Outsourcing Review of Criminal History Records
Document provided by the
The National Crime Prevention and Privacy Compact (Compact) establishes standards and processes for exchanging criminal history records among states and between states and the FBI for non-criminal justice purposes such as licensing or employment. Article VI of the Compact provides for a Compact Council with the authority to announce rules and procedures that control use of the Interstate Identification Index (III) system for non-criminal justice purposes. The III is the system of federal and state criminal history records maintained by the Federal Bureau of Investigation (FBI).
The Compact Council published a Final Rule in the Federal Register (the official daily publication for rules, proposed rules, and notices of Federal agencies and organizations, as well as executive orders and other presidential documents) regarding a Security and Management Control Outsourcing Standard, which became effective December 15, 2005. The goal of the Outsourcing Standard is to permit the outsourcing (delegation of non-core operations from internal production to an external entity specializing in the management of that operation) of non-criminal justice functions related to processing criminal history record information from III. The Outsourcing Standard permits a governmental agency or other authorized recipient of criminal history record information to select a private or governmental agency to perform these non-criminal justice administrative functions on behalf of the governmental or authorized agency, subject to appropriate controls.
The Outsourcing Standard establishes minimum standards to ensure that security and privacy requirements are satisfied when conducting FBI criminal history records checks for non-criminal justice purposes. The contracting parties may not reduce these minimum standards; however, they may adopt stricter standards than required by this Standard.
To ensure agencies follow these minimum standards, the Outsourcing Standard provides that contracts and agreements authorized by this Rule “shall incorporate by reference a Security and Management Control Outsourcing Standard approved by the Compact Council after consultation with the United States Attorney General”. This document is for contractors having access to criminal history record information on behalf of an authorized recipient for non-criminal justice purposes as well as contractors that only pass, or channel, non-criminal justice criminal history record check requests and results between the authorized recipient and the FBI.
Additionally, the Outsourcing Standard identifies duties and responsibilities for adequate security controls between the authorized recipient and the contractor in order to maintain the security, accuracy and reliability of the III system and criminal history record information. The standard security program will consider physical site security, restrictions on dissemination of criminal history record information, personnel security, system security and data security.
Use of Outsourcing Standard by
Prior to outsourcing any non-criminal justice administrative functions, the governmental authorized recipient must:
1) provide the State Compact Officer copies of the specific authority for the outsourced work, criminal history record check requirements, and/or a copy of the contract as requested; and,
2) request and receive written permission to outsource the function.
The authorized recipient shall sign a contract or agreement prior to providing a contractor access to criminal history record information.
The governmental authorized recipient shall:
1) specify the terms and conditions of such access;
2) limit use of such information to the purposes for which it is provided;
3) limit retention of the information;
4) prohibit dissemination of the information except as specifically authorized by federal and state laws, regulations and standards as well as rules, procedures and standards established by the Compact Council and the United States Attorney General;
5) ensure the security and confidentiality of the information;
6) provide for audits and sanctions; provide conditions for termination of the contract;
7) maintain up-to-date records of contractor personnel who have access to criminal history record information; and, ensure that contractor personnel comply with the Outsourcing Standard.
For more information on the Outsourcing Standard, please contact the State Compact Officer at the following address.