CJIS_Security_Policy_v6-1_20260625.pdf

U. S. Department of Justice

Federal Bureau of Investigation

Criminal Justice Information Services Division

Criminal Justice Information Services (CJIS)

Security Policy

Version 6.1

06/25/2026

Prepared by:

FBI CJIS Information Security Officer

Approved by:

CJIS Advisory Policy Board i

CJISSECPOL v6.1

EXECUTIVE SUMMARY

Criminal and noncriminal justice agencies need timely and secure access to services that provide data wherever and whenever for stopping and reducing crime. In response to these needs, the

Advisory Policy Board (APB) recommended to the Federal Bureau of Investigation (FBI) that the

Criminal Justice Information Services (CJIS) Division authorize the expansion of the existing security management structure in 2019. Administered through a shared management philosophy, the CJIS Security Policy (CJISSECPOL) contains information security requirements, guidelines, and agreements reflecting the will of law enforcement and criminal justice agencies for protecting the systems that process, store, and transmit Criminal Justice Information (CJI). The Federal

Information Security Management Act of 2014 provides further legal basis for the APB approved management, operational, and technical security requirements mandated to protect CJI and by extension the hardware, software and infrastructure required to enable the services provided to the criminal and noncriminal justice communities.

The essential premise of the CJISSECPOL is to provide appropriate controls to protect the full lifecycle of CJI, whether at rest or in transit. The CJISSECPOL provides guidance for the creation, viewing, modification, transmission, dissemination, storage, or destruction of CJI. This Policy applies to every individual—contractor, private entity, noncriminal justice agency representative, or member of a criminal justice entity—with access to, or who operate in support of, criminal and noncriminal justice services and information.

The CJISSECPOL integrates presidential directives, federal laws, FBI directives and the criminal and noncriminal justice community decisions along with guidance from the National Crime

Prevention and Privacy Compact Council (Compact Council). The Policy is presented at both strategic and tactical levels and is periodically updated to reflect the security requirements of evolving technology and business models. The Policy features modular sections enabling more frequent updates to address emerging threats and new security measures. The provided security criteria assists agencies with designing and implementing systems to meet a minimum level of risk and security protection while enabling agencies the latitude to institute more stringent security requirements and controls based on their business model and local needs.

The CJISSECPOL strengthens the partnership between the FBI and CJIS Systems Agencies

(CSA), including, in those states with separate authorities, the State Identification Bureaus (SIB), and Interface Agencies (IA). Further, as use of criminal history record information (CHRI) for noncriminal justice purposes continues to expand, the CJISSECPOL becomes increasingly important in guiding the National Crime Prevention and Privacy Compact Council and State

Compact Officers in the secure exchange of CHRI.

The Policy describes the vision and captures the security concepts that set the policies, protections, roles, and responsibilities with minimal impact from changes in technology. The Policy empowers

CSAs, SIBs, and IAs with the insight and ability to tune their security programs according to their risks, needs, budgets, and resource constraints while remaining compliant with the baseline level of security set forth in this Policy. The CJISSECPOL provides a security framework based on laws, standards, and elements of published and vetted policies for accomplishing the mission across the broad spectrum of the criminal justice and noncriminal justice communities.

ii

CHANGE MANAGEMENT

Revision Change Description Created/Changed by Date Approved By

6.0 Policy Modernization

Completion

Security Policy

Modernization Task Force 12/27/2024

APB & Compact

Council

6.1 Incorporate Calendar

Year 2025 Changes CJIS ISO Program Office 06/25/2026

APB & Compact

Council iii

SUMMARY OF CHANGES

Version 6.1

APB Approved Changes

1. Addressing Omissions, Corrections, and Additions to the Modernized CJIS Security

Policy (CJISSECPOL) Part 1, Spring 2025, APB#16, SA#1: update sections with approved changes.

2. Addressing Omissions, Corrections, and Additions to the Modernized CJIS Security

Policy (CJISSECPOL) Part 2, Spring 2025, APB#16, SA#2: update sections with approved changes.

3. Addressing Omissions, Corrections, and Additions to the Modernized CJIS Security

Policy (CJISSECPOL) Part 3, Spring 2025, APB#16, SA#3: update sections with approved changes.

Administrative Changes 0F0F0F

1. Administrative Changes approved by the Security and Access Subcommittee on

November 14, 2025.

Note: Administrative changes are vetted through the Security and Access Subcommittee and not the entire APB process.

KEY TO APB APPROVED CHANGES (e.g., “Modernizing Personnel Security (PS) in the

CJISSECPOL, Spring 2024, APB#11, SA#7: modernize the CJIS Security Policy requirements for:”)

Topic Paper Title

Spring 2024 – Advisory Policy Board cycle and year

APB# – Advisory Policy Board Topic number

SA# – Security and Access Subcommittee Topic number

Summary of change iv

TABLE OF CONTENTS

Executive Summary ....................................................................................................................... i Change Management .................................................................................................................... ii Summary of Changes ................................................................................................................... iii Table of Contents ......................................................................................................................... iv List of Figures ...............................................................................................................................xv List of Priorities.......................................................................................................................... xvi 1 Introduction

1.1 Purpose

1.2 Scope

1.3 Relationship to Local Security Policy and Other Policies

1.4 Terminology Used in This Document

1.5 Distribution of the CJIS Security Policy

2 CJIS Security Policy Approach

2.1 CJIS Security Policy Vision Statement

2.2 Architecture Independent

2.3 Risk Versus Realism

3 Roles and Responsibilities

3.1 Shared Management Philosophy

3.2 Roles and Responsibilities for Agencies and Parties

3.2.1 CJIS Systems Agencies (CSA)

3.2.2 CJIS Systems Officer (CSO)

3.2.3 Terminal Agency Coordinator (TAC)

3.2.4 Criminal Justice Agency (CJA)

3.2.5 Noncriminal Justice Agency (NCJA)

3.2.6 Contracting Agency (CA)

3.2.7 Agency Coordinator (AC)

3.2.8 CJIS Systems Agency Information Security Officer (CSA ISO)

3.2.9 Organizational Personnel with Security Responsibilities

3.2.10 FBI CJIS Division Information Security Officer (FBI CJIS ISO)

3.2.11 Repository Manager

3.2.12 Interface Agency (IA) Official

3.2.13 State Compact Officer (SCO)

4 Criminal Justice Information and Personally Identifiable Information

4.1 Criminal Justice Information (CJI)

4.1.1 Criminal History Record Information (CHRI)

4.2 Access, Use and Dissemination of Criminal History Record Information (CHRI), NCIC

Restricted Files Information, and NCIC Non-Restricted Files Information

4.2.1 Proper Access, Use, and Dissemination of CHRI

4.2.2 Proper Access, Use, and Dissemination of NCIC Restricted Files Information

4.2.3 Proper Access, Use, and Dissemination of NCIC Non-Restricted Files Information

4.2.3.1 For Official Purposes

4.2.3.2 For Other Authorized Purposes

4.2.3.3 CSO Authority in Other Circumstances

v

4.2.4 Storage

4.2.5 Justification and Penalties

4.2.5.1 Justification

4.2.5.2 Penalties

4.3 Personally Identifiable Information (PII)

5 Policy and Implementation

5.1 Policy Area 1: Information Exchange Agreements

5.1.1 Information Exchange

5.1.2 Monitoring, Review, and Delivery of Services

5.1.2.1 Managing Changes to Service Providers

ACCESS CONTROL (AC)

