Sample Audit Checklist for CJIS Security Policy Area 13 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 1 of 7 

5.13 Mobile devices 

1. Each Tribe or TGRA shall establish usage 

restrictions and implementation guidance for 

mobile devices; and authorize, monitor, control 

wireless access to systems which contain 

CJI/CHRI. 

Does the Tribe or TGRA have mobile devices 

with access to CJI/CHRI? 

Mobile devices include smartphones, tablets and 

laptop computers. Wireless technologies1, in the 

simplest sense, enable one or more devices to 

communicate without physical connections—

without requiring network or peripheral cabling. 

If yes, complete all questions. 

If no, the Tribe or TGA is exempt from the 

requirements in CSP Area 13. 

____ ____ CSP 5.13 

2. Has the Tribe or TGRA implemented the 

following controls for all tribal managed wireless 

access points with access to unencrypted 

CJI/CHRI: 

1. Validation testing to ensure rogue APs (Access 

Points) do not exist in the 802.112 Wireless 

Local Area Network (WLAN) and to fully 

understand the wireless network security 

posture? 

2. Inventory of all Access Points (APs) and 

802.11 wireless devices? 

3. Physical security of APs to prevent 

unauthorized physical access and user 

manipulation? 

4. AP boundary testing to determine the precise 

extent of the wireless coverage and to design 

the AP wireless coverage that limits the 

coverage area to only what is needed for 

operational purposes? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.1.1(1) 

CSP 5.13.1.1(2) 

CSP 5.13.1.1(3) 

CSP 5.13.1.1(4) 

 

1

 Examples of wireless communication technologies include, but are not limited to: 802.11, cellular, Bluetooth, 

satellite, microwave, and land mobile radio (LMR). Wireless technologies require at least the minimum security 

applied to wired technology and, based upon the specific technology or implementation, wireless technologies may 

require additional security controls as described in CSP Policy Area 13. 

2

 Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA) cryptographic algorithms, used by all pre802.11i protocols, do not meet the requirements for FIPS 140-2 and shall not be used in accordance with CSP 

5.13.1.1. 
Sample Audit Checklist for CJIS Security Policy Area 13 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 2 of 7 

5. Enabled user authentication and encryption 

mechanisms for the management interface of 

the AP? 

6. The APs have strong administrative passwords 

and all passwords are changed in accordance 

with CSP Section 5.6.2.1? 

7. The reset function on APs is used only when 

needed and is only invoked by authorized 

personnel? 

When the reset functions are used, the 

factory default settings are not utilized 

and the APs are restored to the latest 

security settings? 

8. The default service set identifier (SSID) is 

changed in the APs? 

The broadcast SSID feature has been 

disabled so the client SSID must match 

that of the AP? 

The SSID character string does not 

contain any agency identifiable 

information (division, department, street, 

etc.) or services? 

9. All security features of the wireless product 

are enabled, including the cryptographic 

authentication, firewall, and other available 

privacy features? 

10. The encryption key sizes are at least 128-bits 

and the default shared keys are replaced by 

unique keys? 

11. The ad hoc mode has been disabled? 

12. All nonessential management protocols are 

disabled on the APs? 

13. All management access and authentication 

occurs via FIPS compliant secure protocols3

(e.g. SFTP, HTTPS, SNMP over TLS, etc.)? 

14. Logging (if supported) is enabled and the logs 

are reviewed on a recurring basis per local 

policy? At a minimum logs shall be reviewed 

monthly. 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.1.1(5) 

CSP 5.13.1.1(6) 

CSP 5.13.1.1(7) 

CSP 5.13.1.1(7) 

CSP 5.13.1.1(8) 

CSP 5.13.1.1(8) 

CSP 5.13.1.1(8) 

CSP 5.13.1.1(9) 

CSP 5.13.1.1(10) 

CSP 5.13.1.1(11) 

CSP 5.13.1.1(12) 

CSP 5.13.1.1(13) 

CSP 5.13.1.1(14) 

 

3

 Disable non-FIPS compliant secure access to the management interface. 
Sample Audit Checklist for CJIS Security Policy Area 13 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 3 of 7 

15. The wireless network is insulated, virtually 

(e.g. virtual local area network (VLAN) and 

ACLs) or physically (e.g. firewalls), from the 

operational wired infrastructure? 

