Sample 90 day audit checklist for contractor access to FBI CHRI from the NIGC 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 1 of 8 

2.0 Responsibilities of the Authorized Recipient 

1. Prior to engaging in outsourcing any Noncriminal

Justice Administrative Functions, did the TGRA

request and receive written permission from the

FBI Compact Officer?1

____ ____ ____ 

OS 1.01 

OS 1.10 

OS 2.01 

OS 3.09 

2. Did the TGRA execute the outsourcing

agreement prior to providing the Contractor

access to CHRI?2

____ ____ ____ OS 2.02 

3. Did the agreement incorporate by reference and

attach the Outsourcing Standards to it? ____ ____ ____ OS 2.02 

4. Did the TGRA specify the terms and conditions

of the Contractor’s duties requiring access to

CHRI?

____ ____ ____ OS 2.03 

5. Did the TGRA limit the Contractor’s use of

CHRI to the purposes for which it was provided? ____ ____ ____ OS 2.03 

6. Did the TGRA limit the Contractor’s retention of

the CHRI to a period of time established by the

TGRA?

____ ____ ____ OS 2.03 

7. Did the TGRA prohibit the Contractor’s

dissemination of CHRI, except as specifically

authorized by federal law, regulations, and

standards? If specifically allowed, see OS 3.08,

5.01, 5.02 and 5.03.

____ ____ ____ 

OS 2.03 

OS 3.08 

OS 5.01 

OS 5.02 

OS 5.03 

8. Did the TGRA ensure the security and

confidentiality of the CHRI to include

confirmation that the Contractor’s personnel have

been authorized by the TGRA to access the

CHRI?

____ ____ ____ OS 2.03 

1 The FBI Compact Officer has granted a temporary approval to TGRAs awaiting FBI Compact Officer outsourcing

contract approval. Specifically, this temporary approval allows TGRAs to direct their contractors to proceed with 

necessary equipment/system upgrades that require access to criminal history records while the TGRAs await a 

decision from the FBI Compact Officer on their proposed outsourcing contract(s). See

https://www.nigc.gov/images/uploads/20210409JOBAIDContractorFunctionsAndContractorAccessToCHRI.pdf

2

 See Footnote 1. List date access began, date contract was executed and date Compact Officer approval was

requested and received, if applicable. 
Sample 90 day audit checklist for contractor access to FBI CHRI from the NIGC 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 2 of 8 

9. Did the TGRA provide for audits of the 

Contractor’s use and handling of the CHRI as 

well as sanctions against the Contractor for 

noncompliance? 

The TGRA is responsible for the actions of the 

Contractor and shall monitor the Contractor’s 

compliance to the terms and conditions of the 

Outsourcing Standard (e.g. TGRA audit policies). 

____ ____ ____ OS 2.03 

OS 2.05 

10. Did the TGRA provide conditions for the 

termination of the agreement? ____ ____ ____ OS 2.03 

11. Did the TGRA ensure that Contractor personnel 

comply with the Outsourcing Standard? 

The TGRA is responsible for the actions of the 

Contractor and shall monitor the Contractor’s 

compliance to the terms and conditions of the 

Outsourcing Standard (e.g. TGRA audit policies). 

____ ____ ____ 

OS 2.03 

OS 2.05 

OS 3.01 

OS 3.02 

OS 3.03 

OS 3.04 

12. Did the TGRA conduct criminal history record 

checks of Contractor personnel if located within 

states having passed legislation authorizing or 

requiring civil fingerprint-based background 

checks for personnel with access to CHRI? 

The TGRA shall conduct criminal history record 

checks of Contractor personnel having access to 

CHRI if such checks are authorized under an 

existing federal statue, executive order, or state 

statue approved by the United States Attorney 

General under Public Law 92-544. If applicable, 

the national criminal history record checks of the 

Contractor personnel with access to CHRI cannot 

be outsourced and must be performed by the 

TGRA. 

____ ____ ____ OS 2.03(a) 

OS 6.01 

13. Does the TGRA maintain updated records of 

Contractor personnel who have access to CHRI 

and update those records within 24 hours when 

changes to the access occur? 

____ ____ ____ OS 2.03(a) 

14. Has the TGRA developed and implemented a 

process to ensure that the Contractor maintains 

site security? 

____ ____ ____ 

OS 2.03(b) 

OS 3.05 

OS 4.01 

 
Sample 90 day audit checklist for contractor access to FBI CHRI from the NIGC 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 3 of 8 

15. Has the TGRA, within 60 calendar days of 

notification from the NIGC or FBI, notified the 

Contractor regarding changes or updates to the 

Outsourcing Standard and/or CJIS Security 

Policy? 

____ ____ ____ OS 2.03(c) 

16. Has the TGRA ensured the most recent updated 

versions of the Outsourcing Standard are 

incorporated by reference at the time of the 

contract, contract renewal, or within the 60 

calendar day notification period, whichever is 

sooner? 

____ ____ ____ OS 2.03(c) 

OS 2.03(d) 

17. The Authorized Recipient shall understand the 

communications and record capabilities of the 

Contractor. 

