Access control and multi-factor authentication
Access to CJI is limited to people who need it for their job, and only to the data they need. Accounts are unique, reviewed regularly and disabled promptly when someone leaves or changes roles. Multi-factor authentication is required for access to CJI; older versions of the policy call it advanced authentication. Passwords follow NIST SP 800-63B style rules: a minimum length, checks against lists of compromised passwords, and no forced periodic change unless compromise is suspected. Details are on our CJIS password requirements page.
- Unique accounts, least privilege and documented account reviews
- Prompt revocation when people leave or change roles
- Multi-factor authentication for every path to CJI, including remote and privileged access
- Session locks and limits on failed logins
Encryption and media protection
CJI in transit, and CJI at rest outside a physically secure location, must be encrypted with FIPS 140-2 or FIPS 140-3 validated cryptographic modules. Validated means the module itself has a certificate, not just that the algorithm is strong. Media that held CJI, from laptops to backup tapes to printed reports, must be protected while in use and sanitized or destroyed by an approved method when it is retired. See our CJIS encryption requirements guide for the details.
- FIPS 140-2 or FIPS 140-3 validated encryption in transit and at rest where required
- Controlled access to digital and physical media
- Documented sanitization or destruction with a record of each event
- Secure transport of media outside controlled areas
Personnel security and awareness training
Every person with unescorted physical access or logical access to CJI needs a state and national fingerprint-based record check before access is granted. Every person also needs security and privacy awareness training before access, or within the policy window, and then every year. When someone leaves, access ends promptly. Our CJIS training guide covers levels and records in depth.
- Fingerprint-based record check before access
- Awareness training before access and annually
- Signed acknowledgments and rules of behavior
- Documented termination and transfer steps
Audit logging and incident response
Systems that process CJI must log security events, protect those logs, keep them for the period your state requires and review them. Incidents involving CJI must be handled under a documented incident response plan and reported to the agency and the CSA as the policy and your state require. The plan should be tested, and the test recorded.
- Event logging on systems, applications and network devices that handle CJI
- Regular, documented log review
- Written incident response plan with roles and reporting steps
- Incident response testing and records of real incidents without CJI in the record
Physical security, configuration and patching
CJI is processed in physically secure locations with controlled entry, visitor procedures and escorts. Systems follow documented configuration baselines, changes go through change control, and security patches and vulnerability scans run on a regular schedule. Mobile devices that touch CJI are managed centrally, with the ability to lock or wipe them, and are covered by a written mobile policy.
- Physically secure locations with access lists and visitor logs
- Configuration baselines and change records
- Patching and vulnerability scanning on a defined schedule
- Mobile device management for every device that touches CJI
Agreements that make the requirements binding
Requirements reach beyond the agency through signed agreements. Private contractors with access to CJI sign the CJIS Security Addendum, found in Appendix H of the policy, and each employee with access completes its certification page. Government noncriminal justice agencies, such as a county IT department supporting the sheriff, work under a management control agreement. Agencies that share CJI with each other use information exchange agreements.
- CJIS Security Addendum and employee certification pages for vendors
- Management control agreements for government noncriminal justice agencies
- Information exchange agreements between agencies
CJIS requirements for vendors and for agencies
The requirements are the same policy for everyone, but the work looks different on each side. The table summarizes what each side usually has to show.
| Area | What vendors need | What agencies need |
|---|---|---|
| Agreements | Signed Security Addendum with each agency, certification page per employee | Addendum on file for each vendor, management control agreements, exchange agreements |
| Personnel | Fingerprint checks for staff with access, per agency or state rules | Fingerprint checks for all staff and contractors with access, before access |
| Training | Awareness training records for every employee in scope | Training records for everyone, matched to role and level |
| Technical controls | MFA, FIPS 140 validated encryption, logging, patching in the product and hosting | MFA, encryption and logging on agency networks and devices |
| Policies | Written security policies the agency can review | Full policy set reviewed for the state audit |
| Audit | Agency review before access, evidence on request | State CSA audit at least once every three years |
Vendors answer to each agency they serve; agencies answer to their state CSA. Read the full CJIS Security Policy guide for how the areas map to v6.0 control families, or work through the CJIS compliance checklist.
Are CJIS compliance requirements the same in every state
The FBI policy sets the minimum, and each state CSA may add stricter rules, so always confirm with your CSA.
Do vendors have to meet every requirement
Vendors meet the requirements that apply to the services and access they provide, as set out in the Security Addendum and agency review.
Is multi-factor authentication required for CJIS
Yes, multi-factor authentication is required for access to CJI.
How Cjis tracks every CJIS requirement
Cjis turns each requirement into a task with an owner, status, due date, note and linked evidence, and lets you filter by priority, area and system. The readiness assessment shows where you stand in each area. The personnel register keeps fingerprint check dates, addendum certification pages and training due dates. Policy templates cover access control, incident response, media sanitization, mobile devices, passwords and more. The agency report puts it all into one PDF and a shareable read-only link, one per agency for vendors that serve several.
Cjis is an independent compliance tool, not affiliated with, endorsed by or certified by the FBI or the CJIS Division. It is not legal advice. Cjis never stores CJI; it stores compliance records and evidence that contain no CJI.