Crime Records Services Access and Dissemination Bureau. Susie Dial-Herrera, Supervisor Access & Dissemination Unit
|
|
|
- Abraham Dickerson
- 7 years ago
- Views:
Transcription
1 Crime Records Services Access and Dissemination Bureau Susie Dial-Herrera, Supervisor Access & Dissemination Unit
2 Definitions CHRI: Criminal History Record Information CJI: Criminal Justice Information Access: CJIS Security Policy: The ability to receive, view, or discuss CHRI A policy regarding CHRI enforced by the FBI to which all states and authorized private entities must adhere
3 DPS Secure Site
4 What access does this system allow Criminal History Search - Name-based Searches Search for individuals in the Computerized Criminal History System (CCH). Access is restricted to authorized Entities. F.A.C.T. Clearinghouse - Fingerprint results & searches The FACT Clearinghouse is a repository of the DPS and the FBI fingerprint-based criminal history results. Only persons processed through Fingerprint Applicant Services of Texas (FAST) are eligible for FACT.
5 Eligibility Criminal justice agencies Entities identified in the Government Code for background searches for specific non-criminal justice purposes Research purposes
6 Legislatively Authorized Government Entities and Criminal Justice Agencies: Cities employment and licensing Counties employment and licensing School Districts Higher Education Hospitals and Hospital District Public Transportation Fire Departments Regional Toll way Authorities State Agencies County & District Clerks Juvenile Probation Adult Probation Legislatively Authorized Private Entities
7 What are the requirements? A criminal justice and non-criminal justice entity legislatively authorized by Chapter 411, Subchapter F of the Texas Government Code or other Texas law to received criminal history record information from the Department of Public Safety may access the DPS Secure Site.
8 Omnixx vs. Criminal Justice Agencies only Texas and National Criminal Histories Name based only Warrants/Stolen Vehicles/Missing Persons/Protective Orders/ etc. Secure Site Criminal Justice/Noncriminal Justice Agencies Name based searches Texas only Live Texas fingerprint & static FBI results
9 Security requirements: CJIS Security Policy The CJIS Security Policy provides Criminal Justice Agencies (CJA) and Noncriminal Justice Agencies (NCJA) with a minimum set of security requirements for the access to Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Division systems and information and to protect and safeguard Criminal Justice Information (CJI). This minimum standard of security requirements ensures continuity of information protection. The essential premise of the CJIS Security Policy is to provide the appropriate controls to protect CJI, from creation through dissemination; whether at rest or in transit.
10 Hardware/Software Minimum requirements: Current Operating System Current Firewall Current Virus Protection
11 Media Storage and Access Media protection policy and procedures shall be documented and implemented to ensure that access to electronic media in all forms is restricted to authorized individuals. Procedures shall be defined for securely handling, transporting and storing media. The agency shall securely store electronic media within physically secure locations or controlled areas. The agency shall restrict access to electronic media to authorized individuals. If physical and personnel restrictions are not feasible then the data shall be encrypted per Section
12 Electronic Media in Transit Electronic media means electronic storage media including memory devices in laptops and computers (hard drives) and any removable, transportable digital memory media, such as magnetic tape or disk, optical disk, flash drives, external hard drives, or digital memory card. Controls shall be in place to protect electronic media containing CJI while in transport (physically moved from one location to another) to help prevent compromise of the data. Encryption, as defined in Section of this Policy, is the optimal control during transport; however, if encryption of the data isn t possible then each agency shall institute other controls to ensure the security of the data.
13 Media Transport The agency shall protect and control electronic media and during transport outside of controlled areas and restrict the activities associated with transport of such media to authorized personnel.
14 Use of Mobile Devices Laptop Devices Tablet Devices Pocket/Handheld Mobile Devices Please refer to CJIS Security Policy
15 Compensating Controls for AA for Smartphones or Tablets In the State of Texas Please contact:
16
17 Cellular Risk Mitigations Organizations shall, at a minimum, ensure that cellular devices: Apply available critical patches and upgrades to the operating system as soon as they become available for the device and after necessary testing as described in section Are configured for local device authentication. Use advanced authentication. Encrypt all CJI data resident on the device. Erase cached information when session is terminated. Employ personal firewalls or run a Mobile Device Management system that facilitates the ability to provide firewall services from the agency level. Employ antivirus software or run a Mobile Device Management system that facilitates the ability to provide antivirus services from the agency level.
