS

(2) INFORMATION MANAGEMENT AND RETENTION | MINIMIZE

PERSONALLY IDENTIFIABLE INFORMATION IN TESTING, TRAINING,

AND RESEARCH

(3) INFORMATION MANAGEMENT AND RETENTION | INFORMATION

DISPOSAL

SI-16 MEMORY PROTECTION

5.16 MAINTENANCE (MA)

MA-1 POLICY AND PROCEDURES

MA-2 CONTROLLED MAINTENANCE

MA-3 MAINTENANCE TOOLS

(1) MAINTENANCE TOOLS | INSPECT TOOLS

(2) MAINTENANCE TOOLS | INSPECT MEDIA

(3) MAINTENANCE TOOLS | PREVENT UNAUTHORIZED REMOVAL

MA-4 NONLOCAL MAINTENANCE

MA-5 MAINTENANCE PERSONNEL

MA-6 TIMELY MAINTENANCE

5.17 PLANNING (PL)

PL-1 POLICY AND PROCEDURES

PL-2 SYSTEM SECURITY AND PRIVACY PLANS

PL-4 RULES OF BEHAVIOR

(1) RULES OF BEHAVIOR | SOCIAL MEDIA AND EXTERNAL

SITE/APPLICATION USAGE RESTRICTIONS

PL-8 SECURITY AND PRIVACY ARCHITECTURES

PL-9 CENTRAL MANAGEMENT

PL-10 BASELINE SELECTION

PL-11 BASELINE TAILORING

5.18 CONTINGENCY PLANNING (CP)

CP-1 POLICY AND PROCEDURES

CP-2 CONTINGENCY PLAN

(1) CONTINGENCY PLAN | COORDINATE WITH RELATED PLANS

(3) CONTINGENCY PLAN | RESUME MISSION AND BUSINESS FUNCTIONS ..229

(8) CONTINGENCY PLAN | IDENTIFY CRITICAL ASSETS

CP-3 CONTINGENCY TRAINING

CP-4 CONTINGENCY PLAN TESTING

(1) CONTINGENCY PLAN TESTING | COORDINATE WITH RELATED PLANS .231

CP-6 ALTERNATE STORAGE SITE

(1) ALTERNATE STORAGE SITE | SEPARATION FROM PRIMARY SITE

(3) ALTERNATE STORAGE SITE | ACCESSIBILITY

CP-7 ALTERNATE PROCESSING SITE

(1) ALTERNATE PROCESSING SITE | SEPARATION FROM PRIMARY SITE

(2) ALTERNATE PROCESSING SITE | ACCESSIBILITY

(3) ALTERNATE PROCESSING SITE | PRIORITY OF SERVICE

CP-8 TELECOMMUNICATIONS SERVICES

xiv

(1) TELECOMMUNICATIONS SERVICES | PRIORITY OF SERVICE PROVISIONS

(2) TELECOMMUNICATIONS SERVICES | SINGLE POINTS OF FAILURE

CP-9 SYSTEM BACKUP

(1) SYSTEM BACKUP | TESTING FOR RELIABILITY AND INTEGRITY

(8) SYSTEM BACKUP | CRYPTOGRAPHIC PROTECTION

CP-10 SYSTEM RECOVERY AND RECONSTITUTION

(2) SYSTEM RECOVERY AND RECONSTITUTION | TRANSACTION RECOVERY

5.19 RISK ASSESSMENT (RA)

RA-1 POLICY AND PROCEDURES

RA-2 SECURITY CATEGORIZATION

RA-3 RISK ASSESSMENT

RA-5 VULNERABILITY MONITORING AND SCANNING

(2) VULNERABILITY MONITORING AND SCANNING | UPDATE

VULNERABILITIES TO BE SCANNED

(5) VULNERABILITY MONITORING AND SCANNING | PRIVILEGED ACCESS

(11) VULNERABILITY MONITORING AND SCANNING | PUBLIC DISCLOSURE

PROGRAM

RA-7 RISK RESPONSE

RA-9 CRITICALITY ANALYSIS

Appendices Appendix A TERMS AND DEFINITIONS ......................................................................... A-1 Appendix B ACRONYMS ......................................................................................................B-1 Appendix C NETWORK TOPOLOGY DIAGRAMS ........................................................ C-1 Appendix D SAMPLE INFORMATION EXCHANGE AGREEMENTS........................ D-1

