Jail Management System - Maricopa County

Issue #1:
For Information. No response required.
Issue #2:
Jail Management System (JMS)
Sheriff's Office- JMS Report
February 2012
Audit Response - April 25, 2012
MCSO network security controls could be strengthened in four key areas: (1) the
Criminal Justice Network, (2) password parameters, (3) remote access security, and (4)
patch management. Stronger network security controls reduce the likelihood of system
vulnerabilities and breaches. MCSO should strengthen network security controls in
these areas.
Response requested for Agency Memo only. See Agency memo (separate).
Issue #3:
MCSO personnel screening, security awareness training, and account access review
processes could be improved. Incomplete personnel screening and training processes
may leave MeSO vulnerable to potential abuse of sensitive data. Undocumented user
access procedures increase the risk that unauthorized users may inappropriately
access or modify criminal justice information. MCSO should consider strengthening
personnel screening policies, provide user awareness training, and conduct user access
reviews.
Recommendation A: MCSO should consider developing a personnel screening policy
that covers JMS users who do not access ACJIS data.
Response: Management accepts the risk of this issue. This recommendation applies to a
very small number of Maricopa County Office of Public Defender, Office of Management
and Budget and Department of Finance employees. These users access limited data that
is not criminal history information.
Target Completion Date: N/A
Benefits/Costs: Increased accountability and control.
Recommendation B: MCSO should consider enhancing the security awareness training
program to align with the CJIS Security Policy requirements.
Response: Completed. Security awareness training has been automated by the Arizona
Department of Public Safety. County employees will complete the computer-based
Page 1 of 4