November 2018

Resource Materials:

Outsourcing Standard for Non-Channelers

Goal

To provide adequate 

security and integrity 

for criminal history 

record information 

(CHRI) while under 

the control or management of an

outsourced third party, 

the Contractor.

NATIONAL CRIME PREVENTION AND 

PRIVACY COMPACT COUNCIL

Important Information Regarding Outsourcing Requirements 

Version 1.3, November 2023

The intent of the Outsourcing Standard is to require that the parties involved 

in an outsourcing agreement/contract maintain security practices consistent 

with federal and state laws, regulations, and standards (including the FBI 

Criminal Justice Information Services [CJIS] Security Policy) and with the rules, 

procedures, and standards established by the National Crime Prevention 

and Privacy Compact Council (Council) and the United States (U.S.) 

Attorney General. It is extremely important that each party review and 

understand the requirements outlined in the Outsourcing Standard. Failure 

to comply with the requirements outlined in the Outsourcing Standard may 

result in the approval to use a Contractor being terminated or an 

Authorized Recipient’s access to CHRI being suspended.

• The most current version of the Outsourcing Standard, dated 

05/16/2018, can be located at: https://www.fbi.gov/file-repository/

compact-council-security-and-management-control-outsourcingstandard-for-non-channelers.pdf/view

• The CJIS Security Policy, dated 9/14/2023, can be located at:

https://le.fbi.gov/cjis-division-resources/cjis-security-policy-resource-center

Contents:

Page 2

Important Terms

Compliance

Page 3

Which Outsourcing Standard for Non-Channelers 

requirements apply

Page 4

Important Terms 

(continued)

Compact Council

The Authorized Recipient is responsible for ensuring that each applicant is provided certain notices and the 

results of the fingerprint-based background check are handled in a manner that protects the applicant’s 

privacy. These obligations are pursuant to the Privacy Act of 1974, Title 5, U.S. Code, section 552a and 

Title 28, Code of Federal Regulation, (CFR) § section 50.12, among other authorities. The Guiding Principles

provide additional information regarding the requirements and are available at the following links. 

• “Guiding Principles: Agency Privacy Requirements for Noncriminal Justice Applicants” - This document 

addresses the applicant notification and privacy requirements from an Authorized Recipient’s 

document perspective of the requirements. 

https://www.fbi.gov/how-we-can-help-you/need-an-fbi-service-or-more-information/compact-council//

guiding-principles-agency-privacy-requirements-for-noncriminal-justice-applicants

• “Guiding Principles: Noncriminal Justice Applicant’s Privacy Rights” - This document addresses the applicant 

notification and privacy requirements from the prospective of an applicant and is designed for an 

Authorized Recipient to provide to an applicant if they wish.

https://www.fbi.gov/how-we-can-help-you/need-an-fbi-service-or-more-information/compact-council/

guiding-principles-noncriminal-justice-applicants-privacy-rights

Each applicant must receive a copy of the FBI Privacy Act Statement (dated no later than 2013) when the 

applicant submits his/her fingerprints and associated personal information to the FBI. The most current FBI 

Privacy Act Statement can be located at: https://www.fbi.gov/how-we-can-help-you/need-an-fbi-service-ormore-information/compact-council/privacy-act-statement. If the subject of the record believes that the 

record contains incomplete or inaccurate information, he/she may request a change or correction by 

contacting the agency or agencies that submitted the information to the FBI; or he/she may submit a 

challenge request to the FBI’s CJIS Division. Additional information and instructions can be located at: 

https://www.edo.cjis.gov/#/.

Applicant Notification and Privacy Requirements
Prior to 

engaging in 

outsourcing any 

noncriminal 

justice 

administrative 

functions with a 

Contractor, an 

Authorized 

Recipient must 

request and 

receive written 

permission from 

the FBI 

Compact 

Officer.

Page 2 Reso

Noncriminal Justice Administrative Functions include the routine noncriminal justice 

administrative functions relating to the processing of CHRI on behalf of the Authorized Recipient. This 

includes functions where the Contractor may not be reviewing the CHRI but would have the potential 

to access or view CHRI. This includes functions that do not require a direct connection to the FBI 

CJIS Wide Area Network (WAN) for submission of fingerprints and receipt of CHRI. Examples 

include making fitness determinations, processing, storing, or destroying documents, and providing 

information technology support functions. Noncriminal justice administrative functions only include 

functions that would be performed on behalf of the Authorized Recipient. Therefore, an Authorized 

Recipient may not leverage outsourcing to create an authority for the intended purpose of 

disseminating CHRI to a Contractor for the Contractor’s own separate use. 

If an Authorized Recipient retains positive control of CHRI that is in a Contractor’s possession and the 

Contractor does not have the ability to view or make use of the CHRI, then the Contractor does not 

have “access” and the Authorized Recipient would not be required to implement the Outsourcing 

Standard. This premise typically applies to contractors that perform the function of primary or backup 

record storage and includes encrypted media or locked containers for which the Authorized Recipient 

solely maintains the keys. However, the same logic is applied to similar services such as CHRI mailed 

through the U.S. Postal Service. 

