Security Managment
Security Managment
Table of Contents
TOC \o "1-3" \h \z \u Table of Contents PAGEREF _Toc75519592 \h 1
SECURITY MANAGEMENT
Overview
The EIS RMS-2 product incorporates an expansive security management and previsioning service. The Security Management component functions as the universal gatekeeper for all system resources and was specifically designed to insulate the back-end system services and database from unauthorized intrusion. As such whenever a user launches a common RMS-2 module, the application first contacts the Security service to determine if the requesting user is recognized and has been assigned sufficient permissions to access the requested application. If the user is authenticated, the extended system connection information along with the users defined permissions are returned to the client application and enabled for the user to proceed. If the user fails authentication, a notification to the user is provided. The user credential can be pulled from the Windows logon, to eliminate the application level Username/password log-on approach.
While the basic operations of Security Management are comprised of a specific set of low level system controls operating outside of the normal view of the user, the Security component also maintains the comprehensive listing of all user permissions. As each user is authenticated, Security Management retrieves the related system permissions prepares the session accordingly. These permissions cover all aspects of system operations, including what applications the users can access, enforces control of specific capabilities within the programs and determines what data the users can either view or modify. In a multi-agency system deployment Security Management, will enforce cross agency data sharing rules.
SECURITY Permission Managment
There are two specific concepts that must be understood to properly utilize the Security Management to achieve the agency’s security directives, and to effectively manage the automated routing of system reports as configured within the “EIS Workflow Engine”. These are the “Roles and Users” relationship and the configuration of specific permissions for each user or user class (Role).
System SECURITY Objects and Permission
The RMS-2 utilizes a multi-tiered security definition for each of the system modules and various specialty components and functions. This multi-tiered approach is based upon the System Security Objects and associated Permissions defined for each user or role. A Security Object is a specific set of defined permissions associated with a system module. While the Security Object does not inherently provide any specific permissions for a user, it must be present in the user’s profile before access permissions can be granted. When a user attempts to access a portion of the system, the system will first check to determine if the security object exists in the user’s profile. If the system cannot locate the Security Object in the users profile the request will be denied immediately. If the Security Object is present and no permissions have been assigned the request will also be denied. Only when the combination of Security Object and associated permissions are present will the user be allowed to proceed.
Security Objects
Each Security Object is listed with a set of descriptive data to identify the relationship of the object to the overall system. These fields include.
Application: Identifies the RMS-2 workstation application that will use the object. The application is what the user will launch to access the system. For example, if you wish to grant a user access to the Asset Management Program for entering and modifying information, you must first assign the appropriate security object – in this case the “RMSASSETMANAGEMENT” object.
Module: The module specifies either the functional module (within an application that supports multiple modules – such as RMS Entry), or a “PROGRAM” definition for some of the stand-alone programs provided within the system. For example, since the Asset Management software is provided as a stand-alone program, the application would be listed as:
“RMSASSETMANAGEMENT” and the module would be “PROGRAM”
Object: Specifies the specific portion of the module security affected by this Security Object. These may be entire modules (and may be defined as “PROGRAM” or “ACCESS”) or they may support a specific function within a module (e.g. access to the “EXPUNGE” function within the RMS Manager application)
Description: Simply provides a textural description of the associated Security Object to assist the user in identifying the appropriate item.
Security Permissions
The actual permissions that allow access into the applications are contained within each of the security objects. Applied permissions determine what privileges and capabilities will be available to each user as they utilize the system. Once a Security Object has been associated with a user or role, the associated permissions become visible. There is a common set of permissions provided within the system, however not all modules will support all the available permissions. For example, an inquiry module (one that only allows the retrieval of data) will not display an add, update or delete permission because data modification is not supported in an inquiry only module, and the presence of these permissions would only serve to confuse the user.
Activating the permissions within each Security Object is as simple as checking the permission box or setting a variable value. Standard system permissions include:
ACCESS: A checkbox component that establishes the base level permission and controls whether the user can launch the related application. This permission supersedes all other permissions, in that if the user is not allowed to launch the application, no other function would logically be available to the user. An “Access” permission must be provided if the user is to be able to perform any function within the application. An “Access” permission will be in all security objects.
