Password rules in the current policy
Older CJIS guidance asked for complex passwords that expired on a fixed schedule. Current versions move toward the NIST SP 800-63B approach, which favors length and screening over forced complexity and constant change. The details depend on the policy version your state audits against, so treat the list below as the direction of the rules and confirm the exact settings with your CJIS Systems Agency (CSA). Many states still audit against v5.9.5 during the move to v6.0, and the wording differs between them.
- A minimum password length, enforced by the system, not just written in a policy.
- Checking new passwords against lists of known compromised, common or breached passwords.
- No forced periodic password change, unless there is reason to suspect a compromise.
- A forced change when compromise is suspected or confirmed.
- Limits on repeated failed login attempts, followed by a lockout or delay.
- Passwords stored only in a protected form, never in plain text.
- No password hints that reveal the password, and no sharing of accounts.
MFA and advanced authentication
Multi-factor authentication is required for access to CJI. Older policy versions called this advanced authentication, and you will still see that term in state documents and audit questionnaires. In practice it means a person proves who they are with more than one factor, such as a password plus a hardware token, an authenticator app or a smart card. The policy and many state CSAs care about where MFA is enforced, not only that it exists somewhere. An auditor may ask to see that every path to CJI requires it: remote access, administrator consoles, cloud management portals and mobile devices.
- Use MFA on every path that reaches CJI, not only on the main login.
- Apply it to administrator, support and service desk accounts too.
- Keep configuration screenshots or exports that show MFA is enforced.
Where the password and MFA rules apply
The rules apply to systems that store, process or transmit CJI and to the accounts that reach them. For an agency that usually means records management, computer aided dispatch, the state message switch connection, mobile data terminals and the network that carries CJI. For a vendor it means the production systems that hold agency data, the tools staff use to support those systems and any remote access path into them. Some states allow exceptions for devices inside a physically secure location, while others are stricter, which is another reason to confirm with your CSA. Our guide to CJIS compliance requirements lists the other areas that sit next to authentication.
- Agency systems, terminals and networks that carry CJI.
- Vendor production systems, support tools and remote access paths.
- Mobile devices and laptops that reach CJI from outside a secure location.
Common audit findings around authentication
Authentication findings tend to fall into a few general types. Most are about gaps between the written policy and what systems actually do.
- A written password policy that still describes old rules the systems no longer follow, or the other way around.
- MFA enforced on the main login but missing on an administrator console, a remote access tool or a cloud portal.
- Shared or generic accounts used by several people on a CJI system.
- Accounts of people who left that were never disabled.
- No proof that MFA is enforced, only a statement that it is.
These are easy to prevent when the policy, the account list and the configuration evidence live together. Preparation steps for the whole audit are in our CJIS audit guide.
How Cjis tracks password and MFA requirements
Cjis covers authentication from three sides. The password and advanced authentication policy template gives you a written policy in NIST SP 800-63B style that you adapt to your state rules, with version history, approval and an annual review reminder. You can find it with the rest of our CJIS policy templates. The requirements checklist breaks authentication into separate items, such as minimum length enforced, compromised password screening, MFA on remote access, MFA on administrator accounts and prompt account revocation, each with an owner, a due date and a priority. The evidence locker holds the configuration screenshots and exports that prove each item, so an auditor sees the setting, not just the policy. The readiness assessment includes MFA among its questions, so a gap shows up in your score before it shows up in a finding. Cjis is an independent compliance tool, not affiliated with, endorsed by or certified by the FBI or the CJIS Division, and it is not legal advice. Cjis never stores CJI or user passwords from your systems.
- Password and advanced authentication policy template.
- Checklist items for each authentication control.
- Configuration evidence attached to each item.