Washington State Patrol 1/16/2019

3. Ensuring that personnel security screening procedures are being followed as stated in the CJIS Security Policy. 4. Ensuring that appropriate hardware security measures are in place. 5. Supporting policy compliance and keeping the WSP Information Security Officer (ISO) informed of security incidents. Security Enforcement Each interface agency is responsible for enforcing system security standards for their agency, in addition to all of the other agencies and entities to which the interface agency provides CJIS and Washington State Department of Licensing (DOL) records information. Authorized users shall access CJIS and DOL systems and disseminate the data only for the purpose for which they are authorized. Each criminal justice and non-criminal justice agency authorized to access FBI CJIS systems and DOL shall have a written policy for the discipline of policy violators. Physical Security A physically secure location is a facility, a criminal justice conveyance, or an area, a room, or a group of rooms within a facility with both the physical and personnel security controls sufficient to protect CJI and associated information systems. The physically secure location is subject to criminal justice agency management control. The perimeter of a physically secure location shall be prominently posted and separated from non-secure locations by physical controls. All personnel with access to computer centers, terminal areas, and/or areas where CJIS information is housed shall either be escorted by authorized personnel at all times or receive a fingerprint-based background check and view security awareness training prior to being granted access to the area. Personnel Security To verify identification, a state of residency and national fingerprint-based record checks shall be conducted prior to employment or assignment for all personnel who have authorized access to FBI CJIS systems and those who have direct responsibility to configure and maintain computer systems and networks with access to FBI CJIS systems. All requests for system access shall be made as specified by the CSO. The CSO or their official designee is authorized to approve CJIS systems access. All official designees to the CSO shall be from an authorized criminal justice agency. If a record of any kind exists, access to CJI shall not be granted until the CSO or his/her designee reviews the matter to determine if access is appropriate. Support personnel, contractors, and custodial workers who access computer terminal areas shall be subject to a Washington state and national fingerprint-based background check and view the security awareness training, unless these individuals are escorted by authorized personnel at all times. Authorized personnel are those persons who have passed a Washington state and national fingerprint-based background check and have been granted access. These personnel must be employed by the criminal justice agency or part of the IT Department that provides a criminal justice function for the criminal justice agency. Private ContractorsNendors Private contractors shall be permitted access to CJIS record information systems pursuant to an agreement which specifically identifies the contractor's purpose and scope of providing 2019 WSP ACCESS User Acknowledgment Approved by the Attorney General 11/28/18 5