D.1 CJIS User Agreement .................................................................................................. D.1-1 D.2 Management Control Agreement ................................................................................. D.2-1 D.3 Noncriminal Justice Agency Agreement & Memorandum of Understanding............. D.3-1 D.4 Interagency Connection Agreement ............................................................................ D.4-1

Appendix E SECURITY FORUMS AND ORGANIZATIONAL ENTITIES ..................E-1 Appendix F SAMPLE FORMS ............................................................................................. F-1

F.1 Security Incident Response Form .................................................................................... F-2 Appendix G BEST PRACTICES .......................................................................................... G-1

G.1 Virtualization ............................................................................................................... G.1-1 G.2 Voice over Internet Protocol ........................................................................................ G.2-1 G.3 Cloud Computing ......................................................................................................... G.3-1 G.4 Mobile Appendix ......................................................................................................... G.4-1 G.5 Administrator Accounts for Least Privilege and Separation of Duties ........................ G.5-1 G.6 Encryption .................................................................................................................... G.6-1 G.7 Incident Response ........................................................................................................ G.7-1 G.8 Secure Coding .............................................................................................................. G.8-1

Appendix H SECURITY ADDENDUM ............................................................................... H-1 Appendix I REFERENCES .................................................................................................... I-1 Appendix J NONCRIMINAL JUSTICE AGENCY SUPPLEMENTAL GUIDANCE ... J-1 xv

Appendix K CRIMINAL JUSTICE AGENCY SUPPLEMENTAL GUIDANCE........... K-1 xvi

LIST OF FIGURES

Figure 1 – Overview Diagram of Strategic Functions and Policy Components Figure 2 – Dissemination of restricted and non-restricted NCIC data Figure 3 – Information Exchange Agreements Implemented by a Local Police Department Figure 4 – Security Awareness Training Use Cases Figure 5 – Incident Response Process Initiated by an Incident in a Local Police Department Figure 8 – Digital Identity Model Figure 9 – Notional Strengths of Evidence Types Figure 10 – Types of Identity Evidence Security Features Figure 11 – Validating Identity Evidence Figure 12 – Verification Methods and Strengths Figure 13 – A Local Police Department’s Configuration Management Controls Figure 14 – A Local Police Department’s Media Management Policies Figure 16 – System and Communications Protection and Information Integrity Use Cases Figure 17 – The Audit of a Local Police Department Figure 18 – Personnel Security Use Cases xvii

