Strict Compliance Flashcards

Under NCIC's strict compliance framework, when may an agency grant a sworn officer NCIC access before training is completed?

Answer: Never — training must be fully completed before any NCIC access is permitted

Strict compliance requires that training be completed before access is granted — there is no provision for provisional or emergency access before training.

What is a 'compliance audit' in the NCIC context, and how often is it conducted?

Answer: A comprehensive review of agency practices, records, and security controls conducted by the CJIS Systems Agency or FBI every three years

A CJIS compliance audit is a comprehensive triennial review conducted by the CSA or FBI that evaluates the agency's adherence to all NCIC and CJIS policies, security requirements, and record management practices.

How does strict compliance apply to the handling of NCIC information received in response to a query that is later determined to have been entered in error by the originating agency?

Answer: The receiving agency must take immediate corrective action to mitigate any harm caused by the erroneous information, even though they did not cause the error

Even when an error originates with another agency, any agency that has received and potentially acted on that erroneous information has an obligation under strict compliance to take corrective action to mitigate harm.

What is the NCIC policy on 'browsing' — accessing NCIC records out of curiosity or for personal interest without an official law enforcement reason?

Answer: Browsing is explicitly prohibited as a violation of the strict compliance standard and constitutes inappropriate use subject to disciplinary action and potential criminal penalties

NCIC explicitly prohibits browsing — accessing records without an official law enforcement purpose — as a violation of the strict compliance standard and the Privacy Act.

What does NCIC strict compliance require when an agency discovers that a member of its staff has been accessing NCIC for personal reasons?

Answer: Immediate suspension of the individual's NCIC access, internal investigation, disciplinary action, and notification to the CSA of the security incident

Discovery of NCIC misuse requires immediate suspension of the individual's access, internal investigation, appropriate disciplinary action, and notification to the CJIS Systems Agency as a security incident.

Under NCIC strict compliance, what is required of agencies regarding the physical security of terminals and devices used to access NCIC?

Answer: Agencies must implement physical security controls that prevent unauthorized physical access to NCIC terminals and ensure that unauthorized persons cannot observe or interact with NCIC displays

NCIC strict compliance requires agencies to implement physical security controls preventing unauthorized access to terminals and protecting NCIC displays from being observed by unauthorized persons.