CJIS Security Policy Guide: Protecting Criminal Justice Information

Every agency, contractor and cloud provider that touches criminal justice information in the US has to meet the FBI CJIS Security Policy, and the modernised policy has turned a familiar checklist into a full NIST SP 800-53 style control set. Version 6.0 (27 December 2024) completed that modernisation, and version 6.1 (dated 25 June 2026) is the current version on the FBI's CJIS Security Policy Resource Center as of October 2026. This guide explains who the policy applies to, how its 20 policy areas and priority tiers work, which requirements are already sanctionable at audit and which sit in the zero-cycle until 30 September 2027, and what the identity and multi-factor authentication requirements mean for human and non-human accounts. It is written for agency ISOs and IT teams, CJIS Systems Officers, and vendors serving law enforcement. Always confirm requirement text in the current policy and your CJIS Systems Agency's guidance.

Key takeaways

• Version 6.1 is current. The FBI resource center lists v6.1 (file dated 25 June 2026), which incorporates calendar year 2025 changes approved by the Advisory Policy Board and Compact Council.
• Priority tiers set the audit timetable. Since 1 October 2024, existing requirements and Priority 1 requirements are sanctionable; Priority 2 to 4 are in a zero-cycle from 1 October 2024 to 30 September 2027.
• MFA is Priority 1. IA-2(1) MFA for privileged accounts, IA-2(2) for non-privileged accounts, IA-2(8) replay resistance and IA-2(12) PIV acceptance are all marked P1.
• The control language is NIST SP 800-53 Rev. 5. Policy areas use 800-53 family names and control IDs, which makes mapping to existing programmes far easier than under v5.9.
• Contractors sign the Security Addendum. Private vendors with access to CJI are bound through the CJIS Security Addendum, with fingerprint-based screening of their staff before access.

What it is and who it applies to

The CJIS Security Policy sets the minimum security requirements for access to criminal justice information (CJI) held in, or obtained from, FBI CJIS systems. CJI includes biometric, identity history, biographic, property and case or incident history data, and the personal information within it. The policy covers anyone with access to, or operating in support of, criminal justice and noncriminal justice services and information, including contractors and private entities. It is approved through the CJIS Advisory Policy Board (APB) and the Compact Council.

A CSA can be stricter than the FBI policy, and many are. For a vendor, the practical rule is that each state's CSA decides how you are vetted and audited in that state.

Version history that matters

• v5.9.5 (9 July 2024): brought in a large set of modernised requirements that took effect on 1 October 2024.
• v6.0 (27 December 2024): completed the modernisation to NIST SP 800-53 Rev. 5, with new or modernised families for assessment and monitoring (CA), personnel security (PS), system and services acquisition (SA) and supply chain risk management (SR), and removed Appendices J and K. The California DOJ told its agencies that FBI CJIS audits against v6.0 start on 1 October 2025.
• v6.1 (25 June 2026): incorporates the Spring 2025 APB changes and administrative changes approved by the Security and Access Subcommittee on 14 November 2025. Check its Summary of Changes against your current control set.

Structure and key requirements

Section 5 of the policy contains 20 policy areas. Areas 5.2 to 5.19 follow NIST SP 800-53 Rev. 5 families; 5.1 and 5.20 are CJIS-specific.

Priority tiers and audit dates

Section 1.4 of the policy assigns each modernised requirement a priority. Requirements that already existed before modernisation (v5.9) are marked with an asterisk and remain sanctionable. The tiers tell agencies what auditors can sanction now and what they will sanction after the zero-cycle.

In a zero-cycle, auditors record findings but do not sanction them. California DOJ advised its agencies to implement Priority 1 controls immediately and treat Priorities 2 to 4 as a roadmap in that order, which is sound advice everywhere.

