Changes for page AH 01 Technology Use and Protection

Summary

• Page properties (2 modified, 0 added, 0 removed)

Details

Page properties

Author

...	...	@@ -1,1 +1,1 @@
1		-XWiki.rlarkin
	1	+XWiki.sdobson

Content

...	...	@@ -1,26 +1,15 @@
1	1	**Washington County Sheriff's Office
2		-ADMINISTRATIVE DIVISION**
	2	+SUPPORT DIVISION**
3	3	Policy Manual
4	4
5	5
6		-Volume: AH
7		-Administrative Procedures
8		-Chapter: 01
9		-Technology Use and Protection
	6	+Volume: AH Administrative Procedures
	7	+Chapter: 01 Technology Use and Protection
10	10
11		-Replaces and/or Supersedes:
12		-None
13		-Published:
14		-06/08/2015
15		-Review Date:
16		-04/03/2021
	9	+Replaces and/or Supersedes: AH 01 04/27/2021
	10	+\\Review Date: 12/19/2022
17	17
18	18
19		-Sheriff Cory C. Pulsipher
20		-
21		-Undersheriff James Standley
22		-
23		-
24	24	**__TABLE OF CONTENTS__**
25	25	AH 01_101 Definitions
26	26	AH 01_102 General
...	...	@@ -45,11 +45,11 @@
45	45
46	46	**AH 01_101 __DEFINITIONS__**
47	47
48		-1. Access to Criminal Justice Information: The physical or logical (electronic) ability, right orprivilege to view, modify or make use of Criminal Justice Information.
49		-1. Administration of Criminal Justice: The detection, apprehension, detention, pretrial release,post-trial release, prosecution, adjudication, correctional supervision, or rehabilitation of accused persons or criminal offenders. It also includes criminal identification activities; the collection, storage, and dissemination of criminal history record information; and criminal justice employment.
	37	+1. Access to Criminal Justice Information: The physical or logical (electronic) ability, right or privilege to view, modify or make use of Criminal Justice Information.
	38	+1. Administration of Criminal Justice: The detection, apprehension, detention, pretrial release, post-trial release, prosecution, adjudication, correctional supervision, or rehabilitation of accused persons or criminal offenders. It also includes criminal identification activities; the collection, storage, and dissemination of criminal history record information; and criminal justice employment.
50	50	1. Agency Controlled Mobile Device: A mobile device that is centrally managed by an agency for the purpose of securing the device for potential access to CJI. The device can be agency issued or BYOD (personally owned).
51	51	1. Authorized User/Personnel: An individual, or group of individuals, who have been appropriately vetted through a national fingerprint-based record check and have been granted access to CJI data.
52		-1. BCI: Bureau of Criminial Indification (Utah)
	41	+1. BCI: Bureau of Criminal Identification (Utah)
53	53	1. CJI: Criminal justice information.
54	54	1. CJIS: The Criminal Justice Information System administered by the FBI.
55	55	1. Computer System: Shall mean all computers (on-site and portable), hardware, software and resources owned, leased, rented or licensed by the Washington County Sheriff's Office , which are provided for official use by agency employees. This shall include all access to, and use of, Internet Service Providers (ISP) or other service providers provided by or through the agency or agency funding.
...	...	@@ -89,6 +89,7 @@
89	89	11. Only trained and authorized personnel may disseminate CHRI to the person of record under authority of Right of Access;
90	90	11. WCSO users shall not access CJI from publicly accessed computers or publicly accessed wireless networks;
91	91	11. UCJIS use will be governed by [[Utah Code Annotated 53-10-108>>https://le.utah.gov/xcode/Title53/Chapter10/53-10-S108.html]].
	81	+11. The BCI Director and the Commissioner of Public Safety will be notified immediately of any suspected misuse of UCJIS files or the data obtained through UCJIS as stated in UCA 53-10-108.
92	92
93	93	**AH 01_104 __CJIS SECURITY TRAINING FOR USERS WITH ACCESS__**
94	94
...	...	@@ -140,7 +140,7 @@
140	140	111. NCIC Code Manual;
141	141	111. User Security Statement and Agreement;
142	142	111. All other policies and procedures by NCIC and BCI.
143		-11. The privacy and security of UCJIS and NCIC files will be emphasized in all training sessions.T
