What the CJIS Security Policy is and who publishes it
The policy is published by the FBI Criminal Justice Information Services (CJIS) Division. It sets the minimum security requirements for creating, viewing, modifying, transmitting, disseminating, storing and destroying CJI. CJI covers data from FBI CJIS systems and the state systems connected to them, such as criminal history records, biometric data, case and incident data, and the information needed to make those systems work.
The policy is a minimum. A state CJIS Systems Agency (CSA) may adopt stricter rules for its own agencies, and many do. The policy is also not a product standard: it describes how an organization protects CJI, which includes people, places, processes and technology, not only software.
Who must follow the CJIS Security Policy
Every organization that touches CJI is bound by it, directly or through an agreement. That includes far more than police departments.
- Law enforcement agencies, sheriