SLED Certification of 3rd Party NCIC Application Software Tom Rupsis, SLED January 2004

Agenda Why Certification? SLED-Vendor Participation Agreement Certification Program Timeline Vendor Obligations Certification Levels Requirements for Compliance Certification Process

Agency expectations for SLED guidance Equal opportunity to all vendors Why Certification? Agency expectations for SLED guidance Equal opportunity to all vendors FBI/CJIS security requirements Helpdesk support Training options Timely updates of vendor software Anything not under the direct control of a criminal justice agency is considered to be “public”. This includes any county or city network on which law enforcement PCs are located. This also includes the “cloud” – the public network maintained by the telecommunications carriers (such as Sprint or BellSouth). All NCIC data must be encrypted when exposed to any “public” network. The agency may have to encrypt from its router to the desktop if those PCs are on non-dedicated networks.

SLED-Vendor Participation Agreement Between SLED and the vendor Effective immediately – all vendors Vendor must agree to certification FBI Security Addendum Fingerprint-based background checks No agreement = No SLED approval of new customers or connections SLED modem policy is more stringent than FBI CJIS. No dial-in is allowed to modems attached to PCs. Dial-in is allowed if agency uses modem pools (RAS) located outside of the perimeter firewall. Modems attached to other network devices, used for service and support, are allowed but must remain disconnected when not in use.

Certification Program Timeline Phased in over next 18 months New Vendors Must certify immediately SLED will not approve any connections Existing Vendors Must certify by June 30, 2005 No new connections approved after deadline

Vendor Obligations Letter of Certification No marketing reference to SLED w/o letter Certification withdrawn if vendor defaults No Certification = No contract renewals No Certification = No new customers

Certification Levels Two levels: Inquiry-only & Full Function SLED provides list of most commonly used transaction codes Vendor must meet minimum set Vendor may extend to meet business opportunities

Requirements for Compliance Must pass transaction tests Response times meet NCIC specs Helpdesk Inquiry Only : staffed 8 x 5 Full Function : staffed 24 x 7 Training options made available Notify SLED for new or deleted customers

Requirements for Compliance (con’t) Re-certify minor changes within 60 days Re-certify major changes within 180 days FBI Security Addendum on file Employee background checks on file Reimbursement (if any) paid up

Requirements for Compliance (con’t) Encryption Direct Workstation Software – Cisco VPN Foreign Hosts Must encrypt from server to desktop Should use Cisco VPN from server to SLED If unable to use Cisco, SLED approved alternative must be used

Certification Process

Questions? See www.sled.state.sc.us Certification Overview Current Vendor Certification Status Vendor Participation Agreement Vendor Certification Request Form FBI Security Addendum