rfp_13365_attachment 4_fbi cjis security policy requirements.xlsx
XLSX spreadsheet 280 KB Posted
- Solicitation number
- BPM013365
- Issued by
- California
About this file
This file is the DOJ CJI Control Matrix v6.0 (May 2026) based on the FBI Criminal Justice Information Services (CJIS) Security Policy v6.0 (December 27, 2024), applicable to the State of California and local criminal justice agencies. The document establishes minimum security requirements for protecting Criminal Justice Information (CJI) throughout its lifecycle, whether at rest or in transit. It applies to all individuals, contractors, and private entities with access to or operating in support of criminal justice services. The matrix serves as a compliance documentation tool where agencies and their service providers must demonstrate adherence to FBI CJIS Security Policy controls across multiple responsibility areas, including information exchange agreements, access control, awareness and training, account management, system monitoring, and supply chain risk management. The control matrix accommodates three cloud service models—Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)—with color-coded responsibility assignments indicating whether controls are the responsibility of the agency, service provider, or both. Each control requires documentation of its implementation status (Implemented, Not Applicable, Planned, or Compensating) along with supporting details and timeframes.
The matrix requires agencies to designate responsible personnel including a CJIS Systems Officer, Agency Coordinator, Information Security Officer, and Organizational Personnel with Security Responsibilities. Key control requirements include account management with automatic system features for creating, disabling, and auditing accounts; access enforcement limiting user privileges to the minimum necessary; unsuccessful logon attempt limitations (five attempts within 15 minutes with automatic account lockout); device lock activation after 30 minutes of inactivity; mandatory annual security awareness and role-based training for all personnel with CJI access; and prohibition of bring-your-own-device (BYOD) and personally-owned systems for accessing CJI. The agency maintains ultimate accountability for compliance and must document all control statuses and details within the matrix for submission to the California Department of Justice, with provisions for separate matrices if multiple solutions are employed. No specific pricing, contract terms, award dates, or renewal options are included in this policy document.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| rfp_13365_full package.pdf | ||
| rfp_13365_attachment 1_it requirements_business critical.xlsx | XLSX spreadsheet | |
| rfp_13365_attachment 3_data security checklist.xlsx | XLSX spreadsheet | |
| rfp_13365_attachment 5_rfp additional submittals.xlsx | XLSX spreadsheet | |
| rfp_13365_attachment 2_it requirements_detailed technical.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| California Department of Justice (DOJ) Criminal Justice Information (CJI) Control Matrix (DOJ CJI Controls Matrix v6.0 - MAY 2026) |
| The DOJ CJI Control Matrix is based is on the FBI Criminal Justice Information Services (CJIS) Security Policy (FBI CJIS Security Policy) |
| FBI CJIS Security Policy v6.0 dated 12/27/2024 |
| DOJ CJI Controls v6.0 Matrix dated 05/01/2026 |
| This document details the minimum requirements of the FBI CJIS Security Policy. The essential premise of the FBI CJIS Security Policy is to provide appropriate controls to protect the full lifecycle of Criminal Justice Information (CJI), whether at rest or in transit. The FBI CJIS Security Policy provides guidance for the creation, viewing, modification, transmission, dissemination, storage, and destruction of CJI. This Policy applies to every individual - contractor, private entity, noncriminal justice agency representative, or member of a criminal justice entity (Agency/Entity) - with access to, or who operate in support of, criminal justice services and information. |
| Moreover, this document's purpose is used for the Agency/Entity to document their compliance of the DOJ Criminal Justise information (CJI) controls alongside their chosen providers response and will be submitted to the DOJ. |
| NOTE: The Agency/Entity is always ultimately accountable to ensure adherence to the FBI CJIS Security Policy |
| The Agency/Entity Responsibility by Cloud Model columns describe who (e.g., Agency, Cloud Service Provider or both the agency and service provider) has the technical capability to perform the actions necessary to ensure a particular requirement is being met. Three sub-columns are labeled IaaS, PaaS and SaaS and depict the type of cloud services being leveraged by the Agency/Entity from the Cloud Service Provider. Respectively, these cloud service models are: |
| IaaS: Infrastructure as a Service (IaaS) is a cloud computing model providing on-demand access to fundamental IT resources like compute, storage, and networking, allowing users to run arbitrary software and applications in a virtualized environment. |
PaaS: Platform as a Service (PaaS), is a cloud computing model that provides a complete development and deployment environment in the cloud.