18 Mobile Device Management (MDM) Agencies shall implement the following controls when allowing CJI access from cell / smart phones and tablet devices that do not support Firewalls or Antivirus software. MDM with centralized administration capable of at least: Remote locking of device Remote wiping of device Setting and locking device configuration Detection of rooted and / or jailbroken devices Enforce folder and / or disk level encryption
19 Electronic Storage Electronic storage of CHRI is allowed, unless retention of such information is not permitted by statute. All CHRI retained electronically in storage system must strictly follow FBI CJIS Security Policy 5.2. All CHRI must be contained in separate file folders within the system to prevent unauthorized access, use and dissemination of CHRI.
20 Electronic Media Sanitation and Disposal The agency shall sanitize, that is, overwrite at least three times or degauss electronic media prior to disposal or release for reuse by unauthorized individuals. Inoperable electronic media shall be destroyed (cut up, shredded, etc.). The agency shall maintain written documentation of the steps taken to sanitize or destroy electronic media. Agencies shall ensure the sanitization or destruction is witnessed or carried out by authorized personnel.
21 Network Diagram The agency shall ensure that a complete topological drawing depicting the interconnectivity of the agency network, to criminal justice information, systems and services is maintained in a current status. The network topological drawing shall include the following: All communications paths, circuits, and other components used for the interconnection, beginning with the agency-owned system(s) and traversing through all interconnected systems to the agency end-point. The logical location of all components (e.g., firewalls, routers, switches, hubs, servers, encryption devices, and computer workstations). Individual workstations (clients) do not have to be shown; the number of clients is sufficient. For Official Use Only (FOUO) markings. The agency name and date (day, month, and year) drawing was created or updated.
22 Copy of Diagram here
23
24 Current Operating System Current Firewall Current Virus Protection Diagram (if the diagram can not be released to the city/county agency, it may be send to DPS directly) Agreements and possible fingerprints of contracted IT staff CJIS Security Training
25 Disabling Users Account supervisor(s) need to suspend a user s account when a person no longer needs access to the secure site. Liability for the agency is potentially high if not done. Individual can still access criminal history from another location which would be a potential class B misdemeanor for unauthorized retrieval and purpose. Agency will be held liable for not disabling an individual s access and all criminal history information retrieved by that individual.
26 Section of the Texas Government Code (a) A person commits an offense if the person knowingly or intentionally: (1) obtains criminal history record information in an unauthorized manner, uses the information for an unauthorized purpose, or discloses the information to a person who is not entitled to the information; (2) violates a rule of the department adopted under this subchapter. (b) An offense under Subsection (a) is a Class Bmisdemeanor, except as provided by Subsection (c). (c) An Offense under Subsection (a) is a felony of the second degree if the person: (1) obtains, uses, or discloses criminal history record information for remuneration or for the promise of remuneration; or (2) Employs another person to obtain, use, or disclose criminal history record information for remuneration or for the promise of remuneration. (d) The department shall provide each person who applies for access to criminal history record information maintained by the department with a copy of this section.
27 Review/CJISSecurityPolicyv5.pdf
28 Contact Information Non-Criminal Justice Audit and Training (512) CJIS Security Office Team Lead (512)
Security awareness training is not a substitute for the LEADS Security Policy.
Revised 4/2014 This training will discuss some of the duties of the Terminal Agency Coordinator (TAC), Local Agency Security Officer (LASO) and provide basic security awareness training. Security awareness
CJIS SECURITY POLICY: VERSION 5.2 CHANGES AND THE UPCOMING REQUIREMENTS.
CJIS SECURITY POLICY: VERSION 5.2 CHANGES AND THE UPCOMING REQUIREMENTS. Alan Ferretti CJIS Information Security Officer Texas Department of Public Safety CJIS Security Policy version 5.2: On 8/9/2013
Approved By: Agency Name Management
Policy Title: Effective Date: Revision Date: Approval(s): LASO: CSO: Agency Head: Media Protection Policy Every 2 years or as needed Purpose: The intent of the Media Protection Policy is to ensure the
Noncriminal Justice Agency Guide
\ Arkansas Crime Information Center Noncriminal Justice Agency Guide 1 Contents Acronym Glossary... 4 Introduction... 5 Overview & History... 5 Arkansas... 5 Use of Criminal History Record Information
GENERAL ORDER DISTRICT OF COLUMBIA I. BACKGROUND
GENERAL ORDER DISTRICT OF COLUMBIA Subject CJIS Security Topic Series Number SPT 302 12 Effective Date March 28, 2014 Related to: GO-SPT-302.08 (Metropolitan Police Department (MPD) Wide Area Network)
Tenth Judicial Circuit of Florida Information Systems Acceptable Use Guidelines Polk, Hardee and Highlands Counties as of January 2014
Tenth Judicial Circuit of Florida Information Systems Acceptable Use s Polk, Hardee and Highlands Counties as of January 2014 The following guidelines define the acceptable use of information technology
SECURITY and MANAGEMENT CONTROL OUTSOURCING STANDARD For NON-CHANNELERS
SHP-570A 1/14 SECURITY and MANAGEMENT CONTROL OUTSOURCING STANDARD For NON-CHANNELERS The goal of this document is to provide adequate security and integrity for criminal history record information (CHRI)
Information Security Policy
Information Security Policy Touro College/University ( Touro ) is committed to information security. Information security is defined as protection of data, applications, networks, and computer systems
Protecting Criminal Justice Information: Achieving CJIS Compliance on Mobile Devices
Protecting Criminal Justice Information: Achieving CJIS Compliance on Mobile Devices Protecting Criminal Justice Information: Achieving CJIS Compliance on Mobile Devices It s common today for law enforcement
How To Protect The Time System From Being Hacked
WISCONSIN TIME SYSTEM Training Materials TIME SYSTEM SECURITY AWARENESS HANDOUT Revised 11/21/13 2014 Security Awareness Handout All System Security The TIME/NCIC Systems are criminal justice computer
Lawrence Police Department Administrative Policy. August 2013. A. Access to CJIS sensitive data is only available to authorized users.
Lawrence Police Department Administrative Policy SUBJECT Criminal Justice Information System (CJIS) APPLIES TO All Personnel EFFECTIVE DATE REVISED DATE August 2013 APPROVED BY Chief of Police TOTAL PAGES
VOLUNTEER & EMPLOYEE CRIMINAL HISTORY SERVICE (VECHS) USER AGREEMENT FOR CRIMINAL HISTORY RECORD INFORMATION
VOLUNTEER & EMPLOYEE CRIMINAL HISTORY SERVICE (VECHS) USER AGREEMENT FOR CRIMINAL HISTORY RECORD INFORMATION 1. Purpose This Agreement, entered into by the Hawaii Criminal Justice Data Center (hereinafter
Effective Date: Subject Matter Experts / Approval(s): TAC: LASO: C/ISO: Front Desk: Technology Support Lead: Agency Head:
Policy Title: Effective Date: Revision Date: Subject Matter Experts / Approval(s): TAC: LASO: C/ISO: Front Desk: Technology Support Lead: Agency Head: Every 2 years or as needed Purpose: The purpose of
MCOLES Information and Tracking Network. Security Policy. Version 2.0
MCOLES Information and Tracking Network Security Policy Version 2.0 Adopted: September 11, 2003 Effective: September 11, 2003 Amended: September 12, 2007 1.0 POLICY STATEMENT The Michigan Commission on
Alan Ferretti CJIS Information Security Officer
Alan Ferretti CJIS Information Security Officer AGENDA What is CJIS? What is the APB? What is new in the latest version of the CJIS Security Policy? Advanced Authentication change Mobile policy for Tablets
Network and Security Controls
Network and Security Controls State Of Arizona Office Of The Auditor General Phil Hanus IT Controls Webinar Series Part I Overview of IT Controls and Best Practices Part II Identifying Users and Limiting
BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050
BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050 Adopting Multnomah County HIPAA Security Policies and Directing the Appointment of Information System Security
M E M O R A N D U M. Revised Information Technology Security Procedures INFORMATION TECHNOLOGY SECURITY PROCEDURES. I. General
M E M O R A N D U M To: From: IT Steering Committee Brian Cohen Date: March 26, 2009 Subject: Revised Information Technology Security Procedures The following is a revised version of the Information Technology
Physical Protection Policy Sample (Required Written Policy)
Physical Protection Policy Sample (Required Written Policy) 1.0 Purpose: The purpose of this policy is to provide guidance for agency personnel, support personnel, and private contractors/vendors for the
8.03 Health Insurance Portability and Accountability Act (HIPAA)
Human Resource/Miscellaneous Page 1 of 5 8.03 Health Insurance Portability and Accountability Act (HIPAA) Policy: It is the policy of Licking/Knox Goodwill Industries, Inc., to maintain the privacy of
1.02 Authorized Recipient means an entity authorized by statute to receive background check information for noncriminal justice purposes.
