leds representative 101 oregon state police training/2017 statewide training...leds representative...

8/23/2017

1

LEDS Representative 101

Oregon State PoliceCriminal Justice Information Services Division

Kendele Miyasaki, Training Coordinator

30 August 2017

What We Will Review Today

• Roles of the LEDS Rep

– New Employee Checklist

• LEDS Certification

– Recertification Checklist

– Separating Checklist

• CJIS Security for LEDS Reps

• Understanding CJIS Online

2“Premier Public Safety Services”

8/23/2017

2

Roles of the LEDS Representative

• Agency LEDS Subject Matter Expert & Liaison

• System and Personnel Security/Enforcement of LEDS & NCIC Policy

• File & Record Maintenance

• Record Validation

• CJIS Security Awareness Training

• LEDS Training & Certification


Agency LEDS Subject Matter Expert & Liaison

LEDS Representatives are their agency’s “go‐to” person for all things LEDS related.

How do I…?

How can I get this information?

Where do I find the code for…?

What does this weird thing in LEDS mean?

“Premier Public Safety Services” 4

8/23/2017

3

Agency LEDS Subject Matter Expert & Liaison

CJIS Training has created training tools to assist both LEDS Representatives in achieving the needed level of knowledge,

and Agency Administrators in providing needed time allocation and support.

LEDS Representatives are also the main conduit of information between agencies and the OSP CJIS Division.


LEDS Representative –System and Personnel Security/Enforcement of LEDS & NCIC Policy

Of all the LEDS Representative responsibilities, system and personnel security will always remain at the top of the

priority list.

Unless there is strict adherence to policies and procedures set forth by LEDS and NCIC, the safety and security of the citizens of the state of Oregon, as well as public safety professionals nationwide, will be jeopardized. Furthermore, the potential civil liability associated

with failing to maintain security procedures is endless.


8/23/2017

4

LEDS Representative –File and Record Maintenance

It is the responsibility of the agency LEDS Representative to ensure accurate and up‐to‐date records are maintained on all LEDS Certified

personnel and for required LEDS records.

It is LEDS policy that the answer/certification form(s) be retained by the agency for as long as the employee is associated with the agency. Once a person is no longer associated with the agency, follow the Retention

Schedule for personnel related documents, as established by the Oregon State Archivist for your agency. Reference OAR 166‐300‐0015(11).

LEDS documents and files may be kept in either physical hard copy or electronic format, so long as appropriate security requirements are met.


LEDS Representative –Record Validation

The term “validation,” as used in LEDS policies and procedures, means nothing more than verification.

• Validation obliges the ORI to confirm that the record is complete, accurate, and still outstanding or active. Validation is accomplished by reviewing the entry and current supporting documents, and by recent consultation with any appropriate complainant, victim, prosecutor, court, nonterminal agency, or other appropriate source or individual. (NCIC 2000 Operating Manual, Introduction, 3.4 Validation)


8/23/2017

5

LEDS Representative –Record Validation

It is the responsibility of the LEDS Representative to ensure their agency remains in compliance with the LEDS and NCIC validation requirements. The LEDS

Representative may elect to delegate the actual task of performing record validation to different staff

members; however, they are ultimately responsible for certifying that all of the agency's records are accurate.


LEDS Representative –LEDS Certification & Training

The LEDS Rep is responsible for training their agency personnel on proper and efficient system use.

This includes administering initial LEDS certification training/testing materials, as well as ensuring that all LEDS certified personnel complete their biennial recertification as required by LEDS & NCIC policy, and completing all required

documentation thereof.


8/23/2017

6

Definitions & Acronyms:LEDS: Department of State Police, Law Enforcement Data System.

NCIC: Federal Bureau of Investigation, National Crime Information Center.

NLETS: National Law Enforcement Telecommunications System, Incorporated.

CLETS: California Law Enforcement Telecommunication System.

CDBN: California Data Base Network.

III (“Triple I”): the FBI‐III Interstate Identification Index.

AM: Administrative Message, a message sent from one LEDS terminal to another & to send messages from one agency to another both statewide and nationwide.


