The Criminal Justice Information Services (CJIS) Security Policy is a set of standards and guidelines developed by the FBI to help secure criminal justice information (CJI), such as fingerprints, criminal histories, and other data. The policy aims to provide appropriate controls to protect the full lifecycle of CJI, ensuring that it is securely handled, stored, and transmitted.
Showing 994 controls
4.2.2-1
Gang Files
4.2.2-10
NICS Denied Transactions File
4.2.2-2
Threat Screening Center Files
4.2.2-3
Supervised Release Files
4.2.2-4
National Sex Offender Registry Files
4.2.2-5
Historical Protection Order Files of the NCIC
4.2.2-6
Identity Theft Files
4.2.2-7
Protective Interest Files
4.2.2-8
Person With Information (PWI) data in the Missing Person Files
4.2.2-9
Violent Person File
5.1.1.3-1
Audit.
5.1.1.3-10
Use of the system.
5.1.1.3-11
Validation.
5.1.1.3-2
Dissemination.
5.1.1.3-3
Hit confirmation.
5.1.1.3-4
Logging.
5.1.1.3-5
Quality Assurance (QA).
5.1.1.3-6
Screening (Pre-Employment).
5.1.1.3-7
Security.
5.1.1.3-8
Timeliness.
5.1.1.3-9
Training.
5.1.1.5-1
Private contractors designated to perform criminal justice functions for a CJA shall be eligible for access to CJI. Access shall be permitted pursuant to an agreement which specifically identifies the...
5.1.1.5-2
Private contractors designated to perform criminal justice functions on behalf of a NCJA (government) shall be eligible for access to CJI. Access shall be permitted pursuant to an agreement which spec...
5.11.2-1
At a minimum, triennially audit all CJAs and NCJAs which have direct access to the state system in order to ensure compliance with applicable statutes, regulations and policies.
5.11.2-2
In coordination with the SIB, establish a process to periodically audit all NCJAs, with access to CJI, in order to ensure compliance with applicable statutes, regulations and policies.
5.11.2-3
Have the authority to conduct unannounced security inspections and scheduled audits of Contractor facilities.
5.11.2-4
Have the authority, on behalf of another CSA, to conduct a CSP compliance audit of contractor facilities and provide the results to the requesting CSA. If a subsequent CSA requests an audit of the sam...
5.12.1-1
To verify identification, state of residency and national fingerprint-based record checks shall be conducted prior to granting access to CJI for all personnel who have unescorted access to unencrypted...
5.12.1-1-a
5 CFR 731.106; and/or
5.12.1-1-b
Office of Personnel Management policy, regulations, and guidance; and/or
5.12.1-1-c
agency policy, regulations, and guidance.
5.12.1-2
All requests for access shall be made as specified by the CSO.The CSO, or their designee, is authorized to approve access to CJI.All CSO designees shall be from an authorized criminal justice agency.
5.12.1-3
If a record of any kind exists, access to CJI shall not be granted until the CSO or his/her designee reviews the matter to determine if access is appropriate.
5.12.1-3-a
If a felony conviction of any kind exists, the Interface Agency shall deny access to CJI. However, the Interface Agency may ask for a review by the CSO in extenuating circumstances where the severity...
5.12.1-3-b
Applicants with a record of misdemeanor offense(s) may be granted access if the CSO, or his or her designee, determines the nature or severity of the misdemeanor offense(s) do not warrant disqualifica...
5.12.1-3-c
If a record of any kind is found on a contractor, the CGA shall be formally notified and system access shall be delayed pending review of the criminal history record information.The CGA shall in turn...
5.12.1-4
If the person appears to be a fugitive or has an arrest history without conviction, the CSO or his/her designee shall review the matter to determine if access to CJI is appropriate.
5.12.1-5
If the person already has access to CJI and is subsequently arrested and or convicted, continued access to CJI shall be determined by the CSO.This does not implicitly grant hiring/firing authority wit...
5.12.1-6
If the CSO or his/her designee determines that access to CJI by the person would not be in the public interest, access shall be denied and the person's appointing authority shall be notified in writin...
5.12.1-7
The granting agency shall maintain a list of personnel who have been authorized unescorted access to unencrypted CJI and shall, upon request, provide a current copy of the access list to the CSO.
5.13.1.1-1
Perform validation testing to ensure rogue APs (Access Points) do not exist in the 802.11 Wireless Local Area Network (WLAN) and to fully understand the wireless network security posture.
5.13.1.1-10
Ensure that encryption key sizes are at least 128-bits and the default shared keys are replaced by unique keys
5.13.1.1-11
Ensure that the ad hoc mode has been disabled.
5.13.1.1-12
Disable all nonessential management protocols on the APs.
5.13.1.1-13
Ensure all management access and authentication occurs via FIPS compliant secure protocols (e.g., SFTP, HTTPS, SNMP over TLS, etc.). Disable non-FIPS compliant secure access to the management interfac...
5.13.1.1-14
Enable logging (if supported) and review the logs on a recurring basis per local policy.At a minimum, logs shall be reviewed monthly.
5.13.1.1-15
Insulate, virtually (e.g., virtual local area network (VLAN) and ACLs) or physically (e.g., firewalls), the wireless network from the operational wired infrastructure.Limit access between wireless net...
5.13.1.1-16
When disposing of access points that will no longer be used by the agency, clear access point configuration to prevent disclosure of network configuration, keys, passwords, etc.
5.13.1.1-2
Maintain a complete inventory of all Access Points (APs) and 802.11 wireless devices.
5.13.1.1-3
Place APs in secured areas to prevent unauthorized physical access and user manipulation.
5.13.1.1-4
Test AP range boundaries to determine the precise extent of the wireless coverage and design the AP wireless coverage to limit the coverage area to only what is needed for operational purposes.
5.13.1.1-5
Enable user authentication and encryption mechanisms for the management interface of the AP
5.13.1.1-6
Ensure that all APs have strong administrative passwords and ensure that all passwords are changed in accordance with Section 5.6.2.1.
5.13.1.1-7
Ensure the reset function on APs is used only when needed and is only invoked by authorized personnel.Restore the APs to the latest security settings, when the reset functions are used, to ensure the...
5.13.1.1-8
Change the default service set identifier (SSID) in the APs.Disable the broadcast SSID feature so that the client SSID must match that of the AP. Validate that the SSID character string does not conta...
5.13.1.1-9
Enable all security features of the wireless product, including the cryptographic authentication, firewall, and other available privacy features.
5.13.1.4-1
Enable encryption on the hotspot
5.13.1.4-2
Change the hotspot’s default SSID
5.13.1.4-2-a
Ensure the hotspot SSID does not identify the device make/model or agency ownership
5.13.1.4-3
Create a wireless network password (pre-shared key)
5.13.1.4-4
Enable the hotspot’s port filtering/blocking features if present
5.13.1.4-5
Only allow connections from agency-controlled devices Note: Refer to the requirements in Section 5.10.1.2 Encryption for item #1. Refer to the requirements in Section 5.6.2.1.1.1 Basic Password Stand...
5.13.2-1
Ensure that CJI is only transferred between CJI authorized applications and storage areas of the device.
5.13.2-2
MDM with centralized administration configured and implemented to perform at least the following controls:
5.13.2-2-a
Remote locking of device
5.13.2-2-b
Remote wiping of device
5.13.2-2-c
Setting and locking device configuration
5.13.2-2-d
Detection of “rooted” and “jailbroken” devices
5.13.2-2-e
Enforcement of folder or disk level encryption
5.13.2-2-f
Application of mandatory policy settings on the device
5.13.2-2-g
Detection of unauthorized configurations
5.13.2-2-h
Detection of unauthorized software or applications
5.13.2-2-i
Ability to determine the location of agency-controlled devices
5.13.2-2-j
Prevention of unpatched devices from accessing CJI or CJI systems
5.13.2-2-k
Automatic device wiping after a specified number of failed access attempts
5.13.3-1
Apply available critical patches and upgrades to the operating system as soon as they become available for the device and after necessary testing as described in Section 5.10.4.1.
5.13.3-2
Are configured for local device authentication (see Section 5.13.7.1).
5.13.3-3
Use advanced authentication or CSO approved compensating controls as per Section 5.13.7.2.1.
5.13.3-4
Encrypt all CJI resident on the device.
5.13.3-5
Erase cached information, to include authenticators (see Section 5.6.2.1) in applications, when session is terminated.
5.13.3-6
Employ personal firewalls on full-featured operating system devices or run a Mobile Device Management (MDM) system that facilitates the ability to provide firewall services from the agency level.
5.13.3-7
Employ malicious code protection on full-featured operating system devices or run a MDM system that facilitates the ability to provide anti-malware services from the agency level.
5.13.4.3-1
Manage program access to the Internet.
5.13.4.3-2
Block unsolicited requests to connect to the user device.
5.13.4.3-3
Filter incoming traffic by IP address or protocol.
5.13.4.3-4
Filter incoming traffic by destination ports.
5.13.4.3-5
Maintain an IP traffic log.
5.13.5-1
Loss of device control. For example:
5.13.5-1-a
Device known to be locked, minimal duration of loss
5.13.5-1-b
Device lock state unknown, minimal duration of loss
5.13.5-1-c
Device lock state unknown, extended duration of loss
5.13.5-1-d
Device known to be unlocked, more than momentary duration of loss
5.13.5-2
Total loss of device
5.13.5-3
Device compromise
5.13.5-4
Device loss or compromise outside the United States
5.13.7.2.1-1
Meet the intent of the CJIS Security Policy AA requirement
5.13.7.2.1-2
Provide a similar level of protection or security as the original AA requirement
5.13.7.2.1-3
Not rely upon the existing requirements for AA as compensating controls
5.13.7.2.1-4
Expire upon the CSO approved date or when a compliant AA solution is implemented.
5.13.7.3-1
Protected against being extracted from the device
5.13.7.3-2
Configured for remote wipe on demand or self-deletion based on a number of unsuccessful login or access attempts
5.13.7.3-3
Configured to use a secure authenticator (i.e., password, PIN) to unlock the key for use
5.18-a
Develop, document, and disseminate to organizational personnel with contingency planning responsibilities:
5.18-a-1
Agency-level contingency planning policy that:
5.18-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
5.18-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
5.18-a-2
Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls;
5.18-b
Designate organizational personnel with information security responsibilities to manage the development, documentation, and dissemination of the contingency planning policy and procedures; and
5.18-c
Review and update the current contingency planning:
5.18-c-1
Policy annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI, or training simulations or exercises; and
5.18-c-2
Procedures annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI, or training simulations or exercises.
5.7.1.2-1
All communications paths, circuits, and other components used for the interconnection, beginning with the agency-owned system(s) and traversing through all interconnected systems to the agency end-poi...
5.7.1.2-2
The logical location of all components (e.g., firewalls, routers, switches, hubs, servers, encryption devices, and computer workstations). Individual workstations (clients) do not have to be shown; th...
5.7.1.2-3
“For Official Use Only” (FOUO) markings.
5.7.1.2-4
The agency name and date (day, month, and year) drawing was created or updated.
AC-1-a
Develop, document, and disseminate to: organizational personnel with access control responsibilities
AC-1-a-1
Agency-level access control policy that:
AC-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
AC-1-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
AC-1-a-2
Procedures to facilitate the implementation of the access control policy and the associated access controls;
AC-1-b
Designate an individual with security responsibilities to manage the development, documentation, and dissemination of the access control policy and procedures; and
AC-1-c
Review and update the current access control:
AC-1-c-1
Policy annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI; and
AC-1-c-2
Procedures annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
AC-11-a
Prevent further access to the system by initiating a device lock after a maximum of 30 minutes of inactivity and requiring the user to initiate a device lock before leaving the system unattended. NOTE...
