ThreatKrusher Emblem
ThreatKrusher Assurance Center
🔍 ⌘K
Assurance Center > Technical & Operational Standards > CJIS Compliance Profile & MCA
Search Results
Sanitized Public Edition Ref: ETP-AC-STD-014 Ver: 1.0.0 Owner: GRC Lead & Facility Security Officer (FSO)
⚡ Direct Answer Summary (AI Overview / Key Takeaway)
Law enforcement and criminal justice information security controls meeting FBI CJIS Security Policy 5.9.

eTrepid CJIS Compliance Profile & Management Control Agreement

Governing Standard: FBI CJIS Security Policy Version 5.9.x

1. Purpose and Scope

eTrepid Inc. delivers managed IT, cybersecurity, and cloud operations to law enforcement agencies, state public safety departments, and criminal justice agencies (such as the State of Maryland and regional municipalities).

This document establishes eTrepid's technical and operational compliance posture regarding the FBI Criminal Justice Information Services (CJIS) Security Policy and outlines our standard Management Control Agreement (MCA) framework.

2. CJIS Security Policy Compliance Areas

flowchart LR

A["Personnel Security & Fingerprinting"] --- B["FIPS 140-2 Encryption"]

B --- C["Physical & Logical Enclave Isolation"]

C --- D["Auditing & Criminal History Record Access"]

2.1 Personnel Screening and Security Awareness

  • Fingerprint-Based Background Checks: All eTrepid personnel assigned to law enforcement accounts or systems potentially housing Criminal Justice Information (CJI) undergo state and FBI national fingerprint-based background checks prior to unescorted access.
  • CJIS Security Awareness: Personnel complete Level 4 CJIS Security Awareness Training upon hire and biennially thereafter.

    • 2.2 Technical Security and Encryption

  • FIPS 140-2/3 Validated Cryptography: All CJI transmitted outside the physical perimeter or over public networks is encrypted using FIPS-validated cryptographic modules (minimum 128-bit, standard AES-256).
  • Advanced Authentication: Two-factor authentication is mandatory for all access to criminal justice databases and law enforcement network segments.

    • 2.3 Physical Security and Media Sanitization

  • Physical access to law enforcement IT equipment is restricted to authorized personnel.
  • Digital media containing CJI is sanitized prior to disposal using NIST SP 800-88 Rev 1 overwrite or degaussing procedures.

    • 3. Management Control Agreement (MCA) Terms

    When serving criminal justice agencies, eTrepid executes a formal Management Control Agreement granting the Criminal Justice Agency (CJA) complete management control over all criminal justice records, systems, and personnel access. eTrepid operates strictly as a technical steward under the direct operational authority of the designated agency head.

    ← Previous (Technical & Operational Standards)Digital Accessibility (VPAT® / Section 508)Next (Technical & Operational Standards) →HIPAA BAA Standard Template