LEDS Manual & LEDS Rep ResourcesThe LEDS Manual and the LEDS Representative Manual are located on our secure website at:http://apps.oregon.gov/application/pdfdownload/ospUsername: OSPCJISPassword: Contact LEDS Training or the 24/7 LEDS

Helpdesk for the updated password 503‐378‐5565 or [email protected]

NexTest & CJIS Launchpad:

https://www.cjisportal.com/OR/launchpad

Login credentials originally set at DL# as username and case sensitive ORI as password.


8/23/2017

7

The LEDS Manual:It’s Not All About the Test

13

Administrative Rules for LEDS:


8/23/2017

8

LEDS Representative Resources:

The LEDS Manual houses more than chapters for basic LEDS usage‐‐ there are many helpful links and tools intended to help our LEDS Representatives gather up‐to‐date forms and understand

their responsibilities.

http://apps.oregon.gov/application/pdfdownload/osp

15

New Employee Checklist

• Fingerprint employee and submit prints to OSP CJIS within 30 days of employment

– Must be fingerprinted for each new agency (lateral hires)

– When submitting fingerprint cards, you must include the completed & signed coversheet. Forms available: http://www.oregon.gov/osp/ID/docs/Security_Clearance_Background_Request_Form.pdf

• Must I wait for the CJIS Background Check results before issuing LEDS training materials?

– If the new LEDS user is an agency employee, the only requirement is that the CJIS fingerprints and form are submitted within thirty (30) days of assignment. If the user is a contractor or vendor, then the results of the CJIS Check must be received before the user may be granted unescorted access to CJI.(See CJIS Security Policy Section 5.12)


8/23/2017

9

New Employee Checklist

• LEDS login & password – Establish a login for LEDS usage (contact your agency IT)

• Add the user to NexTEST – “Issue” LEDS certification materials –– Must be issued within 10 days of access to LEDS– Employee has 30 days to complete testing process – Extensions issued by CJIS Training

• LEDS Training record – Either enter a base training record or activate the user for your ORI– Don’t forget to “ETH” training record with issued date and

completion date


Online LEDS Certification

18

Implemented Monday July 10th,

2017

In case you couldn’t tell, we’re a little excited

about the Online Initial LEDS Certification.

“Premier Public Safety Services”

8/23/2017

10

What Has Changed?

• All query‐based LEDS certifications can be completed entirely online.

• Initial LEDS certification process must be completed within thirty (30) days of issue.

• Initial certification and recertification will each be a four (4) step process:

Step 1: CJIS Security Awareness TrainingStep 2: CJIS Security Awareness Testing Step 3: LEDS TrainingStep 4: LEDS Testing


What Has Changed?

• New Entry level users will complete one combined Inquiry & Entry level certification test.

• No more coversheets!

• Users can start the LEDS test and save their work (if they have to leave the test).

• YES, if a user is unsuccessful with the LEDS test, they have to start over.


8/23/2017

11

What HASN’T Changed?• LEDS Reps are still responsible for creating NexTEST & LEDS training records for their users.

• New users still need an active LEDS login to complete their test— they will still need to run specific test queries.

• Initial certification is still an “open reference” test— users will be expected to use the LEDS Manual and NCIC Code Manual to answer their test questions.


What HASN’T Changed?

• New Entry level users will still be required to complete a practical/exercise test section.

• All training extensions must be requested through the CJIS Training Unit.

• You DO still need to retain the Entry level practical test section for a minimum of 180 days.


8/23/2017

12

Creating a NexTEST Record:

• Log into NexTest via “Agency Login”

• Select the User Management option

• Select “Add User”“Premier Public Safety Services” 23

Assign LEDS Certification Level:

Fill in the new user’s information and select

the level of LEDS certification they will

be assigned.REMEMBER: the user’s

username is their driver’s license

number.

Give your new user the NexTEST link, their

login credentials, and the login credentials for the LEDS Manual. Your user has 30 days to complete their

certification process.


8/23/2017

13

Oops, I Got an Error Message…This error indicates the user has an existing NexTEST record.

DO NOT ADD A NEW RECORD.

Call the CJIS Training Unit or send an email‐‐ please include the employee’s full name so we can transfer this record on your behalf.


Online Initial LEDS Certification

26

Step 1: Complete the CJIS Security

Training

Step 2: Successfully complete the CJIS

Security Test

Step 4: Using the LEDS Manual and the NCIC Code Manual as references, complete

your LEDS certification test. You are required to have a LEDS login—some questions will require you to run specific test queries.

