CJIS Brief: Are they a One, or a Nine? Does the contractor need to sign the CJIS Security Addendum?

The CJIS Security Addendum is required for contractors pursuant to chapter of the CJIS Security policy. However, it doesn't apply to every contractor. The easy way to determine whether you need to have the individual sign the security addendum is to jump a few chapters ahead to chapter 5.12.  Take a look at chapter 5.12 of the CJIS security policy. That policy separates individual requiring fingerprints into two groups:
  1. Under item 1, anyone who uses CJI in their job, or has responsibilities for information systems with access to CJI.
  2. Under item 9,  anyone who has access to areas with CJI, but who does not use the CJIS information to perform their work.
Now, jump back to section, the requirement for the security addendum is for: "All private contractors who perform criminal justice functions..." Which incorporates the first group, but not the second.  So that means the janitors, maintenance personnel, electrician, plumber, etc. do not need to sign the security addendum.


Popular posts from this blog

Just Dropped: CJIS Security Policy 5.6

When does the CJIS security policy apply to Criminal Justice and Non-Criminal Justice Information Systems?

How an Auditor Looks at Your Network Diagram