What Is CJIS Compliance and What Does the CJIS Security Policy Require?

CJIS compliance means conforming to the FBI’s Criminal Justice Information Services Security Policy, abbreviated CJISSECPOL. It is the minimum security standard for any entity that creates, views, modifies, transmits, disseminates, stores, or destroys criminal justice information (CJI) — the data flowing from FBI CJIS systems such as the National Crime Information Center, the Interstate Identification Index, and the fingerprint repositories.

The current release is CJIS Security Policy version 6.1, dated June 25, 2026. Its change log describes it as the release that incorporates calendar year 2025 changes approved through the CJIS Advisory Policy Board (APB) and the Compact Council. It succeeds version 6.0 of December 27, 2024, which completed the multi-year “policy modernization” effort.

That modernization matters more than the version number. Before it, the Policy read as 13 narrative policy areas. Version 6.x restructures the requirements as discrete, individually numbered controls borrowed from NIST SP 800-53 Rev. 5, complete with control enhancements, discussion text, and related-control references. If your organization already runs a NIST-based control set, most of the vocabulary will be familiar — see our guide to NIST compliance for the underlying model.

Two practical consequences follow. First, the document is large: version 6.1 runs 473 pages. Second, since version 6.0 the Policy is explicitly a publicly available document that may be posted and shared without restriction, so vendors and agencies can finally cite chapter and verse in contracts and questionnaires instead of trading PDFs under NDA.

Who Has to Comply With CJIS?

The Policy applies to all entities with access to, or that operate systems used to process, store, or transmit CJI. In practice that splits into four groups.

Criminal justice agencies (CJAs) — police departments, sheriffs’ offices, courts, prosecutors, corrections. Noncriminal justice agencies (NCJAs) — government bodies such as a city IT department or a licensing board that touch criminal history record information (CHRI) for background screening. NCJAs performing criminal justice functions for a CJA must sign a management control agreement confirming the CJA retains management control.

Private contractors and vendors. This is where most commercial software companies land. A private contractor performing criminal justice functions, dispatching, or data processing for an agency becomes eligible for CJI access only under an agreement that incorporates the Policy, and every such contractor must sign the CJIS Security Addendum. The Addendum is a uniform contract rider approved by the FBI Director acting for the U.S. Attorney General under 28 CFR 20.33(a)(7); only the FBI can modify it. Contractors are held to the same training, certification, and audit expectations as the agencies they serve.

Cloud and infrastructure providers. Whether a hosting provider is in scope depends on whether its personnel have unescorted logical or physical access that confers the ability to view, modify, or use unencrypted CJI. The Policy’s own use cases make the point: in an IaaS deployment where the agency holds the encryption keys and provider staff cannot reach unencrypted CJI, no fingerprint-based background checks are required for provider personnel. In a SaaS deployment where the vendor administers the records management system and can see plaintext CJI, personnel security applies to the vendor’s staff.

One consequence organizations routinely miss: a company that never contracts with a police department can still be in scope through noncriminal justice channels, because CHRI obtained for employment or licensing screening is CJI once it leaves the state repository.

What Are the CJIS Policy Areas and Control Families?

Version 6.1 organizes requirements into 20 policy areas: 18 NIST-aligned control families plus two legacy narrative areas (information exchange agreements and mobile devices). The List of Priorities table enumerates 178 base controls, and each carries a priority marking from Priority 1 to Priority 4.

Those markings determine what an auditor can sanction you for today. Only 22 of the 178 controls are marked Priority 1. Beginning October 1, 2024, the sanctionable set is the requirements that existed before modernization (version 5.9) plus everything marked Priority 1. All newly introduced Priority 2, 3, and 4 requirements sit in a zero cycle that runs from October 1, 2024 through September 30, 2027 — assessed and reported, but not yet sanctionable.

Read that as a schedule, not a reprieve. Priority 2 covers most of the encryption, training, media protection, and incident response requirements, and the zero cycle ends in the middle of the next triennial audit round for most agencies.

The FBI also publishes a Requirements Companion Document alongside the Policy on the CJIS Security Policy Resource Center, which strips the discussion text out and leaves the testable requirement statements — the more useful artifact for building a control matrix.