AC-1 POLICY AND PROCEDURES

AC-2 ACCOUNT MANAGEMENT

(1) ACCOUNT MANAGEMENT | AUTOMATED SYSTEM ACCOUNT

MANAGEMENT

(2) ACCOUNT MANAGEMENT | AUTOMATED TEMPORARY AND

EMERGENCY ACCOUNT MANAGEMENT

(3) ACCOUNT MANAGEMENT | DISABLE ACCOUNTS

(4) ACCOUNT MANAGEMENT | AUTOMATED AUDIT ACTIONS

(5) ACCOUNT MANAGEMENT | INACTIVITY LOGOUT

(13) ACCOUNT MANAGEMENT | DISABLE ACCOUNTS FOR HIGH-RISK

INDIVIDUALS

AC-3 ACCESS ENFORCEMENT

(14) ACCESS ENFORCEMENT | INDIVIDUAL ACCESS

AC-4 INFORMATION FLOW ENFORCEMENT

AC-5 SEPARATION OF DUTIES

AC-6 LEAST PRIVILEGE

(1) LEAST PRIVILEGE | AUTHORIZE ACCESS TO SECURITY FUNCTIONS

(2) LEAST PRIVILEGE | NON-PRIVILEGED ACCESS FOR NONSECURITY

FUNCTIONS

(5) LEAST PRIVILEGE | PRIVILEGED ACCOUNTS

(7) LEAST PRIVILEGE | REVIEW OF USER PRIVILEGES

(9) LEAST PRIVILEGE | LOG USE OF PRIVILEGED FUNCTIONS

(10) LEAST PRIVILEGE | PROHIBIT NON-PRIVILEGED USERS FROM

EXECUTING PRIVILEGED FUNCTIONS

AC-7 UNSUCCESSFUL LOGON ATTEMPTS

AC-8 SYSTEM USE NOTIFICATION

AC-11 DEVICE LOCK

(1) DEVICE LOCK | PATTERN-HIDING DISPLAYS

AC-12 SESSION TERMINATION

AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR

AUTHENTICATION

AC-17 REMOTE ACCESS

(1) REMOTE ACCESS | MONITORING AND CONTROL

(2) REMOTE ACCESS | PROTECTION OF CONFIDENTIALITY AND INTEGRITY

USING ENCRYPTION

vi

(3) REMOTE ACCESS | MANAGED ACCESS CONTROL POINTS

(4) REMOTE ACCESS | PRIVILEGED COMMANDS AND ACCESS

AC-18 WIRELESS ACCESS

(1) WIRELESS ACCESS | AUTHENTICATION AND ENCRYPTION

(3) WIRELESS ACCESS | DISABLE WIRELESS NETWORKING

AC-19 ACCESS CONTROL FOR MOBILE DEVICES

(5) ACCESS CONTROL FOR MOBILE DEVICES | FULL DEVICE OR

CONTAINER-BASED ENCRYPTION

AC-20 USE OF EXTERNAL SYSTEMS

(1) USE OF EXTERNAL SYSTEMS | LIMITS ON AUTHORIZED USE

(2) USE OF EXTERNAL SYSTEMS | PORTABLE STORAGE DEVICES —

RESTRICTED USE

AC-21 INFORMATION SHARING

AC-22 PUBLICLY ACCESSIBLE CONTENT

AWARENESS AND TRAINING (AT)

AT-1 POLICY AND PROCEDURES

AT-2 LITERACY TRAINING AND AWARENESS

(2) LITERACY TRAINING AND AWARENESS | INSIDER THREAT

(3) LITERACY TRAINING AND AWARENESS | SOCIAL ENGINEERING AND

MINING

AT-3 ROLE-BASED TRAINING

(5) ROLE-BASED TRAINING | PROCESSING PERSONALLY IDENTIFIABLE

INFORMATION

AT-4 TRAINING RECORDS

AUDIT AND ACCOUNTABILITY (AU)

AU-1 POLICY AND PROCEDURES

AU-2 EVENT LOGGING

AU-3 CONTENT OF AUDIT RECORDS

(1) CONTENT OF AUDIT RECORDS | ADDITIONAL AUDIT INFORMATION

(3) CONTENT OF AUDIT RECORDS | LIMIT PERSONALLY IDENTIFIABLE

INFORMATION ELEMENTS

AU-4 AUDIT LOG STORAGE CAPACITY

AU-5 RESPONSE TO AUDIT LOGGING PROCESS FAILURES

AU-6 AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING

(1) AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | AUTOMATED

PROCESS INTEGRATION

(3) AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | CORRELATE

AUDIT RECORD REPOSITORIES

AU-7 AUDIT RECORD REDUCTION AND REPORT GENERATION

(1) AUDIT RECORD REDUCTION AND REPORT GENERATION | AUTOMATIC

PROCESSING

AU-8 TIME STAMPS

AU-9 PROTECTION OF AUDIT INFORMATION

(4) PROTECTION OF AUDIT INFORMATION | ACCESS BY SUBSET OF

PRIVILEGED USERS

AU-11 AUDIT RECORD RETENTION

vii

AU-12 AUDIT RECORD GENERATION

ASSESSMENT, AUTHORIZATION, AND MONITORING (CA)

CA-1 POLICY AND PROCEDURES

CA-2 CONTROL ASSESSMENTS

(1) CONTROL ASSESSMENTS | INDEPENDENT ASSESSORS

CA-3 INFORMATION EXCHANGE

CA-5 PLAN OF ACTION AND MILESTONES

CA-6 AUTHORIZATION

CA-7 CONTINUOUS MONITORING

(1) CONTINUOUS MONITORING | INDEPENDENT ASSESSMENT

(4) CONTINUOUS MONITORING | RISK MONITORING

CA-9 INTERNAL SYSTEM CONNECTIONS

CONFIGURATION MANAGEMENT (CM)

CM-1 POLICY AND PROCEDURES

CM-2 BASELINE CONFIGURATION

(2) BASELINE CONFIGURATION | AUTOMATION SUPPORT FOR ACCURACY

AND CURRENCY

(3) BASELINE CONFIGURATION | RETENTION OF PREVIOUS

CONFIGURATIONS

(7) BASELINE CONFIGURATION | CONFIGURE SYSTEMS AND COMPONENTS

FOR HIGH-RISK AREAS

CM-3 CONFIGURATION CHANGE CONTROL

(2) CONFIGURATION CHANGE CONTROL | TESTING, VALIDATION, AND

DOCUMENTATION OF CHANGES

(4) CONFIGURATION CHANGE CONTROL | SECURITY AND PRIVACY

REPRESENTATIVES

CM-4 IMPACT ANALYSES

(2) IMPACT ANALYSES | VERIFICATION OF CONTROLS

CM-5 ACCESS RESTRICTIONS FOR CHANGE

CM-6 CONFIGURATION SETTINGS

CM-7 LEAST FUNCTIONALITY

(1) LEAST FUNCTIONALITY | PERIODIC REVIEW

(2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION

(5) LEAST FUNCTIONALITY | AUTHORIZED SOFTWARE — ALLOW-BY-

EXCEPTION

CM-8 SYSTEM COMPONENT INVENTORY

(1) SYSTEM COMPONENT INVENTORY | UPDATES DURING INSTALLATION

AND REMOVAL

(3) SYSTEM COMPONENT INVENTORY | AUTOMATED UNAUTHORIZED

COMPONENT DETECTION

CM-9 CONFIGURATION MANAGEMENT PLAN

CM-10 SOFTWARE USAGE RESTRICTIONS

CM-11 USER-INSTALLED SOFTWARE

CM-12 INFORMATION LOCATION

(1) INFORMATION LOCATION | AUTOMATED TOOLS TO SUPPORT

INFORMATION LOCATION

viii

CONTINGENCY PLANNING (CP)

