Topic starter
12/06/2026 10:23 pm
TL;DR: CJIS now requires systems handling criminal justice information to use multifactor authentication and points practitioners toward phishing-resistant MFA, including cryptographic devices, certificates, and FIDO-based approaches, according to Axiad. The real change is governance, because access to CJIS data now depends on assurance strength, revocation capability, and deployment choices that identity teams must validate.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “New CJIS Security Policy Changes the Game for MFA for Criminal Justice Organizations”.
Key questions
Q: What breaks when CJIS MFA is not phishing resistant?
A: Weak MFA can still be phished, replayed, or bypassed with harvested secrets, so access may appear compliant while still failing the assurance level CJIS expects.
Q: Why does CJIS care about authenticator revocation as well as MFA strength?
A: Because a strong factor that cannot be withdrawn quickly still leaves stale trust in place.
Q: How should organisations implement phishing-resistant MFA for regulated access?
A: Start by mapping each protected system to the identity type that uses it, then choose a phishing-resistant method that fits that subject.
Practitioner guidance
- Map CJIS access paths to phishing-resistant MFA Inventory every system and application that stores or provides access to criminal justice information and confirm that each path uses a phishing-resistant method rather than a generic second factor.
- Validate authenticator binding at enrollment Verify that identity proofing and enrollment processes bind authenticators to the correct user or workload and record that binding for audit purposes.
- Test revocation and suspension workflows Prove that lost, stolen, or reassigned authenticators can be suspended or revoked without delay across all CJIS-facing environments.
Bottom line: CJIS now treats MFA as an assurance problem, which means factor strength matters as much as factor presence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 1:07 am
Phishing-resistant MFA is now a governance requirement, not an authentication preference. The CJIS change moves the decision boundary from factor presence to factor assurance. That matters because identity teams can no longer claim compliance by counting factors alone; they have to show resistance to phishing, replay, and secret harvesting. For regulated access, assurance strength is now the control outcome practitioners must evidence.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How do teams know whether their MFA is strong enough for CJIS?
A: Check whether the deployed method resists phishing, supports reliable revocation, and is approved for the assurance level the policy references. If the authentication method can still be tricked by harvested credentials or lacks lifecycle control, it is not enough.
👉 Read our full editorial: CJIS phishing-resistant MFA raises the bar for identity access
This post was modified 6 days ago by NHI Mgmt Group