6VAC35-160-110: Access controls for computer security

A. Where juvenile record information is computerized, logical access controls shall be implemented to ensure that records can be queried, updated, or destroyed only from approved system user accounts. Industry standard levels of encryption shall be required to protect confidential juvenile record information moving through any network.

B. The logical access controls shall be known only to the employees of the participating agency who are responsible for control of the juvenile record information system or to individuals and agencies operating under a specific agreement with the participating agency to provide such security programs. The access controls shall be kept secure.

C. Computer operations, whether dedicated or shared, that support juvenile record information shall operate in accordance with procedures developed or approved by the department.

D. Juvenile record information shall be stored in such a manner that it cannot be modified, destroyed, accessed, changed, purged, or overlaid in any fashion except via an approved system user account.