CP-1 POLICY AND PROCEDURES

CP-2 CONTINGENCY PLAN

(1) CONTINGENCY PLAN | COORDINATE WITH RELATED PLANS

(3) CONTINGENCY PLAN | RESUME MISSION AND BUSINESS FUNCTIONS

(8) CONTINGENCY PLAN | IDENTIFY CRITICAL ASSETS

CP-3 CONTINGENCY TRAINING

CP-4 CONTINGENCY PLAN TESTING

(1) CONTINGENCY PLAN TESTING | COORDINATE WITH RELATED PLANS ...84

CP-6 ALTERNATE STORAGE SITE

(1) ALTERNATE STORAGE SITE | SEPARATION FROM PRIMARY SITE

(3) ALTERNATE STORAGE SITE | ACCESSIBILITY

CP-7 ALTERNATE PROCESSING SITE

(1) ALTERNATE PROCESSING SITE | SEPARATION FROM PRIMARY SITE

(2) ALTERNATE PROCESSING SITE | ACCESSIBILITY

(3) ALTERNATE PROCESSING SITE | PRIORITY OF SERVICE

CP-8 TELECOMMUNICATIONS SERVICES

(1) TELECOMMUNICATIONS SERVICES | PRIORITY OF SERVICE PROVISIONS

(2) TELECOMMUNICATIONS SERVICES | SINGLE POINTS OF FAILURE

CP-9 SYSTEM BACKUP

(1) SYSTEM BACKUP | TESTING FOR RELIABILITY AND INTEGRITY

(8) SYSTEM BACKUP | CRYPTOGRAPHIC PROTECTION

CP-10 SYSTEM RECOVERY AND RECONSTITUTION

(2) SYSTEM RECOVERY AND RECONSTITUTION | TRANSACTION RECOVERY

IDENTIFICATION AND AUTHENTICATION (IA)

IA-0 USE OF ORIGINATING AGENCY IDENTIFIERS IN TRANSACTIONS AND

INFORMATION EXCHANGES

IA-1 POLICY AND PROCEDURES

IA-2 IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)

(1) IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) |

MULTI-FACTOR AUTHENTICATION TO PRIVILEGED ACCOUNTS

(2) IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) |

MULTI-FACTOR AUTHENTICATION TO NON-PRIVILEGED ACCOUNTS ..94

(8) IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) |

ACCESS TO ACCOUNTS — REPLAY RESISTANT

(12) IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) |

ACCEPTANCE OF PIV CREDENTIALS

IA-3 DEVICE IDENTIFICATION AND AUTHENTICATION

IA-4 IDENTIFIER MANAGEMENT

(4) IDENTIFIER MANAGEMENT | IDENTIFY USER STATUS

IA-5 AUTHENTICATOR MANAGEMENT

(1) AUTHENTICATOR MANAGEMENT | AUTHENTICATOR TYPES

(a) Memorized Secret Authenticators and Verifiers:

(b) Look-Up Secret Authenticators and Verifiers ix

(c) Out-of-Band Authenticators and Verifiers

(d) OTP Authenticators and Verifiers

(e) Cryptographic Authenticators and Verifiers (including single- and multi-factor cryptographic authenticators, both hardware- and software-based)

(2) AUTHENTICATOR MANAGEMENT | PUBLIC KEY BASED

AUTHENTICATION

(6) AUTHENTICATOR MANAGEMENT | PROTECTION OF AUTHENTICATORS

IA-6 AUTHENTICATION FEEDBACK

IA-7 CRYPTOGRAPHIC MODULE AUTHENTICATIONF

IA-8 IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL

USERS)

(1) IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL

USERS) | ACCEPTANCE OF PIV CREDENTIALS FROM OTHER AGENCIES

(2) IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL

USERS) | ACCEPTANCE OF EXTERNAL AUTHENTICATORS

(4) IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL

USERS) | USE OF DEFINED PROFILES

IA-11 RE-AUTHENTICATION

IA-12 IDENTITY PROOFING

(2) IDENTITY PROOFING | IDENTITY EVIDENCE

(3) IDENTITY PROOFING | IDENTITY EVIDENCE VALIDATION AND

VERIFICATION

(5) IDENTITY PROOFING | ADDRESS CONFIRMATION

INCIDENT RESPONSE (IR)

IR-1 POLICY AND PROCEDURES

IR-2 INCIDENT RESPONSE TRAINING

(3) INCIDENT RESPONSE TRAINING | BREACH

IR-3 INCIDENT RESPONSE TESTING

(2) INCIDENT RESPONSE TESTING | COORDINATION WITH RELATED PLANS

IR-4 INCIDENT HANDLING

(1) INCIDENT HANDLING | AUTOMATED INCIDENT HANDLING PROCESSES

IR-5 INCIDENT MONITORING

IR-6 INCIDENT REPORTING

(1) INCIDENT REPORTING | AUTOMATED REPORTING

(3) INCIDENT REPORTING | SUPPLY CHAIN COORDINATION

IR-7 INCIDENT RESPONSE ASSISTANCE

(1) INCIDENT RESPONSE ASSISTANCE | AUTOMATION SUPPORT FOR

AVAILABILITY OF INFORMATION AND SUPPORT 10F

IR-8 INCIDENT RESPONSE PLAN

(1) INCIDENT RESPONSE PLAN | BREACHES

MAINTENANCE (MA)

MA-1 POLICY AND PROCEDURES

x

MA-2 CONTROLLED MAINTENANCE

MA-3 MAINTENANCE TOOLS

(1) MAINTENANCE TOOLS | INSPECT TOOLS

(2) MAINTENANCE TOOLS | INSPECT MEDIA

(3) MAINTENANCE TOOLS | PREVENT UNAUTHORIZED REMOVAL

MA-4 NONLOCAL MAINTENANCE

MA-5 MAINTENANCE PERSONNEL

MA-6 TIMELY MAINTENANCE

MEDIA PROTECTION (MP)

MP-1 POLICY AND PROCEDURES

MP-2 MEDIA ACCESS

MP-3 MEDIA MARKING

MP-4 MEDIA STORAGE

MP-5 MEDIA TRANSPORT

MP-6 MEDIA SANITIZATION

MP-7 MEDIA USE

PHYSICAL AND ENVIRONMENTAL PROTECTION (PE)

PE-1 POLICY AND PROCEDURES

PE-2 PHYSICAL ACCESS AUTHORIZATIONS

PE-3 PHYSICAL ACCESS CONTROL

PE-4 ACCESS CONTROL FOR TRANSMISSION

PE-5 ACCESS CONTROL FOR OUTPUT DEVICES

PE-6 MONITORING PHYSICAL ACCESS

(1) MONITORING PHYSICAL ACCESS | INTRUSION ALARMS AND

SURVEILLANCE EQUIPMENT

PE-8 VISITOR ACCESS RECORDS

(3) VISITOR ACCESS RECORDS | LIMIT PERSONALLY IDENTIFIABLE

INFORMATION ELEMENTS

PE-9 POWER EQUIPMENT AND CABLING

PE-10 EMERGENCY SHUTOFF

PE-11 EMERGENCY POWER

PE-12 EMERGENCY LIGHTING

PE-13 FIRE PROTECTION

(1) FIRE PROTECTION | DETECTION SYSTEMS — AUTOMATIC ACTIVATION

AND NOTIFICATION

PE-14 ENVIRONMENTAL CONTROLS

PE-15 WATER DAMAGE PROTECTION

PE-16 DELIVERY AND REMOVAL

PE-17 ALTERNATE WORK SITE

PLANNING (PL)

PL-1 POLICY AND PROCEDURES

PL-2 SYSTEM SECURITY AND PRIVACY PLANS

PL-4 RULES OF BEHAVIOR

(1) RULES OF BEHAVIOR | SOCIAL MEDIA AND EXTERNAL

SITE/APPLICATION USAGE RESTRICTIONS

PL-8 SECURITY AND PRIVACY ARCHITECTURES

xi

PL-9 CENTRAL MANAGEMENT

PL-10 BASELINE SELECTION

PL-11 BASELINE TAILORING

PERSONNEL SECURITY (PS)

PS-1 POLICY AND PROCEDURES

PS-2 POSITION RISK DESIGNATION

PS-3 PERSONNEL SCREENING

PS-4 PERSONNEL TERMINATION

PS-5 PERSONNEL TRANSFER

PS-6 ACCESS AGREEMENTS

PS-7 EXTERNAL PERSONNEL SECURITY

PS-8 PERSONNEL SANCTIONS

PS-9 POSITION DESCRIPTIONS

RISK ASSESSMENT (RA)

RA-1 POLICY AND PROCEDURES

RA-2 SECURITY CATEGORIZATION

RA-3 RISK ASSESSMENT

RA-5 VULNERABILITY MONITORING AND SCANNING

(2) VULNERABILITY MONITORING AND SCANNING | UPDATE

VULNERABILITIES TO BE SCANNED

(5) VULNERABILITY MONITORING AND SCANNING | PRIVILEGED ACCESS

(11) VULNERABILITY MONITORING AND SCANNING | PUBLIC DISCLOSURE

PROGRAM

RA-7 RISK RESPONSE

RA-9 CRITICALITY ANALYSIS

SYSTEM AND SERVICES ACQUISITION (SA)

SA-1 POLICY AND PROCEDURES

SA-2 ALLOCATION OF RESOURCES

SA-3 SYSTEM DEVELOPMENT LIFE CYCLE

SA-4 ACQUISITION PROCESS

(1) ACQUISITION PROCESS | FUNCTIONAL PROPERTIES OF CONTROLS

(2) ACQUISITION PROCESS | DESIGN AND IMPLEMENTATION

INFORMATION FOR CONTROLS

(9) ACQUISITION PROCESS | FUNCTIONS, PORTS, PROTOCOLS, AND

SERVICES IN USE

(10) ACQUISITION PROCESS | USE OF APPROVED PIV PRODUCTS

SA-5 SYSTEM DOCUMENTATION

SA-8 SECURITY AND PRIVACY ENGINEERING PRINCIPLES

(33) SECURITY AND PRIVACY ENGINEERING PRINCIPLES | MINIMIZATION 227

SA-9 EXTERNAL SYSTEM SERVICES

(2) EXTERNAL SYSTEM SERVICES | IDENTIFICATION OF FUNCTIONS,

PORTS, PROTOCOLS, AND SERVICES

SA-10 DEVELOPER CONFIGURATION MANAGEMENT

SA-11 DEVELOPER TESTING AND EVALUATION

SA-15 DEVELOPMENT PROCESS, STANDARDS, AND TOOLS

xii

(3) DEVELOPMENT PROCESS, STANDARDS, AND TOOLS |CRITICALITY

ANALYSIS

SA-22 UNSUPPORTED SYSTEM COMPONENTS

SYSTEM AND COMMUNICATIONS PROTECTION (SC)

SC-1 POLICY AND PROCEDURES

SC-2 SEPARATION OF SYSTEM AND USER FUNCTIONALITY

SC-4 INFORMATION IN SHARED SYSTEM RESOURCES

SC-5 DENIAL-OF-SERVICE PROTECTION

SC-7 BOUNDARY PROTECTION

(3) BOUNDARY PROTECTION | ACCESS POINTS

(4) BOUNDARY PROTECTION | EXTERNAL TELECOMMUNICATIONS

SERVICES

(5) BOUNDARY PROTECTION | DENY BY DEFAULT — ALLOW BY

EXCEPTION

(7) BOUNDARY PROTECTION | SPLIT TUNNELING FOR REMOTE DEVICES ..239

(8) BOUNDARY PROTECTION | ROUTE TRAFFIC TO AUTHENTICATED PROXY

SERVERS

(24) BOUNDARY PROTECTION | PERSONALLY IDENTIFIABLE INFORMATION

SC-8 TRANSMISSION CONFIDENTIALITY AND INTEGRITY

(1) TRANSMISSION CONFIDENTIALITY AND INTEGRITY | CRYPTOGRAPHIC

PROTECTION

SC-10 NETWORK DISCONNECT

SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT

SC-13 CRYPTOGRAPHIC PROTECTION

SC-15 COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS

SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES

SC-18 MOBILE CODE

SC-20 SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE

SOURCE)

SC-21 SECURE NAME/ADDRESS RESOLUTION SERVICE (RECURSIVE OR

CACHING RESOLVER)

SC-22 ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION

SERVICE

SC-23 SESSION AUTHENTICITY

SC-28 PROTECTION OF INFORMATION AT REST

(1) PROTECTION OF INFORMATION AT REST | CRYPTOGRAPHIC

PROTECTION

SC-39 PROCESS ISOLATION

SYSTEM AND INFORMATION INTEGRITY (SI)

SI-1 POLICY AND PROCEDURES

SI-2 FLAW REMEDIATION

(2) FLAW REMEDIATION | AUTOMATED FLAW REMEDIATION STATUS

SI-3 MALICIOUS CODE PROTECTION

SI-4 SYSTEM MONITORING

xiii

(2) SYSTEM MONITORING | AUTOMATED TOOLS AND MECHANISMS FOR

REAL-TIME ANALYSIS

(4) SYSTEM MONITORING | INBOUND AND OUTBOUND COMMUNICATIONS

TRAFFIC

(5) SYSTEM MONITORING | SYSTEM-GENERATED ALERTS

SI-5 SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

SI-7 SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY

(1) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRITY

CHECKS

(7) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRATION

OF DETECTION AND RESPONSE

SI-8 SPAM PROTECTION

(2) SPAM PROTECTION | AUTOMATIC UPDATES

SI-10 INFORMATION INPUT VALIDATION

SI-11 ERROR HANDLING

SI-12 INFORMATION MANAGEMENT AND RETENTION

(1) INFORMATION MANAGEMENT AND RETENTION | LIMIT PERSONALLY

IDENTIFIABLE INFORMATION ELEMENTS

(2) INFORMATION MANAGEMENT AND RETENTION | MINIMIZE

PERSONALLY IDENTIFIABLE INFORMATION IN TESTING, TRAINING,

AND RESEARCH

(3) INFORMATION MANAGEMENT AND RETENTION | INFORMATION

DISPOSAL

SI-16 MEMORY PROTECTION

SUPPLY CHAIN RISK MANAGEMENT (SR)

SR-1 POLICY AND PROCEDURES

SR-2 SUPPLY CHAIN RISK MANAGEMENT PLAN

(1) SUPPLY CHAIN RISK MANAGEMENT PLAN | ESTABLISH SCRM TEAM .264

SR-5 ACQUISITION STRATEGIES, TOOLS, AND METHODS

SR-8 NOTIFICATION AGREEMENTS

SR-10 INSPECTION OF SYSTEMS OR COMPONENTS

SR-12 COMPONENT DISPOSAL

5.20 Policy Area 20: Mobile Devices

5.20.1 Wireless Communications Technologies

5.20.1.1 802.11 Wireless Protocols

5.20.1.2 Cellular Devices

5.20.1.2.1 Cellular Service Abroad

5.20.1.2.2 Voice Transmissions Over Cellular Devices

5.20.1.3 Bluetooth

5.20.1.4 Mobile Hotspots

5.20.2 Mobile Device Management (MDM)

5.20.3 Wireless Device Risk Mitigations

5.20.4 System Integrity

5.20.4.1 Patching/Updates

5.20.4.2 Malicious Code Protection

5.20.4.3 Personal Firewall

xiv

5.20.5 Incident Response

5.20.6 Access Control

5.20.7 Identification and Authentication

5.20.7.1 Local Device Authentication

5.20.7.2 Advanced Authentication

5.20.7.2.1 Compensating Controls

5.20.7.3 Device Certificates

Appendices

APPENDIX A: TERMS AND DEFINITIONS

APPENDIX B: ACRONYMS

APPENDIX C: NETWORK TOPOLOGY DIAGRAMS

APPENDIX D: SAMPLE INFORMATION EXCHANGE AGREEMENTS

D.1 CJIS User Agreement D.2 Management Control Agreement D.3 Noncriminal Justice Agency Agreement & Memorandum of Understanding D.4 Interagency Connection Agreement

APPENDIX E: SECURITY FORUMS AND ORGANIZATIONAL ENTITIES

APPENDIX F: SAMPLE FORMS

F.1 Security Incident Response Form

APPENDIX G: BEST PRACTICES

G.1 Virtualization G.2 Voice over Internet Protocol G.3 Cloud Computing G.4 Mobile Appendix G.5 Administrator Accounts for Least Privilege and Separation of Duties G.6 Encryption G.7 Incident Response G.8 Secure Coding G.9 NIST Authentication Primer

APPENDIX H: SECURITY ADDENDUM

APPENDIX I: REFERENCES

xv

LIST OF FIGURES

Figure 1 – Overview Diagram of Strategic Functions and Policy Components

Figure 2 – Dissemination of restricted and non-restricted NCIC data Figure 3 – Information Exchange Agreements Implemented by a Local Police Department Figure 4 – Security Awareness Training Use Cases Figure 5 – A Local Police Department’s Configuration Management Controls Figure 6 – Digital Identity Model

Figure 7 – Notional Strengths of Evidence Types Figure 8 – Types of Identity Evidence Security Features Figure 9 – Validating Identity Evidence Figure 10 – Verification Methods and Strengths Figure 11 – Incident Response Process Initiated by an Incident in a Local Police Department .174

Figure 12 – A Local Police Department’s Media Management Policies Figure 13 – Personnel Security Use Cases

Figure 14 – System and Communications Protection and Information Integrity Use Cases xvi

LIST OF PRIORITIES

NOTE: An asterisk (‘*’) in the Priority column indicates an existing control from version 5.9.

No. Control Name Enhancements Priority

AC-1 POLICY AND PROCEDURES AC-1 P2

AC-2 ACCOUNT MANAGEMENT AC-2 (1) (2) (3) (4) (5) (13) P1

AC-3 ACCESS ENFORCEMENT AC-3 (14) P1*

AC-4 INFORMATION FLOW ENFORCEMENT AC-4 P1*

AC-5 SEPARATION OF DUTIES AC-5 P1*

AC-6 LEAST PRIVILEGE AC-6 (1) (2) (5) (7) (9) (10) P1*

AC-7 UNSUCCESSFUL LOGON ATTEMPTS AC-7 P3*

AC-8 SYSTEM USE NOTIFICATION AC-8 P2*

AC-11 DEVICE LOCK AC-11 (1) P4*

AC-12 SESSION TERMINATION AC-12 P3

AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION AC-14 P4

AC-17 REMOTE ACCESS AC-17 (1) (2) (3) (4) P1

AC-18 WIRELESS ACCESS AC-18 (1) (3) P2*

AC-19 ACCESS CONTROL FOR MOBILE DEVICES AC-19 (5) P2*

AC-20 USE OF EXTERNAL SYSTEMS AC-20 (1) (2) P1

AC-21 INFORMATION SHARING AC-21 P3*

AC-22 PUBLICLY ACCESSIBLE CONTENT AC-22 P4

AT-1 POLICY AND PROCEDURES AT-1 P2

AT-2 LITERACY TRAINING AND AWARENESS AT-2 (2) (3) P2*

AT-3 ROLE-BASED TRAINING AT-3 P2*

AT-3 ROLE-BASED TRAINING | PROCESSING PERSONALLY IDENTIFIABLE INFORMATION AT-3 (5) P2

AT-4 TRAINING RECORDS AT-4 P4*

AU-1 POLICY AND PROCEDURES AU-1 P2

AU-2 EVENT LOGGING AU-2 P2*

AU-3 CONTENT OF AUDIT RECORDS AU-3 (1) P2*

AU-3

CONTENT OF AUDIT RECORDS | LIMIT PERSONALLY IDENTIFIABLE INFORMATION

ELEMENTS

AU-3 (3) P2

AU-4 AUDIT LOG STORAGE CAPACITY AU-4 P2

AU-5 RESPONSE TO AUDIT LOGGING PROCESS FAILURES AU-5 P2*

AU-6 AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING AU-6 (1) (3) P2*

AU-7 AUDIT RECORD REDUCTION AND REPORT GENERATION AU-7 (1) P3

AU-8 TIME STAMPS AU-8 P2*

AU-9 PROTECTION OF AUDIT INFORMATION AU-9 (4) P2*

AU-11 AUDIT RECORD RETENTION AU-11 P4*

AU-12 AUDIT RECORD GENERATION AU-12 P2

CA-1 POLICY AND PROCEDURES CA-1 P2

CA-2 CONTROL ASSESSMENTS CA-2 (1) P3

CA-3 INFORMATION EXCHANGE CA-3 P2*

CA-5 PLAN OF ACTION AND MILESTONES CA-5 P4

xvii

No. Control Name Enhancements Priority

CA-6 AUTHORIZATION CA-6 P3

CA-7 CONTINUOUS MONITORING CA-7 (1) (4) P1

CA-9 INTERNAL SYSTEM CONNECTIONS CA-9 P3

CM-1 POLICY AND PROCEDURES CM-1 P2

CM-2 BASELINE CONFIGURATION CM-2 (2) (3) (7) P1

CM-3 CONFIGURATION CHANGE CONTROL CM-3 (2) (4) P2

CM-4 IMPACT ANALYSES CM-4 (2) P3

CM-5 ACCESS RESTRICTIONS FOR CHANGE CM-5 P1

CM-6 CONFIGURATION SETTINGS CM-6 P1

CM-7 LEAST FUNCTIONALITY CM-7 (1) (2) (5) P1

CM-8 SYSTEM COMPONENT INVENTORY CM-8 (1) (3) P1

CM-9 CONFIGURATION MANAGEMENT PLAN CM-9 P2

CM-10 SOFTWARE USAGE RESTRICTIONS CM-10 P3

CM-11 USER-INSTALLED SOFTWARE CM-11 P2

CM-12 INFORMATION LOCATION CM-12 (1) P2

CP-1 POLICY AND PROCEDURES CP-1 P2

CP-2 CONTINGENCY PLAN CP-2 (1) (3) (8) P2

CP-3 CONTINGENCY TRAINING CP-3 P3

CP-4 CONTINGENCY PLAN TESTING CP-4 (1) P3

CP-6 ALTERNATE STORAGE SITE CP-6 (1) (3) P2

CP-7 ALTERNATE PROCESSING SITE CP-7 (1) (2) (3) P2

CP-8 TELECOMMUNICATIONS SERVICES CP-8 (1) (2) P2

CP-9 SYSTEM BACKUP CP-9 (1) (8) P2

CP-10 SYSTEM RECOVERY AND RECONSTITUTION CP-10 (2) P2

IA-1 POLICY AND PROCEDURES IA-1 P2

IA-2 IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) IA-2 (1) (2) (8) (12) P1