AC-11-b
Retain the device lock until the user reestablishes access using established identification and authentication procedures.
AC-14-a
Identify any specific user actions that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and
AC-14-b
Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication.
AC-17-a
Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and
AC-17-b
Authorize each type of remote access to the system prior to allowing such connections.
AC-17(4)-a
Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: compelling...
AC-17(4)-b
Document the rationale for remote access in the security plan for the system.
AC-18-a
Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and
AC-18-b
Authorize each type of wireless access to the system prior to allowing such connections.
AC-19-a
Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and
AC-19-b
Authorize the connection of mobile devices to organizational systems.
AC-2-a
Define and document the types of accounts allowed and specifically prohibited for use within the system;
AC-2-b
Assign account managers;
AC-2-c
Require conditions for group and role membership;
AC-2-d
Specify:
AC-2-d-1
Authorized users of the system;
AC-2-d-2
Group and role membership; and
AC-2-d-3
Access authorizations (i.e., privileges) and attributes listed for each account;
AC-2-e
Require approvals by organizational personnel with account management responsibilities for requests to create accounts;
AC-2-f
Create, enable, modify, disable, and remove accounts in accordance with agency policy;
AC-2-g
Monitor the use of accounts;
AC-2-h
Notify account managers and system/network administrators within:
AC-2-h-1
One day when accounts are no longer required;
AC-2-h-2
One day when users are terminated or transferred; and
AC-2-h-3
One day when system usage or need-to-know changes for an individual;
AC-2-i
Authorize access to the system based on:
AC-2-i-1
A valid access authorization;
AC-2-i-2
Intended system usage; and
AC-2-i-3
Attributes as listed in AC-2(d)(3);
AC-2-j
Review accounts for compliance with account management requirements at least annually;
AC-2-k
Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and
AC-2-l
Align account management processes with personnel termination and transfer processes.
AC-2(3)-a
Have expired;
AC-2(3)-b
Are no longer associated with a user or individual;
AC-2(3)-c
Are in violation of organizational policy; or
AC-2(3)-d
Have been inactive for 90 calendar days.
AC-20-a
Establish agency-level policies governing the use of external systems consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external system...
AC-20-a-1
Access the system from external systems; and
AC-20-a-2
Process, store, or transmit organization-controlled information using external systems; or
AC-20-b
Prohibit the use of personally-owned information systems including mobile devices (i.e., bring your own device [BYOD]) and publicly accessible systems for accessing, processing, storing, or transmitti...
AC-20(1)-a
Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or
AC-20(1)-b
Retention of approved system connection or processing agreements with the organizational entity hosting the external system.
AC-21-a
Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for as defined in an executed information exchange...
AC-21-b
Employ attribute-based access control (see AC-2(d)(3)) or manual processes as defined in information exchange agreements to assist users in making information sharing and collaboration decisions.
AC-22-a
Designate individuals authorized to make information publicly accessible;
AC-22-b
Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;
AC-22-c
Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and
AC-22-d
Review the content on the publicly accessible system for nonpublic information quarterly and remove such information, if discovered
AC-5-a
Identify and document separation of duties based on specific duties, operations, or information systems, as necessary, to mitigate risk to CJI; and
AC-5-b
Define system access authorizations to support separation of duties.
AC-6(1)-a
Established system accounts, configured access authorizations (i.e., permissions, privileges), set events to be audited, set intrusion detection parameters, and other security functions; and
AC-6(1)-b
Security-relevant information in hardware, software, and firmware.
AC-6(7)-a
Review annually the privileges assigned to non-privileged and privileged users to validate the need for such privileges; and
AC-6(7)-b
Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.
AC-7-a
Enforce a limit of five (5) consecutive invalid logon attempts by a user during a 15-minute time period; and
AC-7-b
Automatically lock the account or node until released by an administrator when the maximum number of unsuccessful attempts is exceeded.
AC-8-a
Display a system use notification message to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regula...
AC-8-a-1
Users are accessing a restricted information system;
AC-8-a-2
System usage may be monitored, recorded, and subject to audit;
AC-8-a-3
Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
AC-8-a-4
Use of the system indicates consent to monitoring and recording;
AC-8-b
Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and
AC-8-c
For publicly accessible systems:
AC-8-c-1
Display system use information consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines, before granting further access to the publicly accessibl...
AC-8-c-2
Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
AC-8-c-3
Include a description of the authorized uses of the system.
AT-1-a
Develop, document, and disseminate to all personnel when their unescorted logical or physical access to any information system results in the ability, right, or privilege to view, modify, or make use...
AT-1-a-1
Organization-level awareness and training policy that:
AT-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
AT-1-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
AT-1-a-2
Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;
AT-1-b
Designate organizational personnel with information security awareness and training responsibilities to manage the development, documentation, and dissemination of the awareness and training policy an...
AT-1-c
Review and update the current awareness and training:
AT-1-c-1
Policy annually and following changes in the information system operating environment, when security incidents occur, or when changes to the CJIS Security Policy are made; and
AT-1-c-2
Procedures annually and following changes in the information system operating environment, when security incidents occur, or when changes to the CJIS Security Policy are made.
AT-2-a
Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):
AT-2-a-1
As part of initial training for new users prior to accessing CJI and annually thereafter; and
AT-2-a-2
When required by system changes or within 30 days of any security event for individuals involved in the event;
AT-2-b
Employ one or more of the following techniques to increase the security and privacy awareness of system users:
AT-2-b-1
Displaying posters
AT-2-b-2
Offering supplies inscribed with security and privacy reminders
AT-2-b-3
Displaying logon screen messages
AT-2-b-4
Generating email advisories or notices from organizational officials
AT-2-b-5
Conducting awareness events
AT-2-c
Update literacy training and awareness content annually and following changes in the information system operating environment, when security incidents occur, or when changes are made in the CJIS Secur...
AT-2-d
Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.
AT-3-a
Provide role-based security and privacy training to personnel with the following roles and responsibilities:
AT-3-a-1
Before authorizing access to the system, information, or performing assigned duties, and annually thereafter; and
AT-3-a-2
When required by system changes.
AT-3-b
Update role-based training content annually and following audits of the CSA and local agencies; changes in the information system operating environment; security incidents; or when changes are made to...
AT-3-c
Incorporate lessons learned from internal or external security incidents or breaches into role-based training;
AT-3-d
Incorporate the minimum following topics into the appropriate role-based training content:
AT-3-d-1
All individuals with unescorted access to a physically secure location
AT-3-d-1-a
Access, Use and Dissemination of Criminal History Record Information (CHRI), NCIC Restricted Files Information, and NCIC Non-Restricted Files Information Penalties
AT-3-d-1-b
Reporting Security Events
AT-3-d-1-c
Incident Response Training
AT-3-d-1-d
System Use Notification
AT-3-d-1-e
Physical Access Authorizations
AT-3-d-1-f
Physical Access Control
AT-3-d-1-g
Monitoring Physical Access
AT-3-d-1-h
Visitor Control
AT-3-d-1-i
Personnel Sanctions
AT-3-d-2
General User: A user, but not a process, who is authorized to use an information system. In addition to AT-3 (d) (1) above, include the following topics:
AT-3-d-2-a
Criminal Justice Information
AT-3-d-2-b
Proper Access, Use, and Dissemination of NCIC Non-Restricted Files Information
AT-3-d-2-c
Personally Identifiable Information
AT-3-d-2-d
Information Handling
AT-3-d-2-e
Media Storage
AT-3-d-2-f
Media Access
AT-3-d-2-g
Audit Monitoring, Analysis, and Reporting
AT-3-d-2-h
Access Enforcement
AT-3-d-2-i
Least Privilege
AT-3-d-2-j
System Access Control
AT-3-d-2-k
Access Control Criteria
AT-3-d-2-l
System Use Notification
AT-3-d-2-m
Session Lock
AT-3-d-2-n
Personally Owned Information Systems
AT-3-d-2-o
Password
AT-3-d-2-p
Access Control for Display Medium
AT-3-d-2-q
Encryption
AT-3-d-2-r
Malicious Code Protection
AT-3-d-2-s
Spam and Spyware Protection
AT-3-d-2-t
Cellular Devices
AT-3-d-2-u
Mobile Device Management
AT-3-d-2-v
Wireless Device Risk Mitigations
AT-3-d-2-w
Wireless Device Malicious Code Protection
AT-3-d-2-x
Literacy Training and Awareness/Social Engineering and Mining
AT-3-d-2-y
Identification and Authentication (Organizational Users)
AT-3-d-2-z
Media Protection
AT-3-d-3
Privileged User: A user that is authorized (and, therefore, trusted) to perform security- relevant functions that general users are not authorized to perform. In addition to AT-3 (d) (1) and (2) above...
AT-3-d-3-a
Access Control
AT-3-d-3-b
System and Communications Protection and Information Integrity
AT-3-d-3-c
Patch Management
AT-3-d-3-d
Data backup and storage—centralized or decentralized approach
AT-3-d-3-e
Most recent changes to the CJIS Security Policy
AT-3-d-4
Organizational Personnel with Security Responsibilities: Personnel with the responsibility to ensure the confidentiality, integrity, and availability of CJI and the implementation of technology in a m...
AT-3-d-4-a
Local Agency Security Officer Role
AT-3-d-4-b
Authorized Recipient Security Officer Role2
AT-3-d-4-c
Additional state/local/tribal/territorial or federal agency roles and responsibilities
AT-3-d-4-d
Summary of audit findings from previous state audits of local agencies
AT-3-d-4-e
Findings from the last FBI CJIS Division audit
AT-4-a
Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training;and
AT-4-b
Retain individual training records for a minimum of three years.
AU-1-a
Develop, document, and disseminate to organizational personnel with audit and accountability responsibilities:
AU-1-a-1
Agency and system-level audit and accountability policy that:
AU-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
AU-1-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
AU-1-a-2
Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls;
AU-1-b
Designate organizational personnel with information security responsibilities to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and
AU-1-c
Review and update the current audit and accountability:
AU-1-c-1
Policy annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI; and
AU-1-c-2
Procedures annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
AU-12-a
Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on all systems generating required audit logs;
AU-12-b
Allow organizational personnel with audit record generation responsibilities, organizational personnel with information security and privacy responsibilities, and system/network administrators to sele...
AU-12-c
Generate audit records for the event types defined in AU-2c that include the audit record content defined in AU-3.
AU-2-a
Identify the types of events that the system is capable of logging in support of the audit function: authentication, file use, user/group management, events sufficient to establish what occurred, the...
AU-2-b
Coordinate the event logging function with other organizational entities requiring audit- related information to guide and inform the selection criteria for events to be logged;
AU-2-c
Specify the following event types for logging within the system:
AU-2-c-1
System log-on attempts
AU-2-c-2
Attempts to use:
AU-2-c-2-a
Access permission on a user account, file, directory, or other system resource;
AU-2-c-2-b
Create permission on a user account, file, directory, or other system resource;
AU-2-c-2-c
Write permission on a user account, file, directory, or other system resource;
AU-2-c-2-d
Delete permission on a user account, file, directory, or other system resource;
AU-2-c-2-e
Change permission on a user account, file, directory, or other system resource.
AU-2-c-3
Attempts to change account passwords
AU-2-c-4
Actions by privileged accounts (i.e., root, Oracle, DBA, admin, etc.)
AU-2-c-5
Attempts for users to:
AU-2-c-5-a
Access the audit log file;
AU-2-c-5-b
Modify the audit log file;
AU-2-c-5-c
Destroy the audit log file.
AU-2-d
Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and
AU-2-e
Review and update the event types selected for logging annually.
