Use an FBI-authorised originating agency identifier (ORI) in every transaction on CJIS systems to identify the sending agency and set the proper level of access; the ORI is the identifier between the requesting agency and the CSA, SIB or Channeler, alongside user, device or IP identifiers; a servicing agency may transact on behalf of an authorised requesting agency using the requester's ORI, or its own ORI where an audit trail for the retention period is kept, and the CSA, SIB or Channeler must be able to trace each transaction's ORI to the requesting agency; an agency with a limited-access ORI may not use another agency's full-access ORI. The Policy notes this control will fold into AC-3 when modernised.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.