Notifications
Clear all
Topic starter
25/06/2026 12:12 am
TL;DR: CJIS 6.0 raises the bar with MFA, continuous monitoring, and third-party risk management, but public-sector breach data still shows 22% stem from credential abuse, often on enterprise-owned or personal devices, according to Imprivata. The real challenge is turning compliance controls into usable access that does not push staff toward shortcuts.
NHIMG editorial — based on content published by Imprivata: CJIS 6.0 Urges Law Enforcement to Modernize Secure Access for Compliance and Usability
By the numbers:
- 22% of public-sector breaches stemmed from credential abuse, most commonly involving enterprise-owned devices (30%) or personal devices (46%).
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.
Questions worth separating out
Q: How should agencies reduce access friction without weakening CJIS-aligned controls?
A: They should redesign authentication around the actual workflow, not the policy ideal.
Q: Why do shared workstations and mixed devices increase identity risk in public safety environments?
A: Because they weaken the assumption that one person, one device, and one session are aligned.
Q: What do security teams get wrong about third-party access under CJIS-style governance?
A: They often treat supplier access as a ticket to approve rather than a lifecycle to govern.
Practitioner guidance
- Map access friction to control failure points Identify where repeated logins, shared workstations, or legacy applications cause users to bypass MFA, reuse sessions, or delay revocation.
- Govern vendor access as a lifecycle Tie every third-party account to a named business purpose, expiry condition, and offboarding check so vendor access cannot outlive the work it was created for.
- Instrument audit-ready access telemetry Capture authentication events, privileged actions, and revocation actions together so reviewers can reconstruct who had access, when it was used, and when it ended.
What's in the full article
Imprivata's full article covers the operational detail this post intentionally leaves for the source:
- Specific ways proximity badges and biometrics can reduce repeated logins in shared environments.
- Practical handling of legacy applications that resist modern MFA integration.
- How automated audit monitoring supports compliance evidence across third-party access.
- Implementation details for balancing frictionless access with public-sector security requirements.
👉 Read Imprivata's analysis of CJIS 6.0 access modernisation and compliance →
CJIS 6.0 compliance gaps: are your access controls keeping up?
Explore further
25/06/2026 9:03 am
CJIS 6.0 turns access usability into a security control, not a convenience issue. The article shows that compliance can fail in practice when authentication is so cumbersome that people invent workarounds. Shared workstations, older applications, and time-sensitive policing workflows make this a governance problem, not just a technical one. Agencies that treat usability as part of the control design are more likely to preserve both assurance and operational continuity.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: Which frameworks matter most for CJIS access modernisation and auditability?
A: NIST Cybersecurity Framework 2.0 is relevant for continuous governance, while identity controls should be assessed through the lens of authentication assurance, access review, and monitoring. Agencies can also use NHI governance resources to tighten lifecycle handling for vendor and workload credentials that support public-sector systems.
👉 Read our full editorial: CJIS 6.0 exposes the access gap between compliance and usability
