Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 9 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 1 of 5 

5.9 Physical and Environmental Protection (PE)1 

1. Based on inquiry and record examination, has the 

Tribe or TGRA developed, documented, and 

disseminated to organizational personnel with 

physical and environmental protection 

responsibilities an agency-level physical and 

environmental protection policy that: 

 Addresses purpose, scope, roles, 

responsibilities, management commitment, 

coordination among organizational 

entities, and compliance? 

 Is consistent with applicable laws, 

executive orders, directives, regulations, 

policies, standards, and guidelines? 

____ 

____ 

____ 

____ 

____ 

____ 

PE-1, a.1.(a) 

PE-1, a.1.(b) 

2. Does the Tribe or TGRA have procedures to 

facilitate the implementation of the physical and 

environmental protection policy and the 

associated physical and environmental protection 

controls? ____ ____ ____ PE-1, a.2 

3. Has the Tribe or TGRA designated organizational 

personnel with information security 

responsibilities to manage the development, 

documentation, and dissemination of the physical 

and environmental protection policy and 

procedures? ____ ____ ____ PE-1, b 

4. Based on inquiry and record examination, does 

the Tribe or TGRA review and update the current 

physical and environmental protection: 

 Policy annually and following any 

physical, environmental, or security 

related incidents involving Criminal 

Justice Information (CJI) / Criminal 

History Record Information (CHRI) or 

systems used to process, store, or transmit 

CJI / CHRI? 

 Procedures annually and following any 

physical, environmental, or security 

related incidents involving CJI / CHRI or 

systems used to process, store, or transmit 

CJI / CHRI? 

____ 

____ 

____ 

____ 

____ 

____ 

PE-1, c.1 

PE-1, c.2 

1

 These requirements are sanctionable for audit beginning October 1, 2024. 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 9 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 2 of 5 

5. Based on inquiry and record examination, has the 

Tribe or TGRA developed, approved, and 

maintain a list of individuals with authorized 

access to the facility where the system resides? ____ ____ ____ PE-2, a 

6. Based on inquiry and record examination, has the 

Tribe or TGRA issued authorization credentials 

for facility access? ____ ____ ____ PE-2, b 

7. Based on inquiry and record examination, does 

the Tribe or TGRA review the access list detailing 

authorized facility access by individuals annually 

and when personnel changes occur? ____ ____ ____ PE-2, c 

8. Based on inquiry and record examination, does 

the Tribe or TGRA remove individuals from the 

facility access list when access is no longer 

required? ____ ____ ____ PE-2, d 

9. Based on inquiry and record examination, does 

the Tribe or TGRA enforce physical access 

authorizations by: 

 Verifying individual access authorizations 

before granting access to the facility? 

 Controlling ingress and egress to the 

facility using agency-implemented 

procedures and controls? 

____ 

____ 

____ 

____ 

____ 

____ 

PE-3, a.1 

PE-3, a.2 

10. Based on inquiry and record examination, does 

the Tribe or TGRA maintain physical access audit 

logs for the physically secure location and agencydefined sensitive areas? ____ ____ ____ PE-3, b 

11. Based on inquiry and record examination, does 

the Tribe or TGRA control access to areas within 

the facility designated as non-publicly accessible 

by implementing physical access devices 

including, but not limited to keys, locks, 

combinations, biometric readers, placards, and/or 

card readers? ____ ____ ____ PE-3, c 

12. Based on inquiry and record examination, does 

the Tribe or TGRA escort visitors and control 

visitor activity in all physically secure locations? ____ ____ ____ PE-3, d 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 9 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 3 of 5 

