FILE:  GBCA

Cf:  GBC, GBD

 

PROTECTION OF CRIMINAL BACKGROUND INFORMATION

 

 

The DeSoto Parish School Board utilizes the Louisiana State Police (LSP) Bureau of Criminal identification and Information for performing criminal background checks on employment candidates.  In order to process criminal background checks utilizing this system, the DeSoto Parish School Board shall:

 

  1. Comply with state and federal laws, rules, regulations, procedures, and policies, including, but not limited to, the most current version of the Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS), Security Policy and the Louisiana Noncriminal Justice Agency Guide, regarding the access, use, and dissemination of Criminal History Record Information (CHRI).

  2. Only use CHRI for the purpose requested as stated in the Louisiana Noncriminal Justice Agency Guide.

  3. Obtain and retain any required documents mandated by state or federal law for the purpose of submitting and processing a fingerprint based CHRI background check for each individual request.

  4. Establish the necessary security and management controls for the security and confidentiality of CHRI received in accordance with the most current version of the FBI CJ1S Security Policy and Louisiana Noncriminal Justice Agency Guide.  This includes, but is not limited to:

 

  1. Designating a Noncriminal Agency Coordinator (NAC) who will act as liaison between the DeSoto Parish School Board and LSP Bureau.  The NAC will receive audit information from the LSP Bureau and serve as the onsite contact person during audits.

  2. Designating a DeSoto Parish School Board Security Officer who is responsible for ensuring compliance with the terms of this Agreement and state and federal laws, rules, regulations, procedures, and policies regarding access, use, and dissemination of CHRI.

  3. Ensuring its officers, employees, agents, and any other persons associated with the DeSoto Parish School Board who have access to CHRI, have received security awareness training.

  4. Ensuring its officers, employees, agents, and any other persons associated with the DeSoto Parish School Board, abide by all state and federal laws, rules, regulations, procedures, and policies regarding access, use, and dissemination of CHRI; including, but not limited to, any LSP Bureau system(s) approved for use by the DeSoto Parish School Board for the access, receipt, and retention of CHRI.  Additionally, the DeSoto Parish School Board acknowledges and understands that the use of this system provides for tracking and monitoring of computer access and. location-specific variables, as authorized by federal and state laws, rules, regulations, procedures, and policies, including, but not limited to, the most current version of the FBI.CJIS Security Policy and Louisiana Noncriminal Justice Agency Guide as it pertains to CHRI.  Tracking and monitoring is to ensure the use, storage, dissemination; and processing of CHRI is completed in an appropriate environment and limited to authorized personnel.

  5. Establishing and implementing minimum screening requirements as required by CJIS Security Policy for its officers, employees, agents, and any other persons associated with the DeSoto Parish School Board who have access to CHRI.  No individual may be granted access by the School Board when a felony conviction of any kind exists, unless explicitly approved by the LSP Bureau or CJIS System Officer (CSO).

  6. Restricting access to physical or electronic CHRI to authorized personnel.  Physical copies shall be maintained in a controlled; secure environment, such as in a locked cabinet in a room not accessible to all staff and visitors.  When a physically secured location cannot be met, electronic media shall be protected with encryption that meets the most current FBI CJIS Security Policy.

  7. Disseminating CHRI only when authorized by state or federal law approved by the U.S. Attorney General.

  8. Ensuring the DeSoto Parish School Board establishes incident response policy and procedures, including an operational incident handling capability for agency information systems, whether physical or electronic.  The School Board shall track, document, and promptly report a security incident of physical or electronic CHRI to the LSP Bureau information Security Officer (IS)) who shall report the incident to the Louisiana CJIS ISO, Local Agency Security Officer, appropriate School Board officials, and/or local authorities.

  9. Establishing and implementing policy and procedures for CHRI media protection, including, but not limited to, storage and access, media transport, electronic CHRI sanitization, and physical disposal.

 

  1. Notify individuals of their right to update, challenge, or correct any discrepancies within his or her CHRI, and the DeSoto Parish School Board providing direction on how to do so.

  2. Retain supporting documentation for a minimum of three (3) years from the time CHRI results are returned for audit purposes:  Documentation, including but not limited to, Authorization Forms that support the DeSoto Parish School Board's purpose for requesting the individual to complete a background check coincides with an authorized purpose in state or federal law.  The LSP Bureau recognizes the School Board may have a document retention policy that requires a time period greater than three (3) years.

  3. Allow the LSP Bureau to conduct on-site audits to ensure compliance with the terms of this Agreement.

  4. Immediately notify the LSP Bureau of any changes to sections 1 and 3 provided in this Agreement.  If access is no longer needed nor authorized by applicable state or federal law, rule, regulation, procedure or policy, the DeSoto Parish School Board shall immediately notify the LSP Bureau to terminate access.

