CJIS Security Policy 6.0 changes and what they mean for you

Why the FBI rebuilt the policy

For many years the CJIS Security Policy was organized in its own set of policy areas: information exchange agreements, security awareness training, incident response, auditing and accountability, access control, identification and authentication, configuration management, media protection, physical protection, systems and communications protection, formal audits, personnel security and mobile devices. That structure was familiar to every LASO, but it did not line up neatly with the frameworks the rest of the security world uses.

Most federal systems, cloud providers and security teams already speak the language of NIST SP 800-53. A vendor that also sells to federal customers often has controls documented in that format. Mapping those controls to the old CJIS areas meant a second, parallel set of documents. Version 6.0 closes that gap by adopting the NIST control families as the backbone of the policy.

The result is a policy that is easier to compare with other frameworks and easier to map to the controls a cloud or SaaS provider already runs. It is also longer and more granular, which is why the phased priorities matter so much.

The NIST SP 800-53 Rev. 5 control families in v6.0

The policy now groups requirements by control family. If you have worked with NIST before, the names will look familiar. The families that matter most for CJI include:

• Access Control, covering account management, least privilege, session controls and remote access.
• Awareness and Training, covering literacy training and role-based training.
• Audit and Accountability, covering what events to log, how long to keep logs and how to review them.
• Assessment, Authorization and Monitoring, covering assessments, interconnections and continuous monitoring.
• Configuration Management, covering baselines, change control and least functionality.
• Contingency Planning, covering backups and recovery of systems that hold CJI.
• Identification and Authentication, covering unique IDs, multi-factor authentication and password rules.
• Incident Response, covering the plan, handling, reporting and testing.
• Maintenance, Media Protection, and Physical and Environmental Protection.
• Planning, Personnel Security, Risk Assessment, System and Services Acquisition, System and Communications Protection, System and Information Integrity, and Supply Chain Risk Management.

Not every control from NIST SP 800-53 made it into the CJIS policy, and some CJIS requirements are more specific than the NIST baseline. Treat the CJIS text as the authority and the NIST catalog as the structure behind it.

Priorities P1 to P4 and the phased approach

The second big change is the priority label on each requirement. Requirements are tagged P1, P2, P3 or P4. The idea is simple: the most important controls are expected first, and the rest phase in over the following years. P1 requirements come first, and the later priorities follow on the schedule the FBI sets.

In practice, the P1 group contains many controls that agencies and vendors already have in place under the older policy, such as account management, multi-factor authentication for access to CJI, audit logging, awareness training and incident handling. The later priorities include controls that are newer to many organizations or that take more time to put in place.

The phased approach gives you room, but it is not a reason to wait. An auditor who sees no plan for P2 to P4 items will ask about it. The safest path is to close P1 gaps now and keep a dated plan for the rest. Because exact phase dates can be adjusted, check the current schedule in the policy itself and with your CSA rather than relying on a date you read once.

States auditing v5.9.5 during the transition

A new version of the policy does not switch every audit overnight. Each state's CJIS Systems Agency (CSA) runs its own audit program, and many states continue to audit local agencies against v5.9.5 while they update their own documents, training and audit tools. Some states move earlier, some later, and some adopt parts of the new structure before the rest.

This creates a practical question for everyone: which version will my auditor use. The answer comes from your CSA, not from the FBI website and not from a vendor. Ask your CSA or your state CJIS Information Security Officer directly, and keep their answer in writing with the date you received it.

Vendors face a harder version of this problem. A vendor serving agencies in several states can receive questionnaires written for v5.9.5 from one agency and for v6.0 from another, in the same month. Keeping one set of controls mapped to both structures is the only sane way to answer both without starting from scratch each time.

What stays the same

The rewrite changes the structure much more than the substance. Most core expectations carry over:

• Personnel with unescorted physical or logical access to CJI need a state and national fingerprint-based record check before access.
• Security and privacy awareness training is required before access, or within the policy window, and then annually.
• Multi-factor authentication is required for access to CJI. Older versions call this advanced authentication.
• Passwords follow NIST SP 800-63B style rules, with a minimum length, checks against compromised password lists and no forced periodic change unless compromise is suspected.
• CJI in transit and at rest outside a physically secure location is encrypted with FIPS 140-2 or FIPS 140-3 validated modules.
• Media is sanitized or destroyed by an approved method.
• Audit logs are kept and reviewed, and incidents are documented and reported.

If your program already covers these well, the move to v6.0 is mostly a mapping and documentation exercise, followed by work on the later priority controls.

What changes for vendors

For a gov-tech vendor, the change shows up first in sales. Agency security questionnaires start referencing control families and priorities. Procurement teams may ask how your controls map to v6.0, which P1 items you meet today and what your plan is for the rest.

Vendors that already have NIST SP 800-53 documentation, for example from federal work or from a cloud authorization, are in a good position, because the vocabulary now matches. Vendors that only had a CJIS answer document built on the old policy areas need to rework it. The CJIS Security Addendum still governs the contractual side, and vendor staff with access to CJI still complete the certification page and pass fingerprint-based checks.

Supply chain and acquisition controls deserve attention. The new structure makes it clearer that agencies are expected to look at how their vendors build, host and support systems. Expect more questions about your own subprocessors, hosting environment and change management.

What changes for agencies

For a police department, sheriff's office or other criminal justice agency, the change shows up in the audit and in local policy. Written policies that cite the old policy areas need updating to the new structure once your CSA moves to v6.0. The LASO will need to know which version applies to the next audit and how the CSA's audit questions are organized.

Agencies also carry responsibility for their vendors. Under the new structure, vendor management, interconnections and acquisition controls are more visible. An agency that relies on a records management system, a dispatch platform or a cloud service should expect the auditor to ask how it confirmed that the vendor meets the policy.

Smaller agencies do not need to rebuild everything. Start with the P1 controls, keep training and background check records current and update policies as your CSA issues guidance.

A practical transition plan

A transition that works for most organizations has a few clear steps:

• Confirm with your CSA which version your next audit uses and when your state expects to move to v6.0.
• Inventory your current controls, written policies and evidence, and map each one to its v6.0 control family.
• Mark the priority of each requirement and list every P1 gap with an owner and a due date.
• Update written policies to the new structure, keeping the old references where your CSA still audits v5.9.5.
• Check personnel records: background checks, awareness training dates and access granted and removed.
• Collect evidence for each control in one place: configuration screenshots, signed agreements, log review records.
• Set a review rhythm, at least quarterly, for gaps in the later priorities.
• For vendors, prepare one answer set that maps to both v5.9.5 and v6.0 and reuse it for every agency.

The goal is not a perfect score on day one. The goal is a documented, dated plan that an auditor or an agency security reviewer can follow.

How Cjis helps with the move to v6.0

Cjis maps its readiness questions and requirements checklist to the v6.0 control families and shows the priority of each requirement, so you see your P1 gaps first. Each requirement becomes a task with an owner, status, due date and linked evidence. Written policies live next to the controls with version history and review dates.

The personnel register tracks fingerprint-based background checks, Security Addendum certification for vendor staff and awareness training due dates, with reminders before anything expires. The agency report exports one PDF and a read-only link per agency, which helps a vendor answer several agencies at once.

Cjis is an independent compliance tool. It is not affiliated with, endorsed by or certified by the FBI or the CJIS Division, and it is not legal advice. Cjis never stores CJI. It stores compliance records and evidence that contains no CJI.