CJIS Physical Security Requirements 3 — Questions and Answers
Question 1: Under CJIS policy, which personnel are responsible for ensuring that physical security requirements are met at a local agency?
- The FBI CJIS Division exclusively
- The local agency head and designated security officer (Correct answer)
- Third-party auditors contracted by the state
- Only IT administrators within the agency
Correct answer: The local agency head and designated security officer
The local agency head and its designated CJIS Systems Agency Information Security Officer share responsibility for physical security compliance.
Question 2: A mobile data terminal (MDT) in a patrol car accesses CJI. Which physical security measure is specifically required for these devices?
- MDTs are exempt from physical security requirements
- MDTs must be locked in the trunk when not in use
- MDTs must be secured to prevent unauthorized access when unattended (Correct answer)
- MDTs require the same two-factor building entry as fixed terminals
Correct answer: MDTs must be secured to prevent unauthorized access when unattended
CJIS requires that mobile devices accessing CJI be secured to prevent unauthorized access whenever they are unattended.
Question 3: What is the CJIS requirement for workstations located in publicly accessible areas that display CJI?
- No special requirements if the area has security cameras
- Privacy screens and positioning to prevent unauthorized viewing are required (Correct answer)
- Workstations are prohibited in all publicly accessible areas
- A second officer must always be present when CJI is displayed
Correct answer: Privacy screens and positioning to prevent unauthorized viewing are required
CJIS requires workstations in public areas to use privacy screens or positioning that prevents CJI from being viewed by unauthorized individuals.
Question 4: When a CJIS agency relocates its server room, what physical security action must be taken before CJI systems are moved?
- Notify the public 30 days in advance
- Ensure the new location meets CJIS physical security standards before relocation (Correct answer)
- Obtain approval from the U.S. Department of Justice
- Complete a full backup and then delete all CJI from old hardware
Correct answer: Ensure the new location meets CJIS physical security standards before relocation
The new facility must meet all CJIS physical security requirements before any CJI systems or media are moved to it.
Question 5: Which of the following best describes a 'controlled area' under the CJIS Security Policy?
- Any area accessible with a government-issued ID
- An area that provides an outer layer of security for a physically secure location (Correct answer)
- A room that requires armed guards for entry
- Any space inside a law enforcement building
Correct answer: An area that provides an outer layer of security for a physically secure location
A controlled area serves as the outer perimeter security layer that surrounds and protects the physically secure location where CJI is processed.
Question 6: What action is required when an employee with physical access to CJI areas is terminated?
- Access should be removed within 30 days of termination
- Physical access credentials must be revoked immediately upon termination (Correct answer)
- The employee may retain access until their replacement is trained
- Access removal is triggered only if the termination was involuntary
Correct answer: Physical access credentials must be revoked immediately upon termination
CJIS requires that physical access credentials be revoked immediately when an employee is terminated to prevent unauthorized access.
Question 7: Which environmental control is required in CJIS-compliant data rooms to protect CJI systems?
- Pressurized air systems
- Temperature and humidity monitoring (Correct answer)
- Salt-spray corrosion protection
- UV-filtered lighting only
Correct answer: Temperature and humidity monitoring
CJIS Security Policy requires environmental controls including temperature and humidity monitoring to protect CJI systems from environmental threats.
CJIS Physical Security Requirements 3
Under CJIS policy, which personnel are responsible for ensuring that physical security requirements are met at a local agency?