Require providers of external system services to comply with the organisation's security and privacy requirements and the CJISSECPOL acquisition controls under the applicable agreement: a management control agreement for a government NCJA performing criminal justice functions for a CJA, the FBI-approved CJIS Security Addendum incorporated into any private contractor's agreement with its certification page signed, the Compact Council outsourcing standard for channelers, and the outsourcing standard for non-channeling contractors, with contractors meeting the same training, certification and audit criteria as agencies; define and document oversight and user roles for external services; and monitor providers by permitting inquiry and audit of alleged violations, auditing every external provider with system access at least every three years, holding authority for unannounced inspections and scheduled audits of provider facilities, and auditing contractor facilities on behalf of another CSA.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.