SECURITY and MANAGEMENT CONTROL OUTSOURCING STANDARD The goal of this document is to provide adequate security and integrity for background check information while under the control or management of an
Alan Ferretti CJIS Information Security Officer
Alan Ferretti CJIS Information Security Officer CJIS Technical Audit Overview Who, What, Why and When Audit Process Review Network Diagram Review Written Policies/Process Available Resources Helps To Know.
HIPAA Compliance (DSHS and HCA) Preamble: This section of the Contract is the Business Associate Agreement as
HIPAA Compliance (DSHS and HCA) Preamble: This section of the Contract is the Business Associate Agreement as required by HIPAA. 1. Definitions. a. Business Associate, as used in this Contract, means the
SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This
IT Security Standard: Computing Devices
IT Security Standard: Computing Devices Revision History: Date By Action Pages 09/30/10 ITS Release of New Document Initial Draft Review Frequency: Annually Responsible Office: ITS Responsible Officer:
Connecticut Justice Information System Security Compliance Assessment Form
The Connecticut Justice Information System (CJIS-2) is used as a mechanism for municipalities, State and Federal agencies to assess their compliance with the CJIS Security Requirements & Recommendations
Montclair State University. HIPAA Security Policy
Montclair State University HIPAA Security Policy Effective: June 25, 2015 HIPAA Security Policy and Procedures Montclair State University is a hybrid entity and has designated Healthcare Components that
Senate Bill 9 Background Checks for Education A Reference Guide January 1, 2008
Senate Bill 9 Background Checks for Education A Reference Guide January 1, 2008 TABLE OF CONTENTS SB9 OVERVIEW... 3 DEFINITIONS... 4 THE FINGERPRINTING PROCESS:... 6 SUMMARY OF REQUIREMENTS FROM THE BILL...
Criminal Justice Information Services (CJIS) Security Policy
U. S. Department of Justice Federal Bureau of Investigation Criminal Justice Information Services Division Criminal Justice Information Services (CJIS) Security Policy Version 5.4 Prepared by: CJIS Information
Written Information Security Plan (WISP) for. HR Knowledge, Inc. This document has been approved for general distribution.
Written Information Security Plan (WISP) for HR Knowledge, Inc. This document has been approved for general distribution. Last modified January 01, 2014 Written Information Security Policy (WISP) for HR
Deciphering the Safe Harbor on Breach Notification: The Data Encryption Story
Deciphering the Safe Harbor on Breach Notification: The Data Encryption Story Healthcare organizations planning to protect themselves from breach notification should implement data encryption in their
CA Technologies Solutions for Criminal Justice Information Security Compliance
WHITE PAPER OCTOBER 2014 CA Technologies Solutions for Criminal Justice Information Security Compliance William Harrod Advisor, Public Sector Cyber-Security Strategy 2 WHITE PAPER: SOLUTIONS FOR CRIMINAL
FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
Supplier Information Security Addendum for GE Restricted Data
Supplier Information Security Addendum for GE Restricted Data This Supplier Information Security Addendum lists the security controls that GE Suppliers are required to adopt when accessing, processing,
LAW ENFORCEMENT INFORMATION NETWORK INFORMATION MANUAL
LAW ENFORCEMENT INFORMATION NETWORK INFORMATION MANUAL The Michigan Law Enforcement Information Network (LEIN) is a statewide computerized information system established in 1967 as a service to Michigan
NONCRIMINAL JUSTICE AGENCY USE OF CRIMINAL JUSTICE INFORMATION
NONCRIMINAL JUSTICE AGENCY USE OF CRIMINAL JUSTICE INFORMATION PRESENTED BY: MICHIGAN STATE POLICE CRIMINAL JUSTICE INFORMATION CENTER SECURITY & ACCESS SECTION A PROUD tradition of SERVICE through EXCELLENCE,
Retention & Destruction
Last Updated: March 28, 2014 This document sets forth the security policies and procedures for WealthEngine, Inc. ( WealthEngine or the Company ). A. Retention & Destruction Retention & Destruction of
CYBER SECURITY POLICY For Managers of Drinking Water Systems
CYBER SECURITY POLICY For Managers of Drinking Water Systems Excerpt from Cyber Security Assessment and Recommended Approach, Final Report STATE OF DELAWARE DRINKING WATER SYSTEMS February 206 Kash Srinivasan
Information Security Program Management Standard
State of California California Information Security Office Information Security Program Management Standard SIMM 5305-A September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF CHANGES
Federal Bureau of Prisons
Federal Bureau of Prisons Privacy Impact Assessment for the Forensic Laboratory Issued by: Sonya D. Thompson, Senior Component Official for Privacy, Sr. Deputy Assistant Director/CIO Approved by: Erika
Cyber Self Assessment
Cyber Self Assessment According to Protecting Personal Information A Guide for Business 1 a sound data security plan is built on five key principles: 1. Take stock. Know what personal information you have
Please review and make copies of the following documents for each designated staff in need of Valley Express access.
