# Outsourcing Standard for Non-Channelers Sample Policy

1.0 **Purpose**

The purpose of this policy is to provide adequate security and integrity for criminal history record information (CHRI) while under the control or management of an outsourced third party, the Contractor.

*This policy was developed using the National Crime Prevention and Privacy Compact Council’s Security and Management Control Outsourcing Standard for Non-Channelers[footnoteRef:1], which identifies the duties and responsibilities with respect to adequate internal controls for the contractual relationship between the Authorized Recipient and the Contractor so that the security and integrity of the Interstate Identification Index (III) System[footnoteRef:2] and CHRI are not compromised*. [1:  Security and Management Control Outsourcing Standard for Non-Channelers can be found at CJIS Resource Materials | National Indian Gaming Commission (nigc.gov) ]  [2:  Interstate Identification Index (III) is the CJIS service that manages automated submission and requests for CHRI that is warehoused subsequent to the submission of fingerprint information. Subsequent requests are directed to the originating State as needed.] 

2.0 **Scope**

The scope of this policy applies to all personnel, systems, networks, and facilities supporting and/or acting on behalf of the TGRA to perform noncriminal justice administrative functions requiring access to CHRI without a direct connection to the FBI CJIS Wide Area Network.

3.0 **Responsibilities of the TGRA**

**3.1	Outsourcing Noncriminal Justice Administration Functions – FBI permission**

Prior to engaging in outsourcing any noncriminal justice administrative functions, the TGRA must request and receive written permission from the FBI Compact Officer. (See OS 1.01, 1.10, 2.01, and 3.09) Permission must precede the execution of the contract for services performed involving noncriminal justice administrative functions that will provide access to CHRI.

**3.2	Outsourcing Contract Content**

An outsourcing contract must contain the specified terms and conditions of the Contractor’s duties requiring access to CHRI, incorporate by reference the Outsourcing Standards and include an attachment of them. (See OS 2.02 and 2.03)

3.3 **Outsourcing Contract Execution**

The TGRA must execute the outsourcing agreement prior to providing the Contractor access to CHRI.  

**3.4	Outsourcing Contract Audits**

The TGRA must create and implement procedures to conduct audits to ensure:

1. The security and confidentiality of the CHRI, including confirmation that the Contractor’s personnel have been authorized by the TGRA to access the CHRI. (See OS 2.03)

2. The Contractor’s appropriate use and handling of the CHRI. (See OS 2.03)

3. Contractor personnel comply with the Outsourcing Standards. (See OS 2.03, 2.05, 3.01, 3.02, 3.03, and 3.04)

4. If CHRI is stored at the Contractor’s site, the Contractor maintains site security to protect against any unauthorized access to CHRI. (See OS 2.03(b), 3.05, and 4.01)

5. The issuance of appropriate sanctions against the Contractor for non-compliance. (See OS 2.03)

**3.5	Outsourcing or CJIS Security Policy updates**

Within 60 calendar days of notification from the NIGC or FBI, the TGRA must notify the Contractor regarding changes or updates to the Outsourcing Standard and/or CJIS Security Policy. (See OS 2.03(c))

The TGRA must ensure the most recent updated versions of the Outsourcing Standard are incorporated by reference at the time of the contract, contract renewal, or within the 60-calendar day notification period, whichever is sooner. (See OS 2.03(c))

3.6 **Contractor Security Program**

**A.	Approval**

The TGRA must review and approve the Contractor’s security program. Written approval shall be provided to the FBI (See OS 3.02)

To this end, the TGRA shall:

1. Request and approve a topological drawing, which depicts the interconnectivity of the Contractor’s network configuration as it relates to the outsourced noncriminal justice administrative function(s). (See OS 2.04)

2. Provide written notice and require documented acknowledgment from the Contractor that any changes to the Contractor’s network configuration, as it relates to the outsourced function(s), requires the approval of the TGRA. (See OS 2.04) 