SaaS: Software as a Service (SaaS), is a cloud-based software delivery model where applications are hosted by a provider and accessed over the internet via a web browser or app.
| Responsibility is color-coded within the columns based on the agreed ability to perform the actions necessary to meet requirements. They are as follows: |
| Agency/Entity |
Service Provider
(Agency/Entity/Service Providers)
TBD (Modernized control that has not been assigned a matrix value by the FBI) / Some modernized controls have not been assigned matrix values and those corresponding cells are colored in Aqua and contain TBD
| If not using a cloud provider and the technology solution is on-premises, please ignore the cloud computing model columns and only fill out the agency columns. If using an off-premises third-party data center, please fill out the applicable agency and service provider columns. |
| For each area of responsibility please select from the Control Status drop down list and select the appropriate status of the control (Implemented, N/A (Not Applicable), Planned, Compensating). Provide further information in the related cells depending on the selected control status. |
| If necessary please complete a separate Control Matrix for each solution. |
| Note: |
Please see worksheet CJI SSP for guidance on completing the Agency/Entity "DOJ CJI System Security Plan"
(CJI-SSP)"
Additionally, Agency/Entity will be required to complete a "DOJ CJI Certification"
Individual Completing Matrix
| Individual completing the DOJ CJI Control Matrix: |
| Name of Agency/Entity: |
| First Last Name: |
Title:
Telephone Number:
Email:
Date created:
Date submitted to DOJ:
| For additional information about this submission, please contact: |
| First Last Name: |
Title:
Telephone Number:
Email:
Example
(FBI CJIS Security Policy) Requirement Agency/Entity Service Provider Service Provider
| SaaS Solution | Cloud Host | ||||||||||||||||||||||||||||||||||||||
| Ver 4.5 Location | Ver 5.0 Location and/or New Requirement/Date | Ver 5.1 Location and/or New Requirement/Date | Ver 5.2 Location and/or New Requirement/Date | Ver 5.3 Location and New Requirement | Ver 5.4 Location and New Requirement | Ver 5.6 Location and New Requirement | Ver 5.7 Location and New Requirement | Ver 5.8 Location and New Requirement | Ver 5.9 Location and New Requirement | Ver 5.9.1 Location and New Requirement | Ver 5.9.2 Location and New Requirement | Ver 5.9.3 Location and New Requirement | Ver 5.9.4 Location and New Requirement | Ver 5.9.5 Location and New Requirement | Ver 6.0 Location and Requirement | Title | Shall Statement / Requirement | Audit / Sanction Date | Priority | Agency Responsibility by Cloud Model | Agency/Entity "Control Status" | Agency/Entity "Details" | Agency/Entity "N/A" | Agency "Planned" | Agency "Compensating Control" | Service Provider #1 "Control Status" | Service Provider #1 "Details" | ||||||||||||
| (*note: create additional columns if needed) | Service Provider #1 "NA" | Service Provider #1 "Planned" | Service Provider #1 "Compensating Control" | Cloud Host | Cloud Hosting Provider Details | Cloud N/A | Cloud Planned | Cloud Compensating Control | |||||||||||||||||||||||||||||||