ADD: A checkbox component that controls whether the user can create new records within the related application. If enabled for an application or program the user will be allowed to create new records within the module. An “Add” permission will only be presented in security objects associated with data entry programs and will not appear in any of the inquiry applications.
PRINT: A checkbox component that controls whether the user can access any of the standard system output/distribution functions, including Printing documents and emailing reports. If enabled for an application or program the user will be allowed to access these functions from the application controls. PRINT permission will only be presented in security objects associated with programs that natively support printing and will not appear in any of the specialized maintenance applications.
CASE MANGEMENT: A checkbox component that controls whether the user can access any of the case management capabilities associated with a reporting module. There are specific security objects related to the case management functions that are defined in the related object. CASE MANAGEMENT permission will only be presented in security objects associated with report entry programs and should only be enabled for those report types built into the report management Workflow.
ACCESS CONTROL: A checkbox component that controls whether the user can access any of the access control capabilities within each report and presented to the user on the “Report Complete” page of the report within the entry application(s). These capabilities are used to selectively segregate and restrict access to system users. An ACCESS CONTROL permission will only be presented in security objects associated with report entry programs and should only be enabled for those users or roles that would be allowed to modify the security setting associated with a specific report within the related module. This permission is typically reserved for investigative and administrative personnel.
ACCESS LIST: A checkbox component that controls whether the ACCESS LIST would be available for selection on the “Report Complete” page of the report within the entry application(s). This capability is used to control whether the user will be able to restrict reports by Role or by Pin. This permission is typically reserved for investigative and administrative personnel.
READ LEVEL: A variable numeric data field that controls the user default access level for a specific report within the referenced module. Please review the “RMS ADMINISTRATORS READ/WRITE manual for a details description of the usage and settings associated with this control.
WRITE LEVEL: A variable numeric data field that controls the user default write/update access level for a specific report within the referenced module. Please review the “RMS ADMINISTRATORS READ/WRITE manual for a details description of the usage and settings associated with this control.
By default, when the Security Object is added to the users (or roles) profile, all permissions are activated, and the read/write levels are automatically set to the highest level (100). To deactivate the permission the administrator should simply click on the checkbox to disable the control. When a check appears within the checkbox the permission has been enabled if no check is present within the checkbox the permission has not been assigned.
Roles and User Permission
Every system user will need to have a security profile developed and associated with their specific user account before they will be able to utilize the system. A security profile includes a user account definition, an assigned set of security objects and an enabled set of permissions within the security objects. The system provides some quick methods of building default permission sets (ROLE’s) and then associating the users with the roles to streamline permission assignment.
Each user must first have a user account that defines the basic information, passwords, and system processing ID associated with external resources (if applicable). When creating a user, the user’s personnel number (PIN), logon ID and agency must be provided along with the user’s system password. All other fields are optional but may be necessary for certain program options to work properly.
How to Build and Permission a system USER
Each system user will require an account, you may create as many system users as needed by the agency. If the RMS is to participate in a multi-agency configuration, generic external access roles will need to be developed to permission users from external agencies to access selected system information.
Defining a user and the associated permissions is a relatively straight forward process within Security Management.
Building The User’s AccouNt
Launch the Security Management Application from the run directory or from a provided desktop shortcut (if available).
The application will launch and present the application environment. From the application menu bar select the “User” option to load the user definition screen.
A search function and listing of current system users will be presented on the search grid, vertically aligned along the left side of the screen. Make sure you do not attempt to create a user with the same name as an existing user.
The main screen is divided into three sections; the top portion includes the user’s security profile data fields.
Enter the users Personnel Number as created in the EIS personnel module.
Enter the user’s desired logon ID. If you are utilizing Windows to control access be sure to use Windows login, must be an exact match.
Enter the user’s agency
Enter the user’s name information in the name fields as provided.
If the user is to have access to the integrated NCIC functions from within the RMS-2 application the data switch Gateway ID must be entered. This ID is a routing identifier contained within the M2 data switch used to enable specific State Query controls and routing. Please contact EIS support for assistance.