LIST OF PRIORITIES

No. Control Name Enhancements Priority

AC-1 POLICY AND PROCEDURES AC-1 P2

AC-2 ACCOUNT MANAGEMENT AC-2 (1) (2) (3) (4) (5) (13) P1

AC-3 ACCESS ENFORCEMENT AC-3 (14) P1

AC-4 INFORMATION FLOW ENFORCEMENT AC-4 P1

AC-5 SEPARATION OF DUTIES AC-5 P1

AC-6 LEAST PRIVILEGE AC-6 (1) (2) (5) (7) (9) (10) P1

AC-7 UNSUCCESSFUL LOGON ATTEMPTS AC-7 P3

AC-8 SYSTEM USE NOTIFICATION AC-8 P2

AC-11 DEVICE LOCK AC-11 (1) P4

AC-12 SESSION TERMINATION AC-12 P3

AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION AC-14 P4

AC-17 REMOTE ACCESS AC-17 (1) (2) (3) (4) P1

AC-18 WIRELESS ACCESS AC-18 (1) (3) P2

AC-19 ACCESS CONTROL FOR MOBILE DEVICES AC-19 (5) P2

AC-20 USE OF EXTERNAL SYSTEMS AC-20 (1) (2) P1

AC-21 INFORMATION SHARING AC-21 P3

AC-22 PUBLICLY ACCESSIBLE CONTENT AC-22 P4

AT-1 POLICY AND PROCEDURES AT-1 P2

AT-2 LITERACY TRAINING AND AWARENESS AT-2 (2) (3) P2

AT-3 ROLE-BASED TRAINING AT-3 P2

AT-3 ROLE-BASED TRAINING | PROCESSING PERSONALLY IDENTIFIABLE

INFORMATION AT-3 (5) P2

AT-4 TRAINING RECORDS AT-4 P4

AU-1 POLICY AND PROCEDURES AU-1 P2

AU-2 EVENT LOGGING AU-2 P2

AU-3 CONTENT OF AUDIT RECORDS AU-3 (1) P2

AU-3 CONTENT OF AUDIT RECORDS | LIMIT PERSONALLY IDENTIFIABLE

INFORMATION ELEMENTS AU-3 (3) P2

AU-4 AUDIT LOG STORAGE CAPACITY AU-4 P2

AU-5 RESPONSE TO AUDIT LOGGING PROCESS FAILURES AU-5 P2

AU-6 AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING AU-6 (1) (3) P2

AU-7 AUDIT RECORD REDUCTION AND REPORT GENERATION AU-7 (1) P3

AU-8 TIME STAMPS AU-8 P2

AU-9 PROTECTION OF AUDIT INFORMATION AU-9 (4) P2

AU-11 AUDIT RECORD RETENTION AU-11 P4

AU-12 AUDIT RECORD GENERATION AU-12 P2

xviii

No. Control Name Enhancements Priority

CM-1 POLICY AND PROCEDURES CM-1 P2

CM-2 BASELINE CONFIGURATION CM-2 (2) (3) (7) P1

CM-3 CONFIGURATION CHANGE CONTROL CM-3 (2) (4) P2

CM-4 IMPACT ANALYSES CM-4 (2) P3

CM-5 ACCESS RESTRICTIONS FOR CHANGE CM-5 P1

CM-6 CONFIGURATION SETTINGS CM-6 P1

CM-7 LEAST FUNCTIONALITY CM-7 (1) (2) (5) P1

CM-8 SYSTEM COMPONENT INVENTORY CM-8 (1) (3) P1

CM-9 CONFIGURATION MANAGEMENT PLAN CM-9 P2

CM-10 SOFTWARE USAGE RESTRICTIONS CM-10 P3

CM-11 USER-INSTALLED SOFTWARE CM-11 P2

CM-12 INFORMATION LOCATION CM-12 (1) P2

CP-1 POLICY AND PROCEDURES CP-1 P2

CP-2 CONTINGENCY PLAN CP-2 (1) (3) (8) P2

CP-3 CONTINGENCY TRAINING CP-3 P3

CP-4 CONTINGENCY PLAN TESTING CP-4 (1) P3

CP-6 ALTERNATE STORAGE SITE CP-6 (1) (3) P2

CP-7 ALTERNATE PROCESSING SITE CP-7 (1) (2) (3) P2

CP-8 TELECOMMUNICATIONS SERVICES CP-8 (1) (2) P2

CP-9 SYSTEM BACKUP CP-9 (1) (8) P2

CP-10 SYSTEM RECOVERY AND RECONSTITUTION CP-10 (2) P2

IA-1 POLICY AND PROCEDURES IA-1 P2

IA-2 IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) IA-2 (1) (2) (8) (12) P1

