CJIS Security Addendum explained for vendors who sell to agencies

What the CJIS Security Addendum is

The CJIS Security Addendum is a standard document the FBI CJIS Division publishes with the CJIS Security Policy, in Appendix H. It is used when a criminal justice agency allows a private contractor to perform a function that gives the contractor access to CJI. Typical functions include hosting a records management system, providing a dispatch platform, supporting mobile data terminals, storing digital evidence or managing the agency's network.

The Addendum does not replace your commercial contract. It sits alongside it and binds the security side. Because the text is standard, agencies do not usually negotiate it. You sign it as published.

Because it is published with the policy, the Addendum follows the policy as it changes. When the FBI updates the CJIS Security Policy, the commitments you signed point to the current requirements, not to a frozen copy from the day you signed. That is one more reason the move to v6.0 matters to vendors, even those with long-standing agency contracts.

Some states add their own forms or state-specific language next to the Addendum. Ask each agency for the full packet it uses, so nothing arrives as a surprise late in procurement.

Who signs the Addendum

Two signatures matter. The company signs the Addendum with the agency, usually through an authorized officer. Then each employee of the contractor who has access to CJI signs the certification page, which says they have read and understand the Addendum and the relevant parts of the policy and will follow them.

The certification page applies to everyone with access, not just the account manager. Engineers with production access, support staff who can see customer records, database administrators and anyone at a subcontractor with access all need their own signed page. New hires sign before they get access. When people leave, the record should show it.

Keep the original signed pages, or clean scans, in a place your compliance lead controls. Agencies sometimes ask for them years later, during an audit or after a staff change on their side, and the person who signed may have left your company by then.

What the vendor commits to

By signing, the contractor agrees to meet the CJIS Security Policy for the CJI it handles. In practical terms that means:

• Staff with unescorted physical or logical access to CJI go through a state and national fingerprint-based record check before access.
• Staff complete security awareness training before access, or within the policy window, and then annually.
• Systems use multi-factor authentication for access to CJI, follow password rules and encrypt CJI in transit and at rest outside physically secure locations with FIPS 140-2 or FIPS 140-3 validated modules.
• Audit logs are kept and reviewed.
• Security incidents are reported to the agency, which reports onward as the policy requires.
• Media with CJI is sanitized or destroyed by an approved method.
• The contractor accepts audits and inspections by the agency, the CSA and the FBI.
• CJI is used only for the purposes in the contract.

Signing is the easy part. Keeping these commitments, with proof, for years is the real work.

Subcontractors are part of the picture. If your company uses another firm for hosting, support or development and that firm's staff can reach CJI, the same obligations reach them. Agencies will expect you to know who those people are and to show that they are screened, trained and certified.

How it fits the agency's vendor management

For the agency, the Addendum is one piece of its responsibility for vendors. The agency remains responsible for CJI even when a contractor handles it, and the CSA auditor will ask how the agency confirmed that each contractor meets the policy. Expect agencies to ask for more than a signature: background check confirmations for your staff, training records, a description of your security controls and sometimes answers to a detailed questionnaire.

Under the v6.0 structure, built on NIST SP 800-53 Rev. 5 control families, vendor oversight and supply chain controls are more visible. That is one reason agency questionnaires to vendors keep getting longer.

The difference from a management control agreement

The Addendum is for private contractors. When a criminal justice agency gives a government noncriminal justice agency access to CJI or to systems that process it, for example a city or county IT department that runs the police network, the policy uses a management control agreement instead. That agreement gives the criminal justice agency authority over the security of the systems and personnel involved.

If you are a private company working under a county IT department that already has a management control agreement with the police department, you still need the Addendum for your own access. Ask the agency which documents apply to your setup.

Working with many agencies and states

A vendor with customers in many jurisdictions faces repetition. Each agency may want its own signed Addendum, its own certification pages, its own fingerprinting and approval of your staff and its own questionnaire. Some states have programs that simplify vendor screening across agencies in that state, others leave it to each agency.

Practical consequences:

• One engineer may have signed certification pages for several agencies, each on a different date.
• Fingerprint-based checks done for one state may not be accepted in another.
• Training may have to be completed on a specific state platform.
• Questionnaires may reference v5.9.5 in one state and v6.0 in another during the transition.

Without a per agency record, nobody can quickly say which staff are approved where. That is a problem during a sale, and a bigger one during an incident.

A central register solves most of this. One record per person, with a line for each agency that approved them, the date of approval and the date of their certification page, answers the common questions in seconds and makes offboarding reliable.

Practical steps for a vendor

• Read Appendix H and the policy sections it relies on before the first agency asks.
• Decide which roles in your company will have access to CJI, and keep the list small.
• Build an onboarding step that blocks access until the fingerprint-based check, training and certification page are done.
• Keep a per agency record of the signed Addendum, certification pages, approvals and dates.
• Prepare a standard evidence package: control descriptions, MFA and encryption settings, logging and incident response.
• Map your controls to both v5.9.5 and v6.0 so you can answer either kind of questionnaire.
• Set an offboarding step that tells each agency when an approved person leaves.
• Review the whole record at least once a year.

The Addendum in the sales cycle

For many vendors, the first contact with the Addendum comes late, after a pilot goes well and the agency's IT or security staff join the conversation. At that point every missing record delays the contract. A vendor that arrives with the Addendum already understood, a list of cleared staff, an evidence package and answers mapped to the current policy version shortens that stage and looks more credible to the agency.

It also helps to know who on the agency side decides. Usually the agency's LASO or IT lead reviews security, and sometimes the CSA must approve the arrangement. Ask early who will review your documents and what format they prefer, then prepare exactly that.

Common misunderstandings

A few beliefs cause trouble for vendors:

• Signing the Addendum does not make a company CJIS certified. The FBI does not certify companies.
• A commercial background check does not replace the fingerprint-based check.
• A hosting provider's compliance does not cover your own staff and configuration.
• Signing once for one agency does not cover every agency.

Be precise in sales material. Say that you sign the CJIS Security Addendum and follow the policy, and back it with evidence.

Per agency records in Cjis

Cjis keeps vendor compliance organized by agency. The personnel register records each person's background check status, Security Addendum certification, training level and dates, and which agencies approved them. Signed agreements go into the evidence locker, attached to the controls they support. The requirements checklist covers the commitments in the Addendum, mapped to the v6.0 control families.

For each agency you serve, Cjis builds a report as one PDF and a read-only link: assessment summary, control status, policies with dates, personnel compliance table and evidence index. Starter covers one agency report, Team three, Pro 25 and Enterprise unlimited.

Cjis is an independent compliance tool, not affiliated with, endorsed by or certified by the FBI or the CJIS Division, and not legal advice. It never stores CJI.