CJIS approved vendors and how a software vendor gets on the list
There is no national list of CJIS approved vendors and no FBI certification that puts you on one. Approval happens state by state: a state agency keeps a vendor list or program, and you qualify by signing the CJIS Security Addendum, clearing fingerprint-based checks for your staff and keeping security awareness training current. Cjis keeps that record in one workspace, with a separate report for each state or agency, so each application takes days. Plans start at $49 a month.
Key points
- Nobody issues a federal "CJIS approved" badge. A state vendor list or an agency contract is the only approval that exists.
- Each state sets its own steps, forms and fees, so a vendor selling in four states runs four processes.
- Being listed does not replace the agency's own review, and it does not prove compliance on its own.
- What every program asks for is the same: Security Addendum, fingerprint-based checks, training dates and a named contact.
- Keep the records in one register so a new state is a copy of your evidence, not a new project.
How three states handle CJIS approved vendors
The examples below show the spread. Check the current rules with the state office before you apply, because forms and fees change.
| State | What the program does | What it does not do |
|---|---|---|
| Georgia | The GCIC keeps a list of approved vendors and their employees, added after fingerprint-based checks and with yearly security awareness training | Does not replace the contract with each agency |
| Colorado | The CBI runs a vendor management program with a directory of vendors | A directory listing does not indicate full compliance with CJIS requirements |
| Massachusetts | DCJIS approval is required before a vendor connects to the state CJIS network | Does not cover other states you sell into |
Other states have nothing formal, and the agency simply asks for the Security Addendum and a staff list in the contract. For how a screening program can spare you repeat fingerprinting inside one state, read CJIS vendor screening programs.
What every state asks a vendor to prepare
Whatever the state calls its program, the application usually boils down to five items. A vendor that has them dated and filed gets approved faster and answers the next RFP from the same folder.
1. **The signed Security Addendum.** Your authorized representative signs the agreement, and each employee with access signs a certification page. See the CJIS Security Addendum for vendors post for who signs what.
2. **A list of personnel with access.** Role, access level and the date of each fingerprint-based check, by state. Never the prints, only dates and outcomes. The rules are in CJIS background check requirements.
3. **Training records.** Dated security awareness training for each person, at the level their access needs. CJIS training levels explains the four levels.
4. **A system description.** Where the product runs, who can reach agency data, how users authenticate and what you log. Hosting choices are covered in CJIS compliance in AWS, Azure and Microsoft 365.
5. **A named contact.** Someone who answers the state when a staff change, an incident or a renewal comes up.
Five documents sound simple. The trouble is that they live in different people's inboxes and go stale in different months.
Mistakes that slow an approval
The same few habits show up again and again.
- Writing "CJIS certified" in sales copy. No federal body certifies products, and a state reviewer who reads it stops trusting the rest. Our CJIS certification page explains the wording to use instead.
- Applying with a staff list that includes engineers who have not been fingerprinted yet.
- Letting a training record lapse between application and approval.
- Treating the state listing as the finish line. The agency that buys from you still asks for the paperwork.
- Using one folder for every state, so a new state means a week of searching for the right version.
A vendor chasing a bid at the same time can pair this with the CJIS RFP response checklist, and if you are writing the proposal itself, a tool that can turn the RFP into a finished proposal saves hours on the rest of the response.
Keep one record and a report for each state
Cjis keeps your shared controls and policies once, then a record per agency or state with its systems, people, agreements and open items. You send a PDF report or a read-only link scoped to one buyer, so one state never sees another state's names. Reminders fire 30 and 7 days before a training record expires, and the register logs the day access is removed when someone leaves. Starter at $49 a month covers one report, Team at $199 covers three, Pro at $499 covers 25 and Enterprise at $999 has no limit. Compare limits on the CJIS compliance software pricing page.
Questions vendors ask about CJIS approved vendor lists
Is there an official list of CJIS approved vendors?
No. The FBI does not publish one. Some states keep their own vendor lists or programs, and each state decides who qualifies. Ask the CJIS office in every state where you sell for its vendor onboarding steps before you promise a date to a customer.
How do I become a CJIS approved vendor?
Contact the state agency that runs CJIS security, then sign the Security Addendum, clear fingerprint-based checks for staff with access and keep training current. Some states add a vendor form or a fee. The agency that signs your contract may also run its own review.
Does being on a state list mean we are CJIS compliant?
Not by itself. Colorado says its directory listing does not indicate full compliance with CJIS requirements. The list shows you went through the state process, and the buying agency still checks your controls and your staff records.
Do we need a separate approval in each state?
Usually yes. Each state sets its own process, and a clearance in one state does not carry into another. Keeping the same dated evidence for all states makes each new application a matter of filling forms, not rebuilding proof.
Start with the records every state asks for
Run the 12 question readiness check, see your gaps by policy area and build your first state or agency report. Software vendors can start from CJIS compliance for vendors, and teams that sell supervision software can read CJIS compliance for probation software vendors.