When submitting an outsourcing request to the FBI Compact Officer, Authorized Recipients must 

detail the specific noncriminal justice functions the Contractor will be performing. The request must 

also clearly identify how the Contractor will have access to, or the ability to access, CHRI while 

performing the identified functions. Failure to identify the specific functions or to clearly identify how 

the Contractor will have access to CHRI may delay the processing of the request. A new outsourcing 

request must be submitted if the Authorized Recipient wishes for the Contractor to perform any 

additional noncriminal justice administrative functions that were not included in the prior approval. In 

addition, if the Authorized Recipient opts to have a different Contractor perform noncriminal justice 

administrative functions involving Contractor access to or potential access to the FBI CHRI, a new 

request must be submitted to the FBI Compact Officer.

(continued on page 4)

Important Terms 

For additional information regarding Outsourcing or any questions, please contact the FBI 

Outsourcing Team at outsourcing.question@fbi.gov.

Pursuant to the Outsourcing Standard, the Authorized Recipient is responsible for the actions of the 

Contractor and shall monitor the Contractor’s compliance to the terms and conditions of the 

Outsourcing Standard and the CJIS Security Policy. In addition, Part 2.05 of the Outsourcing Standard

requires the Authorized Recipient to conduct an audit of the contractor within 90 days of the date 

the Contractor first receives the FBI CHRI under the approved outsourcing agreement and to certify 

to the FBI Compact Officer that the audit was conducted. However, this provision may not be 

applicable if the Authorized Recipient meets certain conditions under Parts 11.01 or 11.02 of the 

Outsourcing Standard. The Authorized Recipient is responsible forreviewing the Outsourcing Standard 

and determining if it meets the conditions for exclusion. Please review the diagram on the next page 

to assist with making the determination. 

Further, as provided in footnote 2 of the Outsourcing Standard, the FBI will triennially audit a 

representative sample of Contractors and ARs. If selected for an audit, representatives from the FBI’s 

CJIS Audit Unit will contact the Authorized Recipient to schedule the audit and discuss the audit 

process.

Compliance

Page 2 Resource Materials: Outsourcing Standard for Non-Channelers
Which Outsourcing Standard for Non-Channelers Requirements Apply?

Version 1.3, November 2023 Page 3
Page 4 Resource Materials:

Outsourcing Standard for Non-Channelers

Applicant Notification and Privacy Requirements

For additional information regarding Outsourcing or any questions, please 

contact the FBI Outsourcing Team at outsourcing.question@fbi.gov.

In the event of a 

conflict between 

the terms of the 

contract 

between the 

Authorized 

Recipient and 

the Contractor, 

amendments to 

the contract, 

and the 

Outsourcing 

Standard 

relating to the 

FBI-provided 

data, the terms 

of the 

Outsourcing 

Standard shall 

control.

On October 9, 1998, President Clinton signed into law the 

Compact Act of 1998, establishing an infrastructure by which states 

can exchange criminal records for noncriminal justice purposes 

according to the laws of the requesting state and provide 

reciprocity among the states to share records without charging 

each other for the information. The Compact became effective 

April 28, 1999, after Montana and Georgia became the first two 

states to ratify it, respectively. To date, 34 states have ratified the 

Compact.

The Compact Act of 1998 establishes a Council to promulgate 

rules and procedures for the effective use of the Interstate 

Identification Index (III) System for noncriminal justice purposes. 

The Compact Council’s goal is to make available the most complete and up-to date records possible 

for noncriminal justice purposes.

The Compact Council’s mission is to enhance public safety through noncriminal justice background 

checks based on positive identification, while protecting individual privacy rights.

The outsourcing of noncriminal justice administrative functions was authorized by the Compact 

Council in 2005 with the approval of the Outsourcing of Noncriminal Justice Administrative Functions 

final rule, which is codified at 28 CFR Part 906. The Outsourcing Standard requirements discussed in 

this document were adopted by the Compact Council pursuant to this rule.

For additional information regarding the Compact Council, please visit the Compact Council’s website 

at https://www.fbi.gov/how-we-can-help-you/need-an-fbi-service-or-more-information/compact-council.

The Compact Council

Page 4

Important Terms (continued)

CHRI, as referred to in Article I(4) of the National Crime Prevention and Privacy Compact Act 

(Compact), means information collected by criminal justice agencies on individuals consisting of 

identifiable descriptions and notations of arrests, detentions, indictments, or other formal criminal 

charges, and any disposition arising therefrom, including acquittal, sentencing, correctional supervision, 

or release; but does not include identification information such as fingerprint records if such information 

does not indicate involvement of the individual with the criminal justice system.

Information is considered CHRI if it is transferred or reproduced directly from CHRI and 

associated with the subject of the record. This includes information such as conviction/disposition data 

as well as identifiers used to index records regardless of format. Examples of formal and informal 

products or verbalizations include correspondence such as letters and e-mails; documents such as forms 

and hand-written notes; conversations either in person or by telephone; and data fields such as those 

stored in database tables or spreadsheets. However, information is not considered CHRI if it is 

obtained as a result of using CHRI received from a national FBI check as a lead to reach out to source 

record owners such as local courts or state criminal history record repositories. As a prerequisite, 

both the process used to obtain the source record information and the resulting source record 

information itself must not directly reference or be attributed to the national FBI check. 

Information is considered CHRI if it confirms the existence or nonexistence of CHRI. This FBI policy is 

derived from and mirrors the general policy on dissemination found at Title 28, C.F.R., section 20.21 28 

CFR § 20.21, directly relating to applicable state and local criminal history record information systems. 

This includes applicant status information, which is either directly attributed to or predominately based 

on a national FBI check, when no authority or inherent need exists for the release of such information. 

Resource Materials: Outsourcing Standard for Non-Channelers