IA-3 DEVICE IDENTIFICATION AND AUTHENTICATION IA-3 P2

IA-4 IDENTIFIER MANAGEMENT IA-4 (4) P2

IA-5 AUTHENTICATOR MANAGEMENT IA-5 (1) (2) (6) P1

IA-6 AUTHENTICATION FEEDBACK IA-6 P3

IA-7 CRYPTOGRAPHIC MODULE AUTHENTICATION IA-7 P2

IA-8 IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL

USERS) IA-8 (1) (2) (4) P2

IA-11 RE-AUTHENTICATION IA-11 P2

IA-12 IDENTITY PROOFING IA-12 (2) (3) (5) P2

IR-1 POLICY AND PROCEDURES IR-1 P2

IR-2 INCIDENT RESPONSE TRAINING IR-2 P3

IR-2 INCIDENT RESPONSE TRAINING | BREACH IR-2 (3) P3

IR-3 INCIDENT RESPONSE TESTING IR-3 (2) P3

IR-4 INCIDENT HANDLING IR-4 (1) P2

xix

No. Control Name Enhancements Priority

IR-5 INCIDENT MONITORING IR-5 P2

IR-6 INCIDENT REPORTING IR-6 (1) (3) P2

IR-7 INCIDENT RESPONSE ASSISTANCE IR-7 (1) P3

IR-8 INCIDENT RESPONSE PLAN IR-8 P2

IR-8 INCIDENT RESPONSE PLAN | BREACHES IR-8 (1) P2

MA-1 POLICY AND PROCEDURES MA-1 P2

MA-2 CONTROLLED MAINTENANCE MA-2 P3

MA-3 MAINTENANCE TOOLS MA-3 (1) (2) (3) P4

MA-4 NONLOCAL MAINTENANCE MA-4 P3

MA-5 MAINTENANCE PERSONNEL MA-5 P3

MA-6 TIMELY MAINTENANCE MA-6 P3

MP-1 POLICY AND PROCEDURES MP-1 P2

MP-2 MEDIA ACCESS MP-2 P2

MP-3 MEDIA MARKING MP-3 P3

MP-4 MEDIA STORAGE MP-4 P2

MP-5 MEDIA TRANSPORT MP-5 P2

MP-6 MEDIA SANITIZATION MP-6 P2

MP-7 MEDIA USE MP-7 P2

PE-1 POLICY AND PROCEDURES PE-1 P2

PE-2 PHYSICAL ACCESS AUTHORIZATIONS PE-2 P2

PE-3 PHYSICAL ACCESS CONTROL PE-3 P2

PE-4 ACCESS CONTROL FOR TRANSMISSION PE-4 P2

PE-5 ACCESS CONTROL FOR OUTPUT DEVICES PE-5 P3

PE-6 MONITORING PHYSICAL ACCESS PE-6 (1) P2

PE-8 VISITOR ACCESS RECORDS PE-8 (3) P4

PE-9 POWER EQUIPMENT AND CABLING PE-9 P2

PE-10 EMERGENCY SHUTOFF PE-10 P2

PE-11 EMERGENCY POWER PE-11 P2

PE-12 EMERGENCY LIGHTING PE-12 P2

PE-13 FIRE PROTECTION PE-13 (1) P2

PE-14 ENVIRONMENTAL CONTROLS PE-14 P2

PE-15 WATER DAMAGE PROTECTION PE-15 P2

PE-16 DELIVERY AND REMOVAL PE-16 P3

PE-17 ALTERNATE WORK SITE PE-17 P3

PL-1 POLICY AND PROCEDURES PL-1 P2

PL-2 SYSTEM SECURITY AND PRIVACY PLANS PL-2 P2

PL-4 RULES OF BEHAVIOR PL-4 (1) P3

xx

No. Control Name Enhancements Priority

PL-8 SECURITY AND PRIVACY ARCHITECTURES PL-8 P2

PL-9 CENTRAL MANAGEMENT PL-9 P4

PL-10 BASELINE SELECTION PL-10 P3

PL-11 BASELINE TAILORING PL-11 P3

RA-1 POLICY AND PROCEDURES RA-1 P2

RA-2 SECURITY CATEGORIZATION RA-2 P2

RA-3 RISK ASSESSMENT RA-3 (1) P2

RA-5 VULNERABILITY MONITORING AND SCANNING RA-5 (2) (5) (11) P1

RA-7 RISK RESPONSE RA-7 P2

RA-9 CRITICALITY ANALYSIS RA-9 P2

SA-22 UNSUPPORTED SYSTEM COMPONENTS SA-22 P2

SC-1 POLICY AND PROCEDURES SC-1 P2

SC-2 SEPARATION OF SYSTEM AND USER FUNCTIONALITY SC-2 P2

SC-4 INFORMATION IN SHARED SYSTEM RESOURCES SC-4 P2

SC-5 DENIAL-OF-SERVICE PROTECTION SC-5 P2

SC-7 BOUNDARY PROTECTION SC-7 (3) (4) (5) (7) (8) (24) P1

SC-8 TRANSMISSION CONFIDENTIALITY AND INTEGRITY SC-8 (1) P2

SC-10 NETWORK DISCONNECT SC-10 P3

SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT SC-12 P2

SC-13 CRYPTOGRAPHIC PROTECTION SC-13 P2

SC-15 COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS SC-15 P2

SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES SC-17 P2

SC-18 MOBILE CODE SC-18 P3

SC-20 SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE

SOURCE) SC-20 P2

SC-21 SECURE NAME/ADDRESS RESOLUTION SERVICE (RECURSIVE OR

CACHING RESOLVER) SC-21 P2

SC-22 ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION

SERVICE SC-22 P2

SC-23 SESSION AUTHENTICITY SC-23 P2

SC-28 PROTECTION OF INFORMATION AT REST SC-28 (1) P2

SC-39 PROCESS ISOLATION SC-39 P2

SI-1 POLICY AND PROCEDURES SI-1 P2

SI-2 FLAW REMEDIATION SI-2 (2) P1

SI-3 MALICIOUS CODE PROTECTION SI-3 P1

SI-4 SYSTEM MONITORING SI-4 (2) (4) (5) P1

SI-5 SECURITY ALERTS, ADVISORIES, AND DIRECTIVES SI-5 P2

SI-7 SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY SI-7 (1) (7) P1

xxi

No. Control Name Enhancements Priority

SI-8 SPAM PROTECTION SI-8 (2) P3

SI-10 INFORMATION INPUT VALIDATION SI-10 P1

SI-11 ERROR HANDLING SI-11 P3

SI-12 INFORMATION MANAGEMENT AND RETENTION SI-12 (1) (2) (3) P3

SI-16 MEMORY PROTECTION SI-16 P2

SI-18 PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS SI-18 (4) P4

SI-19 DE-IDENTIFICATION SI-19 P4

1 INTRODUCTION

This section details the purpose of this document, its scope, relationship to other information security policies, and its distribution constraints.

1.1 Purpose

The CJIS Security Policy provides Criminal Justice Agencies (CJA) and Noncriminal Justice Agencies (NCJA) with a minimum set of security requirements for access to Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Division systems and information and to protect and safeguard Criminal Justice Information (CJI). This minimum standard of security requirements ensures continuity of information protection. The essential premise of the CJIS Security Policy is to provide the appropriate controls to protect CJI, from creation through dissemination; whether at rest or in transit.

The CJIS Security Policy integrates presidential directives, federal laws, FBI directives, the criminal justice community’s Advisory Policy Board (APB) decisions along with nationally recognized guidance from the National Institute of Standards and Technology (NIST) and the National Crime Prevention and Privacy Compact Council (Compact Council).

1.2 Scope

At the consent of the advisory process, and taking into consideration federal law and state statutes, the CJIS Security Policy applies to all entities with access to, or who operate in support of, FBI CJIS Division’s services and information. The CJIS Security Policy provides minimum security requirements associated with the creation, viewing, modification, transmission, dissemination, storage, or destruction of CJI.

