1. Washington State Patrol Non-Criminal Justice Agency
Compliance Audit Process
Marsha Stril
WSP Compliance Auditor
Introduce yourself. Have others introduce themselves.

2. Introductions
Your name
Your title

4. Fingerprints
How do you verify that the person in front of you is who they say they are?
Verified forms of identification
Current, valid, unexpired picture identification document (driver’s license)

5. Secondary forms of identification
State Government Issued Certificate of Birth
U.S. Active Duty/Retiree/Reservist Military Identification
Card ( )
U.S. Passport
Federal Government Personal Identity Verification
Card (PIV)
Department of Defense Common Access Card
U.S. Tribal or Bureau of Indian Affairs Identification
Card
Social Security Card
Court Order for Name Change/Gender Change/Adoption/
Divorce
Marriage Certificate (Government Certificate Issued)
U.S. Government Issued Consular Report of Birth
Abroad
Foreign Passport with Appropriate Immigration
Document(s)
Certificate of Citizenship (N560)
Certificate of Naturalization (N550)
INS I-551 Resident Alien Card Issued Since 1997
INS Temporary Resident Identification Card
INS I-688B, I-766 Employment Authorization Card

6. Garbage in, Garbage out

7. Audit for compliance

8. Here’s the Deal How is this change relevant to what I do?
What specifically should I do?
How will I be measured and what consequences will I face?
What tools and support are available?
What’s in it for me?

9. Overview Criminal Justice Information Services (CJIS) Security Policy
Statutory Authority Review
User Agreements/Memorandum of Understanding (MOU)
Criminal History Lifecycle
Security
Storage/Retention
Dissemination
Destruction
Media Security
Audit Process
During today’s instruction you will learn to correctly identify the audit components of the Non-criminal justice agency compliance audits. You will understand basic security awareness requirements and you will be able to confidently prepare for the NCJA audit knowing what to expect and how to create policies that comply with the areas outlined in this presentation.

10. CJIS Security Policy http://www.fbi.gov/about-us/cjis
Federal Requirements
Protect the full lifecycle of the Criminal History Record Information (CHRI)
Whether at rest or in transit
Applies to Non-Criminal Justice Agencies (NCJA)
Provides a secure framework of laws and standards
Federal guidelines
Governs the
use
dissemination
storage
destruction of criminal history record information.
Applies to non-criminal justice agencies:
with access to
Or who operate in support of
Criminal justice services and information

11. Criminal History Record Information (CHRI) Lifecycle
Requested (fingerprints)
Delivered (encrypted )
What happens next?
Where is it being stored?
How long do you keep it?
How is it destroyed?
How secure is your agency IT system?
Authorized-need to know basis. Common purpose.

12. Is the CHRI Secure? Personnel Who has access to it?
Are they sharing it?
With whom?
Location
Controlled access
Password protected
Storage
How long can you retain it?
“Shoulder Surfers”
How long?
Only when it is a key element in an ongoing investigation or the integrity of a case.

13. Secure?
What is your perception, based on our discussion, of the security issues in this office? What could they do to fix it? Best practice would be to have a lockable cabinet with only authorized personnel having the key, or keep the cabinet in a locked room when unattended.

14. Storage/Retention Store CHRI in a secure records environment
Dedicated area with restricted access
Retain CHRI only as long as it pertains to a particular event
Licensing
Employment
Fitness determination

15. State & Federal CHRI
CHRI cannot be shared with any internal or external body not involved in the fitness determination of an applicant
CHRI cannot be given to a person or entity that has no direct interest (secondary dissemination).
CHRI can be given to the applicant upon request
Verify ID
CHRI can be shared when the applicant presents government issued ID.

16. Is it okay to share (disseminate) the results to anyone else?
Dissemination of CHRI
Is it okay to share (disseminate) the results to anyone else?

