Policies and procedures required

All criminal justice agencies maintaining criminal history record systems, whether manual or automated must have written policies and procedures to protect criminal history data from unauthorized access. Written policies and procedures must include: 1. Designation of personnel authorized access to criminal history files. 2. Screening of personnel authorized access. 3. Screening of noncriminal justice personnel with access or work proximity to criminal history record information, including information technology personnel, contractors, maintenance personnel, and nonagency janitorial personnel. 4. Supervision of personnel with access or proximity to criminal history record information.