CJIS Policies & Compliance Standards 3

Question 1

Under CJIS policy, who bears ultimate responsibility for ensuring compliance within a criminal justice agency?

Accepted Answer

The Agency Head (Chief or Director)

Answer

The agency head, such as the chief of police or director, bears ultimate responsibility for ensuring the agency's compliance with the CJIS Security Policy.

Question 2

What does the CJIS Security Policy identify as the required baseline encryption standard for protecting CJI at rest?

Accepted Answer

AES 128-bit or higher

Answer

CJIS policy requires AES 128-bit or higher (FIPS 140-2 validated) encryption for protecting CJI stored at rest.

Question 3

A law enforcement agency wants to use a cloud service provider to store CJI. What is the FIRST step the agency must take?

Accepted Answer

Ensure the CSP signs the CJIS Security Addendum

Answer

Before using a cloud service provider for CJI, the provider must execute the CJIS Security Addendum to be contractually bound to CJIS requirements.

Question 4

Which of the following is NOT a required element of a CJIS-compliant incident response plan?

Accepted Answer

A list of all CJI data stored on-site

Answer

While an inventory of CJI is a good practice, a static list of stored data is not a required element of the incident response plan itself under CJIS policy.

Question 5

How does the CJIS Security Policy define 'Criminal Justice Information' (CJI)?

Accepted Answer

All information from the III, NCIC, and other CJIS systems needed for law enforcement

Answer

CJI refers to the information from CJIS systems such as the III, NCIC, and others that is necessary for law enforcement and criminal justice purposes.

(CJIS) Criminal Justice Information Services Certified Practice Test

(CJIS) Criminal Justice Information Services Certified Practice Test

CJIS Policies & Compliance Standards 3