What Are the CJIS MFA Requirements?

Multi-factor authentication is the single most consequential CJIS deadline of the past two years, and it has already passed. Control IA-2 and its enhancements IA-2(1) multi-factor authentication to privileged accounts and IA-2(2) multi-factor authentication to non-privileged accounts are both marked Priority 1 in version 6.1, which means they have been sanctionable since October 1, 2024.

The Policy defines MFA the way NIST does: two or more distinct factors drawn from something you know, something you have, and something you are. A password plus a security question is not MFA. Hardware authenticators, PIV cards, and DoD CAC cards are called out as examples that satisfy the physical-authenticator factor.

Supporting requirements sit in IA-5 (also Priority 1). Memorized secrets must be at least eight characters when user-chosen, agencies must maintain and quarterly-check a list of commonly used or compromised passwords, and users must be allowed to choose long passphrases including spaces and printable characters. Account lockout is separate: AC-7 requires locking after five consecutive invalid attempts in a 15-minute window, released only by an administrator.

Mobile access carries its own rule set. Section 5.20.7.2 requires advanced authentication when CJI is accessed from an authorized mobile device, and device certificates alone are explicitly not accepted as proof that an authorized user is operating the device.

Because MFA and least privilege are enforced together under AC-6, agencies that already run a mature access model have less to do. If yours does not, start with role-based access control best practices and the identity assumptions behind zero trust, since CJIS now expects continuous authentication decisions rather than a hardened perimeter.

What Are the CJIS Encryption Requirements?

CJIS encryption requirements turn on one concept: the physically secure location, defined as a facility, criminal justice conveyance, area, or room with physical and personnel controls sufficient to protect CJI. Outside that boundary, encryption is mandatory.

In transit (SC-13). CJI leaving a physically secure location must be protected by cryptographic modules certified to FIPS 140-3, or by a FIPS-validated symmetric algorithm under FIPS 197 (AES), with a symmetric key of at least 256-bit strength.

At rest (SC-28). The same 256-bit floor applies to CJI stored outside a physically secure location, using FIPS 140-3 certified modules or FIPS 197 AES.

Two more constraints trip up cloud architectures. First, CJI may be stored — encrypted or not — only in environments physically located within an APB-member country: the United States, U.S. territories, Indian Tribes, and Canada, under the legal authority of an APB-member agency. Second, metadata derived from unencrypted CJI is treated as CJI and may never be used for advertising or other commercial purposes by a cloud provider.

Key custody is the practical lever. As AWS documents for CJIS workloads, when the agency or application provider holds the keys in validated hardware security modules, provider personnel have no path to plaintext CJI, which changes the personnel-screening obligation entirely.

How Do CJIS Audits Work, and What Happens If You Fail?

CJIS has no single national auditor. Oversight is layered, and it runs on a three-year clock.

State level. Each CJIS Systems Agency (CSA), State Identification Bureau, or Interface Agency must complete a triennial audit of every agency that reaches CJIS systems through it. In most states the CSA is the state police or bureau of investigation, and its CJIS Information Security Officer runs the program.

Federal level. The FBI’s CJIS Audit Unit (CAU) audits the CSAs themselves to verify compliance with the Policy, and each authorized CSA, IA, or SIB user is subject to a triennial audit by the CJIS Division. The FBI audits the auditors; the auditors audit you.

Third parties. Agencies must, at minimum, triennially audit all external service providers with access to their systems, may conduct unannounced inspections of contractor facilities, and may reuse another CSA’s audit results for the same contractor facility rather than duplicating the work.

Failure is not a fine. Improper access, use, or dissemination of CHRI can produce administrative sanctions up to and including termination of CJIS services, plus state and federal criminal penalties. For an agency, losing NCIC access is an operational emergency; for a vendor, it ends the contract.

Two internal cadences worth engineering before the audit rather than during it: incident reports must reach the agency’s response capability within one hour of discovery and be passed to the CSO, SIB Chief, or Interface Agency Official and the FBI CJIS ISO (IR-6); and audit records must be retained for a minimum of one year (AU-11). Ransomware remains the pressure test — the FBI’s 2025 Internet Crime Report logged more than 3,600 ransomware complaints with reported losses above $32 million, and identified 63 new ransomware variants during the year. Our guide on how to prevent data breaches covers the controls that keep those incidents out of the one-hour reporting queue.

