Why no product is CJIS compliant by itself
The FBI CJIS Security Policy sets rules for how criminal justice information (CJI) is protected, by whom and where. It applies to the agency and to every contractor that stores, processes or transmits CJI for that agency. The FBI does not certify companies or products as CJIS certified, and there is no national list of approved software. What an agency checks is whether your controls, your staff and your hosting meet the policy for its data, and whether its state CJIS Systems Agency (CSA) accepts that. The same product can be acceptable for one agency and need more work for another, because state rules vary. Our page on CJIS certification explains the common confusion around labels.
- Compliance is the vendor's controls plus the agency's approval.
- The FBI does not certify vendors or products.
- Each state CSA can interpret parts of the policy differently.
What makes a vendor CJIS compliant in the eyes of an agency
Agencies and their CSAs look at a consistent set of things. If you can show each one with a document or a record, procurement moves faster.
- A signed CJIS Security Addendum with the agency, and a signed certification page for each staff member with access.
- A state and national fingerprint-based record check for every person with unescorted or logical access, before access.
- Security and privacy awareness training before access and every year, with role-based training for technical staff.
- Multi-factor authentication for all access to CJI, described in our page on CJIS password requirements.
- Encryption of CJI in transit and at rest outside a physically secure location with FIPS 140-2 or FIPS 140-3 validated modules, covered in CJIS encryption requirements.
- Hosting that meets the policy, often a government cloud region such as AWS GovCloud or Azure Government, or a commercial region the agency accepts.
- Audit logging with regular review, and logs the agency can obtain when it needs them.
- A written incident response plan with a commitment to report incidents to the agency.
Answering a CJIS questionnaire
Most vendors meet these requirements through a questionnaire. It can come from the agency's IT team, its procurement office or the state CSA, and it often arrives late in the sales cycle. The questions repeat across agencies with small differences: who on your team has access, when each person had a background check, when training was last completed, which encryption modules are in use, where data is hosted, how MFA is enforced and how incidents are reported. A vendor that keeps these answers current replies in days. A vendor that starts from scratch each time loses weeks and sometimes the deal. Keep in mind that answers must stay true after the contract is signed, because the agency answers to its own auditor in the CJIS audit.
- Keep one current answer per question, with proof attached.
- Track which agency received which version of your answers.
- Update the answers when staff, hosting or encryption change.
Government cloud and hosting choices
Where the product runs is one of the first questions an agency asks. Many vendors host CJI workloads in a government cloud region because the provider documents its own CJIS commitments there. A government cloud region does not finish the job. You still control who has access, how keys are managed, how logs are reviewed and how your staff are screened and trained. Write down which services in which region touch CJI and which controls you run on top of the provider. Some states require specific steps for cloud providers, so confirm them with the CSA before you commit to an architecture.
- List each hosted service that stores, processes or transmits CJI.
- Record which controls the cloud provider covers and which you cover.
- Confirm state specific cloud rules with the CSA.
Choosing a tool for the CJIS record
If you are deciding how to keep the CJIS record for your product, this is what each option covers.
| Need | Cjis | Spreadsheet | Consultant | Generic GRC tool |
|---|---|---|---|---|
| Readiness score by CJIS Security Policy area | Yes | No | Once per engagement | Not CJIS specific |
| Controls mapped to the v6.0 priorities | Yes | Built by hand | In the consultant report | Framework set up by you |
| CJIS policy and procedure templates | Yes | No | Yes | General templates |
| Personnel register with screening and training dates | Yes | A separate sheet | No | Partly |
| Evidence attached to each control | Yes | Links in cells | A folder at the end | Yes |
| Reminders before training and reviews expire | Yes | No | No | Yes |
| Report for each agency | Yes | Built by hand | Once per engagement | Not CJIS specific |
| Monthly price | From $49 | Staff time only | Billed per engagement | Priced for broad frameworks |
How Cjis builds your record per agency
Cjis gives a vendor one place for everything an agency asks about. The readiness assessment scores your organization across every policy area and v6.0 control family and ranks gaps by priority P1 to P4. The personnel register tracks each staff member with access, their fingerprint-based check date and status, their Security Addendum certification and their training due date, with reminders before anything expires. The evidence locker holds encryption module certificates, MFA configuration screenshots, hosting details, signed agreements and log exports, each attached to the control it proves. When an agency asks, you send an agency report as a PDF and a shareable read-only link. Team covers 3 agencies, Pro covers 25 and Enterprise has no limit, so each agency gets its own clean record. See the vendor use case for more. Cjis is an independent compliance tool, not affiliated with, endorsed by or certified by the FBI or the CJIS Division. It never stores CJI, and it is not legal advice.
- One record of controls, people and evidence.
- One agency report per agency, as PDF and read-only link.
- Reminders before training and checks expire.