Lake County School District R-1 is committed to ensuring the protection of Criminal Justice Information (CJI) and its subset, Criminal History Record Information (CHRI), in accordance with applicable federal and state law and the FBI Criminal Justice Information Services (CJIS) Security Policy. CHRI obtained by Lake County School District shall be maintained only for authorized purposes, retained for two (2) years, and reviewed quarterly for secure destruction in accordance with this policy and applicable record retention requirements.
Accordingly, this policy applies to any electronic or physical media containing Federal Bureau of Investigation (FBI) or Colorado Bureau of Investigation (CBI) Criminal Justice Information while being stored, accessed, or physically moved from a secure location within Lake County School District R-1. This policy also applies to any authorized person who accesses, stores, and/or transports electronic or physical media containing criminal history record information.
DEFINITIONS
Criminal Justice Information (CJI) refers to all of the FBI Criminal Justice Information Services (CJIS) provided data necessary for law enforcement and civil agencies to perform their missions including, but not limited to biometric, identity history, biographic, property, and case/incident history data.
Criminal History Record Information (CHRI) means information collected by criminal justice agencies on individuals consisting of identifiable descriptions and notations of arrests, detentions, indictments, information, or other formal criminal charges, and any disposition arising therefrom, including acquittal, sentencing, correctional supervision, and release. The term does not include identification information such as fingerprint records if such information does not indicate the individual’s involvement with the criminal justice system. CHRI is a subset of CJI and for the purposes of this document is considered interchangeable. Due to its comparatively sensitive nature, additional controls are required for the access, use, and dissemination of CHRI.
PROPER ACCESS, USE, AND DISSEMINATION OF CHRI
CHRI must only be used for an authorized purpose consistent with the purpose for which it was accessed or requested and cannot be disseminated outside the receiving departments, related agencies, or other authorized entities. Dissemination to another agency is authorized if (1) the other agency is an Authorized Recipient of such information and is being serviced by the accessing agency, or (2) the other agency is performing noncriminal justice administrative functions on behalf of the authorized recipient and the outsourcing of said functions has been approved by Colorado Bureau of Investigation (CBI) officials with applicable agreements in place.
PERSONNEL SECURITY SCREENING
Access to CJI and/or CHRI is restricted to Authorized Personnel. Authorized Personnel are individuals, or a group of individuals, who have completed security awareness training and have been granted access to CJI data.
SECURITY AWARENESS TRAINING
Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): as part of initial training for new users prior to accessing CJI and annually thereafter; and when required by system changes or within 30 days of any security event for individuals involved in the event.
PHYSICAL SECURITY
All CJI and CHRI information must be securely stored. The District will maintain a current list of Authorized Personnel. Authorized Personnel will take necessary steps to prevent and protect the District from physical, logical, and electronic breaches.
MEDIA PROTECTION
Controls must be in place to protect electronic and physical media containing CJI while at rest, stored, or actively being accessed. Electronic media includes memory devices in laptops and computers (hard drives) and any removable, transportable digital memory media, such as magnetic tape or disk, backup medium, optical disk, flash drives, external hard drives, or digital memory card. Physical media includes printed documents and imagery that contain CJI.
MEDIA SANITATION AND DISPOSAL
When no longer usable, hard drives, diskettes, tape cartridges, CDs, ribbons, hard copies, printouts, and other similar items used to process, store, and/or transmit FBI or CBI CJI must be properly disposed of in accordance with measures established by the District.
Physical media (printouts and other physical media) must be disposed of by one of the following methods:
1. Shredding using District-issued shredders; or
2. Placed in locked shredding bins for a private contractor to come on-site and shred, witnessed by District Personnel throughout the entire process.
ACCOUNT MANAGEMENT
The District must manage information system accounts, including establishing, activating, modifying, reviewing, disabling, and removing accounts. The District must validate information systems accounts at least annually and must document the validation process.
All accounts must be reviewed at least annually by the designated CJIS Point of Contact or their designee to ensure that access and account privileges commensurate with job functions, need-to-know, and employment status on systems that contain CJI. The CJIS Point of Contact may also conduct periodic reviews.
REPORTING INFORMATION SECURITY EVENTS
The District must promptly report incident information to appropriate authorities to include the CBI’s Information Security Officer (ISO). Information security events and weaknesses associated with information systems must be communicated in a manner allowing timely corrective action to be taken. Formal event reporting and escalation procedures must be in place. Wherever feasible, the District must employ automated mechanisms to assist in the reporting of security incidents.
All employees, contractors, and third-party users must be made aware of the procedures for reporting the different types of events and weakness that might have an impact on the security of District assets and are required to report any information security events and weaknesses as quickly as possible to the designated Point of Contact.
POLICY VIOLATION AND MISUSE NOTIFICATION
Violation of this policy or misuse of CHRI by any District Personnel can result in significant disciplinary action, up to and including loss of access privileges, civil and criminal prosecution, and/or termination.
Likewise, violation of this policy or misuse of CHRI by any visitor can result in similar disciplinary action against the sponsoring employee, and can also result in termination of services with any associated consulting organization or prosecution in the case of criminal activity.
In the event of a violation of this policy by District Personnel or any visitor, notification to the Colorado Bureau of Investigation is required.
Adopted: September 2020
Revised: July 2022
Revised: Aug. 2023
Revised: May 2024
Revised: July 2026
Revised: August 2026
LEGAL REFS.: P.L. 92-544 (authorizes the FBI to exchange CHRI with officials of state and local governmental agencies for licensing and employment purposes)
28 C.F.R. 20.33 (b) (limited dissemination of criminal history record information)
28 C.F.R. 50.12 (b) (notification requirements regarding fingerprints)
C.R.S. 22-2-119.3 (6)(d) (name-based judicial record check –
definition)
C.R.S. 22-32-109.8 (non-licensed personnel – submittal of fingerprints and
name-based judicial record check)
C.R.S. 22-32-109.9 (licensed personnel – submittal of fingerprints and name-
based judicial record check)
C.R.S. 24-72-302 (definition of criminal justice information)
CROSS REFS.: GBEB, Staff Conduct and Responsibilities
GCE/GCF, Professional Staff Recruiting/Hiring
GDE/GDF, Classified Staff Recruiting/Hiring
Lake County School District R-1, Leadville, Colorado