Posted by Mike Boyle, TCC Director of Business Development
Amazon Web Services (AWS) delivers a scalable cloud computing platform with high availability and dependability. AWS has a successful track record of government customers using the AWS cloud to manage sensitive state government workloads, including Criminal Justice Information (CJI) data. AWS complies with Criminal Justice Information Services Division (CJIS) Security Policy requirements where applicable.
CJIS Security Policy provides Criminal Justice Agencies (CJA) and Noncriminal Justice Agencies (NCJA) with a minimum set of security requirements for access to FBI CJIS systems and information for the safeguarding of CJI. The CJIS Security Policy provides appropriate controls to protect CJI, from creation through dissemination, whether at rest or in transit. This minimum standard of security requirements ensures continuity of information protection.
AWS recently issued a whitepaper titled Criminal Justice Information Service Compliance on AWS. (2017, March). Retrieved January 10, 2018, from https://d0.awsstatic.com/whitepapers/compliance/AWS_CJIS_Whitepaper.pdf which details how AWS services can be utilized to comply with CJIS requirements and how responsibility is portioned between AWS and CJIS customers. AWS also evaluated the 13 policy areas along with the 131 security requirements and has determined: 10 controls can be directly inherited from AWS; both AWS and the CJIS customer share 78 controls; and 43 controls are customer-specific controls.
Services AWS provides to comply with this policy and improve the security and protection of CJI data includes:
- The advanced security services and features of AWS such as activity logging
- Encryption of data in motion and at rest with the option to bring your own key
- Comprehensive key management and protection
- Integrated permission management
For more information on TCC’s IT Managed Services and our AWS expertise, please visit our website https://www.e-tcc.com/managed-services or contact Mike.Boyle@e-tcc.com.
Technology, Process and Expertise 