id-11-1001-2501: Rules Governing Idaho Public Safety and Security Information System (ZBR Chapter Rewrite)
Get alerted when the next rule lands
New rules open for comment on their own schedule. Pick how you want to hear about them — we email you when one appears.
Publishing to members? Embed a live rule tracker on your own site — the proposed rules in your area and the comment deadlines closing on them, updating themselves. Free, one line of HTML.
Create a free account & build one →What this rule does
This proposed rule outlines the regulations for the Idaho Public Safety and Security Information System. It aims to establish guidelines for how this system will operate and manage information related to public safety and security.
Plain-language description generated by AI — not the agency’s official summary, which we have not captured for this rule. Read the official text →
The rule, in full
6,714 words as published, June 04, 2025. View the original →
Dear Senators LAKEY, Shippy, Wintrow, and Representatives SKAUG, Alfieri, Gannon: The Legislative Services Office, Research and Legislation, has received the enclosed rules of the Idaho State Police - Idaho State Police - Public Safety and Security Information: IDAPA 11.10.01 - Rules Governing Idaho Public Safety and Security Information System (ZBR Chapter Rewrite)-Proposed Rule (Docket No. 11-1001-2501). Pursuant to Section 67-454, Idaho Code, a meeting on the enclosed rules may be called by the cochairmen or by two (2) or more members of the subcommittee giving oral or written notice to Research and Legislation no later than fourteen (14) days after receipt of the rules' analysis from Legislative Services. The final date to call a meeting on the enclosed rules is no later than 08/28/2025. If a meeting is called, the subcommittee must hold the meeting within forty-two (42) days of receipt of the rules' analysis from Legislative Services. The final date to hold a meeting on the enclosed rules is 09/25/2025. The germane joint subcommittee may request a statement of economic impact with respect to a proposed rule by notifying Research and Legislation. There is no time limit on requesting this statement, and it may be requested whether or not a meeting on the proposed rule is called or after a meeting has been held. To notify Research and Legislation, call 334-4854, or send a written request to the address on the memorandum attached below. Page 1 of 1 Terri Kondeff Director MEMORANDUM TO: Rules Review Subcommittee of the Senate Judiciary & Rules Committee and the House Judiciary, Rules & Administration Committee FROM: Principal Legislative Drafting Attorney - Ryan Bush DATE: August 11, 2025 SUBJECT: Idaho State Police - Idaho State Police - Public Safety and Security Information IDAPA 11.10.01 - Rules Governing Idaho Public Safety and Security Information System (ZBR Chapter Rewrite)-Proposed Rule (Docket No. 11-1001-2501) Summary and Stated Reasons for the Rule The Idaho State Police (ISP) submits notice of proposed rulemaking at IDAPA 11.10.01 - Rules Govern- ing Idaho Public Safety and Security Information System (ZBR Chapter Rewrite). ISP states that it performed a comprehensive review of the chapter and that the proposed rule will reduce the regulatory burden and in- crease clarity. The proposed rule makes significant revisions to user responsibilities, information access and dissemination, ILETS security, and access agency sanctions. Negotiated Rulemaking / Fiscal Impact Negotiated rulemaking was conducted, and notice was filed in the June edition of the Idaho Administra- tive Bulletin. There is no anticipated fiscal impact associated with this rulemaking. Statutory Authority The proposed rulemaking appears to be within the statutory authority granted to ISP in Section 19-5203, Idaho Code. cc: Idaho State Police - Idaho State Police - Public Safety and Security Information Tecia Ferguson *** PLEASE NOTE *** Per the Idaho Constitution, all administrative rules may be reviewed by the Legislature during the next legisla- tive session. The Legislature has 3 options with this rulemaking docket: 1) Approve the docket in its entirety; 2) Reject the docket in its entirety; or 3) Reject the docket in part. Paul Headlee, Deputy DirectMatt Drake, Manager Keith Bybee, Manager April Renfro, Manager Norma Clark, Manager Legislative Services OffResearch & Legislation Budget & Policy AnalysLegislative AuditsInformation Technology Statehouse, P.O. Box 83720 Tel: 208–334–2475 Boise, Idaho 83720–0054 legislature.idaho.gov IDAPA 11 – IDAHO STATE POLICE IDAHO PUBLIC SAFETY AND SECURITY INFORMATION SYSTEM 11.10.01 – RULES GOVERNING IDAHO PUBLIC SAFETY AND SECURITY INFORMATION SYSTEM DOCKET NO. 11-1001-2501 (ZBR CHAPTER REWRITE) NOTICE OF RULEMAKING – PROPOSED RULE AUTHORITY: In compliance with Section 67-5221(1), Idaho Code, notice is hereby given that this agency has initiated proposed rulemaking procedures. The action is authorized pursuant to Sections 19-5201, 19-5203, and 19- 5204 Idaho Code. PUBLIC HEARING SCHEDULE: Public hearing(s) concerning this rulemaking will be scheduled if requested in writing by twenty-five (25) persons, a political subdivision, or an agency, not later thanAugust 20, 2025. The hearing site(s) will be accessible to persons with disabilities. Requests for accommodation must be made not later than five (5) days prior to the hearing to the agency address below. DESCRIPTIVE SUMMARY: The following is a nontechnical explanation of the substance and purpose of the proposed rulemaking: ISP initiated this rulemaking in compliance with Executive Order No. 2020-01 Zero-Based Regulation issued by Governor Little. Pursuant to the order, ISP performed a comprehensive review of the chapter to reduce the regulatory burden and increase clarity. FEE SUMMARY: The following is a specific description of the fee or charge imposed or increased: There is no increase in fees associated with this rulemaking. FISCAL IMPACT: The following is a specific description, if applicable, of any negative fiscal impact on the state general fund greater than ten thousand dollars ($10,000) during the fiscal year resulting from this rulemaking: There is no fiscal impact to the general fund associated with this rulemaking. NEGOTIATED RULEMAKING: Pursuant to Section 67-5220(1), Idaho Code, negotiated rulemaking was conducted. The Notice of Intent to Promulgate Rules - Negotiated Rulemaking was published in the June 4, 2025 IdahoAdministrative Bulletin, Volume 25-6, pages 24-25. INCORPORATION BY REFERENCE: Pursuant to Section 67-5229(2)(a), Idaho Code, the following is a brief synopsis of why the materials cited are being incorporated by reference into this rule: Incorporated Documents. IDAPA 11.10.01 incorporates by reference the full text of the requirements relating to criminal justice information and the system used to transport such information found in the following documents: • “Criminal Justice Information Systems,” 28 CFR Part 20; • “Criminal Justice Information Systems--CJIS Security Policy,” Federal Bureau of Investigation, Criminal Justice Information Services (CJIS) Division, Version 6.0 (January 2025); • “National Crime Information Center 2000, Operating Manual,” Federal Bureau of Investigation, National Crime Information Center (August 2015); • The International and Public Safety Network, NLETS, Users Guide, (April 23, 2025); • The Idaho Public Safety and Security Information System User Manual. ASSISTANCE ON TECHNICAL QUESTIONS, SUBMISSION OF WRITTEN COMMENTS: For assistance on technical questions concerning the proposed rule, contact Bureau Chief Leila McNeill at 208-884-7136, email Leila.mcneill@isp.idaho.gov. Anyone may submit written comments regarding this proposed rulemaking. All written comments must be directed to the undersigned and must be delivered on or beforeAugust 27, 2025. IdahoAdministrative Bulletin Page 15 August 6, 2025 – Vol. 25-8 IDAHO STATE POLICE Docket No. 11-1001-2501 Idaho Public Safety & Security Information System Rules ZBR Proposed Rulemaking DATED this 27th day of June, 2025. Lieutenant Colonel Russ Wheatley, Chief of Staff Idaho State Police 700 S Stratford Drive Meridian, ID 83642 (208) 884-7004 Russ.wheatley@isp.idaho.gov THE FOLLOWING IS THE PROPOSED TEXT OF DOCKET NO. 11-1001-2501 (ZBR Chapter Rewrite.) 11.10.01 – RULES GOVERNING IDAHO PUBLIC SAFETY AND SECURITY INFORMATION SYSTEM 000. LEGALAUTHORITY. Title 19, Chapter 52, Idaho Code, creates an information system board and authorizes it to make rules necessary to establish and operate the Idaho Public Safety and Security Information System, known as “ILETS.”.(3-23-22)( ) 001. SCOPE. These rules relate to the governance and operation of the Idaho Public Safety and Security Information System. (3-23-22) 002. INCORPORATION BY REFERENCE.
01. Incorporated Documents. IDAPA 11.10.01 incorporates by reference the full text of the
requirements relating to criminal justice information and the system used to transport such information found in the following documents: (3-23-22) a. “Criminal Justice Information Systems,” 28 CFR Part 20 (July 1, 2006); (3-23-22) b. “Criminal Justice Information Systems--CJIS Security Policy,” Federal Bureau of Investigation, Criminal Justice Information Services (CJIS) Division, Version 5.8 6.0 (June 2019January 2025); (3-23-22)( ) c. “National Crime Information Center 2000, Operating Manual,” Federal Bureau of Investigation, National Crime Information Center (August 2015); (3-23-22) d. The International and Public Safety Network, NLETSlets, Users Guide, (October 19, 2012April 23, 2025); (3-23-22)( ) e. The International and Public Safety Network, NLETS, Policies and Procedures, (October 19, 2012)The Idaho Public Safety and Security Information System User Manual. (3-23-22)( )
02. Document Availability. The above listed documents are available during normal working hours
for inspection and copying at the Idaho State Police. (3-23-22) 003. -- 009. (RESERVED) 010. DEFINITIONS. IdahoAdministrative Bulletin Page 16 August 6, 2025 – Vol. 25-8 IDAHO STATE POLICE Docket No. 11-1001-2501 Idaho Public Safety & Security Information System Rules ZBR Proposed Rulemaking
01. Access Agency. An agency that electronically accesses ILETS through the services of an interface
agency. (3-23-22)
02. Administration of Criminal Justice. (3-23-22)
