There is no FBI-issued CJIS certificate for companies
The CJIS Security Policy is published by the FBI CJIS Division. It sets the minimum security requirements for anyone who accesses, stores, processes or transmits criminal justice information (CJI). The policy does not create a certification program for products or companies. No FBI office audits a vendor and hands out a badge. Instead, the agency that owns the CJI decides whether a vendor may access it, and the CJIS Systems Agency (CSA) of each state audits that agency against the policy.
When a vendor says its product is "CJIS certified", it usually means one of three things: the company has signed the CJIS Security Addendum with one or more agencies, its staff have passed fingerprint-based background checks for those agencies, or its hosting environment supports the controls the policy requires. Each of these is real and valuable. None of them is a national certificate that transfers automatically to the next agency.
- Approval is granted by each agency, not by the FBI
- State CSAs interpret the policy and some add their own rules
- A vendor approved in one state can face new checks in another
- Marketing claims of "CJIS certification" do not replace agency review
CJIS certification requirements for vendors
What procurement teams call CJIS certification requirements is really a list of obligations a vendor must meet before an agency grants access to CJI. The exact list depends on the state, so always confirm the details with the CSA. The core is the same almost everywhere.
- Signed CJIS Security Addendum (Appendix H of the policy) between the vendor and the agency, with each employee who has access completing the certification page
- Agency review and approval of the vendor, its services and the location where CJI is processed
- State and national fingerprint-based record checks for every person with unescorted physical or logical access, completed before access is granted
- Security and privacy awareness training for every person with access, before access and then annually
- Technical controls such as multi-factor authentication, FIPS 140-2 or FIPS 140-3 validated encryption, audit logging, incident response and media sanitization
- Written policies and procedures that show how each control is run and reviewed
Government agencies that support criminal justice work without being criminal justice agencies themselves, for example a county IT department, sign a management control agreement instead of the Security Addendum. The rest of the obligations stay the same. A full breakdown by area is on our CJIS compliance requirements page.
What a job posting means by CJIS certification
For an individual, "CJIS certified" almost always means one thing: you have completed CJIS security awareness training at the level your role requires and you have passed the fingerprint-based background check for the agency you work with. Training is usually delivered through a platform chosen by the state, and completion produces a certificate or a record with a date. That record expires and must be renewed every year.
- Ask your employer or agency which training platform and level apply to you
- Keep a copy of your completion certificate and its date
- Expect to repeat the training every year and after a role change
- Expect a separate background check for each agency or state you work with, depending on local rules
If you are the person who keeps these records for a whole team, read our guide to CJIS training. It covers levels, the annual cycle and the records an auditor asks for.
Why buyers ask for CJIS certification anyway
A police department evaluating records management, dispatch, body-worn camera or digital evidence software has to know that the vendor will not become an audit finding. The phrase on the questionnaire is shorthand. What the reviewer wants is evidence: who at your company can reach CJI, when each person was fingerprinted and trained, where the data is hosted, how it is encrypted and who reviews the logs.
Vendors that answer quickly move through procurement. Vendors that answer with a vague statement and a promise to follow up wait while the agency's clock runs. The difference is rarely the security itself. It is whether the paperwork exists and is current.
- Security questionnaires ask for dates and names, not slogans
- Agencies may request policies, training records and an incident response plan
- The same evidence is reused for every new agency you sell to
- Gaps found late in a sales cycle cost far more time than gaps found early
How an organization prepares for agency review
Preparation follows the structure of the CJIS Security Policy. Start with an honest assessment, fix the gaps that carry the most risk, then keep the evidence current so the next review is routine.
- Map which systems, people and locations touch CJI and which do not
- Run a readiness assessment across every policy area and record the gaps
- Fix priority gaps first, starting with access control, multi-factor authentication and encryption
- Collect signed agreements, background check dates and training records for every person in scope
- Write or update the policies that describe how each control works
- Keep a single record that you can hand to each agency, and prepare for the state CJIS audit
Is CJIS certification issued by the FBI
No. The FBI publishes the CJIS Security Policy but does not certify companies or products; agencies approve vendors and state CSAs audit agencies.
Can a cloud provider make my software CJIS compliant
A government cloud environment helps with hosting controls, but your company still needs agreements, background checks, training and its own policies.
How long does individual CJIS training last
Awareness training is renewed every year, and some states add their own timing rules, so confirm with your agency.
Does one agency approval cover every state
Usually not. Each agency reviews vendors, and state rules differ, so expect new paperwork when you enter a new state.
How Cjis turns CJIS certification questions into evidence
Cjis is a compliance workspace built only for CJIS. It gives vendors and agencies one current record of everything a reviewer asks for when they say "CJIS certification". The readiness assessment scores your organization across every policy area and v6.0 control family and ranks gaps by priority. The personnel register keeps background check dates, Security Addendum certification pages and training due dates for every person with access. Policy templates, an evidence locker and a per-agency report finish the picture, so you answer the next questionnaire with a document instead of a scramble.
Cjis is an independent compliance tool. It is not affiliated with, endorsed by or certified by the FBI or the CJIS Division, and it does not issue certificates. It is not legal advice. Cjis never stores CJI; it stores compliance records and evidence that contain no CJI.
- Readiness score per policy area with P1 to P4 gap ranking
- Personnel register with fingerprint check, addendum and training dates
- Reminders before training and reviews expire
- One PDF and shareable report per agency