Skip to Content
Last modified by Spencer Dobson on 2022/12/19 18:49
From version 4.1
edited by Spencer Dobson
on 2022/12/19 18:49
Change comment: Approved per Sheriff 12/19/2022.
To version 2.1
edited by Ryan Larkin
on 2021/04/03 14:44
Change comment: Added UCA code section to AH 01_103

Summary

Details

Page properties
Author
... ... @@ -1,1 +1,1 @@
1 -XWiki.sdobson
1 +XWiki.rlarkin
Content
... ... @@ -1,15 +1,26 @@
1 1  **Washington County Sheriff's Office
2 -SUPPORT DIVISION**
2 +ADMINISTRATIVE DIVISION**
3 3  Policy Manual
4 4  
5 5  
6 -Volume: AH Administrative Procedures
7 -Chapter: 01 Technology Use and Protection
6 +Volume: AH
7 +Administrative Procedures
8 +Chapter: 01
9 +Technology Use and Protection
8 8  
9 -Replaces and/or Supersedes: AH 01 04/27/2021
10 -\\Review Date: 12/19/2022
11 +Replaces and/or Supersedes:
12 +None
13 +Published:
14 +06/08/2015
15 +Review Date:
16 +04/03/2021
11 11  
12 12  
19 +Sheriff Cory C. Pulsipher
20 +
21 +Undersheriff James Standley
22 +
23 +
13 13  **__TABLE OF CONTENTS__**
14 14  AH 01_101 Definitions
15 15  AH 01_102 General
... ... @@ -34,11 +34,11 @@
34 34  
35 35  **AH 01_101 __DEFINITIONS__**
36 36  
37 -1. Access to Criminal Justice Information: The physical or logical (electronic) ability, right or privilege to view, modify or make use of Criminal Justice Information.
38 -1. Administration of Criminal Justice: The detection, apprehension, detention, pretrial release, post-trial release, prosecution, adjudication, correctional supervision, or rehabilitation of accused persons or criminal offenders. It also includes criminal identification activities; the collection, storage, and dissemination of criminal history record information; and criminal justice employment.
48 +1. Access to Criminal Justice Information: The physical or logical (electronic) ability, right orprivilege to view, modify or make use of Criminal Justice Information.
49 +1. Administration of Criminal Justice: The detection, apprehension, detention, pretrial release,post-trial release, prosecution, adjudication, correctional supervision, or rehabilitation of accused persons or criminal offenders. It also includes criminal identification activities; the collection, storage, and dissemination of criminal history record information; and criminal justice employment.
39 39  1. Agency Controlled Mobile Device: A mobile device that is centrally managed by an agency for the purpose of securing the device for potential access to CJI. The device can be agency issued or BYOD (personally owned).
40 40  1. Authorized User/Personnel: An individual, or group of individuals, who have been appropriately vetted through a national fingerprint-based record check and have been granted access to CJI data.
41 -1. BCI: Bureau of Criminal Identification (Utah)
52 +1. BCI: Bureau of Criminial Indification (Utah)
42 42  1. CJI: Criminal justice information.
43 43  1. CJIS: The Criminal Justice Information System administered by the FBI.
44 44  1. Computer System: Shall mean all computers (on-site and portable), hardware, software and resources owned, leased, rented or licensed by the Washington County Sheriff's Office , which are provided for official use by agency employees. This shall include all access to, and use of, Internet Service Providers (ISP) or other service providers provided by or through the agency or agency funding.
... ... @@ -78,7 +78,6 @@
78 78  11. Only trained and authorized personnel may disseminate CHRI to the person of record under authority of Right of Access;
79 79  11. WCSO users shall not access CJI from publicly accessed computers or publicly accessed wireless networks;
80 80  11. UCJIS use will be governed by [[Utah Code Annotated 53-10-108>>https://le.utah.gov/xcode/Title53/Chapter10/53-10-S108.html]].
81 -11. The BCI Director and the Commissioner of Public Safety will be notified immediately of any suspected misuse of UCJIS files or the data obtained through UCJIS as stated in UCA 53-10-108.
82 82  
83 83  **AH 01_104 __CJIS SECURITY TRAINING FOR USERS WITH ACCESS__**
84 84  
... ... @@ -130,7 +130,7 @@
130 130  111. NCIC Code Manual;
131 131  111. User Security Statement and Agreement;
132 132  111. All other policies and procedures by NCIC and BCI.
