According to the CJIS Security Policy -
The information system shall enforce assigned authorizations for controlling access to the system and contained information. The information system controls shall restrict access to privileged functions (deployed in hardware, software, and firmware) and security-relevant information to explicitly authorized personnel.
Access control policies (e.g., identity-based policies, role-based policies, rule- based policies) and associated access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) shall be employed by agencies to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains) in the information system.
Agencies shall control access to CJI based on one or more of the following:
- Job assignment or function (i.e., the role) of the user seeking access
- Physical location
- Logical location
- Network addresses (e.g., users from sites within a given agency may be permitted greater access than those from outside)
- Time-of-day and day-of-week/month restrictions
Are physical location and logical location are being referred as Physical address and Logical Address here? How these are different from Network Addresses.
Can someone please give the scenarios to make website compliant with CJIS Security Policy?