I feel more like a lawyer than an IT admin today.
When the CJIS Security Policy states that "The remote administrative personnel connection shall be via an encrypted (FIPS 140-2 certified) path," I'm left to wonder if that refers to Level 1, or if it's inclusive of the whole standard and all 4 levels?
That's a lot of assumption and supposition. I'm hoping this makes sense to people more solidly InfoSec grounded. If anyone can point me toward a clearer understanding of the correct interpretation of this, I would very much appreciate it.
Edit: My main confusion here is that the CJIS document doesn't specify a level. Should that be interpreted as requiring Level 1 or Level 4?