How the CJIS audit cycle works
Each state has a CJIS Systems Agency (CSA) that manages access to FBI CJIS systems in that state. The CSA audits the local agencies it serves at least once every three years. The FBI CJIS Division, in turn, audits each CSA on a triennial cycle. That means a sheriff's office or police department answers to its state CSA, and the state answers to the FBI. Audits can be on site, remote or a mix, and many states send a questionnaire ahead of the visit. The policy version matters too. Version 6.0 rebuilt the policy around NIST SP 800-53 Rev. 5 control families with priorities P1 to P4, while many states still audit against v5.9.5 during the transition. Ask your CSA which version applies to your next audit. For background on the policy itself, see our guide to the CJIS security policy.
- The CSA audits local agencies at least every three years.
- The FBI audits each CSA on its own triennial cycle.
- State rules, forms and timing vary, so confirm them with your CSA.
What auditors ask for
Auditors want proof, not promises. Expect requests along these lines, and expect them to pick a few names or systems and follow them all the way through.
- Written security policies and procedures, with approval and review dates.
- Training records showing security and privacy awareness training before access and every year after.
- Background check records showing a state and national fingerprint-based check before access.
- Access lists for systems that store, process or transmit CJI, with account creation and removal dates.
- Audit logs and records showing that someone reviews them.
- A current network diagram showing where CJI flows and where it is protected.
- Signed agreements, such as the CJIS Security Addendum with vendors and management control agreements.
- Incident records and the written incident response plan.
- Proof of multi-factor authentication and of FIPS validated encryption where CJI leaves a physically secure location.
What a CJIS compliance audit means for vendors
Vendors are not usually audited by the CSA directly. Instead, the agency is responsible for its contractors, so the agency asks the vendor for evidence. That request often arrives as a questionnaire during procurement, before renewal or in the weeks before the agency's own audit. A vendor that answers quickly with signed addendum pages, personnel check records, training dates and encryption details keeps the deal moving. A vendor that has to rebuild the answers from inboxes slows down the agency and its own sales cycle. Vendors serving many agencies face the same questions many times, with small state differences each time. Our page on CJIS compliant software explains what agencies look for in a vendor.
- Keep signed Security Addendum certification pages for every staff member with access.
- Track background checks and training dates per person.
- Hold encryption, MFA and logging evidence ready to share.
How to prepare for a CJIS audit
Preparation is mostly about putting existing work in order. Start early, because collecting signatures and training records takes longer than fixing a setting.
- Confirm the audit date, format and policy version with your CSA.
- Run a readiness assessment across every policy area and list the gaps.
- Fix P1 gaps first, since priority P1 controls are audited first.
- Update and approve your policies, using CJIS policy templates as a starting point where you have none.
- Check every person with CJI access for a completed background check and current training.
- Collect proof for each requirement in one place.
- Review agreements with vendors and partner agencies and make sure the signed copies are on file.
- Walk through the evidence as if you were the auditor, using our CJIS compliance checklist.
How Cjis keeps you audit ready
Cjis keeps the record current all year, so the audit is a review of what you already have. The readiness assessment scores each policy area and ranks gaps by priority. The requirements checklist turns each gap into a task with an owner and a due date. The personnel register shows background check dates, Security Addendum certification for vendor staff and training due dates for every person. The evidence locker attaches screenshots, configuration exports, signed agreements and log exports to the control they prove. Reminders count down to the audit date and flag open P1 gaps. When the auditor or a customer agency asks, the agency report pulls the assessment summary, control status, policy list with dates, personnel table and evidence index into one PDF and a shareable read-only link. Vendors get one report per agency. Cjis is an independent compliance tool, not affiliated with, endorsed by or certified by the FBI or the CJIS Division. It never stores CJI, only compliance records and evidence that contain no CJI.
- Evidence locker linked to each control.
- Audit date countdown and P1 gap alerts.
- One agency report as PDF and read-only link.
How often is an agency audited for CJIS?
The state CSA audits each local agency at least once every three years. Some states audit more often or add technical reviews, so confirm the schedule with your CSA.
Does the FBI audit vendors directly?
Usually not. The agency is responsible for its contractors and asks vendors for evidence, often through a questionnaire and the signed CJIS Security Addendum.
Which policy version will we be audited against?
It depends on your state. Version 6.0 is current, and many states still audit against v5.9.5 during the transition. Cjis maps both views.
Is passing a CJIS audit a certification?
No. The FBI does not certify companies as CJIS certified. A clean audit shows that your controls met the policy at that time.