Entities engaged in the interstate exchange of CJI data for noncriminal justice purposes are also governed by the standards and rules promulgated by the Compact Council.

1.3 Relationship to Local Security Policy and Other Policies

The CJIS Security Policy may be used as the sole security policy for the agency. The local agency may complement the CJIS Security Policy with a local policy, or the agency may develop their own stand-alone security policy; however, the CJIS Security Policy shall always be the minimum standard and local policy may augment, or increase the standards, but shall not detract from the CJIS Security Policy standards.

The agency shall develop, disseminate, and maintain formal, documented procedures to facilitate the implementation of the CJIS Security Policy and, where applicable, the local security policy.

The policies and procedures shall be consistent with applicable laws, executive orders, directives, policies, regulations, standards, and guidance. Procedures developed for CJIS Security Policy areas can be developed for the security program in general, and for a particular information system, when required.

This document is a compendium of applicable policies in providing guidance on the minimum security controls and requirements needed to access FBI CJIS information and services. These policies include presidential directives, federal laws, FBI directives and the criminal justice community’s APB decisions. State, local, and Tribal CJA may implement more stringent policies and requirements. Appendix I contains the references while Appendix E lists the security forums and organizational entities referenced in this document.

1.4 Terminology Used in This Document

Effective in version 5.9.5, priority and implementation markings have been added to the modernized controls. Based on the FBI Director approved APB recommendation, beginning October 1, 2024, requirements existing prior to the CJISSECPOL modernization (i.e., version 5.9) and those identified as Priority 1 ([Priority 1]) will be the set of sanctionable requirements.

• Non-modernized sections do not have markings but are considered “existing” requirements and continue to be auditable and sanctionable.

• “Existing” modernized requirements and indicated by the [Existing] marking.

• Priority 1 modernized requirements are indicated by the [Priority 1] marking.

• All [Priority 2], [Priority 3], and [Priority 4] modernized requirements fall into a zero-cycle status. The zero-cycle begins October 1, 2024 and ends September 30, 2027.

The following terms are used interchangeably throughout this document:

• Agency and Organization: The two terms in this document refer to any entity that submits or receives information, by any means, to/from FBI CJIS systems or services.

• Information and Data: Both terms refer to CJI.

• System, Information System, Service, or named applications like NCIC: all refer to connections to the FBI’s criminal justice information repositories and the equipment used to establish said connections.

• References/Citations/Directives: Appendix I contains all of the references used in this Policy and may contain additional sources that could apply to any section.

Appendix A and B provide an extensive list of the terms and acronyms.

1.5 Distribution of the CJIS Security Policy

The CJIS Security Policy, version 5.0 and later, is a publicly available document and may be posted and shared without restrictions.

2 CJIS SECURITY POLICY APPROACH

The CJIS Security Policy represents the shared responsibility between FBI CJIS, CJIS Systems Agency (CSA), and the State Identification Bureaus (SIB) of the lawful use and appropriate protection of CJI. The Policy provides a baseline of security requirements for current and planned services and sets a minimum standard for new initiatives.

2.1 CJIS Security Policy Vision Statement

The executive summary of this document describes the vision in terms of business needs for confidentiality, integrity, and availability of information. The APB collaborates with the FBI CJIS Division to ensure that the Policy remains updated to meet evolving business, technology and security needs.

2.2 Architecture Independent

Due to advancing technology and evolving business models, the FBI CJIS Division is transitioning from legacy stovepipe systems and moving toward a flexible services approach. Systems such as National Crime Information Center (NCIC), National Instant Criminal Background Check System (NICS), and Next Generation Identification (NGI) will continue to evolve and may no longer retain their current system platforms, hardware, or program name. However, the data and services provided by these systems will remain stable.