Step 3: Read the LEDS testing instructions and resource

information. This is where you’ll find the links to the resources you’ll need to answer the test

questions.


8/23/2017

14

Step 1: CJIS Security Training


Step 2: CJIS Security Test


8/23/2017

15

Step 3: LEDS Training


Step 4: LEDS Testing


8/23/2017

16


For Inquiry & Entry Only…


8/23/2017

17

For Inquiry & Entry Only…



8/23/2017

18

Confirming Test Activity

35

Click “Reports”

Click “Test Activity Report”


Confirming Test Activity

36

You can limit your search by:

Test Level (or all)Pass/Fail (or both)Date range


8/23/2017

19

37

This report allows you to see which users have completed which

portions of their test, and when the test(s) were completed.

You can use this information to follow up with users to ensure they are completing their certification within the 30 day training window, and to update their LEDS training

records.


FAQ:

• When does the 30‐day testing window “clock” start?

– Go ahead and enter that new NexTEST record– the clock doesn’t start until they begin their certification process.


8/23/2017

20

FAQ:

• What about this 10‐day LEDS Test window?– Once a user opens (clicks “Begin Test”) on the Step 4: LEDS Test tab, they must complete the test within 10 days.

– This 10‐day window does NOT extend the 30‐day total testing period.


FAQ:

• Can I set up a “dummy” record in NexTEST to play around with the new testing protocol?

– Umm…no.


8/23/2017

21

FAQ:

• What do I need to do if I need to “up” someone’s certification before their recertification is due?

– Contact CJIS Training– we can reset their record’s “certification expiration date” to allow the new certification process.


FAQ:

• Do I need to request anything from CJIS Training?

– Only if you have a new Entry level user who need the Entry practical test section. All other “practical” test questions are built into the online test

– You WILL need to keep a copy of the completed Entry practical test for 180 days, but you don’t need to send in the completion/sign off page.


8/23/2017

22

FAQ:• My new person failed their online test. What happens now?

– Your user gets to wait an hour and then begin a new test.

– Step 2: CJIS Security Awareness Test requires 70% correct (or better) to pass

– Step 4: LEDS Test requires 90% correct (or better) to pass


FAQ:• Wait, do they REALLY have to go back and start the LEDS test again? They can’t just go back and re‐answer the questions they got wrong?– Yes, they must answer all the questions again, not just the ones they got wrong.

– No, I’m not crazy.

– No, it’s not because I’m mean.

– Keep in mind: the test tells the test taker what they got wrong, so they know what they got right. The second time around is usually much faster/easier.


8/23/2017

23

FAQ:

• Can I go ahead and just use the old paper test instead?

– Umm….no.


FAQ:• Why aren’t the test questions in order by chapter?– Each test is randomly generated by the computer system.

– You don’t have to answer the questions in order– feel free to tell your new users that they can scroll through and answer the questions by topic. The test will tell you if you have unanswered questions when you click the “Submit for Grading” button.


8/23/2017

24

LEDS Representative Transactions:QTR: Query Training Record, always the best place to start when making any change to a LEDS training record. Options: Last, First Middle + DOB, Drivers License #, DPSST #, List by employing agency (see example).

ETR: Enter Training History, creates a base LEDS Training Record. Always used for a new employee who has never been LEDS Certified.

MTR:Modify Training History, used to modify information housed in the base training record. Most commonly used to separate or activate LEDS users.

ETH: Enter Training History, used upon issuance and completion of training materials and upon completion of recertification.

MTH: Modify Training History, most commonly used to correct incorrect LEDS training history entries.

XTH: Cancel Training History, most commonly used when submitted transaction twice.

ETH should be completed when the initial certification test is issued AND

once test is completed. Recertifications shall be entered once at

LVL “R” as completed (DSP “C”).“Premier Public Safety Services” 47

LEDS Training Record Codes:

ORI: Originating Agency Identifier

OPID: Operators Identifier (DPSST number or 3 letter initials).

BPS: DPSST number of user, optional field.

LVL: Level of LEDS Training issued to employee IE: Inquiry, Entry, etc.

DAT: Date of training issued or completed; for recerts, just completion date.

DSP: Disposition of training guide, e.g.: Issued, Completed or Voided.