AU-3-a
What type of event occurred;
AU-3-b
When the event occurred;
AU-3-c
Where the event occurred;
AU-3-d
Source of the event;
AU-3-e
Outcome of the event; and
AU-3-f
Identity of any individuals, subjects, or objects/entities associated with the event.
AU-3(1)-a
Session, connection, transaction, and activity duration;
AU-3(1)-b
Source and destination addresses;
AU-3(1)-c
Object or filename involved; and
AU-3(1)-d
Number of bytes received and bytes sent (for client-server transactions) in the audit records for audit events identified by type, location, or subject.
AU-3(1)-e
The III portion of the log shall clearly identify:
AU-3(1)-e-1
The operator
AU-3(1)-e-2
The authorized receiving agency
AU-3(1)-e-3
The requestor
AU-3(1)-e-4
The secondary recipient
AU-5-a
Alert organizational personnel with audit and accountability responsibilities and system/network administrators within one (1) hour in the event of an audit logging process failure; and
AU-5-b
Take the following additional actions: restart all audit logging processes and verify system(s) are logging properly.
AU-6-a
Review and analyze system audit records weekly for indications of inappropriate or unusual activity and the potential impact of the inappropriate or unusual activity;
AU-6-b
Report findings to organizational personnel with audit review, analysis, and reporting responsibilities and organizational personnel with information security and privacy responsibilities; and
AU-6-c
Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sour...
AU-7-a
Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and
AU-7-b
Does not alter the original content or time ordering of audit records.
AU-8-a
Use internal system clocks to generate time stamps for audit records;
AU-8-b
Record time stamps for audit records that meet hundredths of a second (i.e., hh:mm:ss:00) interval and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Ti...
AU-9-a
Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and
AU-9-b
Alert organizational personnel with audit and accountability responsibilities, organizational personnel with information security and privacy responsibilities, and system/network administrators upon d...
CP-2-a
Develop a contingency plan for the system that:
CP-2-a-1
Identifies essential mission and business functions and associated contingency requirements;
CP-2-a-2
Provides recovery objectives, restoration priorities, and metrics;
CP-2-a-3
Addresses contingency roles, responsibilities, assigned individuals with contact information;
CP-2-a-4
Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;
CP-2-a-5
Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented;
CP-2-a-6
Addresses the sharing of contingency information; and
CP-2-a-7
Is reviewed and approved by agency head or their designee;
CP-2-b
Distribute copies of the contingency plan to organizational personnel with contingency planning or incident response duties;
CP-2-c
Coordinate contingency planning activities with incident handling activities;
CP-2-d
Review the contingency plan for the system annually;
CP-2-e
Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
CP-2-f
Communicate contingency plan changes to organizational personnel with contingency planning or incident response duties;
CP-2-g
Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and
CP-2-h
Protect the contingency plan from unauthorized disclosure and modification.
CP-3-a
Provide contingency training to system users consistent with assigned roles and responsibilities:
CP-3-a-1
Within thirty (30) days of assuming a contingency role or responsibility;
CP-3-a-2
When required by system changes; and
CP-3-a-3
Annually thereafter; and
CP-3-b
Review and update contingency training content annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI, or training simula...
CP-4-a
Test the contingency plan for the system annually using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: checklists, walkthrough and tabletop exerc...
CP-4-b
Review the contingency plan test results; and
CP-4-c
Initiate corrective actions, if needed.
CP-6-a
Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and
CP-6-b
Ensure that the alternate storage site provides controls equivalent to that of the primary site.
CP-7-a
Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of operations for essential mission and business functions within the time period defined i...
CP-7-b
Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization...
CP-7-c
Provide controls at the alternate processing site that are equivalent to those at the primary site.
CP-8(1)-a
Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and
CP-8(1)-b
Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provid...
CP-9-a
Conduct backups of user-level information contained in operational systems for essential business functions as required by the contingency plans;
CP-9-b
Conduct backups of system-level information contained in the system as required by the contingency plans;
CP-9-c
Conduct backups of system documentation, including security- and privacy-related documentation as required by the contingency plans; and
CP-9-d
Protect the confidentiality, integrity, and availability of backup information.
IA-1-a
Develop, document, and disseminate to authorized personnel:
IA-1-a-1
Agency/Entity identification and authentication policy that:
IA-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
IA-1-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
IA-1-a-2
Procedures to facilitate the implementation of the identification and authentication policy and the associated identification and authentication controls;
IA-1-b
Designate an individual with security responsibilities to manage the development, documentation, and dissemination of the identification and authentication policy and procedures; and
IA-1-c
Review and update the current identification and authentication:
IA-1-c-1
Policy annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI; and
IA-1-c-2
Procedures annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
IA-12-a
Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines;
IA-12-b
Resolve user identities to a unique individual; and
IA-12-c
Collect, validate, and verify identity evidence.
IA-12(3)-a
Require that the presented identity evidence be validated and verified through agencydefined resolution, validation, and verification methods.
IA-12(3)-aa
The CSP SHALL verify identity evidence as follows:At a minimum, the applicant’s binding to identity evidence must be verified by a process that is able to achieve a strength of STRONG
IA-12(3)-b
Identity proofing SHALL NOT be performed to determine suitability or entitlement to gain access to services or benefits.
IA-12(3)-bb
For IAL2 remote proofing:The collection of biometric characteristics for physical or biometric comparison of the applicant to the strongest piece of identity evidence provided to support the claimed i...
IA-12(3)-c-1
Collection of PII SHALL be limited to the minimum necessary to resolve to a unique identity in a given context.
IA-12(3)-c-2
Collection of PII SHALL be limited to the minimum necessary to validate the existence of the claimed identity and associate the claimed identity with the applicant providing identity evidence for appr...
IA-12(3)-cc
Knowledge-based verification (KBV) SHALL NOT be used for in-person (physical or supervised remote) identity verification.
IA-12(3)-d
The CSP SHALL provide explicit notice to the applicant at the time of collection regarding the purpose for collecting and maintaining a record of the attributes necessary for identity proofing, includ...
IA-12(3)-dd
The CSP SHALL employ appropriately tailored security controls, to include control enhancements, from the moderate or high baseline of security controls defined in the CJISSECPOL.
IA-12(3)-e
If CSPs process attributes for purposes other than identity proofing, authentication, or attribute assertions (collectively “identity service”), related fraud mitigation, or to comply with law or lega...
IA-12(3)-ee
Supervised Remote Identity Proofing:Supervised remote identity proofing is intended to provide controls for comparable levels of confidence and security to in-person IAL3 identity proofing for identit...
IA-12(3)-ee-1
Supervised remote identity proofing and enrollment transactions SHALL meet the following requirements, in addition to the IAL3 validation and verification requirements specified in IA-12(3)s.
IA-12(3)-ee-2
The CSP SHALL monitor the entire identity proofing session, from which the applicant SHALL NOT depart — for example, by a continuous high-resolution video transmission of the applicant.
IA-12(3)-ee-3
The CSP SHALL have a live operator participate remotely with the applicant for the entirety of the identity proofing session.
IA-12(3)-ee-4
The CSP SHALL require all actions taken by the applicant during the identity proofing session to be clearly visible to the remote operator.
IA-12(3)-ee-5
The CSP SHALL require that all digital validation of evidence (e.g., via chip or wireless technologies) be performed by integrated scanners and sensors.
IA-12(3)-ee-6
The CSP SHALL require operators to have undergone a training program to detect potential fraud and to properly perform a supervised remote proofing session.
IA-12(3)-ee-7
The CSP SHALL employ physical tamper detection and resistance features appropriate for the environment in which it is located.
IA-12(3)-ee-8
The CSP SHALL ensure that all communications occur over a mutually authenticated protected channel.
IA-12(3)-f
If the CSP employs consent as part of its measures to maintain predictability and manageability, …then it SHALL NOT make consent for the additional processing a condition of the identity service.
IA-12(3)-ff
Trusted Referee: The use of trusted referees is optional for CSPs; that is, if a CSP chooses to use trusted referees for identity proofing and enrollment, then the following requirements, (1) through...
IA-12(3)-ff-1
If the CSP uses trusted referees, then…The CSP SHALL establish written policy and procedures as to how a trusted referee is determined and the lifecycle by which the trusted referee retains their stat...
IA-12(3)-ff-2
If the CSP uses trusted referees, then…The CSP SHALL proof the trusted referee at the same IAL as the applicant proofing.
IA-12(3)-ff-3
If the CSP uses trusted referees, then…The CSP SHALL determine the minimum evidence required to bind the relationship between the trusted referee and the applicant.
IA-12(3)-g
The CSP SHALL provide mechanisms for redress of applicant complaints or problems arising from the identity proofing.
IA-12(3)-h
The CSP SHALL assess the [redress] mechanisms for their efficacy in achieving resolution of complaints or problems.
IA-12(3)-i
The identity proofing and enrollment processes SHALL be performed according to an applicable written policy or *practice statement* that specifies the particular steps taken to verify identities.
IA-12(3)-j
The *practice statement* SHALL include control information detailing how the CSP handles proofing errors that result in an applicant not being successfully enrolled.
IA-12(3)-k
The CSP SHALL maintain a record, including audit logs, of all steps taken to verify the identity of the applicant as long as the identity exists in the information system.
IA-12(3)-l
The CSP SHALL record the types of identity evidence presented in the proofing process.
IA-12(3)-m
The CSP SHALL conduct a risk management process, including assessments of privacy and security risks to determine:
IA-12(3)-m-1
Any steps that it will take to verify the identity of the applicant beyond any mandatory requirements specified herein;
IA-12(3)-m-2
The PII, including any biometrics, images, scans, or other copies of the identity evidence that the CSP will maintain as a record of identity proofing (Note: Specific federal requirements may apply);...
IA-12(3)-m-3
The schedule of retention for these records (Note: CSPs may be subject to specific retention policies in accordance with applicable laws, regulations, or policies, including any National Archives and...
IA-12(3)-n
All PII collected as part of the enrollment process SHALL be protected to ensure confidentiality, integrity, and attribution of the information source.
IA-12(3)-o
"The entire proofing transaction, including transactions that involve a third party, SHALL occur over authenticated protected channels. "
IA-12(3)-p
"If the CSP uses fraud mitigation measures, then the CSP SHALL conduct a privacy risk assessment for these mitigation measures. "
IA-12(3)-q
In the event a CSP ceases to conduct identity proofing and enrollment processes, then the CSP SHALL be responsible for fully disposing of or destroying any sensitive data including PII, or its protect...
IA-12(3)-r
Regardless of whether the CSP is a federal agency or non-federal entity, the following requirements apply to the federal agency offering or using the proofing service:
IA-12(3)-r-1
The agency SHALL consult with their Senior Agency Official for Privacy (SAOP) to conduct an analysis determining whether the collection of PII to conduct identity proofing triggers Privacy Act require...
IA-12(3)-r-2
The agency SHALL publish a System of Records Notice (SORN) to cover such collection, as applicable.
IA-12(3)-r-3
The agency SHALL consult with their SAOP to conduct an analysis determining whether the collection of PII to conduct identity proofing triggers E-Government Act of 2002 requirements.
IA-12(3)-r-4
The agency SHALL publish a Privacy Impact Assessment (PIA) to cover such collection, as applicable.
IA-12(3)-s
An enrollment code SHALL be comprised of one of the following:
IA-12(3)-s-1
Minimally, a random six character alphanumeric or equivalent entropy. For example, a code generated using an approved random number generator or a serial number for a physical hardware authenticator;
IA-12(3)-s-2
A machine-readable optical label, such as a QR Code, that contains data of similar or higher entropy as a random six character alphanumeric.
IA-12(3)-t
Training requirements for personnel validating evidence SHALL be based on the policies, guidelines, or requirements of the CSP or RP
IA-12(3)-u
This criterion applies to CSPs that provide identity proofing and enrollment services to minors (under the age of 18):
IA-12(3)-v
The CSP SHALL have the operator view the biometric source (e.g., fingers, face) for presence of non-natural materials and perform such inspections as part of the proofing process.