**B.	Audit**

If not exempted based on the conditions stated in 11.01[footnoteRef:3] or 11.02[footnoteRef:4] of the Outsourcing Standard, the TGRA must conduct an audit to ensure the Contractor’s compliance with the Outsourcing Standard within 90 days of the date the Contractor first received CHRI. The TGRA must certify such audit to the FBI Compact Officer upon completion. (See OS 2.05) [3:  11.01 An Information Technology (IT) contract need only include Sections 1.0, 2.01, 2.02, 2.03, 3.01, 6.0, 8.0, and 9.0 of this Outsourcing Standard for Non-Channelers when all of the listed conditions exist. Please see the National Crime Prevention and Privacy Compact Council’s Security and Management Control Outsourcing Standard for Non-Channelers at https://www.fbi.gov/file-repository/compact-council-security-and-management-control-outsourcing-standard-for-non-channelers.pdf/view for listed conditions.]  [4:  11.02 An Authorized Recipient’s contract where access to CHRI is limited solely for the purposes of: (A) storage (referred to as archiving in some states) of the CHRI at the Contractor’s facility; (B) retrieval of the CHRI by Contractor personnel on behalf of the Authorized Recipient with appropriate security measures in place to protect the CHRI; and/or (C) destruction of the CHRI by Contractor personnel when not observed by the Authorized Recipient need only include Sections 1.0, 2.01, 2.02, 2.03, 3.01, 4.0, 6.0, 8.0, and 9.0 of this Outsourcing Standard for Non-Channelers when all of the listed conditions exist. Please see the National Crime Prevention and Privacy Compact Council’s Security and Management Control Outsourcing Standard for Non-Channelers at https://www.fbi.gov/file-repository/compact-council-security-and-management-control-outsourcing-standard-for-non-channelers.pdf/view for listed conditions. ] 

C. **Termination Notice**

The TGRA shall provide written notice of the termination to the FBI Compact Officer (compactoffice@fbi.gov) if the outsourcing contract is terminated early. (See 2.06)

D. **ISO Appointment**

The TGRA must appoint an Information Security Officer (ISO) as the security point of contact for the FBI CJIS ISO and NIGC CSA ISO (*e.g. position description, formal appointment, etc*.). (See OS 2.07 (a)) The TGRA-appointed ISO shall:

1. Document technical compliance with the Outsourcing Standard. (See OS 2.07 (b))

2. Establish a security incident response and reporting procedure to discover, investigate, document, and report on major incidents that significantly endanger the security or integrity of FBI CHRI from the NIGC. (See OS 2.07 (c))

**3.7	Written Notification Procedures**

The TGRA must develop and implement written procedures to provide written notifications and reports to the FBI CJIS ISO (iso@fbi.gov) and NIGC CSA ISO (iso@nigc.gov) as required by the Outsourcing Standard and referenced in this policy. (See OS 2.08 and 8.01 (c) and (d))

**3.8	Outsourcing Contract Provisions – FBI access**

The TGRA shall make available to the FBI Compact Officer the relevant portions of the current and approved contract relating to CHRI, upon request. (See OS 3.09)

**4.0	Responsibility of the Contractor**

**4.1	Contractor Security Program**

The Contractor and its employees must comply with all federal and state laws, regulations, and standards (including the CJIS Security Policy) as well as with rules, procedures, and standards established by the Compact Council and the United States Attorney General. (See OS 3.01) The Contractor must develop, and upon approval of the TGRA, implement a Security Program[footnoteRef:5] to comply with the Outsourcing Standard and the CJIS Security Policy (Physical, Personnel, and Information Technology). (See OS 3.02 and 3.03) The Security Program must: [5:  If the Contractor is using a corporate policy, it must meet the requirements outlined in this Outsourcing Standard and the CJIS Security Policy. If the corporate policy is not this specific, it must flow down to a level where the documentation supports these requirements] 

