Criminal Justice Information Services (CJIS)

Law enforcement agencies trust their law enforcement transcription service to Athreon.

The Criminal Justice Information Services Division (CJIS) is the FBI segment that mandates parameters for access to Criminal Justice Information (CJI). The CJIS Security Policy outlines standards for protecting the sources, transmission, storage, and creation of CJI. It establishes best practices to ensure timely, secure, and reliable access to CJI for agencies that prevent and mitigate crime. So, CJIS is a significant concern for agencies looking to use a law enforcement transcription service.

The fundamental objective of CJIS is to keep CJI secure and private so that it isn’t tampered with and can be relied upon when submitted to a court of law. This is why law enforcement agencies must work with a police case transcription service like Athreon that understands the complexities of CJIS. CJI can take many forms, including fingerprint data, criminal background information, transcribing arrest case video, sentencing reports, parole reports, and body-worn camera footage.

If any CJI were to be compromised and fall into the wrong hands, it could be detrimental to law enforcement and the community. For this reason, Athreon has developed its law enforcement transcription service with a strong focus on supporting the CJIS Security Policy.

The CJIS Security Policy outlines 13 areas to prevent unauthorized access to CJI while maintaining its integrity. These policy areas include:

1. Information Exchange Agreements. Entities need to sign formal documents that outline how they are permitted to handle CJI.
2. Security Awareness Training. Staff with access to CJI must undergo security training within six months of hire and biannually after that.
3. Incident Response. Protocols must help detect, mitigate, and recover from threats. Entities must report security incidents to the Justice Department.
4. Auditing and Accountability. Entities need to document items like login attempts, attempts to change passwords and destroy log files, and more.
5. Access Control. Entities need to limit access to CJI based on job function. Likewise, restrictions on data management are necessary too.
6. Identification and Authentication. Unique login credentials are required to access CJI with advanced authentication methods like multifactor authentication.
7. Configuration Management. Entities need to ensure that only authorized system users can make changes like system updates.
8. Media Protection. Measures to protect physical and digital CJI are required while in transit and at rest. Entities need to destroy CJI on retired equipment.
9. Physical Protection. Unauthorized individuals should not have access to CJI where it is stored.
10. Systems and Communications Protection and Information Integrity. Applications and information systems need to ensure data security and system and network integrity. Encryption, breach detection, and network security are all critical considerations.
11. Formal Audits. The FBI or other agencies may launch audits to ensure CJIS compliance. Entities are subject to audits every three years at a minimum.
12. Personnel Security. Everyone with access to CJI (employees, contractors, and subcontractors) is subject to background checks, including fingerprinting.
13. Mobile Devices. Entities need to establish usage restrictions to authorize, monitor, and control access to CJI on smartphones and tablets.

We only use the CJI entrusted to us to deliver our contracted solutions. We have implemented robust administrative, technical, and physical controls to protect CJI, including advanced encryption. Additionally, we restrict the processing and handling of CJI to transcription company staff located in the United States. Our workforce members are required to undergo background checks and fingerprinting.

To further comply with CJIS, we use audit trails to identify what happens with all the CJI in our care. Our technology tracks who accesses CJI, when they access it, what they do with it, and from where they access it. For technical information about our security and privacy practices, visit this link.

If we were to have a data breach, we would alert the impacted agencies about the security incident without undue delay. We would relay specific details about the security violation and provide a breach risk assessment document and a security incident report.

We encourage clients, vendors, employees, or anyone else with concerns about Athreon’s CJIS compliance to notify Athreon. Anyone may report a concern without fear of reprisal. A compliance officer will address reported concerns and act to remediate the matter.