Requirements that drive most of the work

• Information exchange agreements (5.1): user agreements between CSA and agencies, management control agreements with IT departments, and the Security Addendum for contractors.
• Encryption (SC-8, SC-13, SC-28): protection of CJI in transit and at rest. Check the current policy for the cryptographic module requirements and when the physically secure location exemption applies.
• Audit and accountability (AU-2, AU-6, AU-11): log the events the policy lists, review them, and keep them for the retention period stated in AU-11.
• Personnel security (PS-3, PS-7, PS-8): fingerprint-based background checks before unescorted access, rules for external personnel, and a sanctions process.
• Supply chain (SR): new in the modernised policy; applies supplier risk thinking to products and services that process CJI.

Identity and NHI requirements

The IA area is where most agencies and vendors feel the modernisation. Earlier versions used the term "advanced authentication" with a set of exceptions for physically secure locations. The modernised policy instead uses the NIST SP 800-53 enhancements directly and requires MFA for both privileged and non-privileged accounts. Texas DPS notes that the FBI's MFA guidance, released on 7 December 2022, is sanctionable at audit and that MFA means two or more different factors: something you know, have or are.

The authenticator types the policy lists under IA-5 (memorized secrets, look-up secrets, out-of-band devices, OTP devices and cryptographic authenticators) follow the NIST SP 800-63B taxonomy, and Appendix G.9 provides a NIST authentication primer. See the NIST SP 800-63 Digital Identity Guidelines Guide and the Phishing-Resistant MFA Guide.

• Policy deadline: Texas DPS told its agencies they have until 1 October 2027 to update IA-1 policies to require MFA for all CJIS system users. Check your own CSA's position; the MFA controls themselves are already P1.
• Applications without MFA: Texas DPS suggests enforcing MFA at the operating system level where an application cannot do it. Mobile data terminals and records systems are the usual problem.
• Service and system accounts: interfaces between records management systems, CAD, state message switches and cloud services run on non-human accounts. They cannot do MFA, so control them through AC-2 account management, AC-6 least privilege, IA-5 authenticator management (vaulting and rotation) and IA-9 service identification where you use it. See the Service Account Security Guide.
• Vendor and support accounts: contractor staff need screening before access and their accounts need the same MFA as agency staff. Shared vendor logins fail both AC-2 and IA-2.
• Logging identity events: authentication successes and failures, privilege changes and account changes should all reach the AU-6 review process.

Implementation steps

1. Download the current set. Get v6.1, the Requirements Companion Document (PDF or Excel) and your CSA's addenda. The companion document is the practical tracker for each requirement and its priority.
2. Map where CJI lives. Inventory every system, network, mobile device, cloud service and contractor that stores, processes or transmits unencrypted CJI. This sets the scope for everything else.
3. Close Priority 1 and existing gaps first. These are sanctionable now. MFA for all users with access to unencrypted CJI, account management and authenticator management are usually the largest.
4. Pilot MFA by user group. Start with administrators, then dispatch and records users, then mobile users in vehicles. Test fallback methods (for example OTP tokens where phones are banned) and a lost-token process before mandating it.
5. Bring vendors under the Security Addendum. Confirm every contractor with logical or unescorted physical access has signed the Addendum and that fingerprints were submitted before access.
6. Plan Priority 2 to 4 before September 2027. Build a dated roadmap, because the zero-cycle ends on 30 September 2027 and those findings then become sanctionable.
7. Self-assess annually. California DOJ requires agencies to review the requirements annually; run a self-audit against the companion document and keep the evidence.

Rolling back: MFA changes can lock out patrol users during a shift. Keep a documented, time-limited emergency access method approved by your CSA, monitor its use, and roll back per user group rather than switching MFA off globally.

Agencies of different sizes

• Small agency without IT staff: relies on its CSA, a county IT department (under a management control agreement) or a vendor. Its job is to make sure those parties are contracted, screened and audited.
• Large agency or state CSA: runs its own identity platform, logging and audit programme, and may be the auditor for local agencies.
• Cloud or SaaS vendor: must work state by state; a FedRAMP or GovRAMP status helps with evidence but does not replace CJIS screening, the Security Addendum or CSA approval.