IA-12(3)-w
The CSP SHALL collect biometrics in such a way that ensures that the biometric is collected from the applicant, and not another subject. All biometric performance requirements in IA-5 m (1) through (1...
IA-12(3)-x
The CSP SHALL support in-person or remote identity proofing, or both.
IA-12(3)-y
The CSP SHALL collect the following from the applicant:
IA-12(3)-y-1
One piece of SUPERIOR or STRONG evidence if the evidence’s issuing source,during its identity proofing event, confirmed the claimed identity by collecting two or more forms of SUPERIOR or STRONG evide...
IA-12(3)-y-2
Two pieces of STRONG evidence; OR
IA-12(3)-y-3
One piece of STRONG evidence plus two pieces of FAIR evidence
IA-12(3)-z
The CSP SHALL validate each piece of evidence with a process that can achieve the same strength as the evidence presented (see ‘y’ above). For example, if two forms of STRONG identity evidence are pre...
IA-12(5)-a
Require that a registration code or notice of proofing be delivered through an out-of-band channel to verify the users address (physical or digital) of record.
IA-12(5)-b
The CSP SHALL confirm address of record.
IA-12(5)-c
Valid records to confirm address SHALL be issuing source(s) or authoritative source(s). Self-asserted address data that has not been confirmed in records SHALL NOT be used for confirmation.
IA-12(5)-d
Note that IAL2-7 applies only to in-person proofing at IAL2.
IA-12(5)-e
For remote identity proofing at IAL2:
IA-12(5)-f
For remote identity proofing at IAL2: The applicant SHALL present a valid enrollment code to complete the identity proofing process.
IA-12(5)-g
Note that the following enrollment code validity periods apply to enrollment codes sent to confirmed addresses of record for IAL2 remote in-person proofing only. Enrollment codes shall have the follo...
IA-12(5)-h
If the enrollment code sent to the confirmed address of record as part of the remote identity proofing process at IAL2 is also intended to be an authentication factor, then…it SHALL be reset upon firs...
IA-12(5)-i
If the CSP performs remote proofing at IAL2 and optionally sends notification of proofing in addition to sending the required enrollment code, then…The CSP SHALL ensure the enrollment code and notific...
IA-4-a
Receiving authorization from organizational personnel with identifier management responsibilities to assign an individual, group, role, service, or device identifier;
IA-4-b
Selecting an identifier that identifies an individual, group, role, service, or device;
IA-4-c
Assigning the identifier to the intended individual, group, role, service, or device; and
IA-4-d
Preventing reuse of identifiers for one (1) year.
IA-5-a
Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;
IA-5-b
Establishing initial authenticator content for any authenticators issued by the organization;
IA-5-c
Ensuring that authenticators have sufficient strength of mechanism for their intended use
IA-5-d
Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators;
IA-5-e
Changing default authenticators prior to first use;
IA-5-f
Changing or refreshing authenticators annually or when there is evidence of authenticator compromise;
IA-5-g
Protecting authenticator content from unauthorized disclosure and modification;
IA-5-h
Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and
IA-5-i
Changing authenticators for group or role accounts when membership to those accounts changes.
IA-5-j
AAL2 Specific Requirements
IA-5-j-1
Authentication SHALL occur by the use of either a multi-factor authenticator or a combination of two single-factor authenticators.
IA-5-j-10
Reauthentication of the subscriber SHALL be repeated at least once per 12 hours during an extended usage session.
IA-5-j-11
Reauthentication of the subscriber SHALL be repeated following any period of inactivity lasting 30 minutes or longer.
IA-5-j-12
The CSP SHALL employ appropriately tailored security controls from the moderate baseline of security controls defined in the CJISSECPOL
IA-5-j-13
The CSP SHALL comply with records retention policies i n accordance with applicable laws and regulations.
IA-5-j-14
If the CSP opts to retain records in the absence of any mandatory requirements, then the CSP SHALL conduct a risk management process, including assessments of privacy and security risks to determine h...
IA-5-j-2
If the multi-factor authentication process uses a combination of two single-factor authenticators, then it SHALL include a Memorized Secret authenticator and a possession-based authenticator.
IA-5-j-3
Cryptographic authenticators used at AAL2 SHALL use approved cryptography.
IA-5-j-4
At least one authenticator used at AAL2 SHALL be replay resistant
IA-5-j-5
Communication between the claimant and verifier SHALL be via an authenticated protected channel.
IA-5-j-6
Verifiers operated by government agencies at AAL2 SHALL be validated to meet the requirements of FIPS 140 Level 1.
IA-5-j-7
Authenticators procured by government agencies SHALL be validated to meet the requirements of FIPS 140 Level 1.
IA-5-j-8
If a device such as a smartphone is used in the authentication process, then the unlocking of that device (typically done using a PIN or biometric) SHALL NOT be considered one of the authentication fa...
IA-5-j-9
If a biometric factor is used in authentication at AAL2, then the performance requirements stated in IA-5 m Biometric Requirements SHALL be met.
IA-5-k
Privacy requirements that apply to all CSPs, verifiers, and RPs
IA-5-k-1
The CSP SHALL employ appropriately tailored privacy controls from the CJISSECPOL.
IA-5-k-2
If the CSP processes attributes for purposes other than identity proofing, authentication, or attribute assertions (collectively “identity service”), related fraud mitigation, or to comply with law or...
IA-5-l
General requirements applicable to AAL2 authentication process
IA-5-l-1
CSPs SHALL provide subscriber instructions on how to appropriately protect a physical authenticator against theft or loss.
IA-5-l-10
The CSP SHALL have a documented process to require subscribers to surrender or report the loss of any physical authenticator containing attribute certificates signed by the CSP as soon as practical af...
IA-5-l-11
CSPs SHALL revoke the binding of authenticators immediately upon notification when an online identity ceases to exist (e.g., subscriber’s death, discovery of a fraudulent subscriber), when requested b...
IA-5-l-12
The CSP SHALL have a documented process to require subscribers to surrender or report the loss of any physical authenticator containing certified attributes signed by the CSP within five (5) days afte...
IA-5-l-2
The CSP SHALL provide a mechanism to revoke or suspend the authenticator immediately upon notification from subscriber that loss or theft of the authenticator is suspected.
IA-5-l-3
If required by the authenticator type descriptions in IA-5(1), then the verifier SHALL implement controls to protect against online guessing attacks.
IA-5-l-4
If required by the authenticator type descriptions in IA-5(1) and the description of a given authenticator does not specify otherwise, then the verifier SHALL limit consecutive failed authentication a...
IA-5-l-5
If signed attestations are used, then they SHALL be signed using a digital signature that provides at least the minimum security strength specified in the latest revision of 112 bits as of the date of...
IA-5-l-6
If the verifier and CSP are separate entities (as shown by the dotted line in Figure 6 Digital Identity Model), then communications between the verifier and CSP SHALL occur through a mutually-authenti...
IA-5-l-7
If the CSP provides the subscriber with a means to report loss, theft, or damage to an authenticator using a backup or alternate authenticator, then that authenticator SHALL be either a memorized secr...
IA-5-l-8
If the CSP chooses to verify an address of record (i.e., email, telephone, postal) and suspend authenticator(s) reported to have been compromised, then...The suspension SHALL be reversible if the subs...
IA-5-l-9
If and when an authenticator expires, it SHALL NOT be usable for authentication.
IA-5-m
Biometric Requirements
IA-5-m-1
Biometrics SHALL be used only as part of multi-factor authentication with a physical authenticator (something you have).
IA-5-m-10
If biometric comparison is performed centrally, then biometric revocation, referred to as biometric template protection in ISO/IEC 24745, SHALL be implemented.
IA-5-m-11
If biometric comparison is performed centrally, all transmission of biometrics SHALL be over the authenticated protected channel.
IA-5-m-12
Biometric samples and any biometric data derived from the biometric sample such as a probe produced through signal processing SHALL be zeroized immediately after any training or research data has been...
IA-5-m-2
An authenticated protected channel between sensor (or an endpoint containing a sensor that resists sensor replacement) and verifier SHALL be established.
IA-5-m-3
The sensor or endpoint SHALL be authenticated prior to capturing the biometric sample from the claimant.
IA-5-m-4
The biometric system SHALL operate with an FMR [ISO/IEC 2382-37] of 1 in 1000 or better. This FMR SHALL be achieved under conditions of a conformant attack (i.e., zero-effort impostor attempt) as defi...
IA-5-m-5
The biometric system SHALL allow no more than 5 consecutive failed authentication attempts or 10 consecutive failed attempts if PAD demonstrating at least 90% resistance to presentation attacks is imp...
IA-5-m-6
Once the limit on authentication failures has been reached, the biometric authenticator SHALL either:
IA-5-m-6-i
Impose a delay of at least 30 seconds before the next attempt, increasing exponentially with each successive attempt, or
IA-5-m-7
The verifier SHALL make a determination of sensor and endpoint performance, integrity, and authenticity.
IA-5-m-8
If biometric comparison is performed centrally, then use of the biometric as an authentication factor SHALL be limited to one or more specific devices that are identified using approved cryptography.
IA-5-m-9
If biometric comparison is performed centrally, then a separate key SHALL be used for identifying the device.
IA-5-n
Authenticator binding refers to the establishment of an association between a specific authenticator and a subscriber’s account, enabling the authenticator to be used — possibly in conjunction with ot...
IA-5-n-1
Authenticators SHALL be bound to subscriber accounts by either issuance by the CSP as part of enrollment or associating a subscriber-provided authenticator that is acceptable to the CSP.
IA-5-n-10
At enrollment, authenticators at AAL2 and IAL2 SHALL be bound to the account.
IA-5-n-11
If enrollment and binding are being done remotely and cannot be completed in a single electronic transaction, then the applicant SHALL identify themselves in each new binding transaction by presenting...
IA-5-n-12
If enrollment and binding are being done remotely and cannot be completed in a single electronic transaction, then long-term authenticator secrets are delivered to the applicant within a protected ses...
IA-5-n-13
If enrollment and binding are being done in person and cannot be completed in a single physical encounter, the applicant SHALL identify themselves in person by either using a secret as described in IA...
IA-5-n-14
If enrollment and binding are being done in person and cannot be completed in a single physical encounter, temporary secrets SHALL NOT be reused.
IA-5-n-15
If enrollment and binding are being done in person and cannot be completed in a single physical encounter and the CSP issues long-term authenticator secrets during a physical transaction, they SHALL b...
IA-5-n-16
Before adding a new authenticator to a subscriber’s account, the CSP SHALL first require the subscriber to authenticate at AAL2 (or a higher AAL) at which the new authenticator will be used.
IA-5-n-17
If the subscriber’s account has only one authentication factor bound to it, the CSP SHALL require the subscriber to authenticate at AAL1 in order to bind an additional authenticator of a different aut...
IA-5-n-18
If a subscriber loses all authenticators of a factor necessary to complete multifactor authentication and has been identity proofed at IAL2, that subscriber SHALL repeat the identity proofing process...
IA-5-n-19
If a subscriber loses all authenticators of a factor necessary to complete multifactor authentication and has been identity proofed at IAL2 or IAL3, the CSP SHALL require the claimant to authenticate...
IA-5-n-2
Throughout the digital identity lifecycle, CSPs SHALL maintain a record of all authenticators that are or have been associated with each identity.
IA-5-n-20
If the CSP opts to allow binding of a new memorized secret with the use of two physical authenticators, then it requires entry of a confirmation code sent to an address of record.
