Washington State Patrol WSP 11/3/2016

Each interface agency is responsible for enforcing system security standards for their agency, in addition to all of the other agencies and entities to which the interface agency provides CJIS and Washington State Department of Licensing (DOL) records information. Authorized users shall access CJIS and DOL systems and disseminate the data only for the purpose for which they are authorized. Each criminal justice and non-criminal justice agency authorized to access FBI CJIS systems and DOL shall have a written policy for the discipline of policy violators. Physical Security A physically secure location is a facility or an area, a room, or a group of rooms within a facility with both the physical and personnel security controls sufficient to protect CJI and associated information systems. The physically secure location is subject to criminal justice agency management control. The perimeter of a physically secure location shall be prominently posted and separated from non-secure locations by physical controls. All personnel with access to computer centers, terminal areas, and/or areas where CJIS information is housed shall either be escorted by authorized personnel at all times or receive a fingerprint-based background check and view security awareness training. Personnel Security To verify identification, a state of residency and national fingerprint-based record checks shall be conducted within 30 days of initial employment or assignment for all personnel who have authorized access to FBI CJIS systems and those who have direct responsibility to configure and maintain computer systems and networks with access to FBI CJIS systems. All requests for system access shall be made as specified by the CSO. The CSO or their official designee is authorized to approve CJIS systems access. All official designees to the CSO shall be from an authorized criminal justice agency. Support personnel, contractors, and custodial workers who access computer terminal areas shall be subject to a state of residency and national fingerprint-based record check and view the security awareness training, unless these individuals are escorted by authorized personnel at all times. Authorized personnel are those persons who have passed a state and national fingerprint-based record check and have been granted access. Private Contractors/Vendors Private contractors shall be permitted access to CJIS record information systems pursuant to an agreement which specifically identifies the contractor's purpose and scope of providing services for the administration of criminal justice. The agreement between the criminal justice government agency and the private contractor shall incorporate the CJIS Security Addendum approved by the Director of the FBI. Private contractors who perform the administration of criminal justice shall meet the same training and certification criteria required by governmental agencies performing a similar function, and shall be subject to the same extent of audit review as are local user agencies. Hit Confirmation Any agency that enters a record into NCIC/WACIC has the duty to promptly respond with the necessary confirmation of the hit and other details. They must furnish a response within a specific time period. Valid hit confirmation is based on two levels of priority: urgent or routine. 2014 ACCESS User Acknowledgement 7-23-2015 5