A grant requirement states the city must "protect Criminal Justice Information in transit." Which control set best follows from that stated requirement?
Select an answer to reveal the explanation.
Short Explanation
When the grant says protect CJI on the move, encrypt the ride, guard the keys, and watch the road—do not park the files on anonymous FTP and hope nobody notices the hostname.
Full Explanation
Criminal Justice Information (CJI) moving across networks for grant-compliant sharing must be protected in transit with cryptography, disciplined key management, and monitoring—not obscurity or convenience storage. Architecturally that means encrypting CJI on the wire (approved TLS or equivalent), managing keys and certificates securely (rotation, access-limited key stores, no shared ad-hoc secrets), and monitoring protected channels for misuse, anomalous transfers, or policy violations so detective controls backstop prevention. Posting CJI shares on anonymous FTP and hoping the hostname stays unknown fails confidentiality, authentication, and auditing simultaneously. Storing CJI as unencrypted screenshots in a public SharePoint site expands exposure and abandons both encryption and need-to-know. Disabling auditing of CJI transfers to improve throughput removes accountability required by CJIS-aligned programs and hides abuse. Exam caveat: for regulated data categories such as CJI, expect answers that combine encryption, key management, and monitoring; throughput or obscurity trade-offs are traps. Operational check: inventory CJI data flows, enforce FIPS-validated or policy-approved TLS, store keys in HSM/KMS with dual control, enable detailed transfer logging to SIEM with alerts, and sample transfers during audits for encryption and access-justification evidence.