45-74 Acceptable Use Policy for Criminal Justice Information Services (CJIS) - Colorado Bureau of Investigations(CBI)
This policy applies to Goodwill of Colorado, Goodwill Industrial Services Corporation, Goodwill of Colorado Foundation (collectively, Goodwill). The purpose of this policy is to outline the acceptable use of computer equipment at Goodwill. These rules are in place to protect the employee and Goodwill. Inappropriate use exposes Goodwill to risk including virus attacks, compromises of the network systems and services, and legal issues.
If you have any questions or concerns about this policy, please contact the listed Agency Head, TAC, or ARSO.
Attachments:
Attachment 1 - NCJA User agreement (Rev 2026) – Signed
Attachment 2 - Criminal Justice Information Services (CJIS) Security Policy
Attachment 3 - CJIS Security and Privacy Training - General User
Attachment 4 - CJIS Security and Privacy Training - Privileged User - Security Awareness Training Document
Attachment 5 - Summary of Audit Findings
45-74.2 How and Where CHRI is Stored for CBI (to include Retention and Destruction)
This policy applies to Goodwill of Colorado, Goodwill Industrial Services Corporation, Goodwill of Colorado Foundation (collectively, Goodwill). The purpose of this attachment is to outline how and where Criminal History Record Information (CHRI) is stored within Goodwill.
If you have any questions or concerns about this policy, please contact the listed Agency Head, TAC, or ARSO.
45.74.3 Physical and Media Protection Policy for CBI
This policy applies to Goodwill of Colorado, Goodwill Industrial Services Corporation, Goodwill of Colorado Foundation (collectively, Goodwill). The purpose of this policy is to provide guidance for agency personnel, support personnel, and private contractors/vendors for the physical, logical, and electronic protection of Criminal Justice Information (CJI). All physical, logical, and electronic access must be properly documented, authorized, and controlled on devices that store, process, or transmit unencrypted CJI. This Physical Protection Policy focuses on the appropriate access control methods needed to protect the full lifecycle of CJI from insider and outsider threats.
This Physical Protection Policy was developed using the Federal Bureau of Investigation’s (FBI) CJIS Security Policy Version 6.1 dated June 25, 2026. The intended target audience is Goodwill’s personnel, support personnel, and private contractor/vendors with access to CJI whether logically or physically. The local agency may complement this policy with a local policy; however, the Criminal Justice Information Services (CJIS) Security Policy shall always be the minimum standard and local policy may augment, or increase the standards, but shall not detract from the CJIS Security Policy standards.
If you have any questions or concerns about this policy, please contact the listed Agency Head, TAC, or ARSO.
Attachments:
Attachment 1 – Employee Policy Acknowledgement (see next page (page 9))
45.74.4 Policy Governing Fingerprint-Based Criminal History Record Information (CHRI) Checks Made for Non-Criminal Justice Purposes
This policy applies to Goodwill of Colorado, Goodwill Industrial Services Corporation, Goodwill of Colorado Foundation (collectively, Goodwill). This policy is applicable to any fingerprint-based State and National criminal history record check made for non-criminal justice purposes and requested under applicable Federal authority and/or State statute authorizing such checks for licensing or employment/volunteer purposes. Where such checks are allowable by law, the following practices and procedures will be followed.
If you have any questions or concerns about this policy, please contact the listed Agency Head, TAC, or ARSO.
45-74.5 Disciplinary and Incident Response Policy for CBI
This policy applies to Goodwill of Colorado, Goodwill Industrial Services Corporation, Goodwill of Colorado Foundation (collectively, Goodwill). The purpose of this policy is to outline the disciplinary actions that apply to all Goodwill employees, contractors, consultants, temporary staff, and other workers at Goodwill, including all personnel affiliated with National Crime Information Center (NCIC) and third parties. These rules are in place to protect Goodwill from inappropriate misuse of Criminal History Record Information (CHRI). Inappropriate use of CHRI exposes Goodwill to risk including virus attacks, compromises of the network systems and services, and legal issues.
If you have any questions or concerns about this policy, please contact the listed Agency Head, TAC, or ARSO.
45-74.6 Audit Policy for CBI
This policy applies to Goodwill of Colorado, Goodwill Industrial Services Corporation, Goodwill of Colorado Foundation (collectively, Goodwill). The purpose of this policy is to outline the auditing responsibilities and accountability for Goodwill. Goodwill will carefully assess the inventory of components that compose Goodwill’s information systems to determine which security controls are applicable to the various components.
If you have any questions or concerns about this policy, please contact the listed Agency Head, TAC, or ARSO.
45-74.7 Criminal History Record Information (CHRI) Appropriate Use Policy for CBI
This policy applies to Goodwill of Colorado, Goodwill Industrial Services Corporation, Goodwill of Colorado Foundation (collectively, Goodwill). The purpose of requesting a fingerprint background check for new hires, employees, contractors, and volunteers is to protect Goodwill from liability caused by "negligent hiring" situations, and to ensure that the best possible candidates are hired/employed. Goodwill will request CHRI via Colorado Bureau of Investigation (CBI) and Federal Bureau of Investigation (FBI) fingerprint-based background report. This information shall be used solely for the purpose requested and cannot be disseminated outside the receiving departments, related agencies, or other authorized entities.
If you have any questions or concerns about this policy, please contact the listed Agency Head, TAC, or ARSO.