Effective: 8/11/22 Page 1 of 4 Policy 20.5.23 DEPARTMENT OF

Effective: 8/11/22 Page 1 of 4 Policy 20.5.23

DEPARTMENT OF CORRECTIONS

Operations Division

Title: CJIS Background Clearances DOC Policy: 20.5.23

Effective: 8/11/22 Supersedes: N/A

Applicability:

All DOC employees and contractors, volunteers, and other non-employee service providers

Directives Cross-Reference:

Rules:

257-010 Oregon Criminal Offender Information System

291-015 Volunteer/Student Intern

291-016 Facility Access

Policies:

20.5.15 Identification Cards

60.1.11 Acceptable Use and Management of Criminal Justice Information

90.2.6 Volunteers/Student Interns

100.1.1 Non-Employee Service Provider (Carded and Noncarded)

100.1.2 Non-Employee Service Provider Training

Other:

Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Security

Policy

Attachments:

CD 672 ID Card Request Form

CD 1905 CJIS Denial-DOC Accommodations for Limited Access

CD 1904 Acknowledgment of DOC Facility/Location Limited Access and CJI-Protection

Restriction Requirements

CJIS Approval/Denial and ID Card Issuance Workflow

I. PURPOSE

The purpose of this policy is to establish standards and guidelines for:

A. Documenting Oregon State Police decisions on Oregon Department of Corrections (DOC) employee and non-

employee service provider (NSP) Criminal Justice Information Services (CJIS) background investigations and

CJIS clearance determinations in DOC records systems; and

B. Establishing Criminal Justice Information (CJI) protection restrictions for DOC employees and NSPs without

CJIS clearance.

II. DEFINITIONS

A. Criminal Justice Information (CJI): CJI is defined in DOC Policy 60.1.11 Acceptable Use and Management of

Criminal Justice Information. It is generally a term used to refer to all of the Federal Bureau of Investigations

(FBI) CJIS-provided data necessary for law enforcement agencies to perform their mission and enforce the

laws, including, but not limited to, biometric, identity history, person, organization, property (when

accompanied by any personally identifiable information), and case or incident history data. In addition, CJI

refers to the FBI CJIS-provided data necessary for civil agencies to perform their mission, including, but not

limited to, data used to make hiring decisions. For the purposes of this policy, restricted CJI in DOC systems

is FBI numbers and driver license numbers.

Effective: 8/11/22 Page 2 of 4 Policy 20.5.23

B. Criminal Justice Information Services (CJIS): A national, central repository of criminal history records

maintained by the FBI. The FBI CJIS division is responsible for the collection, warehousing, and timely

dissemination of relevant CJI to the FBI and to qualified law enforcement, criminal justice, civilian, academic,

employment, and licensing agencies.

C. DOC Local Agency Security Officer (LASO): The DOC person responsible for oversight and compliance with

this policy.

D. Electronic Media: Memory devices in laptops and computer hard drives and any removable, transportable

digital memory media such as magnetic tape or disk, backup medium, optical disk, flash drives, external hard

drives, thumb drives, or digital memory card.

F. Facility: The building and grounds area operated by a functional unit which houses adults in custody (AICs).

For the purposes of this policy, a facility includes other locations at which DOC employees or NSPs are

assigned to work or at public buildings owned or occupied by the DOC.

G. Functional Unit: Any organizational component within the DOC responsible for the delivery of program

services or coordination of program operations, to include correctional facilities, non-correctional facilities,

and community corrections facilities. In a correctional facility, the functional unit manager (FUM) is the

superintendent.

F. Non-Employee Service Provider (NSP): As defined in DOC Policy 90.2.6 Volunteer/Student Interns and

OAR 291-015 Volunteer Services/Student Interns, NSPs are generally individuals who provide services or

programs to the department, to adults in custody (AICs), or to adults on supervision, but not as a paid DOC

employee. Examples include contractors, volunteers or student interns, mentors, and other agency

partners.

G. Physical Media: Printed documents and imagery that contain CJI.

III. POLICY

A depiction of the sequence of events for complying with this policy is provided in the CJIS Approval/Denial and

ID Card Issuance Workflow provided as an attachment.

