Direct access to criminal history record information system facilities, system operating environments, data file contents, and system documentation shall be restricted to authorized organizations and persons. Wherever criminal history record information is collected, stored, or disseminated, the criminal justice agency or agencies responsible for the operation of the system:
(1) May determine for legitimate security purposes which personnel may work in a defined area where such information is stored, collected, or disseminated;
(2) shall select and supervise all personnel authorized to have direct access to such information;
(3) shall assure that an individual or agency authorized direct access is administratively held responsible for (a) the physical security of criminal history record information under its control or in its custody, and (b) the protection of such information from unauthorized access, disclosure, or dissemination;
(4) shall institute procedures to reasonably protect any central repository of criminal history record information from unauthorized access, theft, sabotage, fire, flood, wind, or other natural or manmade disasters;
(5) shall provide that each employee working with or having access to criminal history record information is to be made familiar with sections 29-209, 29-210, 29-3501 to 29-3528, and 81-1423 and of any rules and regulations promulgated under such sections; and
(6) shall require that direct access to criminal history record information shall be made available only to authorized officers or employees of a criminal justice agency and, as necessary, other authorized personnel essential to the proper operation of the criminal history record information system. This section shall not be construed to inhibit or limit dissemination of criminal history record information as authorized in other sections of sections 29-209, 29-210, 29-3501 to 29-3528, and 81-1423, including both review of original records and the right to have copies made of records when not prohibited.