Section 2.18 - CORI Policy Requirement for Certain Requestors and the Need to Know Requirements(1) A person or entity which conducts five or more criminal background investigations annually, whether the information is obtained from DCJIS or another source, shall maintain a written CORI policy which shall at least contain and apply all provisions from the DCJIS Model CORI Policy.(2) A CORI policy may be developed and maintained, regardless of the number of CORI requests conducted.(3) Each requestor shall maintain a "need to know" list of staff that have been authorized to request, receive, or review CORI. This list shall be updated periodically, but not less than every six months, and shall be made available to DCJIS upon request. A requestor may also provide the "need to know" list to a subject or subject's attorney or legally designated representative upon request.Amended by Mass Register Issue 1333, eff. 2/24/2017.Amended by Mass Register Issue 1445, eff. 6/11/2021.