CJIS security awareness training levels 1 to 4 explained

Why the policy uses training levels

A dispatcher who reads CJI on a screen, a custodian who cleans a records room at night and a system administrator who manages the database all touch CJI in different ways. Giving all three the same training wastes time for the custodian and leaves the administrator underprepared. The level structure solves that by matching the depth of training to the depth of access.

The levels build on each other. A person at a higher level covers the topics of the lower levels plus the topics for their role. When someone changes jobs and gains access, their training level should change with them.

The level is set by the access a person actually has, not by their rank or title. A chief who never signs in to a CJI system may need less technical training than a part-time IT contractor with administrator rights. Start from your access list, not from your org chart, and assign each person to the level that matches the highest access they hold.

Write the mapping down. A short table that says which roles in your agency or company fall into which level saves time every year and gives the auditor a clear answer when they ask how you decided.

Level 1 for physical access only

Level 1 covers people who have unescorted access to a physically secure location but no authorized access to CJI itself. Typical examples are custodial staff, maintenance workers and facilities contractors who enter a records area or a server room without an escort.

Typical Level 1 topics include:

• What CJI is and why it is protected.
• Rules for visitors, escorts and access to secure areas.
• How to handle any CJI they might see by accident, and that they must not access or share it.
• How to report a security incident or a suspicious event.
• Social engineering and attempts to gain entry by tailgating or pretexting.

Level 2 for all personnel with access to CJI

Level 2 covers all personnel who are authorized to access CJI. In practice it is the level for people who handle CJI in printed or verbal form without signing in to the systems that process it. Records clerks, some dispatch and front desk roles, and staff who receive printed reports often fall here, depending on how your agency defines roles.

Typical Level 2 topics add to Level 1:

• Proper handling, storage and destruction of CJI in any form.
• Dissemination rules and the consequences of misuse.
• Media protection and clean desk practices.
• Threats, vulnerabilities and the risks of releasing CJI to unauthorized people.
• Incident response duties and reporting paths.

Level 3 for logical access

Level 3 covers people with logical access to CJI, meaning they sign in to systems that store, process or transmit it. Patrol officers using mobile data terminals, dispatchers on a CAD system, investigators in a records management system and vendor support staff who can see production data are common examples.

Typical Level 3 topics add to Level 2:

• Account and password rules, and multi-factor authentication for access to CJI.
• Protecting workstations, laptops and mobile devices, including screen locks and session timeouts.
• Safe use of email and the web, malware and phishing.
• Rules for remote access and use of personal devices where allowed.
• Acceptable use and monitoring of systems.

What CJIS level 4 training covers for IT and privileged roles

Level 4 covers information technology personnel and anyone with privileged access: system and network administrators, security staff, database administrators, developers with production access and vendor engineers who manage infrastructure. This is the level people usually mean when they ask about CJIS level 4 training.

Typical Level 4 topics add to Level 3:

• Data backup, storage and recovery.
• Patch management, configuration baselines and change control.
• Access control administration, privileged account handling and least privilege.
• Network security, firewalls, encryption with FIPS validated modules and secure remote administration.
• Audit logging, log review and incident handling at a technical level.
• Protection against malware and timely response to security alerts.

For a gov-tech vendor, most engineering and support staff who can reach customer CJI land at Level 3 or Level 4. Plan for that before your first agency review.

Literacy training and role-based training in current versions

Current versions of the policy, including v6.0 with its NIST SP 800-53 Rev. 5 structure, describe training under the Awareness and Training control family. Instead of four numbered levels, they describe literacy training that everyone with access receives and role-based training for people whose duties need more. The practical effect is close to the old model: a common baseline for all, plus deeper content for logical access, IT and privileged roles.

Many states and training platforms still use the Level 1 to 4 labels because people know them. That is fine as long as the content meets the current policy and your CSA accepts it. If your CSA audits against v5.9.5 during the transition, the level labels will likely still appear in the audit questions. Confirm with your CSA which terms and which course content they expect.

When training must happen

Training is required before a person gets access to CJI, or within the window the policy allows, and then annually after that. Two timing mistakes come up often:

• Access granted first and training scheduled later, with no record that the policy window was met.
• Annual renewals tracked in a spreadsheet that nobody opens until the audit, so several people are overdue at once.

Role changes matter too. When a records clerk moves into a system administrator role, their training must cover the new role before the new access is used, not at the next annual cycle.

Build training into onboarding the same way you build in the account request. The account should not be created, or should stay disabled, until the training record exists. For annual renewals, pick a fixed rhythm, such as the anniversary of each person's last completion, and send reminders well ahead of the date so nobody lapses during vacation or a busy shift schedule.

What records an auditor expects

An auditor wants to see that each person with access completed the right training at the right time. A course catalog or a policy that says training is required is not enough. Keep, for each person:

• Name, role and the type of access they hold.
• Training level or role-based track assigned.
• Date of initial training and date of each annual renewal.
• The certificate or completion record from the platform used.
• For vendor staff, the agency or agencies they support.

Keep these records for as long as your state requires. Retention rules vary, so confirm the period with your CSA.

State platforms and outside courses

Many states provide or designate an official platform for CJIS security awareness training, and some agencies must use it. Others accept courses from other providers if the content meets the policy. Vendors often have to complete training on the platform each agency or state requires, which can mean the same engineer takes similar courses in more than one place.

Before you buy or build training, ask your CSA, or for vendors the contracting agency, which platforms and courses they accept. Keep that answer on file.

Tracking training for every person

Training is easy to deliver once and hard to keep current for dozens or hundreds of people over several years. Cjis keeps a personnel register with each person's role, access level, training level or track and due date. It sends reminders 30 and 7 days before training expires, stores completion records and certificates and shows who is overdue on one screen.

Cjis also includes a short role-based awareness briefing with a quiz for Level 1 to 4 topics. It supplements a state-mandated platform and does not replace it. The agency report includes a personnel compliance table, so a vendor can show each agency that its staff are current.

Cjis is an independent compliance tool, not affiliated with or endorsed by the FBI or the CJIS Division, and not legal advice. It never stores CJI.

A good tracking setup answers three questions at any moment: who has access, which training each of them needs and when each of them is due next. If any of those answers needs a spreadsheet hunt, the next audit will be stressful.

Vendors have an extra question: which agencies each person supports. When one agency asks for proof that your support team is current, you should be able to send a list for that agency only, without exposing staff records that belong to another customer.