NCIC Strict Compliance 2 — Questions and Answers
Question 1: What does NCIC's strict compliance policy require of all participating agencies?
- Agencies must meet a 95% compliance rate with NCIC policies to maintain access
- Agencies must comply fully with all NCIC policies, procedures, and regulations — partial or substantial compliance is not acceptable (Correct answer)
- Strict compliance only applies to federal agencies; state agencies have broader discretion
- Agencies must comply with policies related to wanted persons but have flexibility in property file entries
Correct answer: Agencies must comply fully with all NCIC policies, procedures, and regulations — partial or substantial compliance is not acceptable
NCIC's strict compliance standard requires full compliance with all policies and procedures — there is no partial compliance standard; substantial compliance is insufficient.
NCIC's strict compliance standard means that participating agencies must adhere to all NCIC policies, procedures, and regulations without exception. Unlike some regulatory frameworks that allow for substantial compliance, NCIC requires that agencies meet all requirements because even small deviations can have serious consequences — erroneous entries can lead to wrongful arrests, inadequate security can compromise the entire network, and improper dissemination can violate individuals' rights. The FBI CJIS Division conducts triennial audits to verify compliance, and findings of non-compliance can result in corrective action requirements, retraining mandates, or suspension of access.
Question 2: Under the NCIC strict compliance standard, which personnel must receive NCIC training?
- Only sworn law enforcement officers who directly access NCIC terminals
- All personnel who access NCIC, including civilian dispatchers, records clerks, and any other staff who query or enter NCIC data (Correct answer)
- Only supervisors and NCIC administrators within an agency
- Only personnel who entered service after 2010
Correct answer: All personnel who access NCIC, including civilian dispatchers, records clerks, and any other staff who query or enter NCIC data
All personnel who access NCIC in any capacity — sworn or civilian — must receive appropriate NCIC training before being granted access.
NCIC's strict compliance standard requires that any individual who accesses NCIC — whether to enter records, conduct queries, receive query responses, or access training records — must be trained in NCIC policies and procedures appropriate to their level of access and responsibilities. This includes sworn law enforcement officers, civilian dispatchers, records clerks, and any other personnel with NCIC access. The training must be documented and agencies must maintain records of training completion. Personnel who have not received required training must not be granted NCIC access — allowing untrained personnel to use NCIC violates both the training requirement and the strict compliance standard.
Question 3: What is the consequence under strict compliance rules for an agency that misuses NCIC by running a personal inquiry on a neighbor?
- A written warning for the first offense with no access suspension
- Potential criminal charges, disciplinary action up to termination, and possible suspension or revocation of the agency's NCIC access (Correct answer)
- A civil fine paid by the individual officer
- Suspension of the individual officer's NCIC access for 30 days only
Correct answer: Potential criminal charges, disciplinary action up to termination, and possible suspension or revocation of the agency's NCIC access
Misuse of NCIC for personal inquiries violates strict compliance standards and can result in criminal prosecution of the individual, employment disciplinary action including termination, and potential suspension of the agency's NCIC access.
Using NCIC to run personal inquiries — checking on neighbors, romantic interests, personal acquaintances, or anyone without an official law enforcement reason — is a serious violation of NCIC's strict compliance standards and the 'need to know' principle. Consequences can be severe at multiple levels: the individual officer may face criminal prosecution under the Computer Fraud and Abuse Act or applicable state law, disciplinary action up to and including termination of employment, loss of professional certification in many states, and civil liability. At the agency level, a pattern of individual misuse violations can result in the FBI suspending or revoking the agency's NCIC access until comprehensive corrective measures are implemented.
Question 4: How does NCIC's strict compliance standard apply to the timeliness of record cancellations?
- Cancellations must occur within 48 hours of learning the record is no longer valid
- Records must be cancelled immediately upon learning the basis for the entry no longer exists — delays violate strict compliance (Correct answer)
- A 10-business-day grace period is allowed for routine cancellations
- Timeliness standards only apply to wanted person records, not property records
Correct answer: Records must be cancelled immediately upon learning the basis for the entry no longer exists — delays violate strict compliance
Strict compliance requires immediate cancellation when the basis for an NCIC record no longer exists — any delay is a violation regardless of how short the delay is.
NCIC's strict compliance standard explicitly includes timeliness of record cancellation. When the basis for an NCIC entry no longer exists — a warrant is recalled, a missing person is found, stolen property is recovered — the record must be cancelled as soon as practicable, meaning immediately upon learning the circumstance. There is no grace period. Even a brief delay in cancellation creates a window where an officer could act on a stale record, potentially resulting in a wrongful arrest or detention. Audits examine cancellation timeliness by comparing NCIC entry dates and cancellation dates with agency records of the underlying events to identify systematic delays.
Question 5: What role does the Terminal Agency Coordinator (TAC) play in ensuring strict compliance at the local agency level?
- The TAC is solely responsible for entering records into NCIC on behalf of the agency
- The TAC serves as the primary point of contact with the CJIS Systems Agency and is responsible for ensuring agency personnel comply with NCIC and CJIS policies (Correct answer)
- The TAC is an FBI employee embedded in local agencies to monitor compliance
- The TAC role is optional — small agencies are not required to designate one
Correct answer: The TAC serves as the primary point of contact with the CJIS Systems Agency and is responsible for ensuring agency personnel comply with NCIC and CJIS policies
The TAC is the agency's primary liaison with the CSA and bears responsibility for training, compliance monitoring, and ensuring the agency adheres to all NCIC and CJIS policies.
The Terminal Agency Coordinator (TAC) is a designated individual within each local agency who serves as the primary point of contact with the CJIS Systems Agency (CSA) for NCIC-related matters. The TAC's responsibilities are central to strict compliance: ensuring all personnel with NCIC access receive required training, maintaining documentation of training completion, coordinating with the CSA on access issues and policy updates, conducting internal compliance reviews, and addressing violations promptly. The TAC is the agency's first line of defense against non-compliance and must understand NCIC policies thoroughly. All agencies with NCIC access are required to designate a qualified TAC.
Question 6: What documentation must agencies maintain to demonstrate strict compliance during a CJIS audit?
- Only financial records showing payment of NCIC access fees
- Training records, signed user agreements, security assessment documentation, and records of audit results and corrective actions (Correct answer)
- Only arrest records created using NCIC data
- Documentation is not required — verbal confirmation of compliance is acceptable
Correct answer: Training records, signed user agreements, security assessment documentation, and records of audit results and corrective actions
Agencies must maintain comprehensive documentation including training records, user agreements, security assessments, and audit histories to demonstrate strict compliance during CJIS audits.
During triennial CJIS audits, agencies must be prepared to provide extensive documentation demonstrating ongoing compliance with NCIC and CJIS Security Policy requirements. Required documentation typically includes: training completion records for all personnel with NCIC access, signed user acknowledgment agreements, results of security assessments and vulnerability scans, documentation of corrective actions taken after previous audits or compliance violations, terminal agency agreements, and access control records. The inability to produce required documentation is itself a compliance finding, even if the underlying policies were being followed. Maintaining organized, current compliance documentation is a best practice and a strict compliance requirement.
NCIC Strict Compliance 2
What does NCIC's strict compliance policy require of all participating agencies?