IA-3 DEVICE IDENTIFICATION AND AUTHENTICATION IA-3 P2

IA-4 IDENTIFIER MANAGEMENT IA-4 (4) P2*

IA-5 AUTHENTICATOR MANAGEMENT IA-5 (1) (2) (6) P1

IA-6 AUTHENTICATION FEEDBACK IA-6 P3*

IA-7 CRYPTOGRAPHIC MODULE AUTHENTICATION IA-7 P2

IA-8 IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) IA-8 (1) (2) (4) P2

IA-11 RE-AUTHENTICATION IA-11 P2

IA-12 IDENTITY PROOFING IA-12 (2) (3) (5) P2

IR-1 POLICY AND PROCEDURES IR-1 P2*

IR-2 INCIDENT RESPONSE TRAINING IR-2 P3*

IR-2 INCIDENT RESPONSE TRAINING | BREACH IR-2 (3) P3

IR-3 INCIDENT RESPONSE TESTING IR-3 (2) P3

IR-4 INCIDENT HANDLING IR-4 (1) P2*

IR-5 INCIDENT MONITORING IR-5 P2*

IR-6 INCIDENT REPORTING IR-6 (1) (3) P2*

IR-7 INCIDENT RESPONSE ASSISTANCE IR-7 (1) P3*

xviii

IR-8 INCIDENT RESPONSE PLAN IR-8 P2*

IR-8 INCIDENT RESPONSE PLAN | BREACHES IR-8 (1) P2

MA-1 POLICY AND PROCEDURES MA-1 P2

MA-2 CONTROLLED MAINTENANCE MA-2 P3

MA-3 MAINTENANCE TOOLS MA-3 (1) (2) (3) P4

MA-4 NONLOCAL MAINTENANCE MA-4 P3

MA-5 MAINTENANCE PERSONNEL MA-5 P3

MA-6 TIMELY MAINTENANCE MA-6 P3

MP-1 POLICY AND PROCEDURES MP-1 P2*

MP-2 MEDIA ACCESS MP-2 P2*

MP-3 MEDIA MARKING MP-3 P3*

MP-4 MEDIA STORAGE MP-4 P2*

MP-5 MEDIA TRANSPORT MP-5 P2*

MP-6 MEDIA SANITIZATION MP-6 P2*

MP-7 MEDIA USE MP-7 P2*

PE-1 POLICY AND PROCEDURES PE-1 P2

PE-2 PHYSICAL ACCESS AUTHORIZATIONS PE-2 P2*

PE-3 PHYSICAL ACCESS CONTROL PE-3 P2*

PE-4 ACCESS CONTROL FOR TRANSMISSION PE-4 P2*

PE-5 ACCESS CONTROL FOR OUTPUT DEVICES PE-5 P3*

PE-6 MONITORING PHYSICAL ACCESS PE-6 (1) P2*

PE-8 VISITOR ACCESS RECORDS PE-8 (3) P4

PE-9 POWER EQUIPMENT AND CABLING PE-9 P2

PE-10 EMERGENCY SHUTOFF PE-10 P2

PE-11 EMERGENCY POWER PE-11 P2

PE-12 EMERGENCY LIGHTING PE-12 P2

PE-13 FIRE PROTECTION PE-13 (1) P2

PE-14 ENVIRONMENTAL CONTROLS PE-14 P2

PE-15 WATER DAMAGE PROTECTION PE-15 P2

PE-16 DELIVERY AND REMOVAL PE-16 P3

PE-17 ALTERNATE WORK SITE PE-17 P3*

PL-1 POLICY AND PROCEDURES PL-1 P2

PL-2 SYSTEM SECURITY AND PRIVACY PLANS PL-2 P2

PL-4 RULES OF BEHAVIOR PL-4 (1) P3

PL-8 SECURITY AND PRIVACY ARCHITECTURES PL-8 P2

PL-9 CENTRAL MANAGEMENT PL-9 P4

PL-10 BASELINE SELECTION PL-10 P3

PL-11 BASELINE TAILORING PL-11 P3

PS-1 POLICY AND PROCEDURES PS-1 P2

PS-2 POSITION RISK DESIGNATION PS-2 P2

PS-3 PERSONNEL SCREENING PS-3 P2*

PS-4 PERSONNEL TERMINATION PS-4 P2

xix

PS-5 PERSONNEL TRANSFER PS-5 P3*

PS-6 ACCESS AGREEMENTS PS-6 P4

PS-7 EXTERNAL PERSONNEL SECURITY PS-7 P2*

PS-8 PERSONNEL SANCTIONS PS-8 P4

PS-9 POSITION DESCRIPTIONS PS-9 P4

RA-1 POLICY AND PROCEDURES RA-1 P2

RA-2 SECURITY CATEGORIZATION RA-2 P2

RA-3 RISK ASSESSMENT RA-3 (1) P2

RA-5 VULNERABILITY MONITORING AND SCANNING RA-5 (2) (5) (11) P1

RA-7 RISK RESPONSE RA-7 P2

RA-9 CRITICALITY ANALYSIS RA-9 P2

SA-1 POLICY AND PROCEDURES SA-1 P2

SA-2 ALLOCATION OF RESOURCES SA-2 P2

SA-3 SYSTEM DEVELOPMENT LIFE CYCLE SA-3 P2

SA-4 ACQUISITION PROCESS SA-4 (1) (2) (9) (10) P2

SA-5 SYSTEM DOCUMENTATION SA-5 P3

SA-8 SECURITY AND PRIVACY ENGINEERING PRINCIPLES SA-8 (33) P2

SA-9 EXTERNAL SYSTEM SERVICES SA-9 (2) P2*

SA-10 DEVELOPER CONFIGURATION MANAGEMENT SA-10 P2

SA-11 DEVELOPER TESTING AND EVALUATION SA-11 P2

SA-15 DEVELOPMENT PROCESS, STANDARDS, AND TOOLS SA-15 (3) P3

SA-22 UNSUPPORTED SYSTEM COMPONENTS SA-22 P2

SC-1 POLICY AND PROCEDURES SC-1 P2

SC-2 SEPARATION OF SYSTEM AND USER FUNCTIONALITY SC-2 P2*

SC-4 INFORMATION IN SHARED SYSTEM RESOURCES SC-4 P2*

SC-5 DENIAL-OF-SERVICE PROTECTION SC-5 P2

SC-7 BOUNDARY PROTECTION SC-7 (3) (4) (5) (7) (8) (24) P1

SC-8 TRANSMISSION CONFIDENTIALITY AND INTEGRITY SC-8 (1) P2*

SC-10 NETWORK DISCONNECT SC-10 P3

SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT SC-12 P2*

SC-13 CRYPTOGRAPHIC PROTECTION SC-13 P2*

SC-15 COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS SC-15 P2

SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES SC-17 P2*

SC-18 MOBILE CODE SC-18 P3

SC-20 SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE) SC-20 P2

SC-21 SECURE NAME/ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER) SC-21 P2

SC-22 ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION SERVICE SC-22 P2

SC-23 SESSION AUTHENTICITY SC-23 P2

SC-28 PROTECTION OF INFORMATION AT REST SC-28 (1) P2*

SC-39 PROCESS ISOLATION SC-39 P2*

SI-1 POLICY AND PROCEDURES SI-1 P2

SI-2 FLAW REMEDIATION SI-2 (2) P1

xx

SI-3 MALICIOUS CODE PROTECTION SI-3 P1

SI-4 SYSTEM MONITORING SI-4 (2) (4) (5) P1

SI-5 SECURITY ALERTS, ADVISORIES, AND DIRECTIVES SI-5 P2*

SI-7 SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY SI-7 (1) (7) P1

SI-8 SPAM PROTECTION SI-8 (2) P3*

SI-10 INFORMATION INPUT VALIDATION SI-10 P1

SI-11 ERROR HANDLING SI-11 P3

SI-12 INFORMATION MANAGEMENT AND RETENTION SI-12 (1) (2) (3) P3

SI-16 MEMORY PROTECTION SI-16 P2

SR-1 POLICY AND PROCEDURES SR-1 P2

SR-2 SUPPLY CHAIN RISK MANAGEMENT PLAN SR-2 (1) P3

SR-3 SUPPLY CHAIN CONTROLS AND PROCESSES SR-3 P3

SR-5 ACQUISITION STRATEGIES, TOOLS, AND METHODS SR-5 P2

SR-6 SUPPLIER ASSESSMENTS AND REVIEWS SR-6 P2

SR-8 NOTIFICATION AGREEMENTS SR-8 P3

SR-10 INSPECTION OF SYSTEMS OR COMPONENTS SR-10 P3

SR-11 COMPONENT AUTHENTICITY SR-11 (1) (2) P2

SR-12 COMPONENT DISPOSAL SR-12 P3

1 INTRODUCTION

This section details the purpose of this document, its scope, relationship to other information security policies, and its distribution constraints.

1.1 Purpose

The CJISSECPOL provides Criminal Justice Agencies (CJA), Noncriminal Justice Agencies

(NCJA), and Interface Agencies (IA) with a minimum set of security requirements for access to

Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Division systems and information and to protect and safeguard Criminal Justice Information (CJI). The essential premise of the CJISSECPOL is to provide the appropriate controls to ensure the continuity of the protection of CJI, from creation through dissemination or destruction, whether at rest or in transit.

1.2 Scope

At the consent of the advisory process, and taking into consideration federal law and state statutes, the CJISSECPOL applies to all entities with access to, or that operate systems which are used to process, store, or transmit CJI. The CJISSECPOL provides minimum security requirements associated with the creation, viewing, modification, transmission, dissemination, storage, or destruction of CJI.

Entities engaged in the interstate exchange of CHRI for noncriminal justice purposes are also governed by the standards and rules promulgated by the Compact Council.

1.3 Relationship to Local Security Policy and Other Policies

The CJISSECPOL may be used as the sole security policy for the agency. The local agency may complement the CJISSECPOL with a local policy, or the agency may develop their own stand-alone security policy; however, the CJISSECPOL shall always be the minimum standard. State, local, Tribal, territorial (SLTT), and Federal agencies may augment or implement more stringent policies or requirements.

The agency shall develop, disseminate, and maintain formal, documented policy and procedures to facilitate the implementation of the CJISSECPOL and, where applicable, the local security policy. The policies and procedures shall be consistent with applicable laws, executive orders, directives, policies, regulations, standards, and guidance. Procedures developed for CJISSECPOL areas can be developed for the security program in general, and for a particular information system, when required.

1.4 Terminology Used in This Document

Effective in version 5.9.5, priority and implementation markings have been added to the modernized controls. Based on the FBI Director approved APB recommendation, beginning

October 1, 2024, requirements existing prior to the CJISSECPOL modernization (i.e., version

5.9) and those identified as Priority 1 ([Priority 1]) will be the set of sanctionable requirements.

• Non-modernized sections do not have markings but are considered “existing” requirements and continue to be auditable and sanctionable.

• “Existing” modernized requirements and indicated by the [Existing] marking.

• Priority 1 modernized requirements are indicated by the [Priority 1] marking.

• All [Priority 2], [Priority 3], and [Priority 4] modernized requirements fall into a zero-cycle status. The zero-cycle begins October 1, 2024 and ends September 30, 2027.

The following terms are used interchangeably throughout this document:

• Agency and Organization: The two terms in this document refer to any entity that submits or receives information, by any means, to/from FBI CJIS systems or services.

• Organizational Personnel: Individuals belonging to an agency or organization (see above) or contracted to an agency or organization to provide services under contract.

• Information and Data: Both terms refer to CJI.

• System, Information System, Service, or named applications like NCIC: all refer to connections to the FBI’s criminal justice information repositories and the equipment used to establish said connections.

• Requirement and Control: These terms refer to a condition or capability that must be met or possessed by a system or system element to satisfy an agreement, standard, specification, or other formally imposed document.

Appendix A and B provide extensive lists of the terms and acronyms.

Appendix I contains all of the references used in this Policy and may contain additional sources that could apply to any section.

1.5 Distribution of the CJIS Security Policy

The CJISSECPOL, version 6.0 and later, is a publicly available document and may be posted and shared without restrictions.

2 CJIS SECURITY POLICY APPROACH

The CJISSECPOL represents the shared responsibility among FBI CJIS, CJIS Systems Agency

(CSA), State Identification Bureaus (SIB), and Interface Agency (IA) for the appropriate protection of CJI.

2.1 CJIS Security Policy Vision Statement

The executive summary of this document describes the vision in terms of business needs for confidentiality, integrity, and availability of information. The APB collaborates with the FBI CJIS

Division to ensure that the Policy remains updated to meet evolving business, technology and security needs.

2.2 Architecture Independent

The CJISSECPOL looks at the data and protection controls that apply regardless of the implementation architecture. Architectural independence is not intended to lessen the importance of systems, but provide for the replacement of one technology with another while ensuring the controls required to protect the information remain constant. This objective and conceptual focus on security policy areas provide the guidance and standards while avoiding the impact of the constantly changing landscape of technical innovations. The architectural independence of the

Policy provides agencies with the flexibility for tuning their information security infrastructure and policies to reflect their own environments.

2.3 Risk Versus Realism

Each agency faces risk unique to that agency. It is quite possible that several agencies could encounter the same type of risk however depending on resources would mitigate that risk differently. In that light, a risk-based approach can be used when implementing requirements.

3 ROLES AND RESPONSIBILITIES

3.1 Shared Management Philosophy

In the scope of information security, the FBI CJIS Division employs a shared management philosophy with SLTT and Federal criminal justice agencies. Although an advisory policy board for NCIC has existed since 1969, the Director of the FBI established the CJIS APB in March 1994 to enable appropriate input and recommend policy with respect to CJIS services. Through the

APB and its Subcommittees and Working Groups, consideration is given to the needs of the criminal justice and law enforcement community regarding public policy, statutory and privacy aspects, as well as national security relative to CJIS systems and information. The APB, including a representative of the Compact Council, represents criminal and noncriminal justice agencies throughout the United States, its territories, and Canada.

The FBI has a similar relationship with the Compact Council, which governs the interstate exchange of criminal history records for noncriminal justice purposes. The Compact Council is mandated by federal law to promulgate rules and procedures for the use of the Interstate

Identification Index (III) for noncriminal justice purposes. To meet that responsibility, the

Compact Council depends on the CJISSECPOL as the definitive source for standards defining the security and privacy of records exchanged with noncriminal justice practitioners.

3.2 Roles and Responsibilities for Agencies and Parties

It is the responsibility of all agencies covered under this Policy to ensure the protection of CJI between the FBI CJIS Division and its user community. The following figure provides an abstract representation of the strategic functions and roles such as governance and operations.

Figure 1 – Overview Diagram of Strategic Functions and Policy Components

This section provides a description of the following entities and roles:

1. CJIS Systems Agency (CSA).

2. CJIS Systems Officer (CSO).

3. Terminal Agency Coordinator (TAC).

4. Criminal Justice Agency (CJA).

5. Noncriminal Justice Agency (NCJA).

6. Contracting Agency (CA).

7. Agency Coordinator (AC).

8. CJIS Systems Agency (CSA) Information Security Officer (ISO).

9. Organizational Personnel with Security Responsibilities.

10. FBI CJIS Division Information Security Officer (ISO).

11. SIB Chief/Repository Manager/Chief Administrator.

12. Interface Agency (IA) Official

13. State Compact Officer (SCO).

3.2.1 CJIS Systems Agencies (CSA)

The CSA is responsible for establishing and administering an information technology security program throughout the CSA’s user community, to include the local levels. The head of each CSA shall appoint a CJIS Systems Officer (CSO). The CSA may impose more stringent or additional protection measures than outlined in this document. Such decisions shall be documented and kept current.