IA-5-n-21
If the CSP opts to allow binding of a new memorized secret with the use of two physical authenticators, then the confirmation code SHALL consist of at least 6 random alphanumeric characters generated...
IA-5-n-22
If the CSP opts to allow binding of a new memorized secret with the use of two physical authenticators, then the confirmation code SHALL be valid for a maximum of 7 days but MAY be made valid up to 21...
IA-5-n-3
The CSP or verifier SHALL maintain the information required for throttling authentication attempts.
IA-5-n-4
The CSP SHALL also verify the type of user-provided authenticator so verifiers can determine compliance with requirements at each AAL.
IA-5-n-5
The record created by the CSP SHALL contain the date and time the authenticator was bound to the account.
IA-5-n-6
When any new authenticator is bound to a subscriber account, the CSP SHALL ensure that the binding protocol and the protocol for provisioning the associated key(s) are done at AAL2.
IA-5-n-7
Protocols for key provisioning SHALL use authenticated protected channels or be performed in person to protect against MitM attacks.
IA-5-n-8
Binding of multi-factor authenticators SHALL require multi-factor authentication (or equivalent) at identity proofing.
IA-5-n-9
At enrollment, the CSP SHALL bind at least one, and SHOULD bind at least two, physical (something you have) authenticators to the subscriber’s online identity, in addition to a memorized secret or one...
IA-5-o
Session Management: The following requirements apply to applications where a session is maintained between the subscriber and relying party to allow multiple interactions without repeating the authent...
IA-5-o-1
Session Binding Requirements: A session occurs between the software that a subscriber is running — such as a browser, application, or operating system (i.e., the session subject) — and the RP or CSP t...
IA-5-o-1-a
A session is maintained by a session secret which SHALL be shared between the subscriber’s software and the service being accessed.
IA-5-o-1-b
The secret SHALL be presented directly by the subscriber’s software or possession of the secret SHALL be proven using a cryptographic mechanism.
IA-5-o-1-c
The secret used for session binding SHALL be generated by the session host in direct response to an authentication event.
IA-5-o-1-d
A session SHALL NOT be considered at a higher AAL than the authentication event.
IA-5-o-1-e
Secrets used for session binding SHALL be generated by the session host during an interaction, typically immediately following authentication.
IA-5-o-1-f
Secrets used for session binding SHALL be generated by an approved random bit generator [SP 800-90Ar1].
IA-5-o-1-g
Secrets used for session binding SHALL contain at least 64 bits of entropy.
IA-5-o-1-h
Secrets used for session binding SHALL be erased or invalidated by the session subject when the subscriber logs out.
IA-5-o-1-i
Secrets used for session binding SHALL be sent to and received from the device using an authenticated protected channel.
IA-5-o-1-j
Secrets used for session binding SHALL time out and not be accepted after the times specified in IA-5 j (13) as appropriate for the AAL.
IA-5-o-1-k
Secrets used for session binding SHALL NOT be available to insecure communications between the host and subscriber’s endpoint.
IA-5-o-1-l
Authenticated sessions SHALL NOT fall back to an insecure transport, such as from https to http, following authentication.
IA-5-o-1-m
URLs or POST content SHALL contain a session identifier that SHALL be verified by the RP to ensure that actions taken outside the session do not affect the protected session.
IA-5-o-1-n
Browser cookies SHALL be tagged to be accessible only on secure (HTTPS) sessions.
IA-5-o-1-o
Browser cookies SHALL be accessible to the minimum practical set of hostnames and paths.
IA-5-o-1-p
Expiration of browser cookies SHALL NOT be depended upon to enforce session timeouts.
IA-5-o-1-q
The presence of an OAuth access token SHALL NOT be interpreted by the RP as presence of the subscriber, in the absence of other signals
IA-5-o-2
Reauthentication Requirements
IA-5-o-2-a
Continuity of authenticated sessions SHALL be based upon the possession of a session secret issued by the verifier at the time of authentication and optionally refreshed during the session.
IA-5-o-2-b
Session secrets SHALL be non-persistent, i.e., they SHALL NOT be retained across a restart of the associated application or a reboot of the host device.
IA-5-o-2-c
Periodic reauthentication of sessions (at least every 12 hours per session) SHALL be performed to confirm the continued presence of the subscriber at an authenticated session.
IA-5-o-2-d
A session SHALL NOT be extended past the guidelines in IA-5 o (2) a – j based on presentation of the session secret alone.
IA-5-o-2-e
Prior to session expiration, the reauthentication time limit SHALL be extended by prompting the subscriber for the authentication factor(s) of a memorized secret or biometric. Note: At AAL2, a memoriz...
IA-5-o-2-f
If federated authentication is being used, then since the CSP and RP often employ separate session management technologies, there SHALL NOT be any assumption of correlation between these sessions.
IA-5-o-2-g
An RP requiring reauthentication through a federation protocol SHALL — if possible within the protocol — specify the maximum (see IA-5 j (10)) acceptable authentication age to the CSP.
IA-5-o-2-h
If federated authentication if being used and an RP has specific authentication age (see IA-5 j [10]) requirements that it has communicated to the CSP, then the CSP SHALL reauthenticate the subscriber...
IA-5-o-2-i
If federated authentication is being used, the CSP SHALL communicate the authentication event time to the RP to allow the RP to decide if the assertion is sufficient for reauthentication and to determ...
IA-5(1)(a)-1
Maintain a list of commonly-used, expected, or compromised passwords and update the list quarterly and when organizational passwords are suspected to have been compromised directly or indirectly;
IA-5(1)(a)-10
Verifiers SHALL NOT prompt subscribers to use specific types of information (e.g., “What was the name of your first pet?”) when choosing memorized secrets.
IA-5(1)(a)-11
When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly used, expected, or compromi...
IA-5(1)(a)-12
If a chosen secret is found in the list, the CSP or verifier SHALL advise the subscriber that they need to select a different secret.
IA-5(1)(a)-13
If a chosen secret is found in the list, the CSP or verifier SHALL provide the reason for rejection.
IA-5(1)(a)-14
If a chosen secret is found in the list, the CSP or verifier SHALL require the subscriber to choose a different value.
IA-5(1)(a)-15
Verifiers SHALL implement a rate-limiting mechanism that effectively limits failed authentication attempts that can be made on the subscriber’s account to no more than five.
IA-5(1)(a)-16
Verifiers SHALL force a change of memorized secret if there is evidence of compromise of the authenticator.
IA-5(1)(a)-17
The verifier SHALL use approved encryption when requesting memorized secrets in order to provide resistance to eavesdropping and MitM attacks.
IA-5(1)(a)-18
The verifier SHALL use an authenticated protected channel when requesting memorized secrets in order to provide resistance to eavesdropping and MitM attacks.
IA-5(1)(a)-19
Verifiers SHALL store memorized secrets in a form that is resistant to offline attacks.
IA-5(1)(a)-2
Require immediate selection of a new password upon account recovery
IA-5(1)(a)-20
Memorized secrets SHALL be salted and hashed using a suitable one-way key derivation function.
IA-5(1)(a)-21
The salt SHALL be at least 32 bits in length and be chosen arbitrarily to minimize salt value collisions among stored hashes.
IA-5(1)(a)-22
Both the salt value and the resulting hash SHALL be stored for each subscriber using a memorized secret authenticator
IA-5(1)(a)-23
If an additional iteration of a key derivation function using a salt value known only to the verifier is performed, then this secret salt value SHALL be generated with an approved random bit generator...
IA-5(1)(a)-24
If an additional iteration of a key derivation function using a salt value known only to the verifier is performed, then this secret salt value SHALL provide at least the minimumsecurity strength.
IA-5(1)(a)-25
If an additional iteration of a key derivation function using a salt value known only to the verifier is performed, then this secret salt value SHALL be stored separately from the memorized secrets
IA-5(1)(a)-3
Allow user selection of long passwords and passphrases, including spaces and all printable characters;
IA-5(1)(a)-4
Employ automated tools to assist the user in selecting strong password authenticators;
IA-5(1)(a)-5
Enforce the following composition and complexity rules when agencies elect to follow basic password standards:
IA-5(1)(a)-5-a
Not be a proper name.
IA-5(1)(a)-5-b
Not be the same as the Userid.
IA-5(1)(a)-5-c
Expire within a maximum of 90 calendar days.
IA-5(1)(a)-5-d
Not be identical to the previous ten (10) passwords.
IA-5(1)(a)-5-e
Not be displayed when entered.
IA-5(1)(a)-6
If chosen by the subscriber, memorized secrets SHALL be at least 8 characters in length.
IA-5(1)(a)-7
If chosen by the CSP or verifier using an approved random number generator, memorized secrets SHALL be at least 6 characters in length.
IA-5(1)(a)-8
Truncation of the secret SHALL NOT be performed.
IA-5(1)(a)-9
Memorized secret verifiers SHALL NOT permit the subscriber to store a “hint” that is accessible to an unauthenticated claimant.
IA-5(1)(b)-1
CSPs creating look-up secret authenticators SHALL use an approved random bit generator to generate the list of secrets.
IA-5(1)(b)-10
If look-up secrets have less than 112 bits of entropy, then the salt SHALL be at least 32 bits in length and be chosen arbitrarily to minimize salt value collisions among stored hashes.
IA-5(1)(b)-11
If look-up secrets have less than 112 bits of entropy, then both the salt value and the resulting hash SHALL be stored for each look-up secret.
IA-5(1)(b)-12
If look-up secrets that have less than 64 bits of entropy, then the verifier SHALL implement a rate-limiting mechanism that effectively limits the number of failed authentication attempts that can be...
IA-5(1)(b)-13
The verifier SHALL use approved encryption when requesting look-up secrets in order to provide resistance to eavesdropping and MitM attacks.
IA-5(1)(b)-14
The verifier SHALL use an authenticated protected channel when requesting look-up secrets in order to provide resistance to eavesdropping and MitM attacks.
IA-5(1)(b)-2
Look-up secrets SHALL have at least 20 bits of entropy.
IA-5(1)(b)-3
If look-up secrets are distributed online, then they SHALL be distributed over a secure channel in accordance with the post-enrollment binding requirements in IA-5 ‘n’ 17 through 25.
IA-5(1)(b)-4
Verifiers of look-up secrets SHALL prompt the claimant for the next secret from their authenticator or for a specific (e.g., numbered) secret.
IA-5(1)(b)-5
A given secret from an authenticator SHALL be used successfully only once.
IA-5(1)(b)-6
If a look-up secret is derived from a grid (bingo) card, then each cell of the grid SHALL be used only once.
IA-5(1)(b)-7
Verifiers SHALL store look-up secrets in a form that is resistant to offline attacks.
IA-5(1)(b)-8
If look-up secrets have at least 112 bits of entropy, then they SHALL be hashed with an approved one-way function
IA-5(1)(b)-9
If look-up secrets have less than 112 bits of entropy, then they SHALL be salted and hashed using a suitable one-way key derivation function.
IA-5(1)(c)-1
The out-of-band authenticator SHALL establish a separate channel with the verifier in order to retrieve the out-of-band secret or authentication request.
IA-5(1)(c)-10
Depending on the type of out-of-band authenticator, one of the following SHALL take place: transfer of a secret to the primary channel, transfer of a secret to the secondary channel, or verification o...
IA-5(1)(c)-11
If the out-of-band authenticator operates by transferring the secret to the primary channel, then the verifier SHALL transmit a random secret to the out-of-band authenticator and then wait for the sec...
IA-5(1)(c)-12
If the out-of-band authenticator operates by transferring the secret to the secondary channel, then the verifier SHALL display a random authentication secret to the claimant via the primary channel an...
IA-5(1)(c)-13
If the out-of-band authenticator operates by verification of secrets by the claimant, then the verifier SHALL display a random authentication secret to the claimant via the primary channel, send the s...
