Criminal Justice Information Services (CJIS) Security Policy

1 U. S. Department of Justice Federal Bureau of Investigation Criminal Justice Information Services Division Criminal Justice Information Services ( cjis ) Security Policy Version 06/01/2019 Prepared by: cjis Information Security Officer Approved by: cjis Advisory Policy Board 06/01/2019 i EXECUTIVE SUMMARY Law enforcement needs timely and secure access to Services that provide data wherever and whenever for stopping and reducing crime. In response to these needs, the Advisory Policy Board (APB) recommended to the Federal Bureau of Investigation (FBI) that the Criminal Justice Information Services ( cjis ) Division authorize the expansion of the existing Security management structure in 1998. Administered through a shared management philosophy, the cjis Security Policy contains Information Security requirements, guidelines, and agreements reflecting the will of law enforcement and Criminal Justice agencies for protecting the sources, transmission, storage, and generation of Criminal Justice Information (CJI).

2 The Federal Information Security Management Act of 2002 provides further legal basis for the APB approved management, operational, and technical Security requirements mandated to protect CJI and by extension the hardware, software and infrastructure required to enable the Services provided by the Criminal Justice community. The essential premise of the cjis Security Policy is to provide appropriate controls to protect the full lifecycle of CJI, whether at rest or in transit. The cjis Security Policy provides guidance for the creation, viewing, modification, transmission, dissemination, storage, and destruction of CJI. This Policy applies to every individual contractor, private entity, noncriminal Justice agency representative, or member of a Criminal Justice entity with access to, or who operate in support of, Criminal Justice Services and Information .

3 The cjis Security Policy integrates presidential directives, federal laws, FBI directives and the Criminal Justice community s APB decisions along with nationally recognized guidance from the National Institute of Standards and Technology. The Policy is presented at both strategic and tactical levels and is periodically updated to reflect the Security requirements of evolving business models. The Policy features modular sections enabling more frequent updates to address emerging threats and new Security measures. The provided Security criteria assists agencies with designing and implementing systems to meet a uniform level of risk and Security protection while enabling agencies the latitude to institute more stringent Security requirements and controls based on their business model and local needs.

4 The cjis Security Policy strengthens the partnership between the FBI and cjis Systems Agencies (CSA), including, in those states with separate authorities, the State Identification Bureaus (SIB). Further, as use of Criminal history record Information for noncriminal Justice purposes continues to expand, the cjis Security Policy becomes increasingly important in guiding the National Crime Prevention and Privacy Compact Council and State Compact Officers in the secure exchange of Criminal Justice records. The Policy describes the vision and captures the Security concepts that set the policies, protections, roles, and responsibilities with minimal impact from changes in technology. The Policy empowers CSAs with the insight and ability to tune their Security programs according to their risks, needs, budgets, and resource constraints while remaining compliant with the baseline level of Security set forth in this Policy .

5 The cjis Security Policy provides a secure framework of laws, standards, and elements of published and vetted policies for accomplishing the mission across the broad spectrum of the Criminal Justice and noncriminal Justice communities. 06/01/2019 ii CHANGE MANAGEMENT Revision Change Description Created/Changed by Date Approved By 5 Policy Rewrite Security Policy Working Group 2/9/2011 See Signature Page Incorporate Calendar Year 2011 APB approved changes and administrative changes cjis ISO Program Office 7/13/2012 APB & Compact Council Incorporate Calendar Year 2012 APB approved changes and administrative changes cjis ISO Program Office 8/9/2013 APB & Compact Council Incorporate Calendar Year 2013 APB approved changes and administrative changes cjis ISO Program Office 8/4/2014 APB & Compact Council Incorporate Calendar Year 2014 APB approved changes and administrative changes cjis ISO Program Office 10/6/2015 APB & Compact Council Incorporate Calendar Year 2015 APB approved