JOB: The job type of the employee, e.g.: REC: Records Employee

SID: State Identification Number generated for CJIS fingerprinting; optional field.


8/23/2017

25

Does My New LEDS User Have a Training Record in LEDS?

First thing: query the employee by drivers license number and name to check for an existing LEDS training record.


Sample LEDS Training Record:


8/23/2017

26

If No LEDS Training Record Exists:

Complete an ETR transaction:

Note there are optional fields: BPS & SID. You may also choose to enter training history with LVL, DAT, DISP, & JOB. You do not have to include optional fields for the ETR transaction.


If a LEDS Training Record DOES Exist:

Complete a “Modify Training Record” (MTR) transaction.

NEW ORI

FORMER ORI

Unless there is other information needing to be updated (name change, etc.), the other “Data to be Modified” fields should be left blank.

Contact CJIS Training to transfer the user’s NexTEST record.


8/23/2017

27

Check Your Work: QTRYou can query the record either by drivers license number or

Last,First & DOB.


Check Your Work: Review

Be sure to check spelling, date of birth, and drivers license number for accuracy.


8/23/2017

28

Commonly Encountered Issues:

• Training Extensions/Training Window

– Both the CJIS Security AND LEDS sections must be completed within thirty (30) days

– Contact CJIS Training for all training extensions

• DPSST # error in LEDS

• Duplicate NexTEST record

– NexTEST username issues


A Note About Lateral Hires:For those who have been previously LEDS certified:

• The user must be CJIS fingerprinted and background checked for their new agency within thirty (30) days of hire.

• If they are new to your agency, a new LEDS login must be established.

• Their LEDS Training Record must be transferred to their new ORI (via a “Modify Training Record” (MTR) transaction).

• Their NexTEST record must be transferred to their new ORI

• CJIS Training must complete this transfer. Just send us an email with their information and we will transfer their record on your behalf.

• If their LEDS certification is at the appropriate level and in good standing, they do NOT need to complete their training materials again.

• The user’s new LEDS Rep should contact the user’s previous LEDS agency to request their a copy of their LEDS file.


8/23/2017

29

Questions About Initial Certification

or the New Employee Checklist?

Recertification Checklist

• Every employee has 2 years to complete the LEDS recertification process. CJIS Training would rather have an employee recertify 3‐6 months early as opposed to going on planned leave and needing an extension.

• LEDS Reps are responsible for their employee’s LEDS training records

– The email notifications generated by NexTest are a courtesy only

– Please enable reminders as needed to ensure timely notifications

• As an employee’s expiration date nears, no more than 90 days before, “issue” recertification reminder

• Once an employee has completed the online recertification you will be notified.

– If the employee passed the recertification, query their base training record QTR

– Complete the required ETH to the LEDS training history to reflect the activity

– Query the training record again to ensure the ETH was successful

• Update your reminder/calendar to reflect the employee’s new LEDS expiration date to ensure timely recertification in the coming years


8/23/2017

30

When Do My Users Need to Complete LEDS Recertification?

Every employee has 2 years to complete the LEDS recertification process. CJIS Training would rather have an employee recertify early as opposed to going on planned leave and needing an extension.

CJIS Training has had many agencies report issues receiving the automatically generated NexTest courtesy notifications alerting them to users recertification needs; this can be remediated by setting alerts to notify you of upcoming recertification dates. You can easily view all LEDS training records active for your agency by completing a QTR LEDS transaction, listing by employees by employing agency, or by completing the following free format transaction:

QTR.ORXXXXXXX.EMP/ORXXXXXXX.SRT/A (add two years to the last date listed)

The notification emails sent by the NexTest program are considered a courtesy and should not be relied upon as your sole reminder to recertify your LEDS

employees.


Querying All Active Employees for Your ORI:

It’s easy to fall into the habit of waiting for the automatic NexTest notifications for user expiration reports.

Best practice would include regular “QTR” queries in LEDS and proactively tracking recertification needs.


8/23/2017

31

Querying All Employees – via Mask:

ForseCom:

WebLEDS:


Expiration Reports in NexTEST• Log into NexTest as an

Agency

• Select the “Reports” option

• Select “Expiration Report”


8/23/2017

32

Expiration Reports in NexTEST

Note: you may select Active users only and the dates you would like to review.

I prefer the “All Dates in Data Base” selection, so I don’t accidentally miss

someone.