Did the TGRA request and approve a topological 

drawing which depicts the interconnectivity of 

the Contractor’s network configuration as it 

relates to the outsourced noncriminal justice 

administrative function(s)? 

____ ____ ____ OS 2.04 

18. Did the TGRA certify to the FBI Compact 

Officer that an audit was conducted with the 

Contractor within 90 days of the date the 

Contractor first received CHRI? See #49 and 

#50. 

If the outsourcing contract was terminated early, 

did the TGRA provide written notice of the 

termination to the FBI Compact Officer? 

____ 

____ 

____ 

____ 

____ 

____ 

OS 2.05 

OS 2.06 

19. Has the TGRA appointed an ISO as the security 

point of contact for the FBI CJIS ISO and NIGC 

CSA ISO (e.g. position description, formal 

appointment, etc.)? 

____ ____ ____ OS 2.07 

20. Does the TGRA appointed ISO document 

technical compliance with the Outsourcing 

Standard (e.g. CJIS Security Policy 5.4.3, Audit 

Monitoring, Analysis and Reporting)? 

____ ____ ____ OS 2.07(b) 

 
Sample 90 day audit checklist for contractor access to FBI CHRI from the NIGC 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 4 of 8 

21. Has the TGRA appointed ISO established a 

security incident response and reporting 

procedures to discover, investigate, document, 

and report on major incidents that significantly 

endanger the security or integrity of FBI CHRI 

from the NIGC? 

____ ____ ____ OS 2.07(c) 

22. Has the TGRA developed written procedures to 

immediately (within one hour) notify the FBI 

CJIS ISO and NIGC CSA ISO of any PII breach? 

____ ____ ____ OS 2.08 

23. Has the TGRA developed and implemented 

written procedures to provide a written report of 

any PII breach (to include unauthorized access to 

CHRI by the Contractor) to the FBI CJIS ISO 

and NIGC CSA ISO within 5 calendar days of 

receipt of the initial report of the PII breach? 

The written report must include corrective actions 

taken by the TGRA and, if necessary, the 

Contractor to resolve such PII breach. 

____ ____ ____ OS 2.08 

3.0 Responsibilities of the Contractor 

24. Did the Contractor implement a security program 

to comply with the Outsourcing Standard and the 

CJIS Security Policy? 

____ ____ ____ OS 3.02 

OS 3.03 

25. Did the TGRA provide written approval to the 

NIGC CSA ISO or the FBI Compact Officer for 

the Contractor’s security program? 

____ ____ ____ OS 3.02 

26. If the training requirement is not retained by the 

TGRA, has the Contractor developed, 

documented, administered and maintained a 

security training program to comply with the 

Outsourcing Standard and CJIS Security Policy? 

____ ____ ____ OS 3.04 

27. If the training requirement is not retained by the 

TGRA, has the TGRA provided the Contractor 

with written approval for the security training 

program? 

____ ____ ____ OS 3.04 

OS 3.06 

 
Sample 90 day audit checklist for contractor access to FBI CHRI from the NIGC 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 5 of 8 

28. If the training requirement is not retained by the 

TGRA, did the Contractor, no later than the 

anniversary date of the contract, certify in writing 

to the TGRA that annual refresher training was 

completed for those Contractor personnel with 

access to CHRI? 

____ ____ ____ OS 3.04 

29. Does the Contractor maintain CHRI only for the 

period of time necessary to fulfill its contractual 

obligations but not to exceed the period of time 

established by the TGRA? 

____ ____ ____ OS 3.07 

4.0 Site Security 

30. Has the TGRA ensured that the Contractor’s 

site(s) is a physically secure location to protect 

against any unauthorized access to CHRI (e.g. 

inquiry, records examination, site inspection (as 

applicable or reasonably feasible))? 

____ ____ ____ OS 4.01 

6.0 Personnel Security 

31. Has the Contractor ensured that each employee 

performing work under the contract is aware of 

the requirements of the Outsourcing Standard and 

the state and federal laws governing the security 

and integrity of CHRI? 

____ ____ ____ OS 6.02 

32. Has the Contractor confirmed in writing that each 

employee has certified in writing that they 

understand the Outsourcing Standard 

requirements and laws that apply to their 

responsibilities? 

____ ____ ____ OS 6.02 

33. Does the Contractor maintain up-to-date records 

of personnel who have access to CHRI and 

provides updates to the TGRA with 24 hours 

when additions or deletions occur? 

____ ____ ____ OS 6.03 

7.0 System Security 

34. Does the Contractor’s security system comply 

with the CJIS Security Policy in effect at the time 

of the Outsourcing Standard was incorporated 

into the contract and successor versions of the 

policy? 

____ ____ ____ OS 7.01 
Sample 90 day audit checklist for contractor access to FBI CHRI from the NIGC 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 6 of 8 

35. Did the Contractor implement devices to provide 

a point of defense and a controlled and audited 

access to CHRI, both from the inside and outside 

the networks? 