a. Performance of any of the following activities: detection, apprehension, detention, pretrial release, post-trial release, prosecution, adjudication, correctional supervision, or rehabilitation of accused persons or criminal offenders. (3-23-22) b. It also includes: criminal identification activities; and collection, storage, and dissemination of criminal history record information. (3-23-22)
03. Associated System. Any automated or manual information system that is accessible through
ILETS. (3-23-22)
04. Board. The Board created by Title 19, Chapter 52, Idaho Code to establish priorities and
operational policies and procedures relating to ILETS. (3-23-22)
05. Criminal JusticeAgency. (3-23-22)
a. Federal and state courts having jurisdiction to hear criminal matters; and (3-23-22) b. A government agency or a subunit of a government agency that performs the administration of criminal justice pursuant to a statute or executive order and that allocates a substantial part of its annual budget to the administration of justice. State and federal Inspectors General Offices are included. (3-23-22)( )
07. Executive Officer. A position on the ILETS Board filled by the director of the Idaho State Police,
or its successor agency. (3-23-22)
08. III. The Interstate Identification Index, which is a cooperative federal-state system for the
exchange of automated criminal history records and, to the extent of their participation in the III system, the criminal history repositories of the states. (3-23-22)
09. ILETS. The Idaho Public Safety and Security Information System as established by the director of
Idaho State Police pursuant to Title 19, Chapter 52, Idaho Code, includes all hardware, software, electronic switches, peripheral gear, microwave links, and circuitry that comprise the system. (3-23-22)
10. Interface Direct Access Agency. An agency that has management control of a computer system
directly connected to ILETS. (3-23-22)( )
11. Management Control Agreement. A written agreement between a criminal justice agency and a
non-criminal justice agency that provides services (dispatching, record keeping, computer services, etc.) to the criminal justice agency. The agreement gives the criminal justice agency authority to set and enforce policies governing the non-criminal justice agency’s access to ILETS and ILETS derived information. (3-23-22)( )
12. NCIC 2000. The Federal Bureau of Investigation National Crime Information Center, is a
computerized information system that includes telecommunications lines and message facilities authorized by law, regulation, or policy approved by the United States Attorney General to link local, state, tribal, federal, foreign, and international criminal justice agencies for the purpose of exchanging NCIC related information The National Crime Information Center (NCIC) System is a nationwide information system established as a service to all criminal justice agencies – federal, state, local, tribal, and territorial. The goal of the NCIC System is to help the criminal justice community perform its duties by providing and maintaining a filing system of accurate and timely documented criminal justice information. (3-23-22)( )
13. NLETS. The International Justice and Public Safety Information Sharing Network, is a national
IdahoAdministrative Bulletin Page 17 August 6, 2025 – Vol. 25-8 IDAHO STATE POLICE Docket No. 11-1001-2501 Idaho Public Safety & Security Information System Rules ZBR Proposed Rulemaking computerized message switching system that links national and state criminal justice information systems. (3-23-22)
14. Non-Criminal Justice Agency. A state agency, federal agency, or unit of local government that is
not a criminal justice agency. The term does not refer to private individuals, corporations, or non-governmental agencies or organizations. (3-23-22) 011. (RESERVED) 012. EXECUTIVE OFFICER OFTHE BOARD.
01. Authority of Office. The executive officer represents the Board in the day-to-day administration of
ILETS and is responsible for ensuring that all implementing Board policies and decisions of the Board are promulgated pursuant to the authority of Chapter 52, Title 19, Idaho Code. The executive officer may delegate duties to employees and officers of the department and executes instruments for, and on behalf of, the Board and ILETS. (3-23-22) ( )
02. Additional Responsibilities. The executive officer is responsible for ensuring, subject to adequate
legislative appropriations, that the Board receives adequate staff support and that the following staff duties are performed: ensures, within available legislative appropriation, that the Board has sufficient staff support and that staff carry out duties including posting meeting notices, preparing and distributing agendas, keeping official records of Board meetings, and managing all documents related to the Board and ILETS operations. (3-23-22)( ) a. Preparation and dissemination of agendas, posting of legal notices of all meetings, and maintenance of a written record of the proceedings of board meetings; and (3-23-22) b. Management of all documents relating to the Board and ILETS operations. (3-23-22) 013. -- 015. (RESERVED) 016. ILETS NETWORK.