Reviewing Your NexTEST Expiration Report

You can now compare the NexTEST report to your LEDS training record report.


8/23/2017

33

“Issuing” LEDS RecertificationInitiate communication with your users early to ensure they understand your expectations.

Set yourself reminders and follow up with employees as needed to ensure agency‐wide

compliance.“Premier Public Safety Services” 65

Step 1: CJIS Security Training


8/23/2017

34

Step 2: CJIS Security Test


Step 3: LEDS Training


8/23/2017

35

Step 4: LEDS Testing



8/23/2017

36

Monitoring Recertification Activity Within the NexTEST System

• Log into NexTest as an Agency

• Select the “Reports” option

• Select “Test Activity Report”


Test Activity Reports In NexTEST

There are a variety of formats with which to draw user activity reports from the NexTest System:


8/23/2017

37

Reviewing Test Activity Reports In NexTEST

Make sure to note if the employee has passed or failed their recertification effort.


NexTEST & LEDS Training RecordsDo Not “Talk”

One of the most common misunderstandings is that LEDS Training Records are automatically updated by activity in the NexTest system.

NexTest user accounts were established by one large data transfer from LEDS; this was the only time LEDS & NexTEST exchanged data.

Once online recertifications are completed, LEDS Representatives must complete an “ETH” LEDS transaction to update the user’s LEDS training

record.

LEDS training records are used by our LEDS Auditors to gauge agency training compliance and timely recertification.

LEDS 20/20 will bridge this gap – NexTEST usernames will need to be users’ OLN for this function. “Premier Public Safety Services” 74

8/23/2017

38

Enter NexTEST Training Activity into LEDs Training RecordsI always start by querying the employee’s base training record:

Pay special attention to how the name is listed, certification level & most recent activity“Premier Public Safety Services” 75

Enter NexTEST Training Activity into LEDS Training Records

Once employees have successfully completed their LEDS recertification training and their recertification test, you will complete an “Enter Training History” (ETH)

transaction into each LEDS Training Record:

The employee’s name must appear exactly how it appears in the base LEDS Training Record.

The OPID is either your DPSST # or your 3 letter initials – a unique identifier for you within your agency

EST

EST


8/23/2017

39

Enter NexTEST Training Activity into LEDS Training Records

Query the record again to ensure new activity was successfully submitted:


Questions About Recertification

or the Recertification Checklist?

8/23/2017

40

Separating Employee Checklist

• Disable the employee’s LEDS account – contact your IT Dept./LEDS interface administrator

• Ensures employee can no longer use LEDS

• Also ensures you won’t be billed for an additional user

• Separate user in LEDS Training record within 5 days of leaving agency

• Complete the required MTR transaction to reflect status

• Query the training record again to ensure the MTR was successful

• Make user Inactive in the NexTest system.

• Notify CJIS Unit of user’s separation.

• Send completed “CJIS Flag Removal” form to [email protected]

• Forward a copy of the user’s paper file to new LEDS Rep, if user is transferring to another agency that accesses LEDS, or keep user’s paper file for a minimum of two years.

• After two years, you may destroy their training file(reference OAR 166‐300‐0015 (11))


Separating Employee’s LEDS Training Record

Once an employee’s status has changed within your agency, you must complete a “Modify Training Record” (MTR) transaction to update the employee’s base

training record:

ACT: Active‐‐ a valid user for your agency.DEC: DeceasedINA: Inactive‐‐ still employed at agency but no longer using LEDSMIL: Military LeaveSEP: Separated‐‐ the employee left your agency in good standingTRM: Terminated‐‐misuse of LEDS or left employment for cause; submit on letterhead to the CJIS Training Unit or LEDS Auditor.

EST

EST


8/23/2017

41

Separating User’s NexTEST Record• Log into NexTest as an Agency

• Select the User Management option

• Find user on list & select “Edit User”


Separating User’s NexTEST RecordSelect “Status” and change to “Inactive.”

Hit the “submit” button and ensure user’s record was successfully updated.


8/23/2017

42

Notify CJIS Unit of User’s Separation

The CJIS Unit has created a CJIS Flag Removal Form.

Send to:

OREGON STATE POLICE – CJIS

DIVISION

ATTN: CJIS Security

3565 TRELSTAD AVE SE

SALEM, OR 97317

Or email to:

[email protected]


Questions About Separation

or the Separating Checklist?