Enter the desired initial password for the user (it may be changed later at any time).
Make sure the “Disabled” checkbox is not enabled. If it is enabled, the users account will be immediately suspended.
Click the [SAVE] button on the lower right-hand button bar on the main form. This will create the user’s profile and prepare the system to accept the security definition.
Assigning Permissions to the User’s Account
There are two ways to assign security objects to the user’s profile, either manually adding and configuring the permission set within the user’s profile or by associating the user with a previously defined “Role” and inheriting the security profile from the role definition.
Method 1: Assigning Permissions Manually to the User’s Account
To define system security, you must first select the general security object, and then select the specific permissions within each security object. To associate the desired system security objects from the “AVAILBALE SECURITY OBJECTS” grid to the user’s profile. You may.
ALL: Select all of the security objects and assign to the user’s profile by clicking on the [ADD ALL] button. All available security objects will be copied into the “APPLIED SECURITY OBJECTS” portion of the form.
MULTI SELECT: While depressing the [CTRL] key on the system keyboard, use the mouse to select multiple rows by clicking directly on the row(s) of the grid. Each row will highlight with a dark blue color indicating the selected object is activated. Click the [ADD SELECTED] button and the collection of selected security’s object will be copied into the “APPLIED SECURITY OBJECTS” portion of the form.
Once the desired security objects have been associated, it is now time to set the actual permissions within each of the security objects.
Assigning Permissions to the user’s profile
Each object selected will appear in the grid view in the “APPLIED SECURITY OBJECTS” portion of the application. Displayed within each row of the grid is the object definition fields along with the set of permissions associated with each object. As noted earlier each object will support a differing set of permissions so it is not uncommon to see voided permissions.
By default, when an object is applied all associated permissions are enabled. The administrator should simply click on the checkbox, removing the checkbox, to disable the control. Repeat for each object until the appropriate permissions have been allocated for the user’s profile.
To save time a set of Quick Features are available to rapidly assign permissions to multiple objects. These include selective batch permission assignment and the “Select All” feature.
SELECT ALL: The “Select All” feature saves the step of manually selecting each object within the grid, and activates all security objects assigned to the user.
MULTI SELECT: While depressing the [CTRL] key on the system keyboard, use the mouse to select multiple rows by clicking directly on the row(s) of the grid. Each row will highlight with a dark blue color indicating the selected object is activated.
Batch Updating allows the administrator to set multiple permissions, across multiple security objects with a single command. With a selected set of Objects, click on the [BATCH] button at the base of the Security manager form, and the “Batch Update” function will appear in a new window. Select the permissions to be affected and click on the save button.
The “Batch Update” window will close and the selected permissions will be applied to all the selected security objects.
Once all the permissions have been assigned click the [SAVE] button to commit the permissions to the systems.
Method 2: Assigning Permissions the User’s Account applying a Role
When a user’s profile is linked to a role the system will compare the permission set defined for the role, and the permission set currently defined for the user. If the permissions differ the system will notify the administrator and provide an option to update the user’s permissions with those contained in the new role. By selecting the permission import function, the system will attempt to import the security permissions configured for the role and apply them directly to the user’s security profile. This function will only add those permissions not already present in the user’s permission profile. If multiple roles are added to the user the system will perform the permission parity check each time and allow the administrator the option of updating the user’s permissions each time the user role association is defined.
Note: The role permission assignment function is an additive function only, and it will not remove assigned objects however it will apply the last applied permissions and read/write levels. Take care when applying multiple roles so the desired access and permissions are applied. You will be presented the option to accept or deny security permissions after the parity check is complete.
To associate a user with a role, select the desired role from the “AVAILABLE ROLES” listing along the right-hand side of the Security manager form.
The system will update to show the selected row is now presented in the “APPLIED SECURITY” section.
The system will perform a permission parity check between the permissions already assigned to the user (if any) and those permissions defined for the role. If the system detects a different set of permissions are provided within the role, a dialog prompt will appear asking the administrator if they wish to apply the disparate security settings to the user’s profile. Two options will be presented;
Update the user’s profile from the role’s permissions. If selected the disparate security objects and permissions will be added to the user’s profile.
DON’T update the user’s profile from the role’s permissions. If selected no action occurs, and the users profile is not modified.
Method 3: Assigning Permissions to a User’s Account through a Role
Once a role is established or modified using the Role Feature (see below for further information) the administrator may apply changes to all those within the role with one click of a button. The administrator may replace or elevate all users within a role and associated permissions. This feature will be restricted by a security object under the AACMANAGER application name.
The buttons to perform this are only available based on user rights Module Name = REPLACE-ELEVATE.
Replace Users in Role – This will delete and reinsert all security objects for all users in the selected role.
Elevate Users in Role – This will update and insert missing security objects for all users in the selected role.
Working with Roles
While each user will require a specific set of permissions to be associated with their user account, the EIS RMS-2 system has provided for the establishment of “User Roles” in addition to a single user permission definition approach. The user “Role” can be used for 2 primary purposes, including:
Using an “Security Role” for the rapid assignment of permissions to a specific user. This feature was designed to speed the management of user permissions and to help the agency to ensure consistency in permission assignment. This function can be used when multiple system users will be allocated the same general system permissions. The system security officer would create a “Role” and define the set of permissions associated with the Role. When the user is associated with the role the security officer has the choice of assigning the “Role” permissions to the user with the single click of the mouse. This approach greatly simplifies individual user permission management and will greatly speed the addition of new users to the system.
Assigning Users to Roles for Workflow processing. A users Role association is also used by the EIS Workflow engine to determine the routing and assignment of agency reports. When a system user is associated with a specified workflow process, that user will receive notifications from the Workflow Engine whenever the “Role” is used as a routing destination. For example, when a patrol officer completes an incident report the report is often routed to a patrol supervisor for review and approval. Since we do not always know who will be acting as a supervisor at that moment, the system will typically route the report to the “Patrol Supervisor” role, and all system users associated with that role will receive the notification. This approach simplifies the automated assignment of reports and provides a general catch-all capability to minimize the chance that the report will be missed.
How to Build and Permission a system Role.
You may create and name as many system Roles as appropriate to establish standard permission assignments. However, since the Role definition can be used for both user permission assignment and for system Workflow routing it is important that the role identity be consistent with established Workflow configuration rules. If it is desired that new Workflow processes be defined for the role EIS support should be consulted before proceeding.
Defining a role is a relatively straight forward process within the Security Management Application.
Building the Role
Launch the Security Management Application from the run directory or from a provided desktop shortcut (if available).
The application will launch and present the application environment. From the application menu bar select the “Role” option to load the role definition screen.
The main screen is divided into three sections; the top portion includes the Role name data fields.
Enter the name of the new role into the “ROLE NAME” data field, this is the value that will be used system wide to identify the role.
Enter a “ROLE DESCRIPTION” which is used to provide expanded information about the role if a cryptic name is used in the role name (e.g. ROLE NAME: S1 might mean ROLE DESCRIPTION: Day shift patrol).
If the role is to be used within workflow processing, you may enter the associated supervisory role into the “SUPERVISOR ROLE” data field (Patrol Patrol Supervisor). For automated routing the specified roles must be defined within the system Workflow Engine.
Click the [SAVE] button on the lower right hand button bar on the main form. This will create the role and prepare the system to accept the security definition.
To define system security, you must first select the general security object, and then apply the specific permissions within each security object. To associate the desired system security objects from the “AVAILABLE SECURITY OBJECTS” grid to the role. You may;
ALL: Select all the security objects and assign to the role by clicking on the [ADD ALL] button. All available security objects will be copied into the “APPLIED SECURITY OBJECTS” portion of the form.
SINGLE: Select a specific single object by clicking directly on the row of the grid. The row will highlight with a dark blue color indicating the selected object. Click the [ADD SELECTED] button and the single security object will be copied into the “APPLIED SECURITY OBJECTS” portion of the form.
MULTI SELECT: While depressing the [CTRL] key on the system keyboard, use the mouse to select multiple rows by clicking directly on the row(s) of the grid. Each row will highlight with a dark blue color indicating the selected object is activated. Click the [ADD SELECTED] button and the collection of selected security’s object will be copied into the “APPLIED SECURITY OBJECTS” portion of the form.
Once the desired security objects have been associated, it is now time to set the actual permissions within each of the security objects.
Assigning Permissions to the Role
Each object selected will appear in the grid view in the “APPLIED SECURITY OBJECTS” portion of the application. Displayed within each row of the grid is the object definition fields along with the set of permissions associated with each object. As noted earlier each object will support a differing set of permissions so it is not uncommon to see voided permissions.
To save time a set of Quick Features are available to rapidly assign permissions to multiple objects. These include selective batch permission assignment and the “Select All” feature.
SELECT ALL: The “Select All” feature saves the step of manually selecting each object within the grid, and activates all security objects assigned to the role or user.
MULTI SELECT: While depressing the [CTRL] key on the system keyboard, use the mouse to select multiple rows by clicking directly on the row(s) of the grid. Each row will highlight with a dark blue color indicating the selected object is activated.
Batch Updating allows the administrator to set multiple permissions, across multiple security objects with a single command. With a selected set of Objects, click on the [BATCH] button at the base of the AAC manager form, and the “Batch Update” function will appear in a new window. Select the permissions to be affected and click on the [SAVE] button.
The “Batch Update” window will close and the selected permissions will be applied to all the selected security objects.
Once all the permissions have been assigned click the [SAVE] button to commit the permissions to the systems.
Adjusting User or Role Permissions
At any time, it becomes necessary to modify the user’s permissions within the system the administrator can launch the Security Management Application and update the record as needed. All adjustments to a specific user permissions must be made within the user’s permission settings to take effect, not the users associated role permissions. Adjustments made to the role permissions after the role has been assigned to a user will not update the user’s permission profile. Typical functions include:
DISABLE A USER’S PERMISSIONS: This is a one click function that when activated, suspends all system permissions effectively locking the user out of the system. At any point in time the account can be re-enabled if desired.
To delete a user’s account from Security Management, the administrator would recall the user’s record to the screen by clicking on the user’s name in the left-hand search/recall window and clicking the [DELETE] button on the application toolbar. This function is permanent (not recoverable) and will remove the user account and all assigned security objects from the system.
Modifying a user’s permissions can be simply accomplished by recalling the user’s permission record and updating the associated permission controls. The administrator may add or remove security objects and/or permissions contained within each security object. Once the permissions have been appropriately set, click the [SAVE] button to save the changes to the system.
Updating or modifying a user’s ROLE association. At any point the administrator can assign the user a new role, or to multiple roles. It is recommended to not assign multiple roles utilized by the Workflow Engine to the same user. When the user is assigned to a new role the system will compare the permission set defined for the role, and the permission set currently defined for the user. If the permissions differ the system will notify the administrator and provide an option to update the user’s permissions with those contained in the new role.
Application
Module
Object
Description
AAC Manager
COMPUTER
ACCESS
If configured, allows add/edit/update of authorized computers.
AAC Manager
LOGONLOG
ACCESS
Will allow user to access the LOGONLOG. This shows attempts success or failures of attempted logons. Typically, the agency TAC will need access to this object.
AAC Manager
PROGRAM
PROGRAM
Program access, must be applied if the user will need access to any object within the AAC (Security) Manager.
AAC Manager
ROLE
ACCESS
User will be able to add, delete or update Security Roles
AAC Manager
SYSTEMROLE
ACCESS
Will allow access to add, delete, or update system roles. System roles are utilized in multi-agency configurations.
AAC Manager
USER
ACCESS
Allows the user to add, delete, or update Users within the Security Manager.
EIS M2 Management
ADDRESS
ACCESS
Address module of the M2 module allows the user to add, remove, modify computer access to the various services of the RMS, JMS, CAD EIS programs. Typically granted to users that will be deploying new workstations.
EIS M2 Management
AUDITLOG
ACCESS
Allows access to the M2 audit log, as an example, AM Messages, NCIC transactions. The Agency TAC typically has access to this module.
EIS M2 Management
PAGEADDRESS
ACCESS
User will be able to manage pager addresses with this module.
EIS M2 Management
PAGER
ACCESS
Users that will manage any portion of pagers will need access to this module
EIS M2 Management
PAGERGROUPS
ACCESS
Allows the user to manage pager groups
EIS M2 Management
PAGERLOG
ACCESS
Allows the user to view the pager log.
EIS M2 Management
PROGRAM
PROGRAM
Allows the User to access the M2 Management Program, must be applied if the user will be accessing any modules within M2 management
EIS Media Upload Client
PROGRAM
PROGRAM
Media Upload Program access. This is the program used to upload video and audio files into the RMS program.
MISManager
MLI
ACCESS
Not Currently Used
MISManager
MNI
ACCESS
Allows user to manage the master name index. Merge names, modify name records.
MISManager
MPI
ACCESS
Not Currently Used
MISManager
MVI
ACCESS
Not Currently Used
MISManager
PROGRAM
PROGRAM
Allows user to utilize the Master Index Manager. Must be applied for user to open any module within the MIS program.
RMS Asset Manager
PROGRAM
PROGRAM
Allows access to the Asset Manager program. Assigned to employee(s) responsible for entering, removing, updating records within the asset management program
RMSEntry
ACCIDENT
ACCESS
Allows user to enter Accident records. Applied to any employee that will be entering Accident reports.
RMSEntry
CASE
ACCESS
Allows user to enter Incident Reports (Case and Supplemental Reports)
RMSEntry
CASE
APPROVAL
Allows the user to Approve a report outside of workflow. Unlocks the APPROVED BY fields on the face page of a report. Typically assigned to data entry employees that are entering already approved reports.
RMSEntry
CASE
UPOTHERINCOMP
If this permission is applied the user will be able to update other user’s incomplete reports. This is typically reserved for supervisor use only.
RMSEntry
CASE COMMENT
ACCESS
This is a note field on the Report Complete page. Agencies typically utilize this note field or the Report Log feature for use by the various work groups, i.e. records or detectives. Report Log has date time stamp, case comment is free text.
RMSEntry
CITATION
ACCESS
Allows entry of citation records through the RMS Entry program.
RMSEntry
CITATION
APPROVAL
Allows the user to Approve a citation outside of workflow. Unlocks the APPROVED BY fields on the face page of a citation. Typically, assigned to data entry employees that are entering already approved citations. Before applying consider if your agency includes Citations in the supervisor review process.
RMSEntry
CWP
ACCESS
Assign to users that will be entering or updating records in the concealed weapon permit module of the RMS entry program.
RMSEntry
FI
ACCESS
Any employee that will be entering or modifying Field Interview records will need this permission assigned
RMSEntry
FI
APPROVAL
Allows the user to approve a Field Interview record outside of workflow. Unlocks the APPROVED BY fields. Typically assigned to data entry employees that are entering previously approved FI records. Before applying consider if your agency includes Field Interviews in the supervisor review process.
RMSEntry
MCR
ACCESS
Apply this object to users that will be entering or modifying Major Crime Registrant (Sex Offender, Armed Career Criminal) records within the RMS Entry Program
RMSEntry
MEDIA
ACCESS
Access to this module must be applied to grant the ability to add media (PDF's and Images) to records within RMS Entry Program
RMSEntry
MLI
ACCESS
Records will be included in the Master Location Index
RMSEntry
MNI
ACCESS
Allows access to Master Name Index button on the name page in the various modules of the RMS Entry Program
RMSEntry
MPI
ACCESS
Records will be included in the Master Property Index
RMSEntry
MVI
ACCESS
Allows access to Master Vehicle Index button on the vehicle page in the various modules of the RMS Entry Program
RMSEntry
PARKING
ACCESS
Assign to users that will be entering or updating Parking Citation records within the RMS Entry Program.
RMSEntry
PARKING
APPROVAL
Allows the user to Approve a parking citation outside of workflow. Unlocks the APPROVED BY fields on the face page of parking citation. Typically, assigned to data entry employees that are entering already approved parking citations. Before applying consider if your agency includes Parking Citations in the supervisor review process.
RMSEntry
PAWN
ACCESS
Assign to users that will be entering or updating records in the Pawn module in the RMS Entry Application.
RMSEntry
PERMIT
ACCESS
Allows users to access the Permit module within RMS Entry which allows entry of Permit records.
RMSEntry
PROGRAM
PROGRAM
Program access, must be applied if the user will need access to any object within the RMS Entry Application.
RMSEntry
PROTECT
ACCESS
any employee that will enter or modify records in the Protect (Restraining Orders) Module of the RMS Entry Application
RMSEntry
REGISTRANT
ACCESS
Registrant Entry, (realtor, massage therapists, door to door sales, etc.)
RMSEntry
REPORT COMMENT
ACCESS
Report comment is a free text field on the report complete page. Typically used by certain work groups within an agency, i.e. records or detectives. Usually an agency chooses this feature or Report Log. Report Log is date time and user stamped and entry is consistent through a set of report log type codes.
RMSEntry
REPORTLOG
ACCESS
Report log is a feature that allows users to add report notes. This screen is feature rich with date/time stamps, user stamps, ability to include entry across all supplements, and consistent entry through use of report log type codes.
RMSEntry
RMS STATEREPORTING
ACCESS
Allow user to access the state reporting validation feature within the Entry Application. Access granted to those responsible for State Reporting preparation.
RMSEntry
STATEENTRY
ACCESS
Allows access to State Entry feature if applicable.
RMSEntry
STATEQUERY
ACCESS
Allows access to the State Query feature if applicable.
RMSEntry
TRESPASS
ACCESS
Assign permission to any user that will be entering trespass warnings into the RMS Entry Application
RMSEntry
WARRANT
ACCESS
Users responsible for warrant entry into the RMS Entry Application will need access to this object.
RMSManager
ACCESS
AGENCY
Allows the user to modify Agency related information examples, GEO labels, Agency Logo, Address, UCR/IBR preparer information, etc. Typically, system administrators have access to this module.
RMSManager
ACCESS
AGENCY NUMBERMGMT
Each module has a unique number string and can be self-assign or system generated. This module is the management of all numbers within the RMS Program.
RMSManager
ACCESS
BASESUPCHANGE
Allows a user change a base report to a supplemental report and vice versa.
RMSManager
ACCESS
CASE NUMBER CHANGE
Users with permission can change report numbers for various modules within the RMS Program
RMSManager
ACCESS
CRIME CODES
Allows the user to manage the Crime Code Table utilized by the RMS Program. User can add, delete, and modify Crime Codes.
RMSManager
ACCESS
EXPUNGE
Allows the user to Expunge records from various RMS Modules including Reports, Warrants, and Citations. This is a permanent action and cannot be reversed.
RMSManager
ACCESS
RESTRICT
Restrict module allow the user to restrict or un-restrict reports without having to open the report.
RMSManager
ACCESS
SEAL
Users that need to seal various reports will need access to this module.
RMSManager
ACCESS
TABLE DATA
Table Data (F1 drop down lists throughout the program) maintenance including update, add, delete.
RMSManager
ACCESS
TEMPLATEMGMT
Narrative templates throughout the system are managed within this module.
RMSManager
ACCESS
UNSEAL
Sealed records may be un-sealed using this module. Access is typically limited to the Records Manager and Records Supervisor.
RMSManager
ACCESS
WORK STATION
Permission to this module allows the user to manage workstations which includes camera and State Entry/Query management.
RMSManager
PROGRAM
PROGRAM
Program access, must be applied if the user will need access to any object within the RMS Manager.
RMS Personnel Manager
PROGRAM
PROGRAM
Allows access to the Personnel Management Application. All system users must be entered in the personnel management application. Assign access to the person responsible for managing the Personnel Application or to those that will be creating user profiles or inactivating users.
RMS Property Manager
PROGRAM
PROGRAM
Access to this Application is typically limited to those directly responsible for managing the property/evidence room. All others may view property room information through the RMS Query Application.
RMSQuery
ACCIDENT
ACCESS
View access of Accidents through the RMS Query Application
RMSQuery
ACCIDENT
DELETE
Not Currently Used
RMSQuery
CASE
ACCESS
View access of Reports (base case and supplemental) through the RMS Query Application
RMSQuery
CASE COMMENT
ACCESS
Allows user to view case comments within the Query Application
RMSQuery
CFS
ACCESS
Allows the user to view Calls for Service (CAD Calls) in the Query Application
RMSQuery
CFS
COMMENT
If this permission is applied the user will be able to add comments to Calls for Service (CAD Calls) this is the only place that entry may occur within the Query Application
RMSQuery
CITATION
ACCESS
View only access to the Citation Module within the RMS Query Application
RMSQuery
CWP
ACCESS
View only access to the Concealed Weapon Permit module within Query Application
RMSQuery
FI
ACCESS
When applied to user they will have view access to Field Interview records within Query Application
RMSQuery
JMSQUERY
ACCESS
Allows view only access to Jail Management information through the RMS Query Application
RMSQuery
MCR
ACCESS
Major Crime registrant view only access through the Query Application
RMSQuery
MEDIA
ACCESS
User may access the Media module within RMS Query application
RMSQuery
MII
ACCESS
Allows user to access the Master Incident Index module within the RMS Query Application. Master Incident allows searches across modules of the RMS with simple filters
RMSQuery
MLI
ACCESS
Master Location Index search within the RMS Query Application allows the user to conduct searches based on locations across various RMS modules.
RMSQuery
MNI
ACCESS
Master Name Index search allows the user to search across multiple RMS modules in one transaction.
RMSQuery
MPI
ACCESS
Allows access to the Master Property Index search. This module is for serialized property searches only.
RMSQuery
MVI
ACCESS
Allows users to access the Master Vehicle Index search module in the RMS Query Application. This module allows user to search vehicles across multiple modules at one time.
RMSQuery
PARKING
ACCESS
View only access to parking citation records within the RMS Query Application
RMSQuery
PAWN
ACCESS
View only access to pawn records within the RMS Query Application
RMSQuery
PERMIT
ACCESS
Allows user to view permit records within the RMS Query Application
RMSQuery
PERSONNEL
ACCESS
Limited view only access to records within the personnel management program through RMS Query Application (Name, Contact Information, Emergency information)
RMSQuery
PERSONNEL QUERY
ACCESS
Limited view only access to records within the personnel management program through RMS Query Application (Name, Contact Information, Emergency information)
RMSQuery
PROGRAM
PROGRAM
Program access to RMS Query Application. User must have this permission if they will be accessing any module within RMS Query
RMSQuery
PROPERTY QUERY
ACCESS
Allows the user view only access of Property Management Program information through the RMS Query Application
RMSQuery
PROTECT
ACCESS
View only access to records within the Protection Order (Restraining Order) module within RMS Query Application
RMSQUERY
REGISTRANT
ACCESS
In the RMS Query Application allows the user view only access to Registrant module (Realtors, Massage therapists, etc.)
RMSQuery
REPORT COMMENT
ACCESS
Allow user to view any comments entered in the report comment area, in a view mode only within the RMS Query Application
RMSQuery
REPORTLOG
ACCESS
Allows user view access only to the Report Log screen in RMS Query Application
RMSQuery
STATEENTRY
ACCESS
Allows access to State Entry feature if applicable.
RMSQuery
STATEQUERY
ACCESS
Allows access to State Query feature if applicable.
RMSQuery
TRESPASS
ACCESS
View access only to Trespass records through the RMS Query Application
RMSQuery
WARRANT
ACCESS
Grants view only access to Warrant records through the RMS Query Application
RMS Report Viewer
PROGRAM
PROGRAM
Allows user to access RMS Reports Application to run pre-written statistical reports for various RMS Applications
RMS State Reporting
PROGRAM
PROGRAM
Allows access to the UCR/IBR State Submission program. Typically granted to the user(s) responsible for State Submission only.
TRAINING
PROGRAM
PROGRAM
Allows user to enter, modify, delete records within the Training Program.
Source: RMS Security Management (Old).docx