Access between wireless networks and 

the wired network is limited to only 

operational needs? 

16. When disposing of APs that will no longer be 

used by the Tribe or TGRA, configuration 

settings are cleared to prevent disclosure of 

network configuration, keys, passwords, etc? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.1.1(15) 

CSP 5.13.1.1(15) 

CSP 5.13.1.1(16) 

3. Certain internal functions on cellular devices4

may be modified or compromised by the cellular 

carrier during international use as the devices are 

intended to have certain parameters configured 

by the cellular provider which is considered a 

“trusted” entity by the device. 

If a Tribe or TGRA allows managed devices to 

access CJI/CHRI outside the U.S., does the Tribe 

or TGRA perform a documented inspection to 

ensure all controls are in place and functioning 

properly in accordance with the Tribe’s or 

TGRA’s policies prior to and after deployment 

outside of the U.S? 

Any cellular device used to transmit CJI/CHRI 

via voice is exempt from the encryption and 

authentication requirements. 

____ ____ ____ CSP 5.13.1.2 

CSP 5.13.1.2.1 

CSP 5.13.1.2.2 

4. If Bluetooth5 is utilized, does the Tribe or TGRA 

implement security policies that dictate the use of 

Bluetooth and its associated devices based on the 

operational and business processes? 

____ ____ ____ CSP 5.13.1.3 

 

 

4

 Cellular telephones, smartphones (i.e. Blackberry, iPhones, etc.), tablets, personal digital assistants (PDA), and 

“aircards” are examples of cellular handheld devices or devices that are capable of employing cellular technology. 

Additionally, cellular handheld devices typically include Bluetooth, infrared, and other wireless protocols capable of 

joining infrastructure networks or creating dynamic ad hoc networks. 

5

 Bluetooth is an open standard for short-range radio frequency (RF) communication. Bluetooth is used primarily to 

establish wireless personal area networks (WPAN). Bluetooth technology has been integrated into many types of 

business and consumer devices, including cell phones, laptops, automobiles, medical devices, printers, keyboards, 

mice, headsets, and biometric capture devices. 

Bluetooth technology and associated devices are susceptible to general wireless networking threats (e.g. denial of 

service [DoS] attacks, eavesdropping, man-in-the-middle [MITM] attacks, message modification, and resource 

misappropriation) as well as specific Bluetooth-related attacks that target known vulnerabilities in Bluetooth 

implementations and specifications. 
Sample Audit Checklist for CJIS Security Policy Area 13 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 4 of 7 

5. Based on inquiry and record examination, if a 

Tribe or TGRA allow mobile devices that access 

or store CJI/CHRI to function as a Wi-Fi hotspot 

connecting to the Internet, are the mobile devices 

configured6

: 

1. To enable encryption on the hotspot? 

2. To ensure the hotspot SSID (required to 

change the hotspot’s default SSID) does not 

identify the device make/model or 

Tribe/TGRA ownership? 

3. To create a wireless network password (Preshared key)? 

4. To enable the hotspot’s port filtering/blocking 

features if present? 

5. To only allow connections from the Tribe’s or 

TGRA’s controlled devices? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.1.4(1) 

CSP 5.13.1.4(2)(a) 

CSP 5.13.1.4(3) 

CSP 5.13.1.4(4) 

CSP 5.13.1.4(5) 

6. Based on inquiry and record examination, if a 

Tribe or TGRA allow wireless devices that 

access or store CJI/CHRI, does the Tribe/TGRA, 

at a minimum, ensure that wireless devices: 

1. Apply available critical patches and upgrades 

to the operating system as soon as they 

become available for the device and after 

necessary testing as described in CJIS Security 

Policy Section 5.10.4.1? 