8/23/2017

43

Questions on anything we’ve covered so far?

Contact Info –CJIS Training Unit

[email protected]

503‐378‐2121 (Fax)

Kendele Miyasaki, Training [email protected]

503‐934‐0300 (Desk)


8/23/2017

44

Let’s Talk About CJIS Security…

• CJIS Security Policy

• Fingerprinting/Background Checks

• Security Awareness Training – CJIS Online

• Scenarios


CJIS Security Policy

• Current Policy (Version 5.6) released June 2017 is available for download at the LEDS Website ‐http://www.oregon.gov/OSP/CJIS

• CJIS Security Policy ListServ‐http://listsmart.osl.state.or.us/mailman/listinfo/cjissecuritypolicy

FBI CJIS Security Policy Version 5.6 released


8/23/2017

45

CJIS Security Policy Requirements

CJIS Security Policy Section 5.12.1.1 –Minimum Screening Requirements for Individuals Requiring Access to CJI

“To verify identification, a state of residency and national fingerprint‐based records check shall be conducted

within 30 days of assignment for all personnel who have direct access to CJI and those who have direct

responsibility to configure and maintain computer systems and networks with direct access to CJI”.


For Whom Do You Submit CJIS Security Prints?

CJIS Security fingerprint based backgrounds shall be completed on staff who will have direct access to Criminal Justice Information (CJI) or unescorted access around LEDS terminals, confidential shred bins, IT routers, switches, and servers which process unencrypted CJI.

• Current volunteers for your agency meeting the above description.

• Custodial staff, maintenance staff, and IT staff meeting the above description.

• Please note: this does not include prospective employees with conditional job offers (who are still in the background process).

The CJIS background process is NOT intended to serve as the agency’s pre-employment background check.


8/23/2017

46

• CJIS Clearance– Individuals with any felony conviction or misdemeanor convictions

of ID theft, fraud, or computer crimes are precluded from access to CJI and LEDS/NCIC.

• CJIS Flag– Arrest notifications

• References– OAR 257-015-0050(6)– CJIS Security Policy Section 5.12: Personnel Security

The CJIS background process is NOT intended to serve as the agency pre-employment background check.

WHY Do You Submit CJIS Security Prints?


CJIS Security Fingerprinting & CJIS Security Background Checks

Fingerprint employee and submit prints to OSP CJIS Division ‐within 30 days of employment or assignment

– Must be fingerprinted for each new law enforcement or criminal justice agency (including lateral hires)

– Vendors and contractors who work for multiple CJIS agencies must be fingerprinted for EACH AND EVERY AGENCY.

– When submitting fingerprint cards you must include the completed & signed coversheet. Forms available online


8/23/2017

47

CJIS Security Fingerprinting & Background Process

Please be sure to send this signed and completed form along with your CJIS Security fingerprint cards to the OSP CJIS Division.

This completed form includes information regarding who within your organization OSP will contact should law enforcement action be taken on your CJIS flagged staff.

93


8/23/2017

48

Frequently Asked QuestionsQuestion: What does an employee’s name change mean for their CJIS flag?Answer: When a staff member with a CJIS flag changes their name you may email [email protected] to add the new name as an AKA on their CJIS flag file.

Question: Does a lateral hire have to get fingerprinted again for each new agency? Answer: Yes, this will enable your agency to be alerted for any criminal activity affecting the employee’s LEDS access.

Question: How do I know what staff I presently have listed as active CJIS flags for my ORI?Answer: Contact the OSP CJIS team via email and request a list of active CJIS security flags for the ORIs you oversee. The attachment will be sent via encrypted email attachment. The password to open the encrypted attachment must be relayed over the phone. Once opened, you may review the list and note any users no longer employed by your agency. Provide OSP.CJIS with a list of names and DOBs of the staff you wish to separate from your ORI CJIS security list. You may also begin to list staff who may need to be CJIS security fingerprinted for your ORI.


CJIS Security Awareness

CJIS Security Policy Section 5.2 –CJIS Security Awareness Training

“Basic security awareness training shall be required within six months of initial

assignment, and biennially thereafter, for all personnel who have access to CJI to include all personnel who have unescorted access to a

physically secure location.”


