Jail Management System - Maricopa County

Issue 3 Personnel Screening and Access
Reviews
Summary
MCSO personnel screening, security awareness training, and account access review processes
could be improved. Incomplete personnel screening and training processes may leave MCSO
vulnerable to potential abuse of sensitive data. Undocumented user access procedures increase
the risk that unauthorized users may inappropriately access or modify criminal justice
information. MCSO should consider strengthening personnel screening policies, provide user
awareness training, and conduct user access reviews.
Criteria
The Arizona Criminal Justice Information System (ACJIS) Operating Manual requires that
MCSO conduct criminal justice employment background checks, including a fingerprint check,
for all ACJIS terminal operators. All terminal operators and technical personnel who access the
ACJIS system must be certified through the Terminal Operator Certification (TOC) Program.
The Federal Criminal Justice Information System (CJIS) Security Policy requires that MCSO
conduct security policy training for employees based on their job duties. Key training areas
include the handling of criminal justice information, social engineering, media protection,
malware prevention, and patch management. CJIS has established training guidelines for
different employee groups.
COBIT recommends:
Condition
Recruiting and training a competent workforce, and conducting background checks
Educating and training users according to business requirements
Documenting procedures for requesting, establishing, issuing, modifying, and closing
user accounts
Personnel Screening
MCSO’s procedures appear to be in compliance with state (ACJIS) background check policies.
A small number of employees from the Office of Public Defender, Office of Management and
Budget, and the Department of Finance, access JMS detention and booking information that is
not part of the state criminal database (ACJIS). Currently, individuals from these agencies do
not go through the required background check, and the required training (TOC and security
awareness).
Maricopa County Internal Audit 10 Jail Management System–May 2012