	133	+11. The privacy and security of UCJIS and NCIC files will be emphasized in all training sessions.
144	144	11. The WCSO TAC and alternate TACs should attend the mandatory annual BCI TAC Conference. Other WCSO representatives may attend as directed. Information from the conference will be forwarded to all other WCSO staff by the TAC; in compliance with BCI policy.
145	145
146	146	**AH 01_107 __PASSWORD ATTRIBUTES__**
...	...	@@ -149,7 +149,7 @@
149	149	11. Secure password attributes authenticate an individual’s unique ID. Passwords for systems that access CJIS shall:
150	150	111. Be a minimum length of eight (8) characters on all systems;
151	151	111. Not be a dictionary word or proper name;
152		-111. Not be the same as the Userid;
	142	+111. Not be the same as the User ID;
153	153	111. Expire within a maximum of 90 calendar days;
154	154	111. Not be identical to the previous ten (10) passwords;
155	155	111. Not be transmitted in the clear outside the secure location;
...	...	@@ -192,11 +192,11 @@
192	192	11. Incident Types and Severity based upon affect to operations.
193	193	111. Non-critical incidents
194	194	1111. Type 1 – Isolated incidents of computer viruses and spyware generally handled by antivirus software. Minor system slowdowns or intersystem communication errors.
195		-111. Potentially Critical Incidentsi
	185	+111. Potentially Critical Incidents
196	196	1111. Type 2 – Significant system slowdowns or service interruptions. Unusual system behavior that may impact the integrity or continued operation of IT Systems.
197	197	1111. Type 3 – Obvious signs of system penetration, denial of service or damage to physical infrastructure.
198	198	11. Incident reporting
199		-111. All suspected incidents shall be reported by agency members to the IT Manager either throughthe helpdesk system or directly by phone in the event of potentially critical incidents. Reporting members are expected to provide the following information:
	189	+111. All suspected incidents shall be reported by agency members to the IT Manager either through the helpdesk system or directly by phone in the event of potentially critical incidents. Reporting members are expected to provide the following information:
200	200	1111. Name and contact information;
201	201	1111. Time of the report;
202	202	1111. Observed nature of the incident;
...	...	@@ -295,7 +295,7 @@
295	295	111. Universal Serial Bus (USB drives); and
296	296	111. Other diskettes and tapes.
297	297	11. Studies of disk sanitization indicate that simply deleting files from the media or formatting a hard drive is not sufficient to completely erase data so that it cannot be recovered. These studies generally recommend two methods for disk sanitation:
298		-111. Destruction of the media either by physical force or byelectromagnetic degaussing. Physicaldestruction should be conducted under dual control, and documented.
	288	+111. Destruction of the media either by physical force or by electromagnetic degaussing. Physical destruction should be conducted under dual control, and documented.
299	299	111. Disk sanitization, overwriting of all previously stored data in compliance with NIST standards.
300	300
301	301	**AH 01_115 __TRANSPORTATION OF MEDIA AND CJI__**
...	...	@@ -317,7 +317,8 @@
317	317	11. Internet sites containing information that is not appropriate or applicable to WCSO use and which shall not be intentionally accessed include, but are not limited to:
318	318	111. adult forums;
319	319	111. pornography;
320		-111. chat rooms; and
	310	+111. chat rooms;
	311	+111. Tik Tok; and
321	321	111. similar or related web sites.
322	322	11. Certain exceptions may be permitted with the prior approval of a supervisor as a function of an assignment. Downloaded information shall be limited to messages, mail and data files which shall be subject to audit and review by the WCSO without notice. No copyrighted and/or unlicensed software program files may be downloaded.
323	323	11. Employees shall report any unauthorized access to the system or suspected intrusion from outside sources (including the Internet) to a supervisor and follow the Security Incident Response Plan