IA-5(1)(c)-14
The authentication SHALL be considered invalid if not completed within 10 minutes.
IA-5(1)(c)-15
Verifiers SHALL accept a given authentication secret only once during the validity period.
IA-5(1)(c)-16
The verifier SHALL generate random authentication secrets with at least 20 bits of entropy.
IA-5(1)(c)-17
The verifier SHALL generate random authentication secrets using an approved random bit generator.
IA-5(1)(c)-18
If the authentication secret has less than 64 bits of entropy, the verifier SHALL implement a rate-limiting mechanism that effectively limits the number of failed authentication attempts that can be m...
IA-5(1)(c)-19
If out-of-band verification is to be made using the PSTN, then the verifier SHALL verify that the pre-registered telephone number being used is associated with a specific physical device.
IA-5(1)(c)-2
Communication over the secondary channel SHALL be encrypted unless sent via the public switched telephone network (PSTN).
IA-5(1)(c)-20
If out-of-band verification is to be made using the PSTN, then changing the pre-registered telephone number is considered to be the binding of a new authenticator and SHALL only occur as described in...
IA-5(1)(c)-21
If PSTN is used for out-of-band authentication, then the CSP SHALL offer subscribers at least one alternate authenticator that is not RESTRICTED and can be used to authenticate at the required AAL.
IA-5(1)(c)-22
If PSTN is used for out-of-band authentication, then the CSP SHALL Provide meaningful notice to subscribers regarding the security risks of the RESTRICTED authenticator and availability of alternative...
IA-5(1)(c)-23
If PSTN is used for out-of-band authentication, then the CSP SHALL address any additional risk to subscribers in its risk assessment.
IA-5(1)(c)-24
If PSTN is used for out-of-band authentication, then the CSP SHALL develop a migration plan for the possibility that the RESTRICTED authenticator is no longer acceptable at some point in the future an...
IA-5(1)(c)-3
Methods that do not prove possession of a specific device, such as voice-over-IP (VoIP) or email, SHALL NOT be used for out-of-band authentication.
IA-5(1)(c)-4
If PSTN is not being used for out-of-band communication, then the out-of-band authenticator SHALL uniquely authenticate itself by establishing an authenticated protected channel with the verifier.
IA-5(1)(c)-5
If PSTN is not being used for out-of-band communication, then the out-of-band authenticator SHALL communicate with the verifier using approved cryptography.
IA-5(1)(c)-6
If PSTN is not being used for out-of-band communication, then the key used to authenticate the out-of-band device SHALL be stored in suitably secure storage available to the authenticator application...
IA-5(1)(c)-7
If the PSTN is used for out-of-band authentication and a secret is sent to the out-of-band device via the PSTN, then the out-of-band authenticator SHALL uniquely authenticate itself to a mobile teleph...
IA-5(1)(c)-8
If the out-of-band authenticator sends an approval message over the secondary communication channel, it SHALL either accept transfer of a secret from the primary channel to be sent to the verifier via...
IA-5(1)(c)-9
The verifier SHALL NOT store the identifying key itself, but SHALL use a verification method (e.g., an approved hash function or proof of possession of the identifying key) to uniquely identify the au...
IA-5(1)(d)-1
The secret key and its algorithm SHALL provide at least the minimum security strength of 112 bits as of the date of this publication.
IA-5(1)(d)-10
The verifier SHALL use an authenticated protected channel when collecting the OTP.
IA-5(1)(d)-11
If a time-based OTP is used, it SHALL have a defined lifetime (recommended 30 seconds) that is determined by the expected clock drift — in either direction — of the authenticator over its lifetime, pl...
IA-5(1)(d)-12
Verifiers SHALL accept a given time-based OTP only once during the validity period.
IA-5(1)(d)-13
If the authenticator output has less than 64 bits of entropy, the verifier SHALL implement a rate-limiting mechanism that effectively limits the number of failed authentication attempts that can be ma...
IA-5(1)(d)-14
If the authenticator is multi-factor, then each use of the authenticator SHALL require the input of the additional factor.
IA-5(1)(d)-15
If the authenticator is multi-factor and a memorized secret is used by the authenticator for activation, then that memorized secret SHALL be a randomly chosen numeric secret at least 6 decimal digits...
IA-5(1)(d)-16
If the authenticator is multi-factor, then use of a memorized secret for activation SHALL be rate limited as specified in IA-5 l (3) through (4).
IA-5(1)(d)-17
If the authenticator is multi-factor and is activated by a biometric factor, then that factor SHALL meet the requirements of IA-5 m, including limits on the number of consecutive authentication failur...
IA-5(1)(d)-18
If the authenticator is multi-factor, then the unencrypted key and activation secret or biometric sample — and any biometric data derived from the biometric sample such as a probe produced through sig...
IA-5(1)(d)-19
If the authenticator is multi-factor, the verifier or CSP SHALL establish, via the authenticator source, that the authenticator is a multi-factor device.
IA-5(1)(d)-2
The nonce SHALL be of sufficient length to ensure that it is unique for each operation of the device over its lifetime.
IA-5(1)(d)-20
In the absence of a trusted statement that it is a multi-factor device, the verifier SHALL treat the authenticator as single-factor, in accordance with IA-5 (1) (d) (1) through (13).
IA-5(1)(d)-3
OTP authenticators — particularly software-based OTP generators —SHALL NOT facilitate the cloning of the secret key onto multiple devices.
IA-5(1)(d)-4
The authenticator output SHALL have at least 6 decimal digits (approximately 20 bits) of entropy.
IA-5(1)(d)-5
If the nonce used to generate the authenticator output is based on a real-time clock, then the nonce SHALL be changed at least once every 2 minutes.
IA-5(1)(d)-6
The OTP value associated with a given nonce SHALL be accepted only once.
IA-5(1)(d)-7
The symmetric keys used by authenticators are also present in the verifier and SHALL be strongly protected against compromise.
IA-5(1)(d)-8
If a single-factor OTP authenticator is being associated with a subscriber account, then the verifier or associated CSP SHALL use approved cryptography to either generate and exchange or to obtain the...
IA-5(1)(d)-9
The verifier SHALL use approved encryption when collecting the OTP.
IA-5(1)(e)-1
If the cryptographic authenticator is software based, the key SHALL be stored in suitably secure storage available to the authenticator application
IA-5(1)(e)-10
The challenge nonce SHALL be at least 64 bits in length.
IA-5(1)(e)-11
The challenge nonce SHALL either be unique over the authenticator’s lifetime or statistically unique (i.e., generated using an approved random bit generator).
IA-5(1)(e)-12
The verification operation SHALL use approved cryptography.
IA-5(1)(e)-13
If a multi-factor cryptographic software authenticator is being used, then each authentication requires the presentation of the activation factor.
IA-5(1)(e)-14
If the authenticator is multi-factor, then any memorized secret used by the authenticator for activation SHALL be a randomly chosen numeric secret at least 6 decimal digits in length or other memorize...
IA-5(1)(e)-15
If the authenticator is multi-factor, then use of a memorized secret for activation SHALL be rate limited as specified in IA-5 l (3) through (4).
IA-5(1)(e)-16
If the authenticator is multi-factor and is activated by a biometric factor, then that factor SHALL meet the requirements of IA-5 m, including limits on the number of consecutive authentication failur...
IA-5(1)(e)-17
If the authenticator is multi-factor, then the unencrypted key and activation secret or biometric sample — and any biometric data derived from the biometric sample such as a probe produced through sig...
IA-5(1)(e)-2
If the cryptographic authenticator is software based, the key SHALL be strongly protected against unauthorized disclosure by the use of access controls that limit access to the key to only those softw...
IA-5(1)(e)-3
If the cryptographic authenticator is software based, it SHALL NOT facilitate the cloning of the secret key onto multiple devices.
IA-5(1)(e)-4
If the authenticator is single-factor and hardware-based, secret keys unique to the device SHALL NOT be exportable (i.e., cannot be removed from the device).
IA-5(1)(e)-5
If the authenticator is hardware-based, the secret key and its algorithm SHALL provide at least the minimum-security length of 112 bits as of the date of this publication.
IA-5(1)(e)-6
If the authenticator is hardware-based, the challenge nonce SHALL be at least 64 bits in length.
IA-5(1)(e)-7
If the authenticator is hardware-based, approved cryptography SHALL be used.
IA-5(1)(e)-8
Cryptographic keys stored by the verifier SHALL be protected against modification.
IA-5(1)(e)-9
If symmetric keys are used, cryptographic keys stored by the verifier SHALL be protected against disclosure.
IA-5(2)-a
For public key-based authentication:
IA-5(2)-a-1
Enforce authorized access to the corresponding private key; and
IA-5(2)-a-2
Map the authenticated identity to the account of the individual or group; and
IA-5(2)-b
When public key infrastructure (PKI) is used:
IA-5(2)-b-1
Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and
IA-5(2)-b-2
Implement a local cache of revocation data to support path discovery and validation.
IA-8(2)-a
Accept only external authenticators that are NIST-compliant; and
IA-8(2)-b
Document and maintain a list of accepted external authenticators.
IR-1-a
Develop, document, and disseminate to all personnel when their unescorted logical or physical access to any information system results in the ability, right, or privilege to view, modify, or make use...
IR-1-a-1
Agency-level incident response policy that:
IR-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
IR-1-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
IR-1-a-2
Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;
IR-1-b
Designate an individual with security responsibilities to manage the development, documentation, and dissemination of the incident response policy and procedures; and
IR-1-c
Review and update the current incident response:
IR-1-c-1
Policy annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI; and
IR-1-c-2
Procedures annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
IR-2-a
Provide incident response training to system users consistent with assigned roles and responsibilities:
IR-2-a-1
Prior to assuming an incident response role or responsibility or acquiring system access;
IR-2-a-2
When required by system changes; and
IR-2-a-3
Annually thereafter; and
IR-2-b
Review and update incident response training content annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
IR-4-a
Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;
IR-4-b
Coordinate incident handling activities with contingency planning activities;
IR-4-c
Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
IR-4-d
Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.
IR-6-a
Require personnel to report suspected incidents to the organizational incident response capability within immediately but not to exceed one (1) hour after discovery; and
IR-6-b
Report incident information to organizational personnel with incident handling responsibilities, and if confirmed, notify the CSO, SIB Chief, or Interface Agency Official.
IR-8-a
Develop an incident response plan that:
IR-8-a-1
Provides the organization with a roadmap for implementing its incident response capability;
IR-8-a-10
Explicitly designates responsibility for incident response to organizational personnel with incident reporting responsibilities and CSO or CJIS WAN Official.
IR-8-a-2
Describes the structure and organization of the incident response capability;
IR-8-a-3
Provides a high-level approach for how the incident response capability fits into the overall organization;
IR-8-a-4
Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
IR-8-a-5
Defines reportable incidents;
IR-8-a-6
Provides metrics for measuring the incident response capability within the organization;
IR-8-a-7
Defines the resources and management support needed to effectively maintain and mature an incident response capability;
IR-8-a-8
Addresses the sharing of incident information;
IR-8-a-9
Is reviewed and approved by the organization’s/agency’s executive leadership annually; and
IR-8-b
Distribute copies of the incident response plan to organizational personnel with incident handling responsibilities;
IR-8-c
Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
IR-8-d
Communicate incident response plan changes to organizational personnel with incident handling responsibilities; and
IR-8-e
Protect the incident response plan from unauthorized disclosure and modification.
IR-8(1)-a
A process to determine if notice to individuals or other organizations, including oversight organizations, is needed;
IR-8(1)-b
An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and
IR-8(1)-c
Identification of applicable privacy requirements.