01. Establishment. The executive officer establishes ILETS as a program of the Idaho State Police or
its successor agency. (3-23-22)
02. Responsibilities. The program, as established by the executive officer, has the following
responsibilities: (3-23-22) a. Develop and operate a computerized criminal justice telecommunications and information system that provides message switching and record inquiry and retrieval capabilities. (3-23-22) b. Publish an ILETS Operations Manual and distribute copies to each user agency make available to all user agencies. (3-23-22)( ) c. Function as the NCIC control terminal agency and the NLETS control terminal agency for the State of Idaho. (3-23-22) d. Assist and train criminal justice agencies regarding information retrieved from ILETS and associated systems for use in administration of criminal justice. (3-23-22) e. DevelopEstablish and maintain linkages connections with the Idaho Transportation Department, Idaho Department of Correction, and other Idaho agencies and systems to make appropriate share information available to Idaho criminal justice agencies that will assist them in the supports enforcement of state criminal and traffic laws and regulations. (3-23-22)( ) f. Provide staff support to the ILETS Board. (3-23-22) g. Operate and maintain a program of record validation, quality control, and audits to ensure that IdahoAdministrative Bulletin Page 18 August 6, 2025 – Vol. 25-8 IDAHO STATE POLICE Docket No. 11-1001-2501 Idaho Public Safety & Security Information System Rules ZBR Proposed Rulemaking records entered into in ILETS and NCIC files by the department and user agencies are kept timely, accurate, and complete, and that compliance and compliant with state and national standards is maintained. (3-23-22)( ) h. Create and maintain model management control agreements between criminal justice agencies and non-criminal justice agencies. (3-23-22)( ) i. Provide assistance and information access to non-criminal justice user agencies for statutory licensing, employment and, regulatory purposes and for other purposes legally authorized by law and approved by the Board. (3-23-22)( ) 017. AGENCYACCESS TO ILETS.
01. Authorized Agencies. Consistent with Title 19, Chapter 52, Idaho Code, which mandates the
exclusive use of ILETS for law enforcement and traffic safety purposes, access to ILETS is restricted to the following governmental agencies: (3-23-22) a. Criminal justice agencies; (3-23-22) b. Non-criminal agencies that provide computer services, dispatching support, or other direct support service to one (1) or more criminal justice agencies, and which have signed an ILETS-approved management control agreement with the criminal justice agency; (3-23-22) c. Non-criminal justice agencies with a statutory requirement to use information capabilities that may be available via ILETS, and use of terminal access will not adversely affect criminal justice agency users, and use of the terminal will be for the administration of criminal justice; and (3-23-22)( ) d. Non-criminal justice agencies that provide information or capabilities needed by criminal justice agencies for a criminal justice purpose, and access or use of a terminal will improve the ability to provide such information or capabilities.; and (3-23-22)( ) e. Providing services to criminal justice agencies does not, by itself, authorize ILETS access. ( )
02. Management Control Agreements. The management control agreement between a criminal
justice agency and a non-criminal justice agency grants to the criminal justice agency the authority to set and enforce: (3-23-22) a. Priorities of service; (3-23-22) b. Standards for the selection, supervision, and termination of personnel authorized to access ILETS; and (3-23-22) c. Policies governing the operation of computers, circuits, and telecommunications terminals used to process, store, or transmit information to or receive information from ILETS. (3-23-22)
03. Board Approval. The Board reviews all requests for access to ILETS and determines whether an
agency meets the criteria for access and whether access is appropriate based on system resources. Approved non- criminal justice agencies may have access to ILETS information on a limited basis (for example, motor vehicle information only) as authorized by the Board. (3-23-22) 018. USERACCESS FEES.
01. Payment of Fees Required. Any agency that has signed a user agreement with ILETS to have
direct terminal or system access to the network must pay access and usage fees as provided in Section 018. (3-23-22)
02. ILETS Network User Access Fees. The access fees approved by the Board and to be collected
quarterly in advance by the department are as follows: (3-23-22) IdahoAdministrative Bulletin Page 19 August 6, 2025 – Vol. 25-8 IDAHO STATE POLICE Docket No. 11-1001-2501 Idaho Public Safety & Security Information System Rules ZBR Proposed Rulemaking a. An agency at the county or municipal level pays an annual access fee of five thousand, four hundred and twenty-five dollars ($5,425). (3-23-22) b. An agency at the state, federal, or tribal level pays an annual access fee of nine thousand dollars ($9,000). (3-23-22)
03. Usage Fee. Any agency that has signed a user agreement with ILETS to have direct terminal or
system access to the ILETS network pays quarterly a usage fee based on that agency’s percentage of total annual messages sent and received by user agencies through the ILETS message switcher. The total percentage for an agency includes the message traffic generated by any other agency authorized to access ILETS through that agency’s direct terminal or system access. (3-23-22) a. The usage fee is assessed according to the following schedule: Percentage of Total ILETS Annual Usage Fee Message Traffic Effective October 1, 2023 0 -.25% $3,750 .26 -.50% $7,500 .51 -.75% $15,000 .76 - 1.0% $24,000 1.01 - 1.50% $32,500 1.51 – 2.0% $48,750 2.01 – 5.0% $69,625 > 5.01% $98,939 (7-1-24) b. The department will conduct audits of ILETS message switcher traffic for even-numbered years to determine an agency’s annual usage fee. This fee is effective for two (2) years and begins with the quarterly statement beginning October 1 of odd-numbered years. (3-23-22) c. If an agency discontinues direct terminal or system access to ILETS and acquires authorized access through another agency, the usage fee for the agency maintaining direct access will be adjusted to reflect the combined historical usage. (3-23-22) d. A new agency approved for direct ILETS access that does not have historical usage will be assessed an interim usage fee by the department pending the next audit of ILETS message traffic. The department sets an interim fee based on the agency’s similarities to existing agencies with direct terminal or system access. An agency may appeal the interim usage fee set by the department to the ILETS Board. (3-23-22) e. As operator of ILETS, the department, in lieu of payment of fees, provides direct and in-kind support of network operations. The Board reviews biennially the proportion of that support to the overall operating cost of the system. (3-23-22)
04. Billing and Payment. The department mails billing statements quarterly to all agencies with direct
terminal or system access to ILETS (October 1, January 1,April 1, and July 1). Payment of the fees is due by the first day of the following month of each quarter (October 1, January 1, April 1, and July 1), unless it is a Saturday, a Sunday, or a legal holiday, in which event the payment is due on the first successive business day.(3-23-22)( )
05. Sanctions for Delinquency.Any user agency that becomes delinquent in payment of assessed fees
is subject to sanctions under Section 028. (3-23-22) IdahoAdministrative Bulletin Page 20 August 6, 2025 – Vol. 25-8 IDAHO STATE POLICE Docket No. 11-1001-2501 Idaho Public Safety & Security Information System Rules ZBR Proposed Rulemaking 019. ADJUSTED ACCESS FEES DURING PILOT PROJECTS. The Board may adjust access fees of user agencies participating in pilot projects being conducted by the department in behalf of ILETS. The fee adjustment is based on any cost savings, actual or anticipated, realized by the ILETS network. (3-23-22) 020. USER RESPONSIBILITIES.