Welcome to Valley Express (VE) Valley Express is Valley Health Plan s (VHP) Authorization and Referral data system. By signing this document, the individual signifies that the County s User Responsibility
HIPAA Security Alert
Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information
Fingerprint-Based Background Check Responsibilities for Non-Criminal Justice Agencies and Users
Fingerprint-Based Background Check Responsibilities for Non-Criminal Justice Agencies and Users Version 1.2 Hawaii Criminal Justice Data Center March 20, 2014 Table of Contents Table of Contents... 2 I.
Adams County, Colorado
Colorado Independent Consultants Network, LLC Adams County, Colorado Bring-Your-Own-Device Policy Prepared by: Colorado Independent Consultants Network, LLC Denver, Colorado March 20, 2014 Table of Contents
Other terms are defined in the Providence Privacy and Security Glossary
Subject: Device and Media Controls Department: Enterprise Security Executive Sponsor: EVP/COO Approved by: Rod Hochman, MD - President/CEO Policy Number: New Date: Revised 10/11/2013 Reviewed Policy Owner:
Columbus Police Division Directive. I. Definitions. May 15, 1993 10.01 REVISED. Division Computer Systems
Columbus Police Division Directive EFFECTIVE NUMBER May 15, 1993 10.01 REVISED TOTAL PAGES Mar. 30, 2014 9 Division Computer Systems I. Definitions A. Executable File A program or file that automatically
How To Write A Health Care Security Rule For A University
INTRODUCTION HIPAA Security Rule Safeguards Recommended Standards Developed by: USF HIPAA Security Team May 12, 2005 The Health Insurance Portability and Accountability Act (HIPAA) Security Rule, as a
Wellesley College Written Information Security Program
Wellesley College Written Information Security Program Introduction and Purpose Wellesley College developed this Written Information Security Program (the Program ) to protect Personal Information, as
Information Technology Branch Access Control Technical Standard
Information Technology Branch Access Control Technical Standard Information Management, Administrative Directive A1461 Cyber Security Technical Standard # 5 November 20, 2014 Approved: Date: November 20,
HIPAA Privacy & Security Health Insurance Portability and Accountability Act
HIPAA Privacy & Security Health Insurance Portability and Accountability Act ASSOCIATE EDUCATION St. Elizabeth Medical Center Origin and Purpose of HIPAA In 2003, Congress enacted new rules that would
Ohio Supercomputer Center
Ohio Supercomputer Center Portable Security Computing No: Effective: OSC-09 05/27/09 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original Publication
Security Awareness Training CJIS SECURITY POLICY V5.4 POLICY AREA 2
Security Awareness Training CJIS SECURITY POLICY V5.4 POLICY AREA 2 Level 1: Baseline security awareness training for all authorized personnel with access to CJI. Level 2: Personnel with both physical
Criminal Justice Information Services (CJIS) Security Policy
U. S. Department of Justice Federal Bureau of Investigation Criminal Justice Information Services Division Criminal Justice Information Services (CJIS) Security Policy Version 5.5 06/01/2016 Prepared by:
Privacy Data Loss. Privacy Data Loss. Identity Theft. The Legal Issues
Doing Business in Oregon Under the Oregon Consumer Identity Theft Protection Act and Related Privacy Risks Privacy Data Loss www.breachblog.com Presented by: Mike Porter March 10, 2009 2 Privacy Data Loss
Southwest Airlines 2013 Terms of Use Portable Devices Feb 2013
1 TERMS OF USE As of February 3, 2013 The following terms and conditions of use ( Terms of Use ) form a legally binding agreement between you (an entity or person) and Southwest Airlines Co. ( Southwest
Supplier IT Security Guide
Revision Date: 28 November 2012 TABLE OF CONTENT 1. INTRODUCTION... 3 2. PURPOSE... 3 3. GENERAL ACCESS REQUIREMENTS... 3 4. SECURITY RULES FOR SUPPLIER WORKPLACES AT AN INFINEON LOCATION... 3 5. DATA