MA-1-a
Develop, document, and disseminate to organizational personnel with system maintenance responsibilities:
MA-1-a-1
Agency-level maintenance policy that:
MA-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
MA-1-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
MA-1-a-2
Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;
MA-1-b
Designate an individual with security responsibilities to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
MA-1-c
Review and update the current maintenance:
MA-1-c-1
Policy annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI; and
MA-1-c-2
Procedures annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
MA-2-a
Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
MA-2-b
Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
MA-2-c
Require that organizational personnel with information security and privacy responsibilities explicitly approve the removal of the system or system components from organizational facilities for off-si...
MA-2-d
Sanitize equipment to remove information from associated media prior to removal from organizational facilities for off-site maintenance, repair, replacement, or destruction;
MA-2-e
Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
MA-2-f
Include the following information in organizational maintenance records:
MA-2-f-1
Component name
MA-2-f-2
Component serial number
MA-2-f-3
Date/time of maintenance
MA-2-f-4
Maintenance performed
MA-2-f-5
Name(s) of entity performing maintenance including escort if required.
MA-3-a
Approve, control, and monitor the use of system maintenance tools; and
MA-3-b
Review previously approved system maintenance tools prior to each use.
MA-3(3)-a
Verifying that there is no organizational information contained on the equipment;
MA-3(3)-b
Sanitizing or destroying the equipment;
MA-3(3)-c
Retaining the equipment within the facility; or
MA-3(3)-d
Obtaining an exemption from organizational personnel with system maintenance responsibilities explicitly authorizing removal of the equipment from the facility.
MA-4-a
Approve and monitor nonlocal maintenance and diagnostic activities;
MA-4-b
Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
MA-4-c
Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
MA-4-d
Maintain records for nonlocal maintenance and diagnostic activities; and
MA-4-e
Terminate session and network connections when nonlocal maintenance is completed.
MA-5-a
Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
MA-5-b
Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
MA-5-c
Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizatio...
MP-1-a
Develop, document, and disseminate to authorized individuals:
MP-1-a-1
Agency-level media protection policy that:
MP-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among agency entities, and compliance; and
MP-1-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
MP-1-a-2
Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;
MP-1-b
Designate an individual with security responsibilities to manage the development, documentation, and dissemination of the media protection policy and procedures; and
MP-1-c
Review and update the current media protection:
MP-1-c-1
Policy at least annually and following any security incidents involving digital and/or nondigital media; and
MP-1-c-2
Procedures at least annually and following any security incidents involving digital and/or non-digital media.
MP-3-a
Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and
MP-3-b
Exempt digital and non-digital media containing CJI from marking if the media remain within physically secure locations or controlled areas.
MP-4-a
Physically control and securely store digital and non-digital media within physically secure locations or controlled areas and encrypt CJI on digital media when physical and personnel restrictions are...
MP-4-b
Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
MP-5-a
Protect and control digital and non-digital media to help prevent compromise of the data during transport outside of the physically secure locations or controlled areas using encryption, as defined in...
MP-5-b
Maintain accountability for system media during transport outside of the physically secure location or controlled areas;
MP-5-c
Document activities associated with the transport of system media; and
MP-5-d
Restrict the activities associated with the transport of system media to authorized personnel.
MP-6-a
Sanitize or destroy digital and non-digital media prior to disposal, release out of agency control, or release for reuse using overwrite technology at least three times or degauss digital media prior...
MP-6-b
Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
MP-7-a
Restrict the use of digital and non-digital media on agency owned systems that have been approved for use in the storage, processing, or transmission of criminal justice information by using technical...
MP-7-b
Prohibit the use of personally owned digital media devices on all agency owned or controlled systems that store, process, or transmit criminal justice information; and
MP-7-c
Prohibit the use of digital media devices on all agency owned or controlled systems that store, process, or transmit criminal justice information when such devices have no identifiable owner.
PE-1-a
Develop, document, and disseminate to organizational personnel with physical and environmental protection responsibilities:
PE-1-a-1
Agency-level physical and environmental protection policy that:
PE-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
PE-1-a-2
Procedures to facilitate the implementation of the physical and environmental protection policy and the associated physical and environmental protection controls;
PE-1-b
Designate organizational personnel with information security responsibilities to manage the development, documentation, and dissemination of the physical and environmental protection policy and proced...
PE-1-c
Review and update the current physical and environmental protection:
PE-1-c-1
Policy annually and following any physical, environmental, or security related incidents involving CJI or systems used to process, store, or transmit CJI; and
PE-1-c-2
Procedures annually and following any physical, environmental, or security related incidents involving CJI or systems used to process, store, or transmit CJI.
PE-10-a
Provide the capability of shutting off power to all information systems in emergency situations;
PE-10-b
Place emergency shutoff switches or devices in easily accessible locations to facilitate access for authorized personnel; and
PE-10-c
Protect emergency power shutoff capability from unauthorized activation. Note:This control only applies to data centers as defined in Appendix A Terms and Definitions.
PE-14-a
Maintain adequate HVAC levels within the facility where the system resides at recommended system manufacturer levels; and
PE-14-b
Monitor environmental control levels continuously. Note: This control only applies to data centers as defined in Appendix A Terms and Definitions.
PE-16-a
Authorize and control information system-related components entering and exiting the facility; and
PE-16-b
Maintain records of the system components.
PE-17-a
Determine and document all alternate facilities or locations allowed for use by employees;
PE-17-b
Employ the following controls at alternate work sites:
PE-17-b-1
Limit access to the area during CJI processing times to only those personnel authorized by the agency to access or view CJI.
PE-17-b-2
Lock the area, room, or storage container when unattended.
PE-17-b-3
Position information system devices and documents containing CJI in such a way as to prevent unauthorized individuals from access and view.
PE-17-b-4
Follow the encryption requirements found in SC-13 and SC-28 for electronic storage (i.e., data at-rest) of CJI.
PE-17-c
Assess the effectiveness of controls at alternate work sites; and
PE-17-d
Provide a means for employees to communicate with information security and privacy personnel in case of incidents.
PE-2-a
Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides;
PE-2-b
Issue authorization credentials for facility access;
PE-2-c
Review the access list detailing authorized facility access by individuals annually and when personnel changes occur; and
PE-2-d
Remove individuals from the facility access list when access is no longer required.
PE-3-a
Enforce physical access authorizations by:
PE-3-a-1
Verifying individual access authorizations before granting access to the facility; and
PE-3-a-2
Controlling ingress and egress to the facility using agency-implemented procedures and controls;
PE-3-b
Maintain physical access audit logs for the physically secure location and agency-defined sensitive areas;
PE-3-c
Control access to areas within the facility designated as non-publicly accessible by implementing physical access devices including, but not limited to keys, locks, combinations, biometric readers, pl...
PE-3-d
Escort visitors and control visitor activity in all physically secure locations;
PE-3-e
Secure keys, combinations, and other physical access devices;
PE-3-f
Inventory all agency-issued physical access devices annually; and
PE-3-g
Change combinations and keys when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.
PE-3-h
If the above conditions cannot be met refer to the requirements listed in PE-17.
PE-6-a
Monitor physical access to the facility where the system resides to detect and respond to physical security incidents;
PE-6-b
Review physical access logs quarterly and upon occurrence of any physical, environmental, or security-related incidents involving CJI or systems used to process, store, or transmit CJI; and
PE-6-c
Coordinate results of reviews and investigations with the organizational incident response capability.
PE-8-a
Maintain visitor access records to the facility where the system resides for one (1) year;
PE-8-b
Review visitor access records quarterly; and
PE-8-c
Report anomalies in visitor access records to organizational personnel with physical and environmental protection responsibilities and organizational personnel with information security responsibiliti...
PL-1-a
Develop, document, and disseminate to organizational personnel with planning responsibilities:
PL-1-a-1
Agency-level planning policy that:
PL-1-a-1-c
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
PL-1-a-1-d
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
PL-1-a-2
Procedures to facilitate the implementation of the planning policy and the associated planning controls;
PL-1-b
Designate organizational personnel with information security and privacy responsibilities to manage the development, documentation, and dissemination of the planning policy and procedures; and
PL-1-c
Review and update the current planning:
PL-1-c-1
Policy annually and following; any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI and
PL-1-c-2
Procedures annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
PL-2-a
Develop security and privacy plans for the system that:
PL-2-a-1
Are consistent with the organization’s enterprise architecture;
PL-2-a-10
Provide an overview of the security and privacy requirements for the system;
PL-2-a-11
Identify any relevant control baselines or overlays, if applicable;
PL-2-a-12
Describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions;
PL-2-a-13
Include risk determinations for security and privacy architecture and design decisions;
PL-2-a-14
Include security- and privacy-related activities affecting the system that require planning and coordination with organizational personnel with system security and privacy planning and plan implementa...
PL-2-a-15
Are reviewed and approved by the authorizing official or designated representative prior to plan implementation.
PL-2-a-2
Explicitly define the constituent system components;
PL-2-a-3
Describe the operational context of the system in terms of mission and business processes;
PL-2-a-4
Identify the individuals that fulfill system roles and responsibilities;
PL-2-a-5
Identify the information types processed, stored, and transmitted by the system;
PL-2-a-6
Provide the security categorization of the system, including supporting rationale;
PL-2-a-7
Describe any specific threats to the system that are of concern to the organization;
PL-2-a-8
Provide the results of a privacy risk assessment for systems processing personally identifiable information;
PL-2-a-9
Describe the operational environment for the system and any dependencies on or connections to other systems or system components;
PL-2-b
Distribute copies of the plans and communicate subsequent changes to the plans to organizational personnel with system security and privacy planning and plan implementation responsibilities; system de...
PL-2-c
Review the system security and privacy plans at least annually or when required due to system changes or modifications;
PL-2-d
Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments; and
PL-2-e
Protect the plans from unauthorized disclosure and modification.
PL-4-a
Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;
PL-4-b
Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the sys...
PL-4-c
Review and update the rules of behavior at least annually; and
PL-4-d
Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge annually, or when the rules are revised or updated.
PL-4(1)-a
Use of social media, social networking sites, and external sites/applications:
PL-4(1)-b
Posting organizational information on public websites; and
PL-4(1)-c
Use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
PL-8-a
Develop security and privacy architectures for the system that:
PL-8-a-1
Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;
PL-8-a-2
Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;
PL-8-a-3
Describe how the architectures are integrated into and support the enterprise architecture; and
PL-8-a-4
Describe any assumptions about, and dependencies on, external systems and services
PL-8-b
Review and update the architectures at least annually or when changes to the system or its environment occur to reflect changes in the enterprise architecture; and
PL-8-c
Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.
RA-1-a
Develop, document, and disseminate to organizational personnel with risk assessment responsibilities:
RA-1-a-1
Agency Level risk assessment policy that:
RA-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
RA-1-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
RA-1-a-2
Procedures to facilitate the implementation of the risk assessment policy and the associated risk assessment controls;
RA-1-b
Designate organizational personnel with security and privacy responsibilities to manage the development, documentation, and dissemination of the risk assessment policy and procedures; and
RA-1-c
Review and update the current risk assessment:
RA-1-c-1
Policy annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI; and
RA-1-c-2
Procedures annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
RA-2-a
Categorize the system and information it processes, stores, and transmits;
RA-2-b
Document the security categorization results, including supporting rationale, in the security plan for the system; and
RA-2-c
Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
RA-3-a
Conduct a risk assessment, including:
RA-3-a-1
Identifying threats to and vulnerabilities in the system;
RA-3-a-2
Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits,...
RA-3-a-3
Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
RA-3-b
Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;
RA-3-c
Document risk assessment results in a risk assessment report;
RA-3-d
Review risk assessment results at least quarterly;
RA-3-e
Disseminate risk assessment results to organizational personnel with risk assessment responsibilities and organizational personnel with security and privacy responsibilities; and
RA-3-f
Update the risk assessment at least quarterly or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of th...