  5. Maintain and keep a current list of all DeSoto Parish School Board employees with digital or physical access to CHRI and their purpose for access.

 

Staff shall create and utilize procedures to comply with the requirements of this policy.

 

ADMINISTRATION OF NON-CRIMINAL JUSTICE FUNCTIONS

 

DeSoto Parish School District will abide by the Criminal Justice Information Services (CJIS) Security Policy, Section 5.1.1.1 Information Handling.  This information will be utilized for the sole purpose of employment suitability for the DeSoto Parish School District.

 

The following procedures will be utilized in the handling of this information:

 

  1. Designated personnel will be assigned the task of fingerprinting prospective employees and receiving background information from the Louisiana State Police and the Federal Bureau of Investigation.

  2. Once the background information is received it shall be reviewed by the Supervisor of Personnel for acceptance.

  3. Any areas of concern on the background check will be discussed with the prospective employee.  If the prospective employee disagrees with any content on the background check, they will be allowed to provide documentation from the courts that will clarify areas of concern.

  4. The background check will become a permanent document in the official personnel record of the employee which is stored in a locked file system in a locked room and/or in an electronic file.  This information is accessible only to the designated Personnel Employee(s) and the individual employee who these records pertain to.

  5. Under no circumstances will this information be shared with any other employee or third party unless the file is subpoenaed by the courts or authorized by the employee to be shared for legal purposes with an attorney.

 

SECURITY AWARENESS TRAINING

 

All DeSoto Parish Personnel who are assigned the task of collecting background information on prospective employees will abide by CJIS Security Policy, Section 5.2.1 - Security Awareness Training.  This training will be set up by assigned personnel from the Louisiana State Police.  This training shall be required within six months of initial assignment, and biennially thereafter, for all personnel who have access to CJIS to include all personnel who have unescorted access to a physically secure location.

 

MEDIA PROTECTION

 

DeSoto Parish School District shall ensure that CJIS Security Policy Security 5.8 Media Protection is followed at all times.  Access to digital and physical media in all forms is restricted to authorized individuals.  Procedures to ensure media protections includes the handling of CJI by only authorized personnel from the time the information.

 

DISPOSAL OF PHYSICAL MEDIA

 

DeSoto Parish School District shall adhere to CJIS Security Policy, Section 5.8.4 Disposal of Physical Media. DeSoto Parish School District maintains all physical/electronic criminal record information of all employees.  Upon termination and/or retirement of an employee physical records will be filed electronically as a permanent personnel file of the employee.  The physical record is shredded.  A physical copy, of any person who did not become an employee at the initial processing of the background, will be maintained in a locked file for one (1) year.  At the end of the one year the file will be shredded.

 

SECURITY OF CRIMINAL HISTORY RECORD INFORMATION

 

DeSoto Parish School District will provide a physically secure room to protect CJI and the information system hardware and software as required by CJIS Security Policy, Section 5.9.2 Controlled Area.  Only authorized personnel shall have access to the equipment and information.  This area will remain locked at all times when not in attendance by authorized personnel.  A list of authorized personnel shall be established, maintained and updated as needed.  All electronic storage of media shall follow the encryption standards of CJIS Security Policy 5.10.1.2. if stored outside of a physically secured room.

 

PERSONNEL SANCTIONS

 

DeSoto Parish School District will investigate any suspected misuse of CHRI.  A person suspected of intentional misuse of CHRI will immediately be suspended with pay.  An investigation of suspected misuse will be held.  At the conclusion of the investigation if it is determined that indeed intentional misuse of CHRI took place the employee shall face loss of access to CHRI, loss of employment, and/or criminal prosecution.  Misuse of CHRI shall be reported to the state.

 

INCIDENT RESPONSE

 

Any breaches of information or potential security violations shall be immediately reported to the Supervisor of Personnel.  The supervisor of personnel will be responsible for the investigation of the incident(s) and utilize every measure possible to rectify the situation.  All violations shall be documented and reported to the appropriate agency officials and/or authorities.

 

PASSWORD AUTHENTICATION

 

DeSoto Parish School District shall utilize the basic password standards.  Passwords shall include the following:

 

  1. Be a minimum length of eight(B) characters on all systems

  2. Not be a dictionary word or proper name.

  3. Not be the same as the User Id.

  4. Expire within a maximum of 90 calendar days.

  5. Not be identical to the previous ten (10) passwords.

  6. Not be transmitted in the clear outside the secure location.

  7. Not be displayed when entered.

 

New policy:  December 2, 2021

 

 

Ref:    Board minutes, 12-2-21

 

DeSoto Parish School Board