6 Changes and administrative changes cjis ISO Program Office 6/1/2016 APB & Compact Council Incorporate Calendar Year 2016 APB approved changes and administrative changes cjis ISO Program Office 6/5/2017 APB & Compact Council Incorporate Calendar Year 2017 APB approved changes and administrative changes cjis ISO Program Office 08/16/2018 APB & Compact Council Incorporate Calendar Year 2018 APB approved changes and administrative changes cjis ISO Program Office 06/01/2019 APB & Compact Council 06/01/2019 iii SUMMARY OF CHANGES Version APB Approved Changes 1. Section cjis Systems Officer (CSO): change 2 d. to read consistent with other bullet appointment requirements, Fall 2018, APB#14, SA#5, Local Agency Security Officers (LASO) Training Requirement. 2.

7 Section cjis Systems Officer (CSO): add requirement at 2 f. for LASO training, Fall 2018, APB#14, SA#5, Local Agency Security Officers (LASO) Training Requirement. 3. Section Criminal Justice Information (CJI): add clarifying language to last paragraph, Fall 2018, APB#14, SA#7, SA Subcommittee Courts Task Force Recommendation. 4. Section Policy Area 2: Security Awareness Training: add new introductory paragraph, Fall 2018, APB#14, SA#5, Local Agency Security Officers (LASO) Training Requirement. 5. Section Awareness Topics: rename section to Basic Security Awareness Training , Fall 2018, APB#14, SA#5, Local Agency Security Officers (LASO) Training Requirement. 6. Section Security Training Records: change section title to LASO Training and add new requirements, Fall 2018, APB#14, SA#5, Local Agency Security Officers (LASO) Training Requirement.

8 7. Section Security Training Records: create new section from previous Section , Fall 2018, APB#14, SA#5, Local Agency Security Officers (LASO) Training Requirement. 8. Section Password: add new introductory paragraph and note, Spring 2018, APB#17, SA#5, Adopting New Standards for Passwords from National Institute of Technologies (NIST) Special Publication 800-63D. 9. Section Basic Password Standards: add new section number and title for existing password requirements, Spring 2018, APB#17, SA#5, Adopting New Standards for Passwords from National Institute of Technologies (NIST) Special Publication 800-63D. 10. Section Advanced Password Standards: add new section and requirements, Spring 2018, APB#17, SA#5, Adopting New Standards for Passwords from National Institute of Technologies (NIST) Special Publication 800-63D.

9 11. Section Intrusion Detection Tools and Techniques: add new introductory paragraph and requirements, Fall 2018, APB#14, SA#3, Intrusion Detection and Prevention Systems. 12. Section Mobile Device Management (MDM): add exception to the MDM requirement for indirect access, Fall 2018, APB#14, SA#2, Mobile Device Management. 13. Section Wireless Device Risk Mitigations: add language to bullets 6 and 7, Fall 2018, APB#14, SA#2, Mobile Device Management. 14. Section Advanced Authentication: add language to relax requirement for indirect access, Fall 2018, APB#14, SA#2, Mobile Device Management. 15. Section Compensating Controls: modify language to clarify requirements, Fall 2018, APB#14, SA#2, Mobile Device Management. 06/01/2019 iv 16. Appendix A Terms and Definitions: add definitions, Hashing , Hash Value , Intrusion Detection , Intrusion Detection System , Intrusion Prevention , Intrusion Prevention System , Password Verifier , Salting.

10 17. Appendix B Acronyms: HIDS , HIPS , NIDS , NIPS . Administrative Changes1 1. Appendix Incident Response Best Practices, add new appendix 2. Appendix secure Coding Best Practices, add new appendix 3. Appendix K, General CJI Guidance, bullet k.: update language based on previous Section changes ( ). KEY TO APB APPROVED CHANGES ( Fall 2013, APB#11, SA#6, Topic Title ): Fall 2013 Advisory Policy Board cycle and year APB## Advisory Policy Board Topic number SA## Security and Access Subcommittee Topic number Topic Title 1 Administrative changes are vetted through the Security and Access Subcommittee and not the entire APB process. 06/01/2019 v TABLE OF CONTENTS Executive Summary .. i Change Management.