3.2.2 CJIS Systems Officer (CSO)

The CSO is an individual located within the CSA responsible for the administration of the CJIS network for the CSA. Pursuant to the Bylaws for the CJIS Advisory Policy Board and Working

Groups, the role of CSO shall not be outsourced. The CSO may delegate responsibilities to subordinate agencies. The CSO shall set, maintain, and enforce the following:

1. Standards for the selection, supervision, and separation of personnel who have access to

CJI.

2. Policy governing the operation of computers, access devices, circuits, hubs, routers, firewalls, and other components that comprise and support a telecommunications network and related CJIS systems used to process, store, or transmit CJI, guaranteeing the priority of service required by the law enforcement community, confidentiality, integrity, and availability of CJI.

a. Ensure appropriate use, enforce system discipline, and ensure CJIS Division operating procedures are followed by all users of the respective services and information.

b. Ensure state/federal agency compliance with policies approved by the APB and adopted by the FBI.

c. Ensure the appointment of the CSA ISO and determine the extent of authority to the

CSA ISO.

d. Ensure the designation of a Terminal Agency Coordinator (TAC) within each agency with devices accessing CJIS systems.

e. Ensure each agency having access to CJI has someone designated as the Organizational

Personnel with Security Responsibilities.

f. Ensure each Organizational Personnel with Security Responsibilities receives enhanced security awareness training (ref. Awareness and Training (AT)).

g. Approve access to FBI CJIS systems.

h. Assume ultimate responsibility for managing the security of CJIS systems within their state and/or agency.

i. Perform other related duties outlined by the user agreements with the FBI CJIS

Division.

3. External System Services of Criminal Justice Functions

Responsibility for the management and control of security requirements for information systems which process, store, or transmit CJI shall remain with the CJA. Management and control includes the authority to:

a. Set and enforce standards for the selection, supervision, and termination of access to

CJI;

b. Set and enforce policy governing the operation of computers, circuits, and telecommunications terminals,

c. Guarantee the priority service as determined by the CSA.

3.2.3 Terminal Agency Coordinator (TAC)

The TAC serves as the point-of-contact at the local agency for matters relating to CJIS information access. The TAC administers CJIS systems programs within the local agency and oversees the agency’s compliance with CJIS systems policies.

3.2.4 Criminal Justice Agency (CJA)

A CJA is defined as a court, a governmental agency, or any subunit of a governmental agency which performs the administration of criminal justice pursuant to a statute or executive order and which allocates a substantial part of its annual budget to the administration of criminal justice.

State and federal Inspectors General Offices are included.

3.2.5 Noncriminal Justice Agency (NCJA)

A NCJA is defined (for the purposes of access to CJI) as an entity or any subunit thereof that provides services primarily for purposes other than the administration of criminal justice.

3.2.6 Contracting Agency (CA)

A CA is an agency, whether a CJA, NCJA (public), or NCJA (private), that enters into an agreement with a private contractor subject to the CJIS Security Addendum, the Security and

Management Control Outsourcing Standard for Non-Channeling, or the Security and Management

Control Outsourcing Standard for Channeling. The CA entering into an agreement with a contractor shall appoint an Agency Coordinator.

3.2.7 Agency Coordinator (AC)

An AC is a staff member of the CA who manages the agreement between the Contractor and agency. The AC shall be responsible for the supervision and integrity of the system, training and continuing education of employees and operators, scheduling of initial training and testing, and certification testing and all required reports by NCIC. The AC shall:

1. Understand the communications, records capabilities, and needs of the Contractor which is accessing federal and state records through or because of its relationship with the CA.

2. Participate in related meetings and provide input and comments for system improvement.

3. Receive information from the CA (e.g., system updates) and disseminate it to appropriate

Contractor employees.

4. Maintain and update manuals applicable to the effectuation of the agreement, and provide them to the Contractor.

5. Maintain up-to-date records of Contractor’s employees who access the system, including name, date of birth, social security number, date fingerprint card(s) submitted, date security clearance issued, and date initially trained, tested, certified or recertified (if applicable).

6. Train or ensure the training of Contractor personnel. If Contractor personnel access NCIC, schedule the operators for testing or a certification exam with the CSA staff, or AC staff with permission from the CSA staff as consistent with the NCIC policy.

7. The AC will not permit an untrained/untested or non-certified Contractor employee to access CJI or systems supporting CJI where access to CJI can be gained.

8. Where appropriate, ensure compliance by the Contractor with NCIC validation requirements.

9. Provide completed applicant fingerprint cards on each Contractor employee who accesses the system to the CA (or, where appropriate, CSA) for criminal background investigation prior to such employee accessing the system.

10. Any other responsibility for the AC promulgated by the CA.

3.2.8 CJIS Systems Agency Information Security Officer (CSA ISO)

The CSA ISO shall:

1. Serve as the security point of contact (POC) to the FBI CJIS Division ISO.

2. Document technical compliance with the CJIS Security Policy with the goal to assure the confidentiality, integrity, and availability of criminal justice information to the user community throughout the CSA’s user community, to include the local level.

3. Document and provide assistance for implementing the security-related controls for the

Interface Agency and its users.

4. Establish a security incident response and reporting procedure to discover, investigate, document, and report to the CSA, the affected criminal justice agency, and the FBI CJIS

Division ISO major incidents that significantly endanger the security or integrity of CJI.

3.2.9 Organizational Personnel with Security Responsibilities

Each Organizational Personnel with Security Responsibilities (i.e., LASO, ARSO, Security Point of Contact, etc.) shall:

1. Identify who is using the CSA approved hardware, software, and firmware and ensure no unauthorized individuals or processes have access to the same.

2. Identify and document how the equipment is connected to the state system.

3. Ensure that personnel security screening procedures are being followed as stated in this

Policy.

4. Ensure the approved and appropriate security measures are in place and working as expected.

5. Support policy compliance and ensure the CSA ISO is promptly informed of security incidents.

3.2.10 FBI CJIS Division Information Security Officer (FBI CJIS ISO)

The FBI CJIS ISO shall:

1. Maintain the CJIS Security Policy.

2. Disseminate the FBI Director approved CJIS Security Policy.

3. Serve as a liaison with the CSA’s ISO and with other personnel across the CJIS community and in this regard provide technical guidance as to the intent and implementation of operational and technical policy issues.

4. Serve as a point-of-contact (POC) for computer incident notification and distribution of security alerts to the CSOs and ISOs.

5. Assist with developing audit compliance guidelines as well as identifying and reconciling security-related issues.

6. Develop and participate in information security training programs for the CSOs and ISOs, and provide a means by which to acquire feedback to measure the effectiveness and success of such training.

7. Maintain a security policy resource center (SPRC) on FBI.gov and keep the CSOs and

ISOs updated on pertinent information.

3.2.11 Repository Manager

The State Identification Bureau (SIB) Chief, i.e., Repository Manager or Chief Administrator, is the designated manager of the agency having oversight responsibility for a state’s fingerprint identification services. If both state fingerprint identification services and CJIS systems control are managed within the same state agency, the SIB Chief and CSO may be the same person.

3.2.12 Interface Agency (IA) Official

The IA Official is an employee of the IA responsible for planning necessary hardware, software, funding, and training for the IA’s authorized access to the CJIS Division’s systems. The IA

Official shall not be a contract employee.

3.2.13 State Compact Officer (SCO)

Pursuant to the National Crime Prevention and Privacy Compact, each party state shall appoint a

Compact Officer who shall ensure that Compact provisions and rules, procedures, and standards established by the Compact Council are complied with in their respective state.

4 CRIMINAL JUSTICE INFORMATION AND PERSONALLY

IDENTIFIABLE…