Washington State Patrol, Snohomish County 911 11/15/2024

2023 WSP ACCESS User Acknowledgement Page 5 of 14 Physical Security A physically secure location is a facility, a criminal justice conveyance, or an area, a room, or a group of rooms within a facility with both the physical and personnel security controls sufficient to protect CJI and associated information systems. The physically secure location is subject to criminal justice agency management control. The perimeter of a physically secure location shall be prominently posted and separated from non-secure locations by physical controls. All personnel with access to computer centers, terminal areas, and/or areas where unencrypted CJIS information is housed shall either be escorted by authorized personnel at all times or receive a fingerprint- based background check and view security awareness training prior to being granted access to the area. Personnel Security To verify identification, a state of residency and national fingerprint-based record checks shall be conducted prior to employment or assignment for all personnel who have authorized access to FBI CJIS systems and those who have direct responsibility to configure and maintain computer systems and networks with access to FBI CJIS systems. All requests for system access shall be made as specified by the CSO. The CSO or their official designee is authorized to approve CJIS systems access. All official designees to the CSO shall be from an authorized criminal justice agency. If a record of any kind exists, access to CJI shall not be granted until the CSO or his/her designee reviews the matter to determine if access is appropriate. The agency is required to request a variance from the CSO. Support personnel, contractors, and custodial workers who access computer terminal areas shall be subject to a Washington state and national fingerprint-based background check and view the security awareness training, unless these individuals are escorted by authorized personnel at all times. Authorized personnel are those persons who have passed a Washington state and national fingerprint-based background check and have been granted access. These personnel must be employed by the criminal justice agency or part of the IT Department that provides a criminal justice function for the criminal justice agency. Private Contractors/Vendors Private contractors shall be permitted access to CJIS record information systems pursuant to an agreement which specifically identifies the contractor’s purpose and scope of providing services for the administration of criminal justice. The agreement between the criminal justice government agency and the private contractor shall incorporate the CJIS Security Addendum approved by the Director of the FBI, found at https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center/view. User shall download the latest Addendum at least annually and conform to its requirements. Private contractors who perform the administration of criminal justice shall meet the same training and certification criteria required by governmental agencies performing a similar function, and shall be subject to the same extent of audit review as are local user agencies. Hit Confirmation Any agency that enters a record into WACIC/NCIC has the duty to promptly respond with the necessary confirmation of the hit and other details. They must furnish a response within a specific time period. Valid hit confirmation is based on two levels of priority: Priority 1: Urgent The hit must be confirmed within ten minutes. In those instances where the hit is the only basis for detaining a suspect or the nature of a case requires urgent confirmation of a hit, priority 1 should be specified. Priority 2: Routine The hit must be confirmed within one hour. Generally, this priority will be used when the person is being held on local charges, property has been located under circumstances where immediate action is not necessary, or an urgent confirmation is not required. X. Compliance Audits The FBI CJIS Division requires triennial audits be conducted by the CSA to review CJIS standards of compliance and provide recommendations for best business practices. WSP audit staff provide three types of