Legal CJIS Security Addendum

LEGAL CJIS SECURITY ADDENDUM

This CJIS Security Addendum (the "Addendum") is entered into as of Effective Date: between Agency Name: having principal address at ("Agency"), and Contractor Name: having principal address at ("Contractor"). This Addendum supplements the Underlying Agreement identified as Contract Number: .

RECITALS

WHEREAS, Agency possesses access to Criminal Justice Information ("CJI") protected under federal and state law and governed by CJIS security requirements; and

WHEREAS, Contractor will, in the course of performing services under the Underlying Agreement, have access to, host, process, transmit or store CJI and will be required to meet CJIS security obligations; and

WHEREAS, the parties desire to set forth the additional security, reporting, compliance and flow-down obligations required to protect CJI;

NOW THEREFORE

In consideration of the mutual covenants contained herein and in the Underlying Agreement, the parties agree as follows:

1. DEFINITIONS

"CJI" means Criminal Justice Information as defined by applicable CJIS policy and includes, without limitation, identification data, biometric data, and criminal history record information. "Authorized Personnel" means individuals approved by Agency to access CJI and who have successfully completed required background checks and training. "Covered Systems" means Contractor systems, devices, networks, cloud services and premises that store, process or transmit CJI.

2. SCOPE AND PERMITTED USE

Contractor shall access, use and disclose CJI only as necessary to perform Contractor's obligations under the Underlying Agreement and solely in accordance with applicable CJIS security requirements. Contractor shall not use CJI for any investigation, administrative or operational purpose not expressly authorized by Agency.

3. PERSONNEL SECURITY AND BACKGROUND CHECKS

Contractor shall ensure that all Authorized Personnel who will have access to CJI undergo and pass the fingerprint-based background checks required by CJIS policy prior to any access to CJI. Contractor shall not permit access to CJI by any individual who has not been approved by Agency. Contractor shall immediately remove access and notify Agency if any Authorized Personnel no longer meet clearance requirements.

List of Authorized Personnel or roles requiring access (attach additional sheet if necessary):

4. SECURITY CONTROLS

Contractor shall implement and maintain administrative, technical and physical safeguards that meet or exceed CJIS security requirements, including but not limited to: multi-factor authentication for all remote access to Covered Systems, strong encryption standards for CJI at rest and in transit, role-based access control, least-privilege principles, and continuous logging and monitoring of access to CJI.

Contractor confirms that CJI will be encrypted at rest using algorithm: and encrypted in transit using: .

5. INCIDENT REPORTING AND RESPONSE

Contractor shall notify Agency of any actual or suspected security incident, unauthorized access, or data breach involving CJI within hours of discovery. Notification shall include a description of the incident, affected systems, CJI types involved, corrective actions taken and a remediation plan. Contractor shall preserve all evidence and logs and cooperate fully with Agency and any law enforcement or oversight entity.

Incident contact name: Phone: Email:

6. AUDIT, INSPECTION AND RECORDS

Agency or its designees shall have the right to audit, inspect and monitor Contractor's compliance with this Addendum, including on-site inspections of Covered Systems and review of logs, procedures and background check records. Contractor shall maintain records of all access to CJI and related security events for at least years and shall provide such records upon request.

7. SUBCONTRACTORS AND THIRD PARTIES

Contractor shall not engage any subcontractor to access or process CJI without prior written approval by Agency. All subcontractors shall be bound in writing to the same CJIS security obligations set forth in this Addendum. Contractor shall remain fully liable for the acts and omissions of its subcontractors.

8. TRAINING

Contractor shall ensure that all Authorized Personnel complete CJIS-specific security training prior to access to CJI and annually thereafter. Contractor shall provide training records upon Agency request and certify completion for each individual.

9. DATA RETURN AND DESTRUCTION

Upon expiration or termination of the Underlying Agreement or at Agency request, Contractor shall, at Agency's election, return all CJI to Agency and securely erase or destroy all copies from Contractor systems within days and certify in writing that destruction has been completed, including destruction of backups and residual data.

10. LIABILITY AND INDEMNIFICATION

Contractor shall indemnify, defend and hold harmless Agency from and against any loss, liability, claim, damage, cost or expense arising out of Contractor's breach of this Addendum, unauthorized disclosure of CJI, or Contractor's failure to comply with applicable CJIS security requirements, including reasonable attorneys' fees and regulatory fines to the extent caused by Contractor's acts or omissions.

11. TERMINATION

Agency may immediately suspend Contractor's access to CJI or terminate the Underlying Agreement for material noncompliance with this Addendum. Suspension or termination does not relieve Contractor of obligations to return, destroy or otherwise protect CJI and to cooperate with incident response and audits.

12. NOTICES

All notices required under this Addendum shall be in writing and delivered to the designated notices contact for each party.

13. GOVERNING LAW; VENUE

This Addendum shall be governed by and construed in accordance with the laws of the state of , without regard to its conflict of law principles. Venue for any action arising out of this Addendum shall be in the state or federal courts located within that state.

14. ENTIRE AGREEMENT; SEVERABILITY; AMENDMENT; WAIVER; COUNTERPARTS

This Addendum, together with the Underlying Agreement, constitutes the entire agreement of the parties with respect to CJI protections and supersedes any prior commitments. If any provision of this Addendum is held invalid or unenforceable, the remainder shall remain in full force and effect. This Addendum may be amended only by a written instrument executed by authorized representatives of both parties. No failure or delay by a party in exercising any right shall operate as a waiver.

15. SURVIVAL

The obligations of Contractor with respect to CJI, including but not limited to those in Sections 3, 4, 5, 6, 9 and 10, shall survive termination or expiration of the Underlying Agreement.

CERTIFICATION

Contractor certifies that it understands and will comply with the CJIS security requirements applicable to the Contractor's access to CJI, that it will implement the controls described in this Addendum, and that the statements and representations made herein are true and correct to the best of Contractor's knowledge.

ADDITIONAL SECURITY REPRESENTATIONS

Contractor represents that the Covered Systems are hosted in the following environment (check all that apply):

On-premises infrastructure under Contractor control
Dedicated cloud environment (single-tenant)
Shared/virtualized cloud environment (describe compensating controls below)

ACKNOWLEDGMENT

The undersigned certify that they are authorized to execute this Addendum on behalf of their respective parties and that execution of this Addendum binds their respective party to the terms herein.

Sign Now