WIXLIB

HARDIN COUNTY FISCAL COURTRESOLUTION NO. 2020-111BE IT RESOLVED, upon recommendation of Harry L. Berry, Hardin County Judge/Executiveand Jenny Oldham, Hardin County Attorney, to approve the Criminal Justice Information SystemManagement Control Agreement relating to Hardin County 911 Emergency Services, in order forthe Hardin County Sheriffs Department to assume management control of the Criminal JusticeInformation System (CJIS).BE IT FURTHER RESOLVED, to authorize Harry L. Berry, Hardin County Judge/Executiveand John Ward, Hardin County Sheriff, to sign all documents concerning the CJIS ManagementControl Agreement relating to Hardin County 911 Emergency Services.ADOPTED, by the Hardin County Fiscal Court in its regular meeting on 28Jul2020.- :::::: :::/ ?-Harry L. Berry),Hardin County Judge/ExecutiveATEST:Debbie DonnellyHardin County Clerk

CJIS MANAGEMENT CONTROL AGREEMENTRELATING TO HARDIN COUNTY 911 EMERGENCY SERVICESThis CJIS Management Control Agreement is made and entered into by and between: HardinCounty 911 Emergency Services, hereinafter referred to as Hardin County 911.ANDthe Hardin County Sheriffs Office, hereinafter referred to as HCSO.ANDShall include the following CJA satellite agencies (separate with comma): Hardin County Jail,West Point Police Department, Hardin County District Court Elizabethtown, Hardin CountyCircuit Court Elizabethtown, Hardin County District Court Radcliff.WHEREAS, the HCSO is a Criminal Justice Agency (CJA) formally recognized as suchby both the Federal Bureau of Investigation and the Kentucky State Police; andWHEREAS, on or about 7/1/2020, the HCSO has entered into a LINK User Agreementwith Kentucky State Police for the benefit of access to the Law Information Network of Kentucky(LINK), the National Crime Information Center (NCIC), and all other CJI systems, is therefore anauthorized user of those technology resources, a copy of which is attached hereto and made parthereof as Appendix "A"; andWHEREAS, pursuant to the LINK User Agreement, all state criminal justice agencieswith such access must comply with the FBI Criminal Justice Information Services (CJIS) SecurityPolicy; andWHEREAS, Hardin County 911 is a Noncriminal Justice Agency (NCJA); andWHEREAS, Hardin County Fiscal Court operates, maintains, and owns the HardinCounty 911 Center, which includes a portion of computer systems and network infrastructureinterfacing directly or indirectly with the Law Information Network of Kentucky (LINK) for theinterstate exchange of criminal history/criminal justice information; andWHEREAS, the HCSO and Hardin County 911 desire to enter into a Management ControlAgreement.NOW THEREFORE, in consideration of the mutual terms, conditions, promises,covenants, and payments hereinafter set forth, the parties agree as follows:

COMPLIANCE WITH CJIS SECURITY POLICYManagement Control: is defined as the authority to set, maintain, and enforce;1) Priorities;2) Standards for the selection, supervision, and termination of personnel access toCriminal Justice Information (Cn).3) Policy governing the operation of justice systems, computers, access devices,circuits, hubs, routers, firewalls, and any other components, including encryption,that compromise and support a telecommunications network and related criminaljustice systems to include but not limited to criminal history record/en, insofar asthe equipment is used to process or transmit CH guaranteeing the priority, integrity,and availability of service needed by the criminal justice community.4) Restriction of unauthorized personnel from access or use of equipment accessingthe State (LINK) network.5) Compliance with all rules and regulations of the (Criminal Justice Agency) Policiesand ens Security Policy in the operation of all information received. ManagementControl applies to both the LINK terminal and the personnel access to that terminal.(CSP 5.1.1.4, Appendix D.2)Management control includes, but is not limited to, the supervision of equipment, systems design,programming, and operating procedures necessary for the development and implementation of thecomputerized criminal history program. Such management control guarantees the priority serviceneeded by the criminal justice community.The HCSO per executed LINK Terminal Agency Agreement, shall have the authority andresponsibility, via managed control, to set and enforce the above policies and procedures.Responsibility for the management of security control of CH shall remain with HCSO, CHSSecurity Policy. Further, Hardin County Fiscal Court shall not restrict the HCSO physical accessto CJLThis CHS Management Control Agreement covers the overall supervision of all the HCSOsystems, applications, equipment, systems design, programming and operational proceduresassociated with the development, implementation and maintenance of the HCSO system to includeNCIC Programs that may be subsequently designed and/or implemented with the HCSO.