A. CJIS Clearance Determination

1. The Oregon State Police is the state agency responsible for managing the Oregon Criminal Offender

Information System (OAR 257-010), conducting background investigations, and determining whether a

person may be allowed unescorted access to CJIS.

2. The LASO will record the determination in the DOC tracking system and notify the affected business

unit(s).

3. It is DOC’s policy to:

a. Comply with Oregon State Police CJIS access clearance or denials; and

b. Determine whether adequate CJI-protection restrictions can be implemented to allow a DOC

employee or NSP (potential or current) issuance of an identification card for unescorted facility

access.

Effective: 8/11/22 Page 3 of 4 Policy 20.5.23

4. Employees and NSPs with Oregon State Police CJIS clearance may be issued DOC identification cards

provided they comply with the requirements of DOC Policies 100.1.1 NSP (Carded and Noncarded) and

100.1.2 NSP Training, and meet all other identification card requirements in accordance with DOC Policy

20.5.15 Identification Cards.

5. Employees and NSPs for whom Oregon State Police denies CJIS clearance cannot be issued a DOC

identification card or given unescorted facility access until DOC determines adequate CJI-protection

restrictions can be implemented and they are approved by the FUM or their designee.

B. Identifying CJI-Protection Restrictions

1. If a DOC employee or NSP (current or potential) is denied CJIS access by the Oregon State Police, the

LASO will confer with the affected business unit(s) to determine if adequate CJI-protection restrictions

are or can be put in place to allow the employee or NSP unescorted facility access.

2. Examples of CJI-protection restrictions include, but are not limited to:

a. Assigning the employee or NSP with a DOC systems profile that limits system access and redacts CJI

from user screens.

b. “Authorized Staff Only” signage identifying areas persons without CJIS clearance may not enter

unescorted due to CJI being stored, accessed, or otherwise available.

c. Assigning key sets that do not allow entry to areas in which CJI is stored, accessed, or otherwise

available.

d. Securely storing electronic and physical media within a physically secure or controlled area. A

secured area includes a locked drawer, cabinet, or room only accessible to authorized staff.

e. Restricting access to electronic and physical media to authorized staff.

f. Ensuring only authorized staff remove printed or digital CJI.

g. Storing all hardcopy CJI printouts in a secure area accessible to only those employees whose job

function requires them to handle such documents.

C. Approving or Denying CJI-Protection Restrictions

1. The LASO will present the proposed CJI-protection restrictions to the FUM or their designee for their

review and decision (CJIS Denial-DOC Accommodations for Limited Access CD 1905).

2. The FUM or their designee will review each employee or NSP and the proposed CJI-protection

restrictions on a case-by-case basis.

3. If the proposed CJI-protection restrictions are adequate to protect CJI, the FUM or their designee will

provide the LASO with a written approval (CJIS Denial-DOC Accommodations for Limited Access

CD 1905).

Effective: 8/11/22 Page 4 of 4 Policy 20.5.23

4. If the proposed CJI-protection restrictions are inadequate to protect CJI, the FUM or designee will

identify the deficiencies, as well as any other reason for denial of unescorted facility access, in their

written denial to the LASO (CJIS Denial-DOC Accommodations for Limited Access CD 1905).

5. The LASO will inform the affected business unit(s) of the decision.

6. Employees or NSPs without CJIS clearance but with approved CJI-protection restrictions will be informed

of the restrictions and must review and acknowledge in writing the requirement to comply with the OAR

291-016 Facility Access and CJI-protection restrictions (Acknowledgment of DOC Facility/Location

Limited Access and CJI-Protection Restriction Requirements CD 1904).

7. Employees or NSPs without CJIS clearance but with approved CJI-protection restrictions will be

identified on the ID Card Request Form CD 672.

8. Employees or NSPs without CJIS clearance and for whom CJI-protection restrictions were not approved

will not be issued a DOC identification card with unescorted access to any affected facility.

IV. IMPLEMENTATION

This policy will be adopted immediately without further modification.

Approved:

signature on file

Julie Vaughn, Rules Coordinator

Approved:

signature on file

Heidi Steward, Acting Director