RA-5-a
Monitor and scan for vulnerabilities in the system and hosted applications at least monthly and when new vulnerabilities potentially affecting the system are identified and reported;
RA-5-b
Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
RA-5-b-1
Enumerating platforms, software flaws, and improper configurations;
RA-5-b-2
Formatting checklists and test procedures; and
RA-5-b-3
Measuring vulnerability impact;
RA-5-c
Analyze vulnerability scan reports and results from vulnerability monitoring;
RA-5-d
Remediate legitimate vulnerabilities within the number of days listed;
RA-5-e
Share information obtained from the vulnerability monitoring process and control assessments with organizational personnel with risk assessment, control assessment, and vulnerability scanning responsi...
RA-5-f
Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.
SA-22-a
Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or
SA-22-b
Provide the following options for alternative sources for continued support for unsupported components: original manufacturer support, or original contracted vendor support.
SC-1-a
Develop, document, and disseminate to organizational personnel with system and communications protection responsibilities:
SC-1-a-1
Agency-level system and communications protection policy that:
SC-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
SC-1-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
SC-1-a-2
Procedures to facilitate the implementation of the system and communications protection policy and the associated system and communications protection controls;
SC-1-b
Designate organizational personnel with information security responsibilities to manage the development, documentation, and dissemination of the system and communications protection policy and procedu...
SC-1-c
Review and update the current system and communications protection:
SC-1-c-1
Policy annually and following any changes and security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI; and
SC-1-c-2
Procedures annually and following any changes and security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
SC-13-a
Determine the use of encryption for CJI in-transit when outside a physically secure location; and
SC-13-b
Implement the following types of cryptography required for each specified cryptographic use: cryptographic modules which are Federal Information Processing Standard (FIPS) 140-3 certified, or FIPS val...
SC-15-a
Prohibit remote activation of collaborative computing devices and applications; and
SC-15-b
Provide an explicit indication of use to users physically present at the devices.
SC-17-a
Issue public key certificates under an agency-level certificate authority or obtain public key certificates from an approved service provider; and
SC-17-b
Include only approved trust anchors in trust stores or certificate stores managed by the organization.
SC-18-a
Define acceptable and unacceptable mobile code and mobile code technologies; and
SC-18-b
Authorize, monitor, and control the use of mobile code within the system.
SC-20-a
Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution...
SC-20-b
Provide the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when...
SC-5-a
Protect against or limit the effects of the following types of denial-of-service events: distributed denial of service, DNS Denial of Service, etc.; and
SC-5-b
Employ the following controls to achieve the denial-of-service objective: boundary protection devices and intrusion detection or prevention devices.
SC-7-a
Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;
SC-7-b
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal organizational networks; and
SC-7-c
Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
SC-7(24)-a
Apply the following processing rules to data elements of personally identifiable information: all applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
SC-7(24)-b
Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system
SC-7(24)-c
Document each processing exception; and
SC-7(24)-d
Review and remove exceptions that are no longer supported.
SC-7(4)-a
Implement a managed interface for each external telecommunication service;
SC-7(4)-b
Establish a traffic flow policy for each managed interface;
SC-7(4)-c
Protect the confidentiality and integrity of the information being transmitted across each interface
SC-7(4)-d
Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need;
SC-7(4)-e
Review exceptions to the traffic flow policy annually, after any incident, and after any major changes impacting the information system, while removing exceptions that are no longer supported by an ex...
SC-7(4)-f
Prevent unauthorized exchange of control plane traffic with external networks;
SC-7(4)-g
Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and
SC-7(4)-h
Filter unauthorized control plane traffic from external networks.
SI-1-a
Develop, document, and disseminate to all organizational personnel with system and information integrity responsibilities and information system owners:
SI-1-a-1
Agency-level system and information integrity policy that:
SI-1-a-1-a
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
SI-1-a-1-b
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
SI-1-a-2
Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;
SI-1-b
Designate organizational personnel with system and information integrity responsibilities to manage the development, documentation, and dissemination of the system and information integrity policy and...
SI-1-c
Review and update the current system and information integrity:
SI-1-c-1
Policy annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI; and
SI-1-c-2
Procedures annually and following any security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
SI-11-a
Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and
SI-11-b
Reveal error messages only to organizational personnel with information security responsibilities.
SI-2-a
Identify, report, and correct system flaws;
SI-2-b
Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
SI-2-c
Install security-relevant software and firmware updates within the number of days listed after the release of the updates;
SI-2-d
Incorporate flaw remediation into the organizational configuration management process.
SI-3-a
Implement signature-based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;
SI-3-b
Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;
SI-3-c
Configure malicious code protection mechanisms to:
SI-3-c-1
Perform periodic scans of the system at least daily and real-time scans of files from external sources at network entry and exit points and on all servers and endpoint devices as the files are downloa...
SI-3-c-2
Block or quarantine malicious code, take mitigating action(s), and when necessary, implement incident response procedures; and send alert to system/network administrators and/or organizational personn...
SI-3-d
Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.
SI-4-a
Monitor the system to detect:
SI-4-a-1
Attacks and indicators of potential attacks in accordance with the following monitoring objectives:
SI-4-a-1-a
Intrusion detection and prevention
SI-4-a-1-b
Malicious code protection
SI-4-a-1-c
Vulnerability scanning
SI-4-a-1-d
Audit record monitoring
SI-4-a-1-e
Network monitoring
SI-4-a-1-f
Firewall monitoring;and
SI-4-a-2
Unauthorized local, network, and remote connections;
SI-4-b
Identify unauthorized use of the system through the following techniques and methods: event logging (ref. 5.4 Audit and Accountability);
SI-4-c
Invoke internal monitoring capabilities or deploy monitoring devices:
SI-4-c-1
Strategically within the system to collect organization-determined essential information; and
SI-4-c-2
At ad hoc locations within the system to track specific types of transactions of interest to the organization;
SI-4-d
Analyze detected events and anomalies;
SI-4-e
Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;
SI-4-f
Obtain legal opinion regarding system monitoring activities; and
SI-4-g
Provide intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring, and firewall monitoring software logs to o...
SI-4(4)-a
Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic;
SI-4(4)-b
Monitor inbound and outbound communications traffic continuously for unusual or unauthorized activities or conditions such as: the presence of malicious code or unauthorized use of legitimate code or...
SI-5-a
Receive system security alerts, advisories, and directives from external source(s) (e.g., CISA, Multi-State Information Sharing & Analysis Center [MS-ISAC], U.S. Computer Emergency Readiness Team [USC...
SI-5-b
Generate internal security alerts, advisories, and directives as deemed necessary;
SI-5-c
Disseminate security alerts, advisories, and directives to: organizational personnel implementing, operating, maintaining, and using the system; and
SI-5-d
Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.
SI-7-a
Employ integrity verification tools to detect unauthorized changes to software, firmware, and information systems that contain or process CJI; and
SI-7-b
Take the following actions when unauthorized changes to the software, firmware, and information are detected: notify organizational personnel responsible for software, firmware, and/or information int...
SI-8-a
Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and
SI-8-b
Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
3.2.10-1
Maintain the CJIS Security Policy.
3.2.10-2
Disseminate the FBI Director approved CJIS Security Policy.
3.2.10-3
Serve as a liaison with the CSA’s ISO and with other personnel across the CJIS community and in this regard provide technical guidance as to the intent and implementation of operational and technical...
3.2.10-4
Serve as a point-of-contact (POC) for computer incident notification and distribution of security alerts to the CSOs and ISOs.
3.2.10-5
Assist with developing audit compliance guidelines as well as identifying and reconciling security-related issues.
3.2.10-6
Develop and participate in information security training programs for the CSOs and ISOs, and provide a means by which to acquire feedback to measure the effectiveness and success of such training.
3.2.10-7
Maintain a security policy resource center (SPRC) on FBI.gov and keep the CSOs and ISOs updated on pertinent information.
3.2.2-1
Standards for the selection, supervision, and separation of personnel who have access to CJI.
3.2.2-2
Policy governing the operation of computers, access devices, circuits, hubs, routers,firewalls, and other components that comprise and support a telecommunications network and related CJIS systems use...
3.2.2-2-a
Ensure appropriate use, enforce system discipline, and ensure CJIS Division operating procedures are followed by all users of the respective services and information.
3.2.2-2-b
Ensure state/federal agency compliance with policies approved by the APB and adopted by the FBI.
3.2.2-2-c
Ensure the appointment of the CSA ISO and determine the extent of authority to the CSA ISO.
3.2.2-2-d
Ensure the designation of a Terminal Agency Coordinator (TAC) within each agency with devices accessing CJIS systems.
3.2.2-2-e
Ensure each agency having access to CJI has someone designated as the Local Agency Security Officer (LASO).
3.2.2-2-f
Ensure each LASO receives enhanced security awareness training (ref. Section 5.2).
3.2.2-2-g
Approve access to FBI CJIS systems.
3.2.2-2-h
Assume ultimate responsibility for managing the security of CJIS systems within their state and/or agency.
3.2.2-2-i
Perform other related duties outlined by the user agreements with the FBI CJIS Division.
3.2.2-3
Outsourcing of Criminal Justice Functions
3.2.2-3-a
Responsibility for the management of the approved security requirements shall remain with the CJA. Security control includes the authority to enforce the standards for the selection, supervision, and...
3.2.2-3-b
Responsibility for the management control of network security shall remain with the CJA. Management control of network security includes the authority to enforce the standards for the selection, super...
3.2.7-1
Understand the communications, records capabilities, and needs of the Contractor which is accessing federal and state records through or because of its relationship with the CGA.
3.2.7-10
Any other responsibility for the AC promulgated by the FBI.
3.2.7-2
Participate in related meetings and provide input and comments for system improvement.
3.2.7-3
Receive information from the CGA (e.g., system updates) and disseminate it to appropriate Contractor employees.
3.2.7-4
Maintain and update manuals applicable to the effectuation of the agreement, and provide them to the Contractor.
3.2.7-5
Maintain up-to-date records of Contractor’s employees who access the system, including name, date of birth, social security number, date fingerprint card(s) submitted, date security clearance issued,...
3.2.7-6
Train or ensure the training of Contractor personnel. If Contractor personnel access NCIC, schedule the operators for testing or a certification exam with the CSA staff, or AC staff with permission fr...
3.2.7-7
The AC will not permit an untrained/untested or non-certified Contractor employee to access CJI or systems supporting CJI where access to CJI can be gained.
3.2.7-8
Where appropriate, ensure compliance by the Contractor with NCIC validation requirements.
3.2.7-9
Provide completed applicant fingerprint cards on each Contractor employee who accesses the system to the CGA (or, where appropriate, CSA) for criminal background investigation prior to such employee a...
3.2.8-1
Serve as the security point of contact (POC) to the FBI CJIS Division ISO.
3.2.8-2
Document technical compliance with the CJIS Security Policy with the goal to assure the confidentiality, integrity, and availability of criminal justice information to the user community throughout th...
3.2.8-3
Document and provide assistance for implementing the security-related controls for the Interface Agency and its users.
3.2.8-4
Establish a security incident response and reporting procedure to discover, investigate,document, and report to the CSA, the affected criminal justice agency, and the FBI CJIS Division ISO major incid...
3.2.9-1
Identify who is using the CSA approved hardware, software, and firmware and ensure no unauthorized individuals or processes have access to the same.
3.2.9-2
Identify and document how the equipment is connected to the state system.
3.2.9-3
Ensure that personnel security screening procedures are being followed as stated in this Policy.
3.2.9-4
Ensure the approved and appropriate security measures are in place and working as expected.
3.2.9-5
Support policy compliance and ensure the CSA ISO is promptly informed of security incidents.