CJIS compliance for probation and case management software vendors
Probation, parole and pretrial case management software shows officers criminal history returns, warrants, supervision conditions and violation records, so every department and state buyer asks how you meet the FBI CJIS Security Policy before they sign. Cjis gives your team one workspace to answer: a readiness score by policy area, a register of every person with access, policy templates and a separate report for each department. Plans are published and start at $49 a month.
What a probation department asks a software vendor
A supervision platform sits close to CJI. Officers pull criminal history to set conditions, intake staff see charges and warrant status, and many products exchange data with courts and state repositories. The department answers to its state CJIS Systems Agency (CSA), so the RFP pushes the same questions to you: where the data is hosted, how officers authenticate, what you log, which of your staff can open department records and whether they passed a fingerprint-based check.
- Cloud case management puts your support and implementation staff inside department records
- Each department signs the CJIS Security Addendum with you, often with a certification page for each named employee
- Electronic monitoring and check-in apps need a clear boundary between offender-facing features and CJI
Where CJIS touches a probation or case management product
For what agencies expect inside the product, see our CJIS compliant software page. Hosting choices are covered in CJIS compliance in AWS, Azure and Microsoft 365.
| Product area | What the policy asks | What you document |
|---|---|---|
| Officer caseload and case notes | Access limited to authorized users, audit trail | Role model, access logging, log retention |
| Criminal history and warrant lookups | Controlled use of state and NCIC returns | Which screens show returns and who can open them |
| Risk assessment and violation records | Protection of stored CJI | Encryption at rest, region, key custody |
| Court and agency data exchange | Controlled dissemination between agencies | Interface list, data flows, agreements |
| Officer login | Advanced authentication for access to CJI | MFA method, session lock, password rules |
| Client check-in app and monitoring portal | Separation from CJI | Network and data boundary diagram |
| Implementation, upgrade and support | Screened and escorted staff | Fingerprint dates, remote access method |
Which of your people count as CJIS personnel
Probation vendors usually have a small team with broad reach: implementers who migrate case files from a legacy system, trainers who sit with officers, support engineers with remote sessions and developers who query production data. Anyone with unescorted logical or physical access to unencrypted CJI needs a fingerprint-based record check and security awareness training. Cjis keeps role, access level, check date by state, training level, expiry and the departments each person is approved for.
See CJIS background check requirements for what the check involves, and CJIS vendor screening programs if you work in states that clear vendor staff once.
- Import the staff list by CSV and tag who can reach department data
- Reminders 30 and 7 days before training expires
- Log the day access is removed when someone leaves
One record, a separate report for every department
A vendor with a dozen county and state probation customers faces a security review at renewal and again for each new module. Cjis keeps shared controls and policies once, then a record per department with its systems, people, agreements and open items. Send a PDF report or a read-only link scoped to one department, so one chief never sees another office's names. Start from the CJIS policy templates for access control, incident response and the system boundary.
- One set of controls mapped to CJIS Security Policy v6.0 and v5.9.5
- Evidence dated and attached to the control it supports
- Open items by department, so sales sees what blocks a renewal
Ways probation software vendors keep the CJIS record
Details in the Vanta CJIS alternative comparison and in CJIS compliance consultant vs software.
| Option | Cost | Strength | Weak spot |
|---|---|---|---|
| Spreadsheets and a shared drive | Staff time | Nothing to buy | No reminders, rebuilt for every RFP |
| Cjis | $49 to $999 a month, published | CJIS only, per department reports, personnel register | No automated cloud tests |
| Multi-framework platform | Quote only | Automated tests across frameworks | CJIS is one framework among many |
| CJIS consultant | Per engagement | State know-how | A snapshot that ages |
Plans that match a department sales pipeline
Starter at $49 a month covers one department report. Team at $199 covers three and fits a vendor in several active bids. Pro at $499 covers 25 agencies, and Enterprise at $999 has no agency limit, which suits an established supervision software vendor with a large customer base. Yearly billing halves the monthly rate. Compare limits on the CJIS compliance software pricing page.
Questions probation software vendors ask about CJIS
Is there a CJIS certification for probation software?
No. The FBI does not certify products or vendors. Some states run a vendor program, and departments still review you through the Security Addendum, background checks, training records and evidence of controls. Read what CJIS certification means before it goes into sales copy.
Does a client check-in app fall under CJIS?
Only if it can reach CJI. Keep the offender-facing app on a separate boundary with no path to criminal history returns, and show that boundary in your system diagram. Reviewers accept a documented separation more readily than a verbal promise.
Do our implementation engineers need fingerprinting?
If they have unescorted access to unencrypted CJI, yes, and several states require it for each state. Escorted sessions or encryption that keeps keys away from staff can shorten the list, but each CSA decides.
Who signs the Security Addendum?
Your authorized representative signs the agreement with the department, and employees with access sign the certification page. Requirements differ by state, so confirm with the department and its CSA. The CJIS Security Addendum for vendors post walks through it.
How long until we can answer a probation RFP security section?
A few weeks if your controls exist and need recording, a few months if you still need MFA on every path or a year of logs. Fingerprint processing alone can take weeks per state. The readiness check shows which areas are open today.
Answer the next department security review in days
Run the 12 question readiness check, see your gaps by policy area and build the first department report. More on CJIS compliance for vendors, jail and court software vendors and RMS and CAD software vendors.
What Cjis is and is not
Cjis is an independent compliance workspace, not affiliated with, endorsed by or certified by the FBI or the CJIS Division, and not legal advice. It does not run automated tests against your cloud account and it never stores CJI.