CJIS MFA changes: what law enforcement IAM teams need to know

NHI Mgmt Group · 2026-06-08T17:15:23+00:00

TL;DR: CJIS now requires multifactor authentication for systems that store or provide access to criminal justice information by October 1, 2024, and points implementers toward phishing-resistant methods grounded in NIST SP 800-63B, according to Axiad. The practical shift is that identity assurance, revocation, and authenticator binding now matter as much as access itself. Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “New CJIS Security Policy Changes the Game for MFA for Criminal Justice Organizations”. Key questions Q: What breaks when CJIS MFA is not phishing resistant? A: Weak MFA can still be phished, replayed, or bypassed with harvested secrets, so access may appear compliant while still failing the assurance level CJIS expects. Q: When should organisations replace legacy MFA with phishing-resistant MFA? A: They should do it first for privileged accounts, remote access, and any workflow that attackers can target with phishing or adversary-in-the-middle attacks. Q: What are the signs that CJIS access governance is failing? A: Warning signs include incomplete visibility into all accounts, missing authentication logs, weak review of privileged activity, and access attempts that are not evaluated against normal behavior. Practitioner guidance Map every CJIS-accessing system to its authenticator assurance level Inventory which systems store or provide access to criminal justice information, then record whether each one uses phishing-resistant MFA or a weaker MFA method. Validate enrollment binding and revocation paths Check whether authenticators are bound at enrollment and whether administrators can revoke or suspend them without delay. Prioritise cryptographic authenticators for CJIS users Use certificate-based authentication or FIDO passkeys where CJIS access depends on phishing resistance, and avoid treating passwords plus OTP as equivalent. Bottom line: The policy shift is about stronger identity assurance, not simply more MFA coverage. Explore furtherView Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →

Topic starter 08/06/2026 6:31 pm

Phishing-resistant MFA is now the real control boundary for CJIS access. The policy shift makes the quality of the authenticator more important than the presence of a second factor. That changes the governance question from "is MFA enabled?" to "can this authentication method withstand phishing and credential replay?" Practitioners should treat authentication strength as the compliance variable, not a feature toggle.

A few things that frame the scale:

Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

A question worth separating out:

Q: What is the difference between strong MFA and phishing-resistant MFA?

A: Strong MFA means more than one factor is used, while phishing-resistant MFA means the factor cannot be easily captured and replayed by an attacker. A code sent by text may count as MFA, but it is not resistant enough for high-risk accounts because the secret can be stolen outside the application itself. Resistance is the higher standard.

👉 Read our full editorial: CJIS phishing-resistant MFA raises the bar for identity assurance

CJIS MFA changes: what law enforcement IAM teams need to know

Deepen Your Knowledge

Subscribe to the NHI & AI Identity Journal

Subscribe to the NHI & AI Identity Journal