13. Based on inquiry and record examination, does 

the Tribe or TGRA secure keys, combinations, 

and other physical access devices? ____ ____ ____ PE-3, e 

14. Based on inquiry and record examination, does 

the Tribe or TGRA inventory all agency-issued 

physical access devices annually? ____ ____ ____ PE-3, f 

15. Based on inquiry and record examination, does 

the Tribe or TGRA change combinations and keys 

when keys are lost, combinations are 

compromised, or when individuals possessing the 

keys or combinations are transferred or 

terminated? ____ ____ ____ PE-3, g 

16. Based on inquiry and record examination, does 

the Tribe or TGRA control physical access to 

information system distribution and transmission 

lines and devices within organizational facilities 

using agency-implemented procedures and 

controls? ____ ____ ____ PE-4 

17. Based on inquiry and record examination, does 

the Tribe or TGRA control physical access to 

output from monitors, printers, scanners, audio 

devices, facsimile machines, and copiers to 

prevent unauthorized individuals from obtaining 

the output? ____ ____ ____ PE-5 

18. Based on inquiry and record examination, does 

the Tribe or TGRA monitor physical access to the 

facility where the system resides to detect and 

respond to physical security incidents? ____ ____ ____ PE-6, a 

19. Based on inquiry and record examination, does 

the Tribe or TGRA review physical access logs 

quarterly and upon occurrence of any physical, 

environmental, or security-related incidents 

involving CJI / CHRI or systems used to process, 

store, or transmit CJI / CHRI? ____ ____ ____ PE-6, b 

 
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 9 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 4 of 5 

20. Based on inquiry and record examination, does 

the Tribe or TGRA coordinate results of reviews 

and investigations with the organizational incident 

response capability? ____ ____ ____ PE-6, c 

21. Based on inquiry and record examination, does 

the Tribe or TGRA monitor physical access to the 

facility where the system resides using physical 

intrusion alarms and surveillance equipment? ____ ____ ____ PE-6, (1) 

22. Based on inquiry and record examination, does 

the Tribe or TGRA maintain visitor access records 

to the facility where the system resides for one (1) 

year? ____ ____ ____ PE-8, a 

23. Based on inquiry and record examination, does 

the Tribe or TGRA review visitor access records 

quarterly? ____ ____ ____ PE-8, b 

24. Based on inquiry and record examination, does 

the Tribe or TGRA report anomalies in visitor 

access records to organizational personnel with 

physical and environmental protection 

responsibilities and organizational personnel with 

information security responsibilities? ____ ____ ____ PE-8, c 

25. Based on inquiry and record examination, does 

the Tribe or TGRA limit personally identifiable 

information contained in visitor access records to 

the minimum Personally Identifiable Information 

(PII) necessary to achieve the purpose for which it 

is collected (see CJISSECPOL Section 4.3)2? 

Note: Access to visitor access records is restricted 

to authorized agency personnel. 

____ ____ ____ PE-8, (3) 

26. Based on inquiry and record examination, does 

the Tribe or TGRA authorize and control 

information system-related components entering 

and exiting the facility? ____ ____ ____ PE-16, a 

27. Based on inquiry and record examination, does 

the Tribe or TGRA maintain records of the system 

components? ____ ____ ____ PE-16, b 

 

2

 See CJISSECPOL v5.9.4, Section 4, pages 3-4.
Sample Audit Checklist for CJIS Security Policy (CJISSECPOL) Area 9 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 5 of 5 

28. Based on inquiry and record examination, does 

the Tribe or TGRA determine and document all 

alternate facilities or locations allowed for use by 

employees? ____ ____ ____ PE-17, a 

29. Based on inquiry and record examination, does 

the Tribe or TGRA employ the following controls 

at alternate work sites: 

 Limit access to the area during CJI /CHRI 

processing times to only those personnel 

authorized by the agency to access or view 

CJI / CHRI? 

 Lock the area, room, or storage container 

when unattended? 

 Position information system devices and 

documents containing CJI /CHRI in such a 

way as to prevent unauthorized individuals 

from access and view? 

 Follow the encryption requirements found 

in SC-1334 and SC-2856 for electronic 

storage (i.e., data at-rest) of CJI / CHRI? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

PE-17, b.1 

PE-17, b.2 

PE-17, b.3 

PE-17, b.4 

30. Based on inquiry and record examination, does 

the Tribe or TGRA assess the effectiveness of 

controls at alternate work sites? ____ ____ ____ PE-17, c 

31. Based on inquiry and record examination, does 

the Tribe or TGRA provide a means for 

employees to communicate with information 

security and privacy personnel in case of 

incidents? ____ ____ ____ PE-17, d 

3

 See CJISSECPOL v5.9.4, SC-13 CRYPTOGRAPHIC PROTECTION, page 160. 4

 Please refer to questions #29 and #30 of the Sample Audit Checklist for CJISSECPOL 5.10. 

5

 See CJISSECPOL v5.9.4, SC-28 PROTECTION OF INFORMATION AT REST, pages 163-4. 6

 Please refer to questions #42 and #43 of the Sample Audit Checklist for CJISSECPOL 5.10.