17. Here is an example
The State Department of Education (DOE) conducts state and national fingerprint-based fingerprint CHRI checks under an approved state statute. Ms. Doe applies to work for the Wonder County Board of Education (BOE). The BOE conducts a state and national fingerprint-based CHRI check on Ms. Doe. The results of the national CHRI check are disseminated to the State Identification Bureau (SIB). The SIB disseminates the record to the State DOE, who is turn disseminates the record to the Wonder County BOE.

18. Remember: Safety First!
DESTRUCTION OF CHRI
Janitorial staff is fingerprinted, right? They won’t look at the items in my wastebasket. They will just throw it away. Handout the Macy’s Day parade article. Talk about it.
What are the authorized methods of destruction?
Remember: Safety First!

19. Macy’s Day Parade Story

20. Federally Approved Methods of CHRI Destruction
Incineration
Shredding

21. Media Security “at rest or in transit”

22. Let’s review….. Security Storage & Retention Dissemination Destruction
Personnel & environment
Storage & Retention
Where & how long
Dissemination
Authorized or not
Destruction
Only two authorized methods
Media Security

23. Any Questions so Far?

24. Audit Process
Not as scary as you may think.

25. It’s not that bad!
NCJA audits are mandated to the state repository (WSP) by the FBI
On-site and/or Mail-in
Triennial audit cycle (every 3 years)

26. The Audit Covers Security Retention/Storage Dissemination Destruction
Media Security
Statutory Authority Review
User Agreements/Memorandum of Understanding (MOU)
Required “Security Awareness Training”
The formal audit is composed of these aspects. As you can see, we’ve discussed most of them already. The records sections we haven’t covered yet are: Statutory authority review verifies that your code or statute contains the categories of applicants for which you are submitting fingerprints. Fingerprint rejection rate is the percentage of request submitted by your agency that are rejected by the FBI for poor fingerprint quality. ORI/RFP usage review compares the reason for fingerprinting listed on the submitted fingerprint card against the reason your agency has on file and how it was received at WSP.

27. Statutory Authority
Authorized by state statute [ Revised Code of Washington (RCW)]
Can also be authorized by ordinance
Federal Regulations (HUD, etc.)
For purposes of employment, licensing, fitness determination and/or emergency placement

28. Memorandum of understanding (MOU)
The FBI requires WSP to have an MOU with each of the non-criminal justice agencies (and criminal justice agencies) that submit fingerprint based state and federal background checks
The purpose of this MOU is to set policy to ensure the protection of CHRI between WSP, the agencies, and the FBI

29. Why Audit???? The intention of the audit process is to:
Help agencies implement and/or review policies, meeting state and federal security standards
Increase safety practices with regards to CHRI
Limit Agency Liability (MOU)

30. Pre-Audit
Pre-audit questionnaire and an audit worksheet are sent out prior to on-site or mail-in audit
WSP auditor draws a sample of data, verifying information
The agency returns the completed documents-(timelines are important) Why???
The auditor will notify you of the data drawn and the requested date and time for an on-site or mail in (correspondence) review

31. During the Audit Verify information provided
Verify Training requirements
Security Awareness Training mandatory in 2013
Verify the security of the process
Verify the security of your IT services
Verify storage procedures
Verify how CHRI is disseminated
Verify how CHRI is destroyed
Verify MOU’s that cover these areas

32. Post Audit Conversation, compliance and completeness
Areas of concern noted
Compliance letter sent to the audited agency
Agency is given 30 days to respond with an action plan
Be responsive
Official letter with completed findings sent to the audited agency within 10 business days of reaching compliance standards satisfactorily
The TAC and the agency head are invited to the table to talk about the items of concern. Compliance is driven by the FBI CJIS standards. Complete understanding by the time I leave your facility.

33. As we move forward Open and transparent communication
Clarification of any misunderstandings
What can the Washington State Patrol do to assist you?

34. Questions??? WSP Compliance Auditor Marsha Stril
Office:
NCJA webpage: