All agencies with the authority to access criminal justice information must comply with the CJIS Security Policy. The CJIS Information Security Officer enforces requirements as defined in the CJIS Security Policy Manual. This includes the administration, operation, physical and technical security requirements that are subject to audit.