1. Describe the implementation of the security requirements outlined in the Outsourcing Standard and the CJIS Security Policy. (See OS 3.02 and 3.03 (a))

2. Set, maintain, and enforce the standards for the selection, supervision, and separation of personnel who have access to CHRI. (See OS 3.02 and 3.03 (d))

3. Contain requirements for security training. (See OS 3.03 (b))

4. Set forth guidelines for documentation of security violations, including (See OS 3.03 (c)):

a. Development and maintenance of a written incident reporting plan to address security events, to include violations and incidents. (See the CJIS Security Policy, https://le.fbi.gov/cjis-division-resources/cjis-security-policy-resource-center (See OS 3.03 (c) (i))

b. A process in place for reporting security violations. (See OS 3.03 (c)(ii))

**4.2	Training Records**

Except when the training requirement is retained by the TGRA, the Contractor must (See OS 3.04):

1. Develop, document, administer, and maintain a Security Training Program for all Contractor personnel with access to CHRI prior to their appointment/assignment.

2. Obtain written approval of the Security Training Program from the TGRA.

3. Provide training, upon receipt of notice from the Compact Officer or TGRA, on any changes to federal and state laws, regulations, and standards as well as with rules, procedures, and standards established by the Compact Council and the United States Attorney General.

4. Provide annual refresher training.

5. Annually, not later than the anniversary date of the contract, certify in writing to the TGRA that annual refresher training was completed for those Contractor personnel with access to CHRI.

**4.3	Audits and Inspections**

The Contractor shall make its facilities available for announced and unannounced audits and security inspections performed by the TGRA, the state, or the FBI on behalf of the Compact Council. (See OS 3.05)

The Contractor’s Security Program is subject to review by the TGRA, the Compact Officer, and the FBI CJIS Division. During this review, provision shall be made to update the Security Program to address security violations and to ensure changes in policies and standards as well as changes in federal and state law are incorporated. (See OS 3.06)

Contractor shall make available to the FBI Compact Officer the relevant portions of the current and approved contract relating to CHRI, upon request. (See OS 3.09)

**4.4	Record Retention and Use**

The Contractor shall maintain CHRI only for the period of time necessary to fulfill its contractual obligations but not to exceed the period of time that the TGRA is authorized to maintain and does maintain the CHRI. (See OS 2.03 and 3.07)

The Contractor is limited to the use of CHRI only for the purposes for which it is provided according to the contract. (See OS 2.03)

**4.5	PII**

The Contractor is responsible for protecting all PII in its possession and control when handling, using, or storing CHRI. (See OS 9.01)

The Contractor must notify authorized individuals of their right to report PII breaches directly to the FBI should they believe their information has been mishandled or compromised. (See OS 9.02)

**5.0	Site Security**

The Contractor site(s) must be a physically secure location to protect against any unauthorized access to CHRI. (See OS 4.01)

**6.0	Personnel Security**

The Contractor must demonstrate that each employee performing work under the contract is aware of the requirements of the Outsourcing Standard and the state and federal laws governing the security and integrity of CHRI by requiring an attestation from each employee certifying such prior to performing work under the contract. The certifications shall be maintained in a file that is subject to review during audits. (See OS 6.02)

The Contractor shall confirm in writing that each employee has certified in writing that he/she understands the Outsourcing Standard requirements and laws that apply to his/her responsibilities. (See OS 6.02) 

The Contractor shall maintain updated records of personnel who have access to CHRI, update those records within 24 hours when changes to that access occur, and must notify the TGRA within 24 hours when additions or deletions occur. (See OS 6.03)

**7.0	System Security**

The Contractor’s security system must comply with the CJIS Security Policy in effect at the time the Outsourcing Standard is incorporated into the contract and with successor versions of the policy. (See OS 7.01)

1. Devices must be implemented to provide a point of defense and a controlled and audited access to CHRI, both from inside and outside the networks.