01. User Agreement. Any agency with access to ILETS, whether directly or through another agency,
is responsible for adhering to all applicable ILETS rules and policies and must have signed an agreement with ILETS or an interface agency to that effect accessing ILETS, directly or through another agency, must comply with all ILETS rules and policies and have a signed agreement with ILETS or the direct access agency. (3-23-22)( )
02. Record Validation. Any agency that enters information into ILETS or NCIC files is responsible
for the accuracy, timeliness and completeness of that information. ILETS will send a record validation review list, regularly, to each agency. Validation is accomplished by reviewing the original entry and current supporting documents. Recent consultation with any appropriate complainant, victim, prosecutor, court, motor vehicle registry files, or other appropriate source or individual also is required with respect to the wanted person, missing person, and vehicle files. In the event the agency is unsuccessful in its attempts to contact the victim, complainant, etc., the entering authority must make a determination based on the best information and knowledge available whether or not to retain the original entry in the file. Validation procedures must be formalized and copies of these procedures be on file for review during an ILETS or NCIC audit. When the agency has completed the validation process, the records must be modified to verify their validity no later than thirty (30) days after receiving electronic notification. (3-23-22) 032. Minimum TrainingILETS Certification. Each agency employee who operates a computer to access ILETS must complete ILETS training at a level consistent with the employee's duties. Each employee who operates a computer to access ILETS must be re-certified within three months of accessing ILETS and by the agency every two (2) years thereafter. (3-23-22)( ) 04. Hit Confirmation. When another agency receives a positive record response (Hit) from ILETS or NCIC and requests confirmation of the status of the record (warrant, stolen vehicle, etc.), the agency responsible for entry of the record must respond within ten (10) minutes for urgent hit confirmation requests or within one (1) hour for routine hit confirmation requests, with an answer that indicates the status of the record or a time frame when the record status will be confirmed. (3-23-22) 05. Terminal Agency Coordinators. The agency administrator of each agency with computer access to ILETS must designate one (1) or more terminal agency coordinators who will be the primary contact(s) for all matters relating to use of ILETS by the agency. A terminal agency coordinator must have sufficient authority to implement and enforce necessary policy and procedures. (3-23-22) 063. Background Checks of Terminal Operators ILETS Authorized Users Required. Policies for access to the FBI-NCIC system require background screening of all terminal operators with access to the NCIC system. For efficiency and consistency, the NCIC background screening policies are also adopted for all ILETS access All persons accessing ILETS or ILETS-derived information must undergo a national Criminal Justice fingerprint-based records check, in accordance with FBI CJIS policies. These screening policies are adopted for all ILETS access to ensure consistency. Results must meet the Board-approved ILETS access criterion, and persons must be approved before access is granted. (3-23-22)( ) 021. INFORMATIONACCESS AND DISSEMINATION.
01. General Policy. Information is made available to ILETS users from various sources and agencies,
including ILETS and other state justice information system files, motor vehicle departments, NCIC, and NLETS. Each user must observe any restrictions placed on the use or dissemination of information by its source. It is ILETS' responsibility to advise user agencies of any restrictions which apply to any information accessed via ILETS ILETS users receive information from multiple sources, including ILETS, Idaho criminal justice agencies, motor vehicle departments, FBI CJIS, and Nlets. Users must follow any restrictions set by the information source. ILETS is responsible for informing users of applicable access or dissemination restrictions. (3-23-22)( ) IdahoAdministrative Bulletin Page 21 August 6, 2025 – Vol. 25-8 IDAHO STATE POLICE Docket No. 11-1001-2501 Idaho Public Safety & Security Information System Rules ZBR Proposed Rulemaking
02. Criminal History Records. Criminal history information accessed via ILETS from a state or
national computerized file is available only to criminal justice agencies for criminal justice purposes. This precludes the dissemination of such information for use in connection with licensing applications, regulatory activities, or local or state employment, other than with a criminal justice agency. (3-23-22)
03. Administrative Messages. An administrative message (AM) is a free text message from one (1)
agency to one (1) or more agencies.All administrative messages transmitted via ILETS must be by the authority of an authorized user and relate to criminal justice purposes or matters of interest to the user community. Administrative messages sent within Idaho, either statewide, regionally or to individual terminal identifiers are subject to the following restrictions: (3-23-22) a. No messages supportive or in opposition to political issues, labor management issues, or announcements of meetings relative to such issues. (3-23-22) b. No messages supportive or in opposition of legislative bills. (3-23-22) c. No requests for criminal history record information. (3-23-22) 022. -- 023. (RESERVED) 024. ILETS SECURITY.
01. General Policy. The data stored in the ILETS, NCIC, and other criminal justice information system
files is documented criminal justice information. This information must be protected to ensure its integrity and its correct, legal and efficient storage, dissemination and use. It is incumbent upon an agency accessing ILETS directly, or another system that has access to the ILETS network, to implement the procedures necessary to make the access device secure from any unauthorized use and to ensure ILETS is not subject to a malicious disruption of service. ILETS access agencies must participate in ILETS training and compliance activities to ensure that all agency personnel authorized to access the ILETS network are instructed in the proper use and dissemination of the information and that appropriate agency personnel are aware of security requirements and of the dangers to network integrity. ILETS may impose more stringent or additional protection measures than outlined in this document. ILETS retains the authority to disconnect an access agency or network connection when serious security threats and vulnerabilities are detected. (3-23-22)( )
02. Definitions. The following is a list of terms and their meanings as used in the ILETS security rule:
(3-23-22) a. Computer interface capabilities means any communication to ILETS allowing an agency to participate in the system. (3-23-22) b. Firewall means a collection of components placed between two (2) networks that keep the host network secure by having the following properties: (3-23-22) i. All traffic from inside the network to outside, and vice-versa, must pass through it; (3-23-22) ii. Only authorized traffic is allowed to pass; and (3-23-22) iii. The components as a whole are immune to unauthorized penetration and disablement. (3-23-22) ca. ILETS Security Officer (ISO) is the department staff member designated by the executive officer to monitor and enforce agency compliance with site and network security requirements. This position contains additional responsibilities as defined in the CJIS Security Policy as CJIS Systems Agency Information Security Officer. (3-23-22)( ) db. Peer networks are computer interfaces between cooperative governmental agencies in Idaho where none of the participating entities exercise administrative or management control over any other participating entity. IdahoAdministrative Bulletin Page 22 August 6, 2025 – Vol. 25-8 IDAHO STATE POLICE Docket No. 11-1001-2501 Idaho Public Safety & Security Information System Rules ZBR Proposed Rulemaking (3-23-22) ( ) e. Interface agency is an agency that has management control of a computer system directly connected to ILETS. (3-23-22) fc. Untrusted system is any system or series of systems that does not employ sufficient hardware or software security measures to allow its use for simultaneously processing a range of sensitive or confidential information meet the compliance requirements of ILETS, Nlets, CJIS Security Policy, and/or are not authorized for access to ILETS information. (3-23-22)( )
03. Interface Direct Access Agency Agreements. To ensure agencies having computer interface
capabilities to ILETS are fully aware of their duties and of the consequences of failure to carry out those duties, a written and binding Interface Direct Access Agency Addendum Agreement must exist between ILETS and all interface direct access agencies. This agreement will clarify that the interface direct access agency is equally responsible for actions by secondary and affiliated systems connected through their site to ILETS. Interface Direct access agencies must put in place similar subsidiary security agreements with secondary and affiliated systems to protect its network and ILETS. (3-23-22)( )
04. ILETS Security Officer. The ILETS Security Officer is responsible for the following duties:
(3-23-22) a. DisseminatingMake available to user agencies copies of ILETS security policies and guidelines; (3-23-22)( ) b. Communicating to user agencies information regarding current perceived security threats and providing recommended measures to address the threats; (3-23-22) c. Monitoring use of the ILETS network systems either in response to information about a specific threat, or generally because of a perceived situation; (3-23-22)( ) d. Directing an interface direct access agency, through its nominated appropriate contact, to rectify any omission in its duty of responsibility compliance findings; (3-23-22)( ) e. When an agency is unable or unwilling to co-operate, reporting the issue to the executive officer and initiating the procedure for achieving an emergency disconnection escalated sanctions pursuant to IDAPA 11.10.01 section 28; and (3-23-22)( ) f. Provide support and coordination for investigations into breaches of security. (3-23-22)
05. Agency Security Contacts. A terminal agency coordinator shall serve as that agency’s security
contact for ILETS, unless another individual is specifically selected for this purpose and approved by the ILETS Security Officer. ILETS primary sites shall ensure the agency’s security contact, or another person or position designated in an incident contingency plan, can be contacted by the ILETS security officer at any time. (3-23-22)
06. Peer Networks. The security responsibilities of the operators of peer networks connected to
ILETS, with respect to their user organizations, are parallel to those of ILETS user organizations in respect to their individual users. The ILETS Security Officer shall ensure that a written agreement exists between ILETS and an interface agency, signed by the agency heads, that embodies these principles. (3-23-22)
07. Physical Security Standards. Interface agencies will observe standards and procedures to ensure
security of the physical premises and computing equipment. The minimum standards and procedures include the following: (3-23-22) a. Access to computer rooms will be limited to staff who require access for the normal performance of their duties. (3-23-22) b. Electrical power protection devices to suppress surges, reduce static, and provide battery backup in IdahoAdministrative Bulletin Page 23 August 6, 2025 – Vol. 25-8 IDAHO STATE POLICE Docket No. 11-1001-2501 Idaho Public Safety & Security Information System Rules ZBR Proposed Rulemaking the event of a power failure will be used as necessary. (3-23-22) c. Computer system backups shall be stored in a secure location with restricted access. (3-23-22) d. Network infrastructure components will be controlled with access limited to support personnel with a demonstrated need for access. (3-23-22) e. Physical labeling of infrastructure components will be done to assist in proper identification. Additionally, all components will be inventoried at regular intervals for asset management and physical protection. (3-23-22) f. An interface agency must create and enforce a password policy in which the agency is responsible for assigning ILETS users a unique password. The password policy must require that a new password be initiated by the user or agency every ninety (90) days. (3-23-22) 087. Network/Physical/Personnel Security Standards. User agencies must exercise appropriate security precautions when connecting ILETS and computer systems linked to ILETS with external untrusted systems. The primary objective of such precautions is to prevent unauthorized access to sensitive information while still allowing authorized users free access. The minimum standards and procedures include the following:Are established through the incorporation by reference of the CJIS Security Policy. (3-23-22)( ) a. Agencies must routinely audit for and remove unused or unneeded services/accounts, review accounts periodically, and enforce aggressive and effective password strategies. (3-23-22) b. Agencies must ensure that the software security features of the networks they manage are installed and functioning correctly. (3-23-22) c. Agencies must monitor network security on a regular basis. Adequate information concerning network traffic and activity must be logged to ensure that breaches in network security can be detected. (3-23-22) d. Agencies must implement and maintain procedures to provide the ILETS network adequate protection from intrusion by external and unauthorized sources. (3-23-22) e. No computer connected to the network can have stored, on its disk(s) or in memory, information that would permit access to other parts of the network. For example, scripts used in accessing a remote host may not contain passwords. (3-23-22) f. No connection to ILETS may be established utilizing dial-up communications. Asynchronous communications connections should be limited and tightly controlled as they pose a serious risk because they can circumvent any security precaution enacted to protect networks from untrusted sources. (3-23-22) g. Network management protocols must be limited to internal or trusted networks. (3-23-22) h. Any system having direct or indirect access to the Internet via their computer network must have in place services that allow no access to ILETS from the Internet. Organizations with large distributed Wide Area Networks connecting many remote sites may choose to incorporate many security layers and a variety of strategies. These strategies must incorporate the implementation of a firewall to block network traffic, and restriction of remote user access. (3-23-22) i. Agencies accessing ILETS directly or through another agency, must insure that all telecommunications infrastructure meets the FBI CJIS Security Policy for encryption standards. (3-23-22) j. No routing or IP Network Translations are to be performed on individual access devices. All routing and translation must be performed on a router or firewall device. (3-23-22) 025. -- 0276. (RESERVED) IdahoAdministrative Bulletin Page 24 August 6, 2025 – Vol. 25-8 IDAHO STATE POLICE Docket No. 11-1001-2501 Idaho Public Safety & Security Information System Rules ZBR Proposed Rulemaking 027. MISUSE OFTHE ILETS SYSTEM AND/OR DERIVED INFORMATION Refer to the ILETS Manual. ( ) 028. USERACCESS AGENCY SANCTIONS.
01. Review of Violations. The board reviews violations of ILETS rules and may impose appropriate
sanctions on access agencies. (3-23-22)
02. Objective of Sanctions. The objectives of the sanction procedure are as follows: (3-23-22)
a. To ensure the security, integrity, availability, and financial stability of the ILETS and access agencies. (3-23-22)( ) b. To create an awareness among access agencies of the importance of following rules, regulations, and procedures in order to minimize the risk to liabilities that may be incurred by misuse of the system and access to its information. (3-23-22)
03. Class Severity of Sanctions. Sanctions are based upon the class severity of violation, any previous
violations offenses, and any exposure to criminal and civil liabilities that the violation might place on the system, its officials, and the offending agency potential legal risks. Violations are classed as either administrative (minor) or security (serious) violations. Security violations are defined as ones which have or could result in access of ILETS data by unauthorized individuals. All other violations are classed as administrative. When deciding on sanctions, the Board considers the violation’s severity, prior sanctions, and any corrective action plans submitted by the offending agency. Sanctions can include various actions as determined by the Board. The Board may impose as sanctions, one (1) or more of the following: (3-23-22)( )
04. Form of Sanctions. When imposing sanctions, the Board considers the severity of the violation,
the violation type, either administrative or security, and previous sanctions issued. The Board may require the violating agency to submit a mediation plan showing how the violation will be corrected and future violations prevented. The Board shall consider such a mediation plan, if submitted, when imposing sanctions. The Board may impose as sanctions one (1) or more of the following: (3-23-22) a. Written warning. (3-23-22) b. Written notice of violation. (3-23-22) c. Written notice of probation. (3-23-22) d. Written notice of temporary suspension. (3-23-22) e. Written notice of permanent suspension. (3-23-22) 054. Effective Date of Sanctions. Temporary or permanent suspension of service will not begin, unless an emergency exists, until fifteen (15) days after the agency head has received written notice by certified mail or personal service. (3-23-22) 065. Reinstatement. An agency placed on permanent suspension may apply to the Board for reinstatement. (3-23-22) 029. -- 999. (RESERVED) IdahoAdministrative Bulletin Page 25 August 6, 2025 – Vol. 25-8 INCORPORATION BY REFERENCE SYNOPSIS In compliance with Section 67-5223(4), Idaho Code, the following is a synopsis of the differences between the materials previously incorporated by reference in this rule that are currently of full force and effect and newly revised or amended versions of these same materials that are being proposed for incorporation by reference under this rulemaking. The following agency of the state of Idaho has prepared this synopsis as part of the proposed rulemaking for the chapter cited here under the docket number specified: IDAPA 11 – IDAHO STATE POLICE IDAHO PUBLIC SAFETY AND SECURITY INFORMATION SYSTEM 11.10.01 – Rules Governing Idaho Public Safety and Security Information System Docket No. 11-1001-2501 (ZBR Chapter Rewrite) CJIS Security Policy Following version 5.8, the CJIS Security Policy went through seven incremental revisions, culminating in version 6.0. These updates were primarily focused on rewriting the cybersecurity control framework to align with federal standards, particularly NIST SP 800-53. The revised structure reflects current federal requirements and modern cybersecurity practices, while maintaining the policy’s focus on protecting Criminal Justice Information. A summary of changes between versions is provided at the beginning of the CJIS Security Policy. Nlets User Guide The Nlets User Guide is provided via the Nlets website. It was formally known as the Nlets Wiki, but the format has been updated and is now called the Nlets User Guide. Nlets User Guide : Nlets SUMMARY OF CHANGES Version 6.0 APB Approved Changes
1. Modernizing the Executive Summary, Section 1: Introduction, Section 2:
CJISSECPOLApproach, and Section 3: Roles and Responsibilities in the CJISSECPOL, Spring 2024, APB#11, SA#2: update sections with approved changes.
2. Changing and RefreshingAuthenticators in the CJISSECPOL, Spring 2024,
APB#11, SA#3: clarifies which authenticator type requires annual changing and clarifies the use of a “banned password” list.
3. Modernizing System and ServicesAcquisition (SA) in the CJISSECPOL, Spring
2024, APB#11, SA#5: add definitions and modernize the CJIS Security Policy requirements for: System and Services Acquisition Policy and Procedures Allocation of Resources System Development Lifecycle Acquisition Process System Documentation Security and Privacy Engineering Principles External System Services Developer Configuration Management Developer Testing and Evaluation Developer Process, Standards, and Tools
4. Modernizing Supply Chain and Risk Management (SR) in the CJISSECPOL, Spring
2024, APB#11, SA#6: modernize the CJIS Security Policy requirements for Supply Chain Risk Management Policy and Procedures Supply Chain Risk Management Plan Acquisition Strategies, Tools, and Methods Notification Agreements Inspection of Systems or Components Component Disposal
5. Modernizing Personnel Security (PS) in the CJISSECPOL, Spring 2024, APB#11,
SA#7: modernize the CJIS Security Policy requirements for Personnel Security Policy and Procedures Position Risk Designation Personnel Screening Personnel Termination Personnel Transfer Access Agreements External Personnel Security iii 12/27/2024 CJISSECPOL v6.0 Personnel Sanctions Position Descriptions
6. ModernizingAssessment,Authorization, and Monitoring (CA) in the CJISSECPOL,
Spring 2024, APB#11, SA#8: modernize the CJIS Security Policy requirements for Assessment, Authorization, and Monitoring Policy and Procedures Control Assessments Information Exchange Plan of Action and Milestones Authorization Continuous Monitoring Internal System Connections
7. RemoveAppendix J and K from the CJISSECPOL, Spring 2024, APB#11, SA#9:
remove the indicated appendices. Administrative Changes
1. There are no Administrative Changes in this version.
Note: Administrative changes are vetted through the Security and Access Subcommittee and not the entire APB process. KEY TO APB APPROVED CHANGES (e.g., “Section 5.13 Mobile Devices, Fall 2013, APB#11, SA#6, Future CSP for Mobile Devices: add language”): Section Number and Name Fall 2013 – Advisory Policy Board cycle and year APB# – Advisory Policy Board Topic number SA# – Security and Access Subcommittee Topic number Topic Paper Title Summary of change iv 12/27/2024 CJISSECPOL v6.0
Documents
- Full text (state register) · June 04, 2025
Don't miss the comment window
One Click Politics alerts you on every deadline, hearing, and rule change.
See all rules with comments due soon →