133 -11. The privacy and security of UCJIS and NCIC files will be emphasized in all training sessions.
143 +11. The privacy and security of UCJIS and NCIC files will be emphasized in all training sessions.T
134 134  11. The WCSO TAC and alternate TACs should attend the mandatory annual BCI TAC Conference. Other WCSO representatives may attend as directed. Information from the conference will be forwarded to all other WCSO staff by the TAC; in compliance with BCI policy.
135 135  
136 136  **AH 01_107 __PASSWORD ATTRIBUTES__**
... ... @@ -139,7 +139,7 @@
139 139  11. Secure password attributes authenticate an individual’s unique ID. Passwords for systems that access CJIS shall:
140 140  111. Be a minimum length of eight (8) characters on all systems;
141 141  111. Not be a dictionary word or proper name;
142 -111. Not be the same as the User ID;
152 +111. Not be the same as the Userid;
143 143  111. Expire within a maximum of 90 calendar days;
144 144  111. Not be identical to the previous ten (10) passwords;
145 145  111. Not be transmitted in the clear outside the secure location;
... ... @@ -182,11 +182,11 @@
182 182  11. Incident Types and Severity based upon affect to operations.
183 183  111. Non-critical incidents
184 184  1111. Type 1 – Isolated incidents of computer viruses and spyware generally handled by antivirus software. Minor system slowdowns or intersystem communication errors.
185 -111. Potentially Critical Incidents
195 +111. Potentially Critical Incidentsi
186 186  1111. Type 2 – Significant system slowdowns or service interruptions. Unusual system behavior that may impact the integrity or continued operation of IT Systems.
187 187  1111. Type 3 – Obvious signs of system penetration, denial of service or damage to physical infrastructure.
188 188  11. Incident reporting
189 -111. All suspected incidents shall be reported by agency members to the IT Manager either through the helpdesk system or directly by phone in the event of potentially critical incidents. Reporting members are expected to provide the following information:
199 +111. All suspected incidents shall be reported by agency members to the IT Manager either throughthe helpdesk system or directly by phone in the event of potentially critical incidents. Reporting members are expected to provide the following information:
190 190  1111. Name and contact information;
191 191  1111. Time of the report;
192 192  1111. Observed nature of the incident;
... ... @@ -285,7 +285,7 @@
285 285  111. Universal Serial Bus (USB drives); and
286 286  111. Other diskettes and tapes.
287 287  11. Studies of disk sanitization indicate that simply deleting files from the media or formatting a hard drive is not sufficient to completely erase data so that it cannot be recovered. These studies generally recommend two methods for disk sanitation:
288 -111. Destruction of the media either by physical force or by electromagnetic degaussing. Physical destruction should be conducted under dual control, and documented.
298 +111. Destruction of the media either by physical force or byelectromagnetic degaussing. Physicaldestruction should be conducted under dual control, and documented.
289 289  111. Disk sanitization, overwriting of all previously stored data in compliance with NIST standards.
290 290  
291 291  **AH 01_115 __TRANSPORTATION OF MEDIA AND CJI__**
... ... @@ -307,8 +307,7 @@
307 307  11. Internet sites containing information that is not appropriate or applicable to WCSO use and which shall not be intentionally accessed include, but are not limited to:
308 308  111. adult forums;
309 309  111. pornography;
310 -111. chat rooms;
311 -111. Tik Tok; and
320 +111. chat rooms; and
312 312  111. similar or related web sites.
313 313  11. Certain exceptions may be permitted with the prior approval of a supervisor as a function of an assignment. Downloaded information shall be limited to messages, mail and data files which shall be subject to audit and review by the WCSO without notice. No copyrighted and/or unlicensed software program files may be downloaded.
314 314  11. Employees shall report any unauthorized access to the system or suspected intrusion from outside sources (including the Internet) to a supervisor and follow the Security Incident Response Plan