The CJIS Security Policy looks at the data (information), services, and protection controls that apply regardless of the implementation architecture. Architectural independence is not intended to lessen the importance of systems, but provide for the replacement of one technology with another while ensuring the controls required to protect the information remain constant. This objective and conceptual focus on security policy areas provide the guidance and standards while avoiding the impact of the constantly changing landscape of technical innovations. The architectural independence of the Policy provides agencies with the flexibility for tuning their information security infrastructure and policies to reflect their own environments.

2.3 Risk Versus Realism

Every “shall” statement contained within the CJIS Security Policy has been scrutinized for risk versus the reality of resource constraints and real-world application. The purpose of the CJIS Security Policy is to establish the minimum security requirements; therefore, individual agencies are encouraged to implement additional controls to address agency specific risks. Each agency faces risk unique to that agency. It is quite possible that several agencies could encounter the same type of risk however depending on resources would mitigate that risk differently. In that light, a risk-based approach can be used when implementing requirements.

3 ROLES AND RESPONSIBILITIES

3.1 Shared Management Philosophy

In the scope of information security, the FBI CJIS Division employs a shared management philosophy with federal, state, local, and tribal law enforcement agencies. Although an advisory policy board for the NCIC has existed since 1969, the Director of the FBI established the CJIS APB in March 1994 to enable appropriate input and recommend policy with respect to CJIS services. Through the APB and its Subcommittees and Working Groups, consideration is given to the needs of the criminal justice and law enforcement community regarding public policy, statutory and privacy aspects, as well as national security relative to CJIS systems and information.

The APB represents federal, state, local, and tribal law enforcement and criminal justice agencies throughout the United States, its territories, and Canada.

The FBI has a similar relationship with the Compact Council, which governs the interstate exchange of criminal history records for noncriminal justice purposes. The Compact Council is mandated by federal law to promulgate rules and procedures for the use of the Interstate Identification Index (III) for noncriminal justice purposes. To meet that responsibility, the Compact Council depends on the CJIS Security Policy as the definitive source for standards defining the security and privacy of records exchanged with noncriminal justice practitioners.

3.2 Roles and Responsibilities for Agencies and Parties

It is the responsibility of all agencies covered under this Policy to ensure the protection of CJI between the FBI CJIS Division and its user community. The following figure provides an abstract representation of the strategic functions and roles such as governance and operations.

Figure 1 – Overview Diagram of Strategic Functions and Policy Components

This section provides a description of the following entities and roles:

1. CJIS Systems Agency.

2. CJIS Systems Officer.

3. Terminal Agency Coordinator.

4. Criminal Justice Agency.

5. Noncriminal Justice Agency.

6. Contracting Government Agency.

7. Agency Coordinator.

8. CJIS Systems Agency Information Security Officer.

9. Local Agency Security Officer.

10. FBI CJIS Division Information Security Officer.

11. Repository Manager.

12. Compact Officer.

3.2.1 CJIS Systems Agencies (CSA)

The CSA is responsible for establishing and administering an information technology security program throughout the CSA’s user community, to include the local levels. The head of each CSA shall appoint a CJIS Systems Officer (CSO). The CSA may impose more stringent protection measures than outlined in this document. Such decisions shall be documented and kept current.

3.2.2 CJIS Systems Officer (CSO)

The CSO is an individual located within the CSA responsible for the administration of the CJIS network for the CSA. Pursuant to the Bylaws for the CJIS Advisory Policy Board and Working Groups, the role of CSO shall not be outsourced. The CSO may delegate responsibilities to subordinate agencies. The CSO shall set, maintain, and enforce the following:

1. Standards for the selection, supervision, and separation of personnel who have access to

CJI.

