CJIS Media Protection & Sanitization 3

Question 1

A CJIS-compliant agency is replacing its entire fleet of networked printers that stored print jobs containing CJI in internal memory. What is the required action under the CJIS Security Policy?

Accepted Answer

Sanitize or destroy the internal storage of the printers before disposal or transfer

Answer

Return the printers to the manufacturer with documentation of their prior use

Answer

Archive all print job logs and delete them from the printer memory remotely

Answer

Notify users whose CJI was printed that their data may be at risk before disposal

Question 2

Which statement best reflects the CJIS requirement for media access control?

Accepted Answer

Access to media containing CJI must be restricted to authorized individuals based on official need

Answer

Only supervisory personnel may physically handle media containing CJI at any time

Answer

All media access must be pre-approved by the state CJIS Systems Officer on a case-by-case basis

Answer

Media access is unrestricted for sworn law enforcement personnel regardless of assignment

Question 3

What is 'cryptographic erasure' in the context of media sanitization, and when is it applicable under CJIS guidelines?

Accepted Answer

Destroying the encryption keys used to protect CJI on encrypted media, rendering the data unreadable—applicable when the media was encrypted from inception

Answer

Applying a virus to corrupt encrypted files, making them permanently inaccessible to any reader

Answer

Overwriting data with cryptographically random patterns, applicable to all media types

Answer

Encrypting data a second time to add a layer of protection before physical disposal

Question 4

An officer's agency-issued laptop is stolen while containing CJI on its encrypted hard drive. Under the CJIS Security Policy, what is the PRIMARY reason encryption is critical in this scenario?

Accepted Answer

Encryption protects the CJI from unauthorized access even if the physical media falls into the wrong hands

Answer

Encryption ensures the laptop can be remotely wiped by the agency's IT department

Answer

Encryption satisfies the media sanitization requirement, so no further action is needed

Answer

Encryption allows investigators to track the physical location of the stolen laptop

Question 5

Under CJIS media protection requirements, which of the following must be included in a media protection policy?

Accepted Answer

Procedures for marking, handling, storing, transporting, and sanitizing/disposing of media containing CJI

Answer

A list of all personnel who have ever accessed the media and their access dates

Answer

A schedule requiring all media to be physically destroyed after no more than one year of use

Answer

Annual certification from the FBI that the agency's media meets current hardware standards

Question 6

A state criminal justice agency stores CJI on backup tapes kept at an offsite storage facility. What CJIS requirement applies to the offsite facility?

Accepted Answer

The offsite facility must meet CJIS physical security requirements and personnel at the facility must be subject to appropriate security measures

Answer

The offsite facility must be operated by a government entity and cannot be a private company

Answer

The tapes must be transported to the offsite facility daily by sworn law enforcement officers

Answer

Backup tapes containing CJI cannot be stored offsite under any CJIS policy provision

Question 7

What is the recommended minimum shred size for paper records containing CJI when cross-cut shredding is used, based on CJIS guidance aligned with NIST standards?

Accepted Answer

1 mm x 5 mm or smaller cross-cut particles consistent with DIN 66399 Level P-4 or higher

Answer

1 mm x 5 mm particles (NSA/CSS EPL-listed Level P-7)

Answer

1/32 inch strips (strip-cut, Level P-2)

Answer

5/8 inch strips (strip-cut, Level P-3)