8/23/2017

49

“Access” Defined

Question: What is “access”?

Answer: The physical or logical (electronic) ability, right, or privilege to view, modify, or make use of Criminal Justice Information. (As defined by the Criminal Justice Information Services (CJIS) Security Policy)

Personnel may have the ability to view CJI (purely based on physical proximity), but not have any permissions or rights to actually view, modify, or make use of CJI or any CJIS applications are still considered to have access to Criminal Justice Information and therefore required to be CJIS Security Awareness cleared/fingerprinted and trained.

• Contracted custodial staff at a sheriff’s office who have access to physically secured areas, but do not have permission to actually view or make use of the CJI stored within the secured area, are still considered to have physical access.


Physical Access (Level 1)

Question: Who has “proximity access”?

Answer: Anyone who has unescorted (eyes‐on at all times) access to physically secure locations that process or store CJI. Common examples include the following roles:

• Janitors

• Building maintenance

• Radio technician vendors

• Anyone given unfettered walking access to your secured location.

Escort – Authorized personnel who accompany a visitor at all times while within a physically secure location to ensure the protection and integrity of the physically secure location and any Criminal Justice Information therein. The use of cameras or other electronic means used to monitor a physically secure location does not constitute an escort.


8/23/2017

50

Physical Access (Level 2)

Question:Who has “physical access” to CJI?

Answer: Anyone who has physical access to CJI and have the right, privilege, or authority to make use of CJI. Common examples include the following roles:

• A judge who views a criminal history supplied by the DA

• A Human Resources staff member who reviews a hard‐copy criminal history as part of a background check packet.



Logical Access (Level 3)Question: Who has “logical access”?

Answer: Anyone who has a login to systems that access or house CJI. Common examples include the following roles:

• ALL LEDS users

• Any person who can log into any electronic database that contains CJI (law enforcement records management system, computer aided dispatch system, jail management system, case management system, etc., whether or not that system can query LEDS directly.)



8/23/2017

51

Personnel with Information Technology Roles (Level 4)

Question: What does this mean? What is “IT access”?

Answer: Anyone that has unescorted access to networking equipment such as: routers, switches, hubs or servers processing or storing CJI.

– Access can be as simple as a key to the door that secures this equipment (server closet).

– This can also be as complex as vendors with (unescorted) VPN access to systems that process CJI.


Wait, Which Level of CJIS Training?


8/23/2017

52

Additional Information


Apply Your Knowledge:

Your supervisor has tasked you with making sure your agency is CJIS compliant.

Given the following scenarios, what actions need to be taken to ensure CJIS compliance

(and happy Auditors)?


8/23/2017

53

Scenario #1:

Your agency has contracted with an outside custodial company for janitorial service after

hours, when no agency employees are present.

What do you need to do to ensure your agency and custodial staff are compliant with

the CJIS Policy?


Scenario #2:

Your department has hired a part‐time, on‐call computer tech. This new tech happens to work full time at a law enforcement agency as a police officer. She states that she is LEDS certified through her full time employer (and her LEDS certification is in good standing.

What do you need to do to ensure CJIS Security compliance?


8/23/2017

54

Your agency has hired an outside IT company to help maintain all servers at your location. The company owner assures you that all of their employees are “CJIS Cleared” and eligible to begin working immediately.

Is there anything you need to do to ensure CJIS Security compliance?

107

Scenario #3:


You work at the LEDSTEST County Jail. Only the records staff are LEDS certified; the Corrections Deputies are NOT certified to run LEDS, but they do have access to

the Jail Management System.As per Jail policy, the records staff run QWH queries on arrestees as part of the intake process. The records staff then enter applicable information, including SID

number(s), into the arrestee’s record in JMS.The LEDSTEST County JMS does not directly connect to LEDS or NCIC; users cannot query LEDS through JMS.At what level must the Corrections Deputies complete

CJIS Security Awareness training?

108

Scenario #4:


8/23/2017

55

Questions?


Contact:

Nick Harris

CJIS Information Security Officer

[email protected]

(503) 934‐2335 (Desk)


8/23/2017

56

Understanding CJIS Online

CJIS Security Awareness Training & Testing

How to Navigate CJIS Online

Walking you through the CJIS Online system:

• Logging in as an agency administrator

• Setting up user accounts

• Modifying user accounts:

– Inactivating users

– Resetting login credentials

• Relaying user login credentials & testing instructions

• Generating & reviewing test activity reports.