| IaaS | PaaS | SaaS | Agency/Entity Name: | (Insert Agency/Entity Name) | Service Provider Name: | (Insert Service Provider Name) | Provider Name: | (Insert Cloud Host Provider Name) | |||||||||||||||||||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Control Status | Provide details on how control is met | Provide reason for why control is N/A | Provide timeframe for when planned control will be met | Provide details on compensating control | Control Status | Provide details on how control is met | Provide reason for why control is N/A | Provide timeframe for when planned control will be met | Provide details on compensating control | Control Status | Provide details on how control is met | Provide reason for why control is N/A | Provide timeframe for when planned control will be met | Provide details on compensating control | ||||||||||||||||||||||||
| Section 3.1 & 3.2 | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | |||||||||||||||||||||||||
| New | New (2012) | ||||||||||||||||||||||||||||||||||||||
| 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | CA-3 | INFORMATION EXCHANGE | a. Approve and manage the exchange of information between the agency system and external systems using the following agreements when applicable; | Existing | P2 | Agency | Agency | Agency | Implemented | We have a formal approval process in place to approve and manage external agency information exchange. | N/A | Agency only control. | N/A | Control applies to agency only. | ||||||||||||
| 5.15: SI-4 | |||||||||||||||||||||||||||||||||||||||
| 5.10.1.3 | 5.10.1.3 | 5.10.1.3 | 5.10.1.3 | 5.10.1.3 | 5.10.1.3 | 5.10.1.3 | 5.10.1.3 | 5.10.1.3 | 5.10.1.3 | 5.15: SI-4 (2) | 5.15: SI-4 (2) | 5.15: SI-4 (2) | 5.15: SI-4 (2) | SI-4 (2) | (2) SYSTEM MONITORING | AUTOMATED TOOLS AND MECHANISMS FOR REAL-TIME ANALYSIS | Employ automated tools and mechanisms to support near-real-time analysis of events. | Existing | P1 | Both | Service Provider | Service Provider | Implemented | Logs are sent to agency SIEM which provides analysis of events. | Implemented | We uses various tools to analyze logs in near-real time. | Implemented | We have SIEM systems to provide near-real time analysis. |
SR-2(1) (1) SUPPLY CHAIN RISK MANAGEMENT PLAN | ESTABLISH SCRM TEAM Establish a supply chain risk management team consisting of individuals with security responsibilities and supply chain risk management responsibilities to lead and support the following SCRM activities: information technology, contracting, information security, privacy, mission or business, legal, supply chain and logistics, acquisition, business continuity, and other relevant functions. Zero-cycle P3 TBD TBD TBD Planned We are working on establishing procedures and roles for a SCRM process. Planned to have implemented in six months. Implemented SCRM team established. Implemented Existing processes in place which meets this control.
| New (2012) | New (2012) | ||||||||||||||||||||||||||||
| 5.5.7 | 5.5.7 | 5.5.7 | New | ||||||||||||||||||||||||||
| 5.13 | 5.2 | 5.13 | 5.2 | 5.13 | 5.13 | 5.13 | 5.13 | 5.13 | 5.13 | 5.13 | 5.20 | Mobile Devices | The agency shall: | Existing | Existing | ||||||||||||||
| New (2012) | 5.20 | Mobile Devices | (i) establish usage restrictions and implementation guidance for mobile devices; | Existing | Existing | Agency | Agency | Agency | N/A | Agency does not use mobiles for CJI access | N/A | No mobiles used. | N/A | No mobiles used. | |||||||||||||||
| New (2012) | 5.20 | Mobile Devices | (ii) authorize, monitor, control wireless access to the information system. | Existing | Existing | Agency | Agency | Agency | N/A | Agency does not use mobiles for CJI access | N/A | No mobiles used. | N/A | No mobiles used. |
CM-2 BASELINE CONFIGURATION a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; 10/1/24 P1 TBD TBD TBD Compensating Agency uses CIS Hardened Images instead of developing and documenting their own baseline. The CIS Hardened images are pre-hardened to the CIS Benchmarks.