DESIGNATED CONTRACT MARKET OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE
DESIGNATED CONTRACT MARKET OPERATIONAL CAPABILITY TECHNOLOGY QUESTIONNAIRE Please provide all relevant documents responsive to the information requests listed within each area below. In addition to the
EXECUTIVE DECISION NOTICE. ICT, Communications and Media. Councillor John Taylor. Deputy Executive Leader
EXECUTIVE DECISION NOTICE SERVICE AREA: SUBJECT MATTER: DECISION: DECISION TAKER(S): DESIGNATION OF DECISION TAKER(S): GOVERNANCE ICT, Communications and Media PERSONAL DEVICE POLICY That the Personal
DUUS Information Technology (IT) Acceptable Use Policy
DUUS Information Technology (IT) Acceptable Use Policy Issue Date: October 1, 2013 Effective Date: October 1, 2013 Revised Date: Number: DHHS-2013-002 1.0 Purpose and Objectives The purpose of this policy
What Is Expungement?...1 When Can I File For Expungement?...2 Case Information...3 Petitions For Expungement...3 What Do the Dispositions Mean and
Expungement Information About Removing Criminal Records from Public Access in Maryland Table of Contents What Is Expungement?...1 When Can I File For Expungement?...2 Case Information...3 Petitions For
Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. hhughes@uslegalsupport.com www.uslegalsupport.com
Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. hhughes@uslegalsupport.com www.uslegalsupport.com HIPAA Privacy Rule Sets standards for confidentiality and privacy of individually
REQUEST FOR PROPOSAL INFORMATION TECHNOLOGY SUPPORT SERVICES
CITY OF RICHLAND HILLS, TEXAS REQUEST FOR PROPOSAL INFORMATION TECHNOLOGY SUPPORT SERVICES Proposals will be received by the City of Richland Hills for Information Technology Support Services. Interested
Estate Agents Authority
INFORMATION SECURITY AND PRIVACY PROTECTION POLICY AND GUIDELINES FOR ESTATE AGENTS Estate Agents Authority The contents of this document remain the property of, and may not be reproduced in whole or in
CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy
CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy Amended as of February 12, 2010 on the authority of the HIPAA Privacy Officer for Creative Solutions in Healthcare, Inc. TABLE OF CONTENTS ARTICLE
Information Technology Acceptable Use Policies and Procedures
Information Technology Acceptable Use Policies and Procedures The following Information Technology Acceptable Use Policies and Procedures are to be followed by ALL employees, contractors, vendors, and
REQUEST FOR QUOTE Department of Children and Families Office of Child Welfare National Youth in Transition Database Survey Tool January 27, 2014
REQUEST FOR QUOTE SUBJECT: Request for Quotes, State Term Contract #973-561-10-1, Information Technology Consulting Services TITLE: National Youth in Transition Database (NYTD) Survey Tool Proposal Software
HIPAA Compliance Evaluation Report
Jun29,2016 HIPAA Compliance Evaluation Report Custom HIPAA Risk Evaluation provided for: OF Date of Report 10/13/2014 Findings Each section of the pie chart represents the HIPAA compliance risk determinations
Vendor Assessment Worksheet:
Vendor Assessment Worksheet: A sample set of IT security controls for evaluation of third party vendors capacity to protect institutional research data 1 Table of Contents Executive Summary... 3 Vendor
Getting Started - MDM Setup
Mobile App Getting Started - MDM Setup Thank you for acquiring the Talon Mobile app. The Talon Mobile app allows you to request sensitive justice information. To use the Talon Mobile app, your agency s
ETHICS: RESTRICTED ACCESS AND SEALING OF JUVENILE RECORDS IN TEXAS
ETHICS: RESTRICTED ACCESS AND SEALING OF JUVENILE RECORDS IN TEXAS PRESENTED BY RILEY N. SHAW CHIEF JUVENILE PROSECUTOR TARRANT COUNTY CRIMINAL DISTRICT ATTORNEY S OFFICE OFFICE 817-838-4613 EMAIL: rshaw@tarrantcountytx.gov
Data Recovery - What is possible to recover and how?
Data Recovery - What is possible to recover and how? Data Erasure - How to erase information in a secure way Åke Ljungqvist, Country Manager Sweden Who is Ibas? Norway... Recovery of hard drives after
ADM:49 DPS POLICY MANUAL Page 1 of 5
DEPARTMENT OF PUBLIC SAFETY POLICIES & PROCEDURES SUBJECT: IT OPERATIONS MANAGEMENT POLICY NUMBER EFFECTIVE DATE: 09/09/2008 ADM: 49 REVISION NO: ORIGINAL ORIGINAL ISSUED ON: 09/09/2008 1.0 PURPOSE The
CITY UNIVERSITY OF HONG KONG. Information Classification and
CITY UNIVERSITY OF HONG KONG Handling Standard (Approved by the Information Strategy and Governance Committee in December 2013) PUBLIC Date of Issue: 2013-12-24 Document Control Document Owner Classification
Data Access Request Service
Data Access Request Service Guidance Notes on Security Version: 4.0 Date: 01/04/2015 1 Copyright 2014, Health and Social Care Information Centre. Introduction This security guidance is for organisations
PBGC-19: Office of General Counsel Case Management System
PBGC-19: Office of General Counsel Case Management System Excerpted from Federal Register: Sept. 9, 2014 (Volume 79, Number 174) General Routine Uses System Name: Office of General Counsel Case Management
Preparing for the HIPAA Security Rule
A White Paper for Health Care Professionals Preparing for the HIPAA Security Rule Introduction The Health Insurance Portability and Accountability Act (HIPAA) comprises three sets of standards transactions
HP FutureSmart Firmware Device Hard Disk Security
HP FutureSmart Firmware Device Hard Disk Security Summary: This document discusses hard disk security for HP FutureSmart Firmware printing devices. Contents: Overview... 2 Secure Erase Commands... 2 1.
Payment Card Industry Data Security Standard
Payment Card Industry Data Security Standard Introduction Purpose Audience Implications Sensitive Digital Data Management In an effort to protect credit card information from unauthorized access, disclosure
DEPARTMENT OF STATE POLICE CRIMINAL RECORDS DIVISION CRIMINAL JUSTICE INFORMATION SYSTEMS
DEPARTMENT OF STATE POLICE CRIMINAL RECORDS DIVISION CRIMINAL JUSTICE INFORMATION SYSTEMS (By authority conferred on the Department of State Police by 1974 PA 163, MCL 28.214, and Executive Reorganization
State HIPAA Security Policy State of Connecticut
Health Insurance Portability and Accountability Act State HIPAA Security Policy State of Connecticut Release 2.0 November 30 th, 2004 Table of Contents Executive Summary... 1 Policy Definitions... 3 1.
INFORMATION SECURITY GUIDELINES
INFORMATION SECURITY GUIDELINES TABLE OF CONTENTS: Scope of Document 1 Data Definition Guidelines (Appendix 1).2 Data Protection Guidelines (Appendix 2).3 Protection of Electronic or Machine- Readable
Criminal Justice Information Services (CJIS) Security Policy
U. S. Department of Justice Federal Bureau of Investigation Criminal Justice Information Services Division Criminal Justice Information Services (CJIS) Security Policy Version 5.0 Prepared by: CJIS Information
FBI CJIS SECURITY ADDENDUM
FBI CJIS SECURITY ADDENDUM The following is an expanded version of the FBI Criminal Justice Information Services (CJIS) Security Addendum. This document was created in order to assist Texas agencies and
FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY
FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY Page 1 of 6 Summary The Payment Card Industry Data Security Standard (PCI DSS), a set of comprehensive requirements for enhancing payment account
Criminal Justice Information System (CJIS) Vendor Policy Guidelines
Criminal Justice Information System (CJIS) Vendor Policy Guidelines Last Updated: 08/17/2015 Massachusetts Department of Criminal Justice Information Services 200 Arlington Street, Suite 2200 Chelsea,
Cyber Security Best Practices
Cyber Security Best Practices 1. Set strong passwords; Do not share them with anyone: They should contain at least three of the five following character classes: o Lower case letters o Upper case letters
Guadalupe Regional Medical Center
Guadalupe Regional Medical Center Health Insurance Portability & Accountability Act (HIPAA) By Debby Hernandez, Compliance/HIPAA Officer HIPAA Privacy & Security Training Module 1 This module will address
8/17/2010. Over 90% of all compromised merchants are PCI level 4 (small) merchants or merchants with less than 1 million transactions per year
Over 90% of all compromised merchants are PCI level 4 (small) merchants or merchants with less than 1 million transactions per year Over 80% of compromised systems were card present or in-person transactions
State of Texas. TEX-AN Next Generation. NNI Plan
State of Texas TEX-AN Next Generation NNI Plan Table of Contents 1. INTRODUCTION... 1 1.1. Purpose... 1 2. NNI APPROACH... 2 2.1. Proposed Interconnection Capacity... 2 2.2. Collocation Equipment Requirements...
Criminal Justice Information Services (CJIS) Security Policy
U. S. Department of Justice Federal Bureau of Investigation Criminal Justice Information Services Division Criminal Justice Information Services (CJIS) Security Policy Version 5.3 Prepared by: CJIS Information
ADMINISTRATORS SERIES PRIVACY AND SECURITY AT UF. Cheryl Granto Information Security Manager, UFIT Information Security
ADMINISTRATORS SERIES PRIVACY AND SECURITY AT UF Susan Blair Chief Privacy Officer Cheryl Granto Information Security Manager, UFIT Information Security RULES OF THE ROAD Information Highway Danger Zones
Information Technology Services Guidelines
Page 1 of 10 Table of Contents 1 Purpose... 2 2 Entities Affected by These Guidelines... 2 3 Definitions... 3 4 Guidelines... 5 4.1 Electronic Sanitization and Destruction... 5 4.2 When is Sanitization
Chapter 2.82 - RECORDS MANAGEMENT Sections:
Chapter 82 - RECORDS MANAGEMENT Sections: 8010 - Government records findings Recognition of public policy. The council of Salt Lake County finds the following: A. It is in the best interests of Salt Lake
PINAL COUNTY POLICY AND PROCEDURE 2.50 ELECTRONIC MAIL AND SCHEDULING SYSTEM
PINAL COUNTY POLICY AND PROCEDURE 2.50 Subject: ELECTRONIC MAIL AND SCHEDULING SYSTEM Date: November 18, 2009 Pages: 1 of 5 Replaces Policy Dated: April 10, 2007 PURPOSE: The purpose of this policy is
MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10)
MIT s Information Security Program for Protecting Personal Information Requiring Notification (Revision date: 2/26/10) Table of Contents 1. Program Summary... 3 2. Definitions... 4 2.1 Identity Theft...
HIGH-RISK SECURITY VULNERABILITIES IDENTIFIED DURING REVIEWS OF INFORMATION TECHNOLOGY GENERAL CONTROLS
Department of Health and Human Services OFFICE OF INSPECTOR GENERAL HIGH-RISK SECURITY VULNERABILITIES IDENTIFIED DURING REVIEWS OF INFORMATION TECHNOLOGY GENERAL CONTROLS AT STATE MEDICAID AGENCIES Inquiries
NETWORK SECURITY & PRIVACY SUPPLEMENT
A. ACCOUNT INFORMATION NETWORK SECURITY & PRIVACY SUPPLEMENT THIS SUPPLEMENT IS PART OF THE APPLICATION, INCLUDING A RENEWAL APPLICATION, SUBMITTED BY OR ON BEHALF OF THE APPLICANT FOR THE PROPOSED INSURANCE.
System Security Plan University of Texas Health Science Center School of Public Health
System Security Plan University of Texas Health Science Center School of Public Health Note: This is simply a template for a NIH System Security Plan. You will need to complete, or add content, to many
140-2-.04 Criminal Justice Information Exchange and Dissemination.
140-2-.04 Criminal Justice Information Exchange and Dissemination. (1) Exchange and dissemination of criminal justice information by criminal justice agencies: (a) Criminal justice agencies shall exchange