Larry Coffee
Jun 4, 2024
Are we there yet?
Hey Y’all,
It’s been awhile since my last newsletter; my apologies. They keep me busy and I’m trying to understand the modernized CJIS Security Policy (CJISSECPOL) so I can pass it along to y’all. I’m sure by now you’re well aware that we’re in version 5.9.4 (see the last CJIS ACE Newsletter from March.) If you remember properly, this journey started about a year and a half ago with the release of 5.9.1 and I can say that we are almost done with the modernization.
I can’t cover everything in the latest version ‘cause it would take up too much time. So here are a couple of things from 5.9.4 that I’d like to highlight.
There are several controls in Section 5.9 Physical and Environmental Protection (PE) that apply only to data centers. A data center is defined as a physical room, building, or facility housing Information Technology infrastructure for developing, running, and delivering applications and services associated with storing and managing data, as determined by the CSO, their designee, or Interface Agency Official. This one could be interesting because I see wiggle-room for interpretation.
Another new control is the establishment of rules of behavior (ROB) that must be “acknowledged” before a user is granted access to CJI and then annually afterwards (PL-4). I’ve already talked with folks at Peak Performance about allowing the upload of ROB documents into CJIS Online which may be helpful in achieving compliance. CJIS ACE is looking to develop an ROB template as I can see auditors asking to see the ROB acknowledgements in the future.
Finally, according to what I’ve heard, version 5.9.5 will be released soon along with the prioritization/ implementation dates for all of the controls, so keep your eyes peeled!
As always, if you have questions about these updates, CJIS ACE is here to help you understand them so you can be compliant. For CJIS ACE Insight customers, we can go through this together as Insight gets updated.
You can always learn more about what we at CJIS ACE can do for you and your agency. I’d enjoy a chance to talk with you; gimme a call or send me an email.
Y'all take care,
Larry Coffee