Evidence and assessment

The FBI CJIS Audit Unit (CAU) audits on a triennial schedule. It reviews the CSA's policies, procedures, practices and data, samples local agencies to see how the CSA ensures compliance, interviews staff, reviews data quality and tours facilities for physical security. Findings go to the CSA and oversight bodies, are presented to the APB Compliance Evaluation Subcommittee or the Compact Council Sanctions Committee, and are tracked to completion. CSAs in turn audit the agencies in their jurisdiction; Texas DPS reported that its technical audit team aims to audit every agency without a technical audit in the past three years.

Metrics that show it is working

• Percentage of users with access to unencrypted CJI enrolled in MFA (target 100 percent).
• Number of shared or generic accounts in CJI systems (target zero).
• Service accounts with a named owner and rotated credential, as a percentage.
• Contractor staff with access who have a completed fingerprint check and signed Addendum (target 100 percent).
• Priority 2 to 4 requirements closed against the September 2027 roadmap.
• Open audit findings and median days to close.

Mapping to other frameworks

Because the control IDs match NIST SP 800-53 Rev. 5, an agency that already runs an 800-53 programme can treat CJIS as a tailored overlay with CJIS-specific parameters. See the NIST SP 800-53 Guide. Cloud vendors with a FedRAMP package can reuse control narratives, but CJIS adds personnel screening, the Security Addendum and CSA-specific rules. See the FedRAMP Guide.

Common pitfalls

• MFA only for remote users. Older practice exempted users in physically secure locations. IA-2(2) is P1 for non-privileged accounts; check your CSA's reading before relying on any exemption.
• Accounts on third-party platforms without MFA. Data held in cloud platforms is exposed when vendor or tenant accounts use passwords alone. The Snowflake breach, where infostealer credentials on accounts without MFA unlocked about 165 organisations' data, is the pattern to avoid for any cloud service holding CJI.
• Forgetting service accounts. Interface and integration accounts often hold broad CJI access with old passwords and no owner. They are in scope for AC-2 and IA-5 even though they cannot use MFA.
• Treating the zero-cycle as a holiday. Priority 2 to 4 findings become sanctionable after 30 September 2027; multi-year projects such as device authentication need to start now.
• Vendors without a signed Addendum or completed screening. A cloud or managed service provider whose staff can reach CJI without fingerprint checks is a direct audit finding.
• Working from an old version. Policies and contracts that cite v5.9 miss the modernised families. Update references to v6.1 and the companion document.

Practitioner checklist

• Confirm you are working from CJIS Security Policy v6.1 and the current Requirements Companion Document.
• Map every system, device, cloud service and contractor that handles unencrypted CJI.
• Enforce MFA for all privileged and non-privileged accounts with CJI access (IA-2(1), IA-2(2)).
• Update the IA-1 policy to require MFA for all CJIS system users, ahead of your CSA's deadline.
• Inventory service and interface accounts with owners, least privilege and rotated credentials.
• Check every contractor has signed the CJIS Security Addendum and completed fingerprint screening.
• Close Priority 1 and asterisked gaps now; publish a dated plan for Priorities 2 to 4 before 30 September 2027.
• Run an annual self-audit and keep evidence ready for the triennial CSA and FBI audits.

Standards and references

• FBI: CJIS Security Policy Resource Center
• FBI: CJIS Security Policy v6.1
• FBI: Secure and Uncompromised Criminal Justice Information with Help from the CJIS Audit Unit
• NIST: SP 800-53 Rev. 5
• California DOJ: Information Bulletin 2025-ISRS-001, CJIS Security Policy v6.0
• Texas DPS: Crime Records Newsletter, 3rd Quarter 2025
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: NIST SP 800-53 Guide · FedRAMP Guide · Phishing-Resistant MFA Guide · Local Government Identity Security Guide · Service Account Security Guide. This guide summarises the FBI CJIS Security Policy v6.1 as published in October 2026 and is not legal advice.