____ ____ ____ OS 7.01(a) 

36. Did the Contractor implement data encryption for 

CHRI in transit pursuant to the requirements in 

the CJIS Security Policy? 

____ ____ ____ OS 7.01(b) 

37. Did the Contractor provide for the secure storage 

and disposal of all hard copy and media 

associated with the system to prevent access by 

unauthorized personnel? 

Refer to the CJIS Security Policy to address: 

physically secure location; sanitization 

procedures for all fixed and non-fixed storage 

media; and storage procedures for all fixed and 

non-fixed storage media. 

____ ____ ____ OS 7.02 

38. To prevent and or detect unauthorized access to 

CHRI in transmission or storage, are Contractor 

personnel assigned a unique identifying number? 

____ ____ ____ OS 7.03 

8.0 Security Violations 

39. Has the TGRA developed and implemented a 

written policy for discipline of Contractor 

personnel who violate the security provisions of 

the contract, which includes the Outsourcing 

Standards incorporated by reference? 

____ ____ ____ OS 8.01(a) 

40. Has the TGRA developed and implemented a 

written incident reporting plan for security 

events, to include violations and incidents? 

____ ____ ____ OS 8.01(a) 

41. Does the Contractor have a written process to 

suspend any employee who commits a security 

violation, upon detection, from assignments in 

which they have access to CHRI under the 

contract? 

____ ____ ____ OS 8.01(b) 

42. Has the Contractor implemented a written 

processes to immediately (within 1 hour of 

discovery) notify the TGRA, the NIGC CSA ISO 

or FBI CJIS ISO of any security violation to 

include unauthorized access to CHRI? 

____ ____ ____ OS 8.01(c) 
Sample 90 day audit checklist for contractor access to FBI CHRI from the NIGC 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 7 of 8 

43. Has the Contractor implemented a written 

process to, within five calendar days of such 

discovery, provide the TGRA, the NIGC CSA 

ISO or the FBI CJIS ISO a written report 

documenting the security violation, corrective 

actions taken by the Contractor to resolve such 

violation, and the date, time and summary of the 

violation? 

If the Contractor refuses to or is incapable of 

taking corrective actions to successfully resolve a 

security violation, the TGRA shall terminate the 

contract and provide written notice to the NIGC 

ISO and FBI Compact Officer. See OS 8.04 (a-c) 

for the notification requirements. 

____ ____ ____ OS 8.01(c) 

OS 8.02(c) 

44. Has the TGRA implemented a written process to 

immediately (within 4 hours) notify the NIGC 

CSA ISO and FBI Compact Officer of any 

security violation or termination of the contract, 

to include unauthorized access to CHRI made 

available pursuant to the contract? 

____ ____ ____ OS 8.01(d) 

45. Has the TGRA implemented a written process to, 

within five calendar days of any security 

violation (to include unauthorized access to 

CHRI by the Contractor), provide the NIGC CSA 

ISO and the FBI Compact Officer a written report 

documenting the corrective actions taken by the 

Contractor and the TGRA to resolve such 

violation? 

If the Contractor refuses to or is incapable of 

taking corrective actions to successfully resolve a 

security violation, the TGRA shall terminate the 

contract and provide written notice to the NIGC 

ISO and FBI Compact Officer. See OS 8.04 (a-c) 

for the notification requirements. 

____ ____ ____ 

OS 8.01(d) 

OS 8.02(c) 

OS 8.03 

OS 8.04 

OS 8.05 

OS 8.06 

9.0 PII 

46. Does the Contractor have a written process to 

notify authorized individuals of their right to 

report PII breaches directly to the FBI should 

they believe their information has been 

mishandled or compromised? 

____ ____ ____ OS 9.02 

 
Sample 90 day audit checklist for contractor access to FBI CHRI from the NIGC 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 8 of 8 

47. Does the Contractor have a written process to 

immediately (within 1 hour of discovery) notify 

the TGRA, the NIGC CSA ISO or the FBI CJIS 

ISO of any PII breach or potential PII breach? 

____ ____ ____ OS 9.03 

48. Does the Contractor have a written process to, 

within five calendar days of such discovery, 

provide the TGRA, the NIGC CSA ISO or the 

FBI CJIS ISO a written report documenting such 

violation and corrective actions taken to resolve 

such violation, to include the date, time, and 

summary of the notification to resolve such 

breach? 

____ ____ ____ OS 9.03 

 90 day Audit Certification 

49. The TGRA is responsible for the actions of the 

Contractor and shall monitor the Contractor’s 

compliance to the terms and conditions of the 

Outsourcing Standard. 

Has the Contractor complied with the terms and 

conditions of the Outsourcing Standard as 

documented on this sample 90 day audit checklist?

____ ____ ____ OS 2.05 

50. Based on the certification made in the preceding 

question, the undersigned certifies this audit was 

conducted with the Contractor within 90 days of the 

date the Contractor first received CHRI. 

__________________________________________ 

TGRA Authorized Official – Printed/Signature 

Date______________________________________ 

__________________________________________ 

Contractor Authorized Official - Printed/Signature 

Date______________________________________ 

____ ____ ____ OS 2.05