2. Are configured for local device authentication 

(see CJIS Security Policy Section 5.13.7.1)? 

3. Use advanced authentication or NIGC CSA 

CSO approved compensating controls (see 

CSP 5.13.7.2.1)? 

4. Encrypt all CJI/CHRI resident on the device? 

5. Erase cached information, to include 

authenticators (see CSP 5.6.2.1) in 

applications, when session is terminated? 

6. Employ personal firewalls on full-featured 

operating system devices or run a Mobile 

Device Management7

 (MDM) system that 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.3(1) 

CSP 5.13.3(2) 

CSP 5.13.3(3) 

CSP 5.13.3(4) 

CSP 5.13.3(5) 

CSP 5.13.3(6) 

 

6

 Refer to the requirements in CSP Section 5.10.1.2 encryption for item #1. Refer to the requirements in Section 

5.6.2.2.1 Password for item #3. Only password attributes #1, #2 and #3 are required or have a MDM solution to 

provide the same security as identified in items 1 – 5 above. 

7

 Mobile Device Management (MDM) — Centralized administration and control of mobile devices specifically 

including, but not limited to, cellular phones, smart phones, and tablets. Management typically includes the ability to 

configure device settings and prevent a user from changing them, remotely locating a device in the event of theft or 

loss, and remotely locking or wiping a device. Management can also include over-the-air distribution of applications 

and updating installed applications 
Sample Audit Checklist for CJIS Security Policy Area 13 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 5 of 7 

facilitates the ability to provide firewall 

services from the tribal level? 

7. Employ malicious code protection on fullfeatured operating system devices or run a 

MDM system that facilitates the ability to 

provide anti-malware services from the tribal 

level? 

____ ____ ____ CSP 5.13.3(7) 

7. In many cases, the requirements of CSP 5.10 

cannot be met with a mobile device without the 

installation of a third party MDM, application, or 

supporting service infrastructure. 

Based on inquiry and record examination, does 

the Tribe/TGRA have a third party MDM, 

application, or supporting service infrastructure? ____ ____ ____ CSP 5.13.4 

8. Based on the varying connection methods for 

mobile devices, an always on connection cannot 

be guaranteed for patching and updating. Devices 

without always-on cellular connections may not 

be reachable for extended periods of time by the 

MDM or solution either to report status or initiate 

patching. 

Based on inquiry and record examination, does 

the Tribe/TGRA monitor mobile devices to 

ensure their patch and update state is current. ____ ____ ____ CSP 5.13.4.1 

9. A personal firewall8 shall be employed on all 

mobile devices that have a full-feature operating 

system (i.e. laptops or tablets with Windows or 

Linux/Unix operating systems). 

Based on inquiry and record examination, does 

the personal firewall9 perform the following 

activities: 

1. Manage program access to the Internet? 

2. Block unsolicited requests to connect to the 

user device? 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.4.3(1) 

CSP 5.13.4.3(2) 

 

8

 Personal Firewall — An application which controls network traffic to and from a computer, permitting or denying 

communications based on a security policy. 

9

 Mobile devices with limited-feature operating systems (i.e. tablets, smartphones) may not support a personal 

firewall. However, these operating systems have a limited number of system services installed, carefully controlled 

network access, and to a certain extent, perform functions similar to a personal firewall on a device with a fullfeature operating system. Appropriately configured MDM software is capable of controlling which applications are 

allowed on the device. 
Sample Audit Checklist for CJIS Security Policy Area 13 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 6 of 7 

3. Filter incoming traffic by IP address or 

protocol? 

