Approve and manage information exchange between the agency system and external systems through the applicable agreements: executed CJIS User Agreements between each CSA, SIB or IA and the FBI CJIS Division (standards, audit, sanctions and the FBI's right to penetration-test the connection), Criminal Justice Agency User Agreements between CJAs and the CSA covering audit, dissemination, hit confirmation, logging, quality assurance, screening, security, timeliness, training, system use and validation, and agreements for noncriminal justice use of CHRI under the outsourcing standards for non-channeling and channeling or a management control agreement or security addendum under 28 CFR 20.33; document for each agreement the interface characteristics, security and privacy requirements, controls, responsibilities and impact level; review the agreements at least every three years or when responsibilities or signatories change; and log secondary dissemination of CHRI to agencies outside the primary agreement while validating each requestor under local policy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.