CJIS vendor screening programs and how to stop fingerprinting staff agency by agency
A CJIS vendor screening program is a state run process that fingerprints and approves a vendor's employees once, so the vendor can work for any agency in that state instead of repeating the background check for every contract. Colorado and Minnesota both run one, and many other states have their own version. If you sell to agencies in several states, you will meet several programs with different forms and fees, and the practical problem becomes keeping track of who is cleared where. Cjis keeps that record for every person and every agency.
Key points
- A state vendor program replaces repeat fingerprinting inside that state. It does not carry over to other states.
- Colorado lists a one time processing fee of $39.50 per participating employee, plus any fee charged by the fingerprinting provider. Confirm the current amount with the state before budgeting.
- Minnesota's BCA Vendor Screening Program lets a vendor work at any agency in the state once its staff are approved.
- You still owe the agency a signed CJIS Security Addendum and security awareness training records.
- The costly failure is not the fee, it is a gap in the record when an engineer is not cleared for a state you just won.
How state vendor programs replace repeat checks
Without a program, every agency that contracts with you runs or demands its own fingerprint-based record check on your people. A vendor with ten police customers in one state would repeat the process ten times for the same engineer. A vendor program moves that work to the state CJIS Systems Agency (CSA). You enroll, submit fingerprints for each employee who needs access, pay the state fee and receive an approval the agencies in that state can rely on.
| Question | Without a program | With a state vendor program |
|---|---|---|
| Who runs the check | Each agency separately | The state, once |
| Where it applies | The contracting agency | Agencies across that state |
| What you track | One approval per agency | One approval per person per state |
| What stays with you | Training, Addendum, access control | Training, Addendum, access control |
| Weak spot | Slow bids and duplicate fees | A new state means a new program |
The program covers the background check part of the CJIS Security Policy. It does not replace training, access control or your own written policies, so an agency review still asks for them. Our guide to CJIS background check requirements lists what a check includes.
Which employees to put into a vendor program
Enroll people who can reach unencrypted criminal justice information, not the whole company. That usually means production admins, on call engineers, implementation and support staff who open agency records, and managers who approve their access. Fewer enrolled people means lower fees, faster approval and a shorter list to maintain.
Architecture helps here. When data is encrypted with FIPS validated modules and your staff cannot reach the keys, many CSAs treat those people as outside the personnel requirement. Each state reads this differently, so get the answer in writing before you rely on it. The cost side of the same decision is in CJIS compliance cost for vendors.
What to record for every person and state
Programs approve people, but agencies ask you to prove it. Keep one record per person that shows the state, the program or agency that cleared them, the date, the fingerprint reference you are allowed to store, the security awareness training level and its expiry, and the agencies they are approved to support. Remove access the same day someone leaves and note the date.
- Role and access level to agency data
- Check date and state for each clearance
- Training level and expiry date
- Security Addendum signed, with the date
- Agencies the person supports
Training is the item that quietly lapses. A platform such as train and certify your staff with reminders helps keep it current, and Cjis shows the expiry next to the check date so a reviewer sees both. See CJIS security awareness training levels for who needs which level.
Selling in several states
A vendor in three states faces three sets of forms, three fee schedules and three timelines. Some states accept another state's check, many do not, and a few add their own requirements for out of state vendors. Build a short table in your own records: state, program name, status, people cleared, open items. Cjis keeps shared controls and policies once, then a record per agency and state on top, and exports a PDF report or read only link for a single agency. The CJIS Security Addendum for vendors post explains the agreement that goes alongside.
Questions vendors ask about CJIS screening programs
Is there a national CJIS vendor certification?
No. The FBI does not certify vendors or products. Screening programs are run by individual states, and each agency still reviews you through its CSA. See what CJIS certification means.
Does a Colorado approval work in another state?
Not automatically. State programs cover agencies in that state, and other states set their own rules, so assume you need a new approval or written acceptance for each state you sell into.
Who pays the fingerprinting fee?
It depends on the state and the contract. In the Colorado program the vendor pays the processing fee and any third party fingerprinting charge. Agreements elsewhere may split it, so read the vendor agreement before the bid.
How long does approval take?
Plan for weeks, not days, because fingerprints go through state and FBI processing. Start enrollment when you submit the bid, not after the award, and keep a record of the date each person was submitted.
Do we still need security awareness training?
Yes. Training is separate from the background check and is tracked per person. Agencies ask for dates and expiry in the same review.
Know who is cleared before the next bid
Run the 12 question readiness check, see which policy areas are open and build the first agency report. If you ship a cloud product, read CJIS compliance for SaaS companies, and for dispatch or records products see CJIS compliance for RMS and CAD software vendors.