4. Filter incoming traffic by destination ports? 

5. Maintain an IP traffic log? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.4.3(3) 

CSP 5.13.4.3(4) 

CSP 5.13.4.3(5) 

10. In addition to the requirements in CSP 5.3, a 

Tribe or TGRA shall develop additional or 

enhanced incident reporting and handling 

procedures to address mobile device operating 

scenarios. Rapid response to mobile device 

related incidents can significantly mitigate the 

risks associated with illicit data access either on 

the device itself or within online data resources 

associated with the device through an application 

or specialized interface. 

Based on inquiry and record examination, does 

the Tribe or TGRA implement reporting 

procedures for the following situations: 

1. Loss of device control? 

a. Device known to be locked, minimal 

duration of loss. 

b. Device lock state unknown, minimal 

duration of loss. 

c. Device lock state unknown, extended 

duration of loss. 

d. Device known to be unlocked, more than 

momentary duration of loss. 

2. Total loss of device? 

3. Device compromise? 

4. Device loss or compromise outside the United 

States? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.5(1)(a) 

CSP 5.13.5(1)(b) 

CSP 5.13.5(1)(c) 

CSP 5.13.5(1)(d) 

CSP 5.13.5(2) 

CSP 5.13.5(3) 

CSP 5.13.5(4) 

11. Multiple user accounts are not generally 

supported on limited-feature mobile operating 

systems10. Access control (CSP Section 5.5 

Access Control) shall be accomplished by the 

application that accesses CJI. 

Based on inquiry and record examination does 

the limited-feature mobile operating system(s) 

and application(s) comply with CSP 5.5? ____ ____ ____ 

CSP 5.13.6 

CSP 5.13.7 

 

 

10 Due to the technical methods used for identification and authentication on many limited-feature mobile operating 

systems, achieving compliance may require many different components. 
Sample Audit Checklist for CJIS Security Policy Area 13 

# QUESTION YES NO N/A STANDARD COMMENT 

Page 7 of 7 

12. When mobile devices are authorized for use in 

accessing CJI/CHRI, local device authentication 

shall be used to unlock the device for use. The 

authenticator used shall meet the requirements in 

section CSP 5.6.2.1 Standard Authenticators. 

Based on inquiry and record examination, does 

the local device authentication require each 

device be unlocked before device use? 

If a Tribe or TGRA allow wireless devices that 

access or store CJI/CHRI, does the authenticator 

used meet the requirements in CSP 5.6.2.1 

Standard Authenticators? 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.7.1 

CSP 5.13.7.1 

13. When accessing CJI from an authorized mobile 

device, advanced authentication shall be used by 

the authorized user unless the access to CJI/CHRI 

is indirect as described in CSP 5.6.2.2.1.11

Based on inquiry and record examination, is CSP 

5.6.2.2.1 applicable? 

If yes, based on inquiry and record examination, 

does the Tribe or TGRA implement policies to 

comply with CSP 5.6.2.2.1? 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.7.2 

CSP 5.13.7.2 

14.. When certificates12 or cryptographic keys used to 

authenticate a mobile device are used in lieu of 

compensating controls for advanced 

authentication, does Tribe or TGRA require 

certificates or cryptographic keys be: 

1. Protected against being extracted from the 

device? 

2. Configured for remote wipe on demand or 

self-deletion based on a number of 

unsuccessful login or access attempts? 

3. Configured to use a secure authenticator (i.e. 

password, PIN) to unlock the key for use? 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

____ 

CSP 5.13.7.3(1) 

CSP 5.13.7.3(2) 

CSP 5.13.7.3(3) 

 

11 If access is indirect, then AA is not required. 12 Device certificates are often used to uniquely identify mobile devices using part of a public key pair on the device 

in the form of a public key certificate. While there is value to ensuring the device itself can authenticate to a system 

supplying CJI, and may provide a critical layer of device identification or authentication in a larger scheme, a device 

certificate alone placed on the device shall not be considered valid proof that the device is being operated by an 

authorized user.