8/23/2017

57

CJIS Online: For Your Non-LEDS Users

(…mostly)It is your agency’s responsibility to maintain CJIS Security Awareness training documentation.

CJIS Security Awareness training shall be completed within six months of initial assignment, and biennially thereafter, for all personnel who have access to CJI.

If your employee is not LEDS certified, they will need a record in CJIS Online.

• Level 1: Access to a physically controlled area

• Level 2: Access to CJI

• Level 3: Logical Access (typically LEDS certified, can also be an RMS system, etc.)

• Level 4: Personnel with Information Technology Roles/Access

OSP has provided a way for agencies to maintain their records online using the CJIS Online Portal.


Logging In to CJIS Online

Log in to CJIS Online as the Local Agency Admin: https://www.cjisonline.com/index.cgi

If you cannot log in, call or email CJIS Training to reset your password.

Agencies can set only one admin for CJIS online.


8/23/2017

58

Logging In to CJIS Online Your login credentials are unique to you and your agency:


CJIS Online – Agency Options

This is your agency home screen, which lists all the options available to you to

administrate your agency, add vendors, and run reports.


8/23/2017

59

Setting Up New CJIS Online Users

To add new users, go to IT & Agency User Admin:



Your existing users will be listed alphabetically.

You can add new users by clicking on the “Add New IT or Agency Employee” button:


8/23/2017

60


You will need to provide the below information for

new users.The fields with an asterisk are the only required fields.

You can set the password to any secure password appropriate for your agency. Please do not use personal identifying information, such as a driver’s license number.

Make a note of the employee’s login credentials – you will relay them so they can start the training process.

You will be asked to assign the user the appropriate level of training

Remember LEDS users are level 3; their CJIS training is covered during their online recertification process. You do not need to set up CJIS accounts for most LEDS staff.

119

If the New Account is RejectedIf you get an error message saying this is a duplicate record, the user has already been

created by another agency. CJIS Training can either transfer the user to be active for your ORI, or in the case of vendors, send you their information for your records.

DO NOT CREATE DUPLICATE USER ACCOUNTS.

Email us: [email protected]


8/23/2017

61

Setting Up New CJIS Online UsersYour newly added employee will now be listed in your “IT & Agency Employees” list.

You may click on the magnifying glass to view their record, edit their credentials, or inactivate their record.



You can edit your employee’s CJIS Online record, including their name and login credentials. You can add training and certification history and update their fingerprint date.


8/23/2017

62

Email the New CJIS Online User and Relay Their Login Credentials


Monitoring Testing ActivityBy logging in as a “Local Agency Admin,”

you can also run reports to monitor your agency’s testing activity.


8/23/2017

63

CJIS Online ReportsRegularly reviewing your certification expiration report gives you an agency‐wide

perspective of your upcoming expiration dates. Be proactive and administer training & testing reminders 60 days in advance to give your users plenty of time to complete the

testing process.


CJIS Online ReportsRegularly reviewing your certification expiration report gives you an agency‐wide

perspective of your upcoming expiration dates. Be proactive and administer training & testing reminders 60 days in advance to give your users plenty of time to complete the

testing process.


8/23/2017

64

Test Activity Report


You can check on testing activity by pass or fail and by time period.

Test Activity Report


8/23/2017

65

Certification Expiration ReportThis command will generate a list of all the expiration dates for your

entire agency, including active employees with no training history.


Certification Expiration ReportThis report will list all the certification expiration dates in the database for your agency.

Pay special attention to the employees for whom you have created accounts,

but who have not completed the necessary training activity.

130

8/23/2017

66

Hint: Logging In to CJIS Online

Vendor employees with login by clicking “Vendor

Access.”

Your agency employees will login by clicking “IT &

AGENCY USERS.”

No Oregon users should attempt to login here. It

won’t work.


Questions?

8/23/2017

67

Contact [email protected]

503‐378‐2121 (Fax)

Kendele Miyasaki, Training [email protected]

503‐934‐0300 (Desk)

Nick Harris, CJIS Information Security [email protected]

503‐934‐2335


leds representative 101 oregon state police training/2017 statewide training...leds representative...

Documents