2. Policy governing the operation of computers, access devices, circuits, hubs, routers, firewalls, and other components that comprise and support a telecommunications network and related CJIS systems used to process, store, or transmit CJI, guaranteeing the priority, confidentiality, integrity, and availability of service needed by the criminal justice community.

a. Ensure appropriate use, enforce system discipline, and ensure CJIS Division operating procedures are followed by all users of the respective services and information.

b. Ensure state/federal agency compliance with policies approved by the APB and adopted by the FBI.

c. Ensure the appointment of the CSA ISO and determine the extent of authority to the

CSA ISO.

d. Ensure the designation of a Terminal Agency Coordinator (TAC) within each agency with devices accessing CJIS systems.

e. Ensure each agency having access to CJI has someone designated as the Local Agency Security Officer (LASO).

f. Ensure each LASO receives enhanced security awareness training (ref. Section 5.2).

g. Approve access to FBI CJIS systems.

h. Assume ultimate responsibility for managing the security of CJIS systems within their state and/or agency.

i. Perform other related duties outlined by the user agreements with the FBI CJIS

Division.

3. Outsourcing of Criminal Justice Functions

a. Responsibility for the management of the approved security requirements shall remain with the CJA. Security control includes the authority to enforce the standards for the selection, supervision, and separation of personnel who have access to CJI; set and enforce policy governing the operation of computers, circuits, and telecommunications terminals used to process, store, or transmit CJI; and to guarantee the priority service needed by the criminal justice community.

b. Responsibility for the management control of network security shall remain with the CJA. Management control of network security includes the authority to enforce the standards for the selection, supervision, and separation of personnel who have access to CJI; set and enforce policy governing the operation of circuits and network equipment used to transmit CJI; and to guarantee the priority service as determined by the criminal justice community.

3.2.3 Terminal Agency Coordinator (TAC)

The TAC serves as the point-of-contact at the local agency for matters relating to CJIS information access. The TAC administers CJIS systems programs within the local agency and oversees the agency’s compliance with CJIS systems policies.

3.2.4 Criminal Justice Agency (CJA)

A CJA is defined as a court, a governmental agency, or any subunit of a governmental agency which performs the administration of criminal justice pursuant to a statute or executive order and which allocates a substantial part of its annual budget to the administration of criminal justice.

State and federal Inspectors General Offices are included.

3.2.5 Noncriminal Justice Agency (NCJA)

A NCJA is defined (for the purposes of access to CJI) as an entity or any subunit thereof that provides services primarily for purposes other than the administration of criminal justice.

3.2.6 Contracting Government Agency (CGA)

A CGA is a government agency, whether a CJA or a NCJA, that enters into an agreement with a private contractor subject to the CJIS Security Addendum. The CGA entering into an agreement with a contractor shall appoint an agency coordinator.

3.2.7 Agency Coordinator (AC)

An AC is a staff member of the CGA who manages the agreement between the Contractor and agency. The AC shall be responsible for the supervision and integrity of the system, training and continuing education of employees and operators, scheduling of initial training and testing, and certification testing and all required reports by NCIC. The AC shall:

1. Understand the communications, records capabilities, and needs of the Contractor which is accessing federal and state records through or because of its relationship with the CGA.

2. Participate in related meetings and provide input and comments for system improvement.

3. Receive information from the CGA (e.g., system updates) and disseminate it to appropriate

Contractor employees.

4. Maintain and update manuals applicable to the effectuation of the agreement, and provide them to the Contractor.

5. Maintain up-to-date records of Contractor’s employees who access the system, including name, date of birth, social security number, date fingerprint card(s) submitted, date security clearance issued, and date initially trained, tested, certified or recertified (if applicable).

6. Train or ensure the training of Contractor personnel. If Contractor personnel access NCIC, schedule the operators for testing or a certification exam with the CSA staff, or AC staff with permission from the CSA staff. Schedule new operators for the certification exam within six (6) months of assignment. Schedule certified operators for biennial re-certification testing within thirty (30) days prior to the expiration of certification. Schedule operators for other mandated class.

7. The AC will not permit an untrained/untested or non-certified Contractor employee to access CJI or systems supporting CJI where access to CJI can be gained.

8. Where appropriate, ensure compliance by the Contractor with NCIC validation requirements.

9. Provide completed applicant fingerprint cards on each Contractor employee who accesses the system to the CGA (or, where appropriate, CSA) for criminal background…