2. Data encryption shall be required for data in transit pursuant to the requirements in the CJIS Security Policy.

The Contractor shall provide for the secure storage and disposal of all hard copy and media associated with the system to prevent access by unauthorized personnel.[footnoteRef:6] (See OS 7.02) [6:  Refer to the current CJIS Security Policy to address requirements for physically secure location, sanitization procedures for all fixed and non-fixed storage media, and storage procedures for all fixed and non-fixed storage media.] 

To prevent and/or detect unauthorized access to CHRI in transmission or storage, each TGRA, Contractor, or Sub-Contractor must be assigned a unique identifying number. (See OS 7.03)

**8.0	Security Violations**

**8.1	Duties of the TGRA (See OS 8.01)**

1. The TGRA shall develop and maintain a written policy for discipline of Contractor employees who violate the security provisions of the contract, which includes the Outsourcing Standard that is incorporated by reference. (See OS 8.01 (a)) 

2. The TGRA shall immediately (within four hours) notify the NIGC CSA ISO (iso@nigc.gov) and the FBI Compact Officer (compactoffice@fbi.gov) of any security violation, PII breach, or termination of the contract, to include unauthorized access to CHRI made available pursuant to the contract. (See OS 2.08 and 8.01 (d))

3. The TGRA shall provide a written report of any security violation, as stated in 8.1.2 of this policy, to the NIGC CSA ISO and the FBI Compact Officer within five calendar days of receipt of the written report from the Contractor. The written report must include any corrective actions taken by the Contractor and the Authorized Recipient to resolve such security violation. (See OS 8.01 (d))

**8.2	Duties of the Contractor (See OS 8.01)**

1. Pending investigation, the Contractor shall, upon detection or awareness, suspend any employee who commits a security violation from assignments in which he/she has access to CHRI under the contract. (See OS 8.01 (b))

2. The Contractor shall immediately (within one hour of discovery) notify the TGRA or FBI CJIS ISO (iso@fbi.gov) of any security violation to include unauthorized access to CHRI, PII breach, or potential PII breach. (See OS 8.01 (c) and 9.03)

3. Within five calendar days of such discovery, the Contractor shall provide the TGRA, the NIGC CSA ISO or FBI CJIS ISO a written report documenting such security violation, corrective actions taken by the Contractor to resolve such violation, and the date, time, and summary of the violation. (See OS 8.01 (c) and 9.03)

**8.3	Suspension or Termination of Contract**

The contract is subject to termination by the TGRA for (See OS 2.03 and 8.02 (a-c)):

1. Security violations involving CHRI obtained pursuant to the contract.

2. The Contractor’s failure to notify the TGRA of any security violation or to provide a written report concerning such violation.

3. If the Contractor refuses to or is incapable of taking corrective actions to successfully resolve a security violation, they must terminate the contract.

Suspension or termination of the exchange of CHRI for security violations (See 8.03 (b))

1. If the exchange of CHRI is suspended, it may be reinstated after satisfactory written assurances have been provided to the Compact Council Chairman or the United States Attorney General by the Compact Officer/Chief Administrator, by the TGRA and by the Contractor that the security violation has been resolved. 

2. If the exchange of CHRI is terminated, the Contractor’s records (including media) containing CHRI shall be deleted in accordance with the CSP or returned in accordance with the provisions and timeframe as specified by TGRA.

**8.4	Notice to the FBI Compact Officer**

The TGRA and Contractor shall provide written notice to the FBI Compact Officer of the following (See 8.04 (a-c)):

1. The termination of a contract for security violations.

2. Security violations involving the unauthorized access to CHRI.

3. The Contractor’s name and unique identification number, the nature of the security violation, whether the violation was intentional, and the number of times the violation occurred.

Required notices, assurances, and correspondence to the FBI Compact Officer shall be sent by First Class Mail to (See OS 10.06):

FBI Compact Officer

1000 Custer Hollow Road

Module D-3

Clarksburg, WV 26306

Outsourcing Sample Policy	Updated December 28, 2022