Is There a CJIS Certification? How Vendors Actually Prove Compliance

There is no such thing as CJIS certification. The FBI does not certify, accredit, or list compliant products or companies, and no third party can issue a CJIS certificate that binds a CSA. Any vendor claiming to be “CJIS certified” is describing something that does not exist.

What actually exists is a chain of accountability:

1. The agency owns compliance. A CJA or NCJA is responsible for the CJI it holds, including the portion handled by its vendors.
2. The Security Addendum binds the vendor. Every private contractor performing criminal justice functions signs the Addendum’s certification page, committing to all of its terms; the agreement between agency and contractor must incorporate the Policy.
3. Personnel are screened. Contractor staff with access to unencrypted CJI undergo state-of-residency and national fingerprint-based record checks; a felony conviction is disqualifying absent a documented variance from the CSO.
4. The CSA decides. Compliance is confirmed through the audit process in the states where you operate — which is why large providers negotiate CJIS Information Agreements state by state, as Microsoft describes for its government cloud offerings.

So what should a vendor produce when a procurement team asks for proof? A control-by-control mapping to CJISSECPOL v6.1 with the priority markings preserved; documentation of FIPS 140-3 module usage and key custody; a personnel screening attestation; a data residency statement naming the hosting regions; a signed Security Addendum; the results of the most recent CSA audit of your facility; and a list of the states where an Information Agreement is already in place.

Because the same evidence underpins FedRAMP, StateRAMP, and NIST-based programs, most vendors serving public safety build one control set and map it across their compliance frameworks rather than maintaining a separate CJIS binder.

How Do You Build a CJIS Compliance Program?

A workable CJIS program follows the same sequence whether you are a 40-officer department or a SaaS provider selling into 30 states.

1. Define the CJI boundary. Diagram every system, interface, mobile device, and third party that touches CJI or CHRI, and mark which components sit inside a physically secure location. Everything outside that line inherits the encryption and advanced authentication requirements.
2. Identify your CSA and get the agreements right. Confirm which agency is your CJIS Systems Agency, who the CSO and CSA ISO are, and which instrument applies — interagency agreement, management control agreement, or the CJIS Security Addendum.
3. Gap-assess against v6.1, not v5.9. Pull the Requirements Companion Document and assess all 178 controls. Record the priority marking beside each finding so you can separate what is sanctionable today from what becomes sanctionable when the zero cycle closes on September 30, 2027.
4. Close Priority 1 first. The 22 Priority 1 controls concentrate in account management, least privilege, remote access, MFA and authenticators, configuration baselines, boundary protection, vulnerability scanning, and system integrity monitoring. RA-5 sets the pace: scan at least monthly and remediate critical findings in 15 days, high in 30, medium in 60, and low in 90.
5. Fix crypto before the September 21, 2026 cutoff. Replace FIPS 140-2 modules, verify 256-bit symmetric keys in transit and at rest, and confirm every storage location sits inside an APB-member country.
6. Run personnel security as a process. Fingerprint-based checks before access, re-evaluation on a defined cycle, security literacy training before access and annually thereafter, retraining within 30 days of any security incident for those involved, and a sanctions process that notifies security and account administrators within 24 hours of initiation.
7. Instrument logging and incident response. One-year log retention, defined review and correlation, and a tested path that gets a suspected incident to your response capability within one hour and onward to the CSO and FBI CJIS ISO.
8. Keep evidence audit-ready continuously. The triennial audit asks for artifacts — access reviews, training records, scan results, configuration baselines, agreements, and prior audit findings, which role-based training must itself cover. Collecting these on demand every three years is how agencies fail; collecting them continuously is how they pass.

The last step is the one most programs underinvest in. CJIS is not a point-in-time assessment, and the modernized Policy’s control-by-control structure makes it far easier to monitor continuously than the narrative version it replaced.

Frequently asked questions

About this guide. By Compyl Research. Last updated August 11, 2026. This is general information, not legal advice — consult counsel for your specific obligations. Compyl is an AI-powered, agentic GRC platform built by CISOs.