v6.0 Req
| FBI CJIS Security Policy Requirement | County of San Diego - To Complete Only | Service Provider | Cloud Host | |||||||||||||||||||||||
| Audit / Sanction Date | Priority | Ver 5.9.4 Location and New Requirement | Ver 5.9.5 Location and New Requirement | Ver 6.0 Location and New Requirement | Title | Shall Statement / Requirement | Agency Responsibility by Cloud Model | Agency/Entity "Control Status" | Agency/Entity "Details" | Agency/Entity "N/A" | Agency "Planned" | Agency "Compensating Control" | Service Provider #1 "Control Status" | Service Provider #1 "Details" | ||||||||||||
| (*note: create additional columns if needed) | Service Provider #1 "NA" | Service Provider #1 "Planned" | Service Provider #1 "Compensating Control" | Cloud Host #1 "Control Status" | Cloud Host #1 "Details" | |||||||||||||||||||||
| (*note: create additional columns if needed) | Cloud Host #1 "NA" | Cloud Host #1 "Planned" | Cloud Host #1 "Compensating Control" | |||||||||||||||||||||||
| IaaS | PaaS | SaaS | Agency/Entity Name: | (Insert Agency/Entity Name) | Cloud Host Name: | (Insert Vendor Name) | Cloud Host Name: | (Insert Vendor Name) | ||||||||||||||||||
| Control Status | Provide details on how control is met | Provide reason for why control is N/A | Provide timeframe for when planned control will be met | Provide details on compensating control | Control Status | Provide details on how control is met | Provide reason for why control is N/A | Provide timeframe for when planned control will be met | Provide details on compensating control | Control Status | Provide details on how control is met | Provide reason for why control is N/A | Provide timeframe for when planned control will be met | Provide details on compensating control |
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) |
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 1.3 | 1.3 | 1.3 | Relationship to Local Security Policy and Other Policies | The local agency may complement the CJIS Security Policy with a local policy, or the agency may develop their own stand-alone security policy; however, the CJIS Security Policy shall always be the minimum standard and local policy may augment, or increase the standards,… | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 1.3 | 1.3 | 1.3 | Relationship to Local Security Policy and Other Policies | ...and local policy may augment, or increase the standards, but shall not detract from the CJIS Security Policy standards. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 1.3 | 1.3 | 1.3 | Relationship to Local Security Policy and Other Policies | The agency shall develop, disseminate, and maintain formal, documented procedures to facilitate the implementation of the CJIS Security Policy and, where applicable, the local security policy. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 1.3 | 1.3 | 1.3 | Relationship to Local Security Policy and Other Policies | The policies and procedures shall be consistent with applicable laws, executive orders, directives, policies, regulations, standards, and guidance. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.1 | 3.2.1 | 3.2.1 | CJIS Systems Agencies (CSA) | The head of each CSA shall appoint a CJIS Systems Officer (CSO). | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.1 | 3.2.1 | 3.2.1 | CJIS Systems Agencies (CSA) | Such decisions shall be documented and kept current. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.1 | 3.2.2 | 3.2.2 | CJIS Systems Officer (CSO) | Pursuant to The Bylaws for the CJIS Advisory Policy Board and Working Groups, the role of CSO shall not be outsourced. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.1 | 3.2.2 | 3.2.2 | CJIS Systems Officer (CSO) | The CSO shall set, maintain, and enforce the following: | ||||||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(1) | 3.2.2(1) | 3.2.2(1) | CJIS Systems Officer (CSO) | 1. Standards for the selection, supervision, and separation of personnel who have access to CJI. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(2) | 3.2.2(2) | 3.2.2(2) | CJIS Systems Officer (CSO) | 2. Policy governing the operation of computers, access devices, circuits, hubs, routers, firewalls, and other components that comprise and support a telecommunications network and related CJIS systems used to process, store, or transmit CJI, guaranteeing the priority, confidentiality, integrity, and availability of service needed by the criminal justice community. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(2) | 3.2.2(2) | 3.2.2(2) | CJIS Systems Officer (CSO) | a. Ensure appropriate use, enforce system discipline, and ensure CJIS Division operating procedures are followed by all users of the respective services and information. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(2) | 3.2.2(2) | 3.2.2(2) | CJIS Systems Officer (CSO) | b. Ensure state/federal agency compliance with policies approved by the APB and adopted by the FBI. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(2) | 3.2.2(2) | 3.2.2(2) | CJIS Systems Officer (CSO) | c. Ensure the appointment of the CSA ISO and determine the extent of authority to the CSA ISO. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(2) | 3.2.2(2) | 3.2.2(2) | CJIS Systems Officer (CSO) | d. Ensure the designation of a Terminal Agency Coordinator (TAC) within each agency with device access to CJIS systems. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(2) | 3.2.2(2) | 3.2.2(2) | CJIS Systems Officer (CSO) | e. Ensure each agency having access to CJI has someone designated as the Organizational Personnel with Security Responsibilities. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(2) | 3.2.2(2) | 3.2.2(2) | CJIS Systems Officer (CSO) | f. Ensure the Organizational Personnel with Security Responsibilities receives enhanced security awareness training (ref. Awareness and Training (AT)). | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(2) | 3.2.2(2) | 3.2.2(2) | CJIS Systems Officer (CSO) | g. Approve access to FBI CJIS systems. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(2) | 3.2.2(2) | 3.2.2(2) | CJIS Systems Officer (CSO) | h. Assume ultimate responsibility for managing the security of CJIS systems within their state and/or agency. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.2(2) | 3.2.2(2) | 3.2.2(2) | CJIS Systems Officer (CSO) | i. Perform other related duties outlined by the user agreements with the FBI CJIS Division. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.3(3) | 3.2.3(3) | 3.2.3(3) | CJIS Systems Officer (CSO) | 3. External System Services of Criminal Justice Functions: Responsibility for the management and control of security requirements for information systems which process, store, or transmit CJI remains with the CJA. Management and control includes the authority to: | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.3(3) | 3.2.3(3) | 3.2.3(3) | CJIS Systems Officer (CSO) | a. Set and enforce standards for the selection, supervision, and termination of access to CJI; | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.3(3) | 3.2.3(3) | 3.2.3(3) | CJIS Systems Officer (CSO) | b. Set and enforce policy governing the operation of computers, circuits, and telecommunications terminals, | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.3(3) | 3.2.3(3) | 3.2.3(3) | CJIS Systems Officer (CSO) | c. Guarantee the priority service as determined by the CSA. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.6 | 3.2.6 | 3.2.6 | Contracting Agency (CA) | A CA is an agency, whether a CJA, NCJA (public), or NCJA (private), that enters into an agreement with a private contractor subject to the CJIS Security Addendum, The Security and Management Control Outsourcing Standard for Non-Channelers, of the Security and Management Control Outsourcing Standard for Channeling. The CA entering into an agreement with a contractor shall appoint an Agency Coordinator. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | The AC shall be responsible for the supervision and integrity of the system, training and continuing education of employees and operators, scheduling of initial training and testing, and certification testing and all required reports by NCIC. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | The AC shall: | ||||||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | 1. Understand the communications, records capabilities, and needs of the Contractor which is accessing federal and state records through or because of its relationship with the CGA. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | 2. Participate in related meetings and provide input and comments for system improvement. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | 3. Receive information from the CGA (e.g., system updates) and disseminate it to appropriate Contractor employees. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | 4. Maintain and update manuals applicable to the effectuation of the agreement, and provide them to the Contractor. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | 5. Maintain up-to-date records of Contractor’s employees who access the system, including name, date of birth, social security number, date fingerprint card(s) submitted, date security clearance issued, and date initially trained, tested, certified or recertified (if applicable). | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | 6. Train or ensure the training of Contractor personnel. If Contractor personnel access NCIC, schedule the operators for testing or a certification exam with the CSA staff, or AC staff with permission from the CSA staff. Schedule new operators for the certification exam within six (6) months of assignment. Schedule certified operators for biennial re-certification testing within thirty (30) days prior to the expiration of certification. Schedule operators for other mandated class. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | 7. The AC will not permit an untrained/untested or non-certified Contractor employee to access CJI or systems supporting CJI where access to CJI can be gained. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | 8. Where appropriate, ensure compliance by the Contractor with NCIC validation requirements. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | 9. Provide completed applicant fingerprint cards on each Contractor employee who accesses the system to the CJA (or, where appropriate, CSA) for criminal background investigation prior to such employee accessing the system. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.7 | 3.2.7 | 3.2.7 | Agency Coordinator (AC) | 10. Any other responsibility for the AC promulgated by the FBI. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.8 | 3.2.8 | 3.2.8 | CJIS System Agency Information Security Officer (CSA ISO) | The CSA ISO shall: | ||||||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.8 | 3.2.8 | 3.2.8 | CJIS System Agency Information Security Officer (CSA ISO) | 1. Serve as the security point of contact (POC) to the FBI CJIS Division ISO. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.8 | 3.2.8 | 3.2.8 | CJIS System Agency Information Security Officer (CSA ISO) | 2. Document technical compliance with the CJIS Security Policy with the goal to assure the confidentiality, integrity, and availability of criminal justice information to the user community throughout the CSA’s user community, to include the local level. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.8 | 3.2.8 | 3.2.8 | CJIS System Agency Information Security Officer (CSA ISO) | 3. Document and provide assistance for implementing the security-related controls for the Interface Agency and its users. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.8 | 3.2.8 | 3.2.8 | CJIS System Agency Information Security Officer (CSA ISO) | 4. Establish a security incident response and reporting procedure to discover, investigate, document, and report to the CSA, the affected criminal justice agency, and the FBI CJIS Division ISO major incidents that significantly endanger the security or integrity of CJI. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.9 | 3.2.9 | 3.2.9 | Organizational Personnel with Security Responsibilities | Each Organizational Personnel with Security Responsibilities shall: | ||||||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.9 | 3.2.9 | 3.2.9 | Organizational Personnel with Security Responsibilities | 1. Identify who is using the CSA approved hardware, software, and firmware and ensure no unauthorized individuals or processes have access to the same. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.9 | 3.2.9 | 3.2.9 | Organizational Personnel with Security Responsibilities | 2. Identify and document how the equipment is connected to the state system. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.9 | 3.2.9 | 3.2.9 | Organizational Personnel with Security Responsibilities | 3. Ensure that personnel security screening procedures are being followed as stated in this policy. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.9 | 3.2.9 | 3.2.9 | Organizational Personnel with Security Responsibilities | 4. Ensure the approved and appropriate security measures are in place and working as expected. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.9 | 3.2.9 | 3.2.9 | Organizational Personnel with Security Responsibilities | 5. Support policy compliance and ensure CSA ISO is promptly informed of security incidents. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.10 | 3.2.10 | 3.2.10 | FBI CJIS Division Information Security Officer (FBI CJIS ISO) | The FBI CJIS ISO shall: | ||||||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.10 | 3.2.10 | 3.2.10 | FBI CJIS Division Information Security Officer (FBI CJIS ISO) | 1. Maintain the CJIS Security Policy. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.10 | 3.2.10 | 3.2.10 | FBI CJIS Division Information Security Officer (FBI CJIS ISO) | 2. Disseminate the FBI Director approved CJIS Security Policy. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.10 | 3.2.10 | 3.2.10 | FBI CJIS Division Information Security Officer (FBI CJIS ISO) | 3. Serve as a liaison with the CSA’s ISO and with other personnel across the CJIS community and in this regard provide technical guidance as to the intent and implementation of operational and technical policy issues. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.10 | 3.2.10 | 3.2.10 | FBI CJIS Division Information Security Officer (FBI CJIS ISO) | 4. Serve as a point-of-contact (POC) for computer incident notification and distribution of security alerts to the CSOs and ISOs. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.10 | 3.2.10 | 3.2.10 | FBI CJIS Division Information Security Officer (FBI CJIS ISO) | 5. Assist with developing audit compliance guidelines as well as identifying and reconciling security-related issues. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.10 | 3.2.10 | 3.2.10 | FBI CJIS Division Information Security Officer (FBI CJIS ISO) | 6. Develop and participate in information security training programs for the CSOs and ISOs, and provide a means by which to acquire feedback to measure the effectiveness and success of such training. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.10 | 3.2.10 | 3.2.10 | FBI CJIS Division Information Security Officer (FBI CJIS ISO) | 7. Maintain a security policy resource center (SPRC) on FBI.gov and keep the CSOs and ISOs updated on pertinent information. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.12 | 3.2.12 | 3.2.12 | State Compact Officer (SCO) | Pursuant to the National Crime Prevention and Privacy Compact, each party state shall appoint a Compact Officer… | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 3.2.12 | 3.2.12 | 3.2.12 | State Compact Officer (SCO) | ...Compact Officer who shall ensure that Compact provisions and rules, procedures, and standards established by the Compact Council are complied with in their respective state. | CJIS/CSO | CJIS/CSO | CJIS/CSO | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.1 | 4.2.1 | 4.2.1 | Proper Access, Use, and Dissemination of CHRI | The III shall be accessed only for an authorized purpose. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.1 | 4.2.1 | 4.2.1 | Proper Access, Use, and Dissemination of CHRI | Further, CHRI shall only be used for an authorized purpose consistent with the purpose for which III was accessed. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | Proper access to, use, and dissemination of data from restricted files shall be consistent with the access, use, and dissemination policies concerning the III described in Title 28, Part 20, CFR, and the NCIC Operating Manual. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | The restricted files, which shall be protected as CHRI, are as follows: | ||||||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | 1. Gang File | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | 2. Threat Screening Center File | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | 3. Supervised Release File | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | 4. National Sex Offender Registry File | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | 5. Historical Protection Order File of the NCIC | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | 6. Identity Theft File | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | 7. Protective Interest File | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | 8. Person With Information [PWI] data in the Missing Person Files | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | 9. Violent Person File | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.2 | 4.2.2 | 4.2.2 | Proper Access, Use, and Dissemination of NCIC Restricted Files Information | 10. NICS Denied Transaction File | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.3.2 | 4.2.3.2 | 4.2.3.2 | For Other Authorized Purposes | Non-restricted files information shall not be disseminated commercially. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.3.2 | 4.2.3.2 | 4.2.3.2 | For Other Authorized Purposes | Agencies shall not disseminate restricted files information for purposes other than law enforcement. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.4 | 4.2.4 | 4.2.4 | Storage | When CHRI is stored, agencies shall establish appropriate administrative, technical and physical safeguards to ensure the security and confidentiality of the information. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.4 | 4.2.4 | 4.2.4 | Storage | These records shall be stored for extended periods only when they are key elements for the integrity and/or utility of case files and/or criminal record files. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.2.5.1 | 4.2.5.1 | 4.2.5.1 | Justification | In addition to the use of purpose codes and logging information, all users shall provide a reason for all III inquiries whenever requested by NCIC System Managers, CSAs, local agency administrators, or their representatives. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.3 | 4.3 | 4.3 | Personally Identifiable Information (PII) | PII shall be extracted from CJI for the purpose of official business only. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Sections 1 - 4 (Introduction, Approach, Roles & Responsibilities, and CJI/PII) | Existing | Existing | 4.3 | 4.3 | 4.3 | Personally Identifiable Information (PII) | Agencies shall develop policies, based on state and local privacy rules, to ensure appropriate controls are applied when handling PII extracted from CJI. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements |
| CJIS Security Policy Section 5-1: Information Exchange Agreements | Existing | Existing | 5.1 | 5.1 | 5.1 | Policy Area 1: Information Exchange Agreements | The information shared through communication mediums shall be protected with appropriate security safeguards. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Section 5-1: Information Exchange Agreements | Existing | Existing | 5.1.1 | 5.1.1 | 5.1.1 | Information Exchange | Before exchanging CJI, agencies shall put formal agreements in place that specify security controls. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Section 5-1: Information Exchange Agreements | Existing | Existing | 5.1.1 | 5.1.1 | 5.1.1 | Information Exchange | Information exchange agreements for agencies sharing CJI data that is sent to and/or received from the FBI CJIS shall specify the security controls and conditions described in this document. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Section 5-1: Information Exchange Agreements | Existing | Existing | 5.1.1 | 5.1.1 | 5.1.1 | Information Exchange | Information exchange agreements shall be supported by documentation committing both parties to the terms of information exchange. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Section 5-1: Information Exchange Agreements | Existing | Existing | 5.1.2 | 5.1.2 | 5.1.2 | Monitoring, Review, and Delivery of Services | As specified in the inter-agency agreements, MCAs, and contractual agreements with private contractors, the services, reports and records provided by the service provider shall be regularly monitored and reviewed. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Section 5-1: Information Exchange Agreements | Existing | Existing | 5.1.2 | 5.1.2 | 5.1.2 | Monitoring, Review, and Delivery of Services | The CJA, authorized agency, or FBI shall maintain sufficient overall control and visibility into all security aspects to include, but not limited to, identification of vulnerabilities and information security incident reporting/response. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Section 5-1: Information Exchange Agreements | Existing | Existing | 5.1.2 | 5.1.2 | 5.1.2 | Monitoring, Review, and Delivery of Services | The incident reporting/response process used by the service provider shall conform to the incident reporting/response specifications provided in this policy. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Section 5-1: Information Exchange Agreements | Existing | Existing | 5.1.2.1 | 5.1.2.1 | 5.1.2.1 | Managing Changes to Service Providers | Any changes to services provided by a service provider shall be managed by the CJA, authorized agency, or FBI. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Section 5-1: Information Exchange Agreements | Existing | Existing | 5.1.2.1 | 5.1.2.1 | 5.1.2.1 | Managing Changes to Service Providers | Evaluation of the risks to the agency shall be undertaken based on the criticality of the data, system, and the impact of the change. | Agency/Entity | Agency/Entity | Agency/Entity | |||||||||||||||
| CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements | CJIS Security Policy Section 5-1: Information Exchange Agreements |
| FBI CJIS Security Policy Section 5-1: Information Exchange Agreements | Zero-cycle | P2 | AC-1 | AC-1 | AC-1 | POLICY AND PROCEDURES | a. Develop, document, and disseminate to: organizational personnel with access control responsibilities | Agency/Entity | Agency/Entity/Service Provider | Agency/Entity/Service Provider | |||||||||||||||
| FBI CJIS Security Policy Section 5-1: Information Exchange Agreements | Zero-cycle | P2 | AC-1 | AC-1 | AC-1 | POLICY AND PROCEDURES | 1. Agency-level access control policy that: | Agency/Entity | Agency/Entity/Service Provider | Agency/Entity/Service Provider | |||||||||||||||
| FBI CJIS Security Policy Section 5-1: Information Exchange Agreements | Zero-cycle | P2 | AC-1 | AC-1 | AC-1 | POLICY AND PROCEDURES | (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and | Agency/Entity | Agency/Entity/Service Provider | Agency/Entity/Service Provider | |||||||||||||||
| FBI CJIS Security Policy Section 5-1: Information Exchange Agreements | Zero-cycle | P2 | AC-1 | AC-1 | AC-1 | POLICY AND PROCEDURES | (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and | Agency/Entity | Agency/Entity/Service Provider | Agency/Entity/Service Provider | |||||||||||||||
| FBI CJIS Security Policy Section 5-1: Information Exchange Agreements | Zero-cycle | P2 | AC-1 | AC-1 | AC-1 | POLICY AND PROCEDURES | 2. Procedures to facilitate the implementation of the access control policy and the associated access controls; | Agency/Entity | Agency/Entity/Service Provider | Agency/Entity/Service Provider | |||||||||||||||
| FBI CJIS Security Policy Section 5-1: Information Exchange Agreements | Zero-cycle | P2 | AC-1 | AC-1 | AC-1 | POLICY AND PROCEDURES | b. Designate an individual with security responsibilities to manage the development, documentation, and dissemination of the access control policy and procedures; and | Agency/Entity | Agency/Entity/Service Provider | Agency/Entity/Service Provider | |||||||||||||||
| FBI CJIS Security Policy Section 5-1: Information Exchange Agreements | Zero-cycle | P2 | AC-1 | AC-1 | AC-1 | POLICY AND PROCEDURES | c. Review and update the current access control: | Agency/Entity | Agency/Entity/Service Provider | Agency/Entity/Service Provider |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .