Why a written CJIS policy matters
The CJIS Security Policy asks agencies and their contractors to set down how they protect criminal justice information (CJI), and auditors ask to see those documents first. A control that works but is not written down often still becomes a finding. A policy that is written but years old tells the auditor nobody is looking at it. Written policies also help your own staff: they say who approves access, how to report an incident and what to do with an old hard drive. For vendors, a clear policy set answers a large part of any agency questionnaire before it arrives. For the bigger picture of what you need to document, read our guide to CJIS compliance requirements.
- Auditors read policies before they test controls.
- A dated, approved policy shows the control is managed.
- Clear procedures cut the number of questions staff ask you.
The policy and procedure templates in Cjis
Each template is written around the CJIS Security Policy areas and the v6.0 control families. Every one has sections for scope, roles, procedure and review.
- Access control. Who can reach CJI, how accounts are created, reviewed and removed, and how least privilege is applied.
- Incident response. How incidents are detected, contained, documented and reported to your CSA and the agency that owns the data.
- Media sanitization. How digital and physical media are sanitized or destroyed by an approved method, with a record of each disposal.
- Mobile device. How phones, tablets and laptops that touch CJI are managed, locked, encrypted and wiped.
- Password and advanced authentication. Password rules in NIST SP 800-63B style and multi-factor authentication for access to CJI.
- Personnel screening. Fingerprint-based record checks before access, handling of results, and steps when people leave or change roles.
- Awareness training. Who completes security and privacy awareness training, by role, before access and every year.
- Physical security. How a physically secure location is defined, how entry is controlled and how visitors are escorted.
- Configuration management. Baselines, change control, patching and how system changes are approved and recorded.
Version history, approvals and annual reviews
A template becomes your policy when you edit it, approve it and date it. Cjis keeps every version, so you can show an auditor what changed, when and who approved it. Each policy carries an approval date and a next review date. Reminders go out ahead of the annual review, and an overdue policy shows up next to the open gaps in your requirements checklist. When a policy changes, the old version stays in the history instead of disappearing. Policies are also listed with their dates in the agency report, so a customer agency or your CSA sees the full set at a glance.
- Full version history with author and date.
- Approval date and named approver for each policy.
- Reminders before the annual review is due.
- Policy list with dates in the agency report.
A starting point to adapt to your state
Templates are a starting point, not a finished answer. State CSAs interpret parts of the policy differently, some publish their own forms, and your systems are not the same as anyone else's. Read each template against your state rules, replace the generic parts with how you actually work and confirm anything unclear with your CSA. If your state still audits against v5.9.5, keep that version in mind while the transition to v6.0 runs. Cjis is not legal advice, and a template alone does not make an organization compliant. Pair each policy with the evidence that shows it is followed, using our CJIS compliance checklist as a guide.
- Replace generic wording with your real process.
- Check state specific forms and rules with your CSA.
- Link each policy to the evidence that proves it.
Templates included in each plan
Every plan includes the policy module with version history, approvals and review reminders. The difference is how many templates you get. See pricing for the full comparison.
| Plan | Price | Templates |
|---|---|---|
| Starter | $49 per month or $24 per month billed yearly | 10 core templates |
| Team | $199 per month or $99 per month billed yearly | All templates |
| Pro | $499 per month or $249 per month billed yearly | All templates plus custom |
| Enterprise | $999 per month or $499 per month billed yearly | All templates plus custom |
Yearly billing saves 50 percent. Every plan is a subscription you can cancel any time, with access to the end of the paid period.
How Cjis connects policies to the rest of your record
Policies in Cjis do not sit in a folder on their own. Each one links to the requirements it covers in the checklist, so an approved access control policy closes the matching documentation tasks. The personnel screening and awareness training policies sit next to the personnel register, where each person's background check and training dates live. Evidence that a policy is followed, such as a log review record or a sanitization certificate, goes in the evidence locker against the same control. When an audit comes, read how that record is used in our CJIS audit guide. Cjis is an independent compliance tool, not affiliated with, endorsed by or certified by the FBI or the CJIS Division, and it never stores CJI.