HCSO RESPONSIBILITIES (CRIMINAL JUSTICE AGENCY) Shall comply with all federal and state laws, rules, procedures and policies set forth in theLINK Manual, CJIS Security Policy, NCIC Operating Manual, and NLETS Manual. Shall provide 24 hour, 7 day per week operation for Full Access service. Shall ensure terminal operators are employed, supervised, and under the managementcontrol of the terminal agency. Shall maintain a current Terminal Agency User Agreement. Shall maintain a current executed Satellite Agency User Agreement with all the satelliteagencies they service. Shall maintain a Management Control Agreement with all Noncriminal Justice Agenciesperforming the duties of a dispatch center. The Management Control Agreement shallgive a single Criminal Justice Agency management control of CJIS access.TheManagement Control Agreement must be provided to the State Control Terminal Officer(CSO) for approval. Shall agree to acquire terminal equipment compatible with the LINK system specificationsand further agree to replace such equipment when deemed necessary by the StateControl Terminal Officer (CSO). Shall ensure thorough background screening of all personnel prior to employment as aterminal operator. This screening will include but not be limited to, a check of local arrestfiles and a search through the state of residency and FBI NCIC Ill files. As part of thisscreening the CJIS User Agency agrees to provide fingerprints of each employee to theCJIS Compliance Staff for a fingerprint-based comparison through both the stateidentification section and the FBI identification division. Fingerprints will be submitted tothe CJIS Compliance Staff no later than 10 days after initial employment. Shall ensure only CJIS certified operators with the appropriate level of certification canaccess the CJIS information.

a) Full Access (must certify within 180 days)b) Inquiry Only Access (must certify within 30 days)c) Security Awareness Training (must complete within 30 days) Shall designate a Terminal Agency Coordinator (TAC}, Assistant Terminal AgencyCoordinator, and a Local Agency Security Officer (LASO). Shall ensure physical, personnel and technical security limitations are in place to preventunauthorized access to the CJIS terminal. Shall have an Agency Security Policy of written standards for the discipline of CJIS policyviolators. Shall maintain and make accessible at all times documentation of the networkconfiguration, in detail, and diagram of the physical location of all terminals connected tothe LINK network. Shall notify the Information Security Officer (ISO), by teletype, 60 to 90 days prior tomoving the CJIS Terminal. Shall ensure that all hit confirmation requests are responded to within ten (10} minutesfor urgent requests and within one (1) hour for routine requests by either the TerminalAgency or the Satellite Agency that caused the record to be entered into LINK/NCIC. Shall be responsible for the accuracy, timeliness, and completeness of all LINK/NCICrecords.Shall ensure second party checks for accuracy are properly performed by CJIS Users on allLINK/NCIC records. Shall ensure that a case report includes one (1) or more of the following: NIBRS report,warrant, missing person report (KSP-261} to make the criteria for LINK/NCIC entry. Acomplete description of the person or property, and all supporting documentation shallbe included in the case report.

HARDIN COUNTY 911 RESPONSIBILITES (NON CRIMINAL JUSTICE AGENCY) Shall comply with all federal and state laws, rules, procedures and policies set forth in theLINK Manual, CJIS Security Policy, NCIC Operating Manual, and NLETS Manual. Shall provide 24 hour, 7 day per week operation for Full Access service. Shall ensure terminal operators are employed, supervised, and under the managementcontrol of the terminal agency. Shall maintain an adequate number of Certified LINK Terminal Operators, with theappropriate level of Certification, are available to staff the terminal. Shall maintain a Management Control Agreement with the Criminal Justice Agency. Shall comply with the background screening of all personnel with CJIS access as set forthin the CJIS Security Policy and LINK Manual. Shall ensure only CJIS certified operators with the appropriate level of certification canaccess the CJIS information.a) Full Access (must certify within 180 days)b) Inquiry Only Access (must certify within 30 days)c) Security Awareness Training (must complete within 30 days) Shall designate a Terminal Agency Coordinator (TAC), Assistant Terminal AgencyCoordinator, and a Local Agency Security Officer (LASO). Shall ensure physical, personnel and technical security limitations are in place to preventunauthorized access to the CJIS terminal. Shall have an Agency Security Policy of written standards for the discipline of CJIS policyviolators. Shall maintain and make accessible at all times documentation of the networkconfiguration, in detail, and diagram ofthe physical location of all terminals connected tothe LINK network.

ADDITIONAL INSIGHTS (not addressed in the agreeme11t)The above criteria must be met in the CJIS Management Control Agreement.It may be necessary to add additional sections to the agreement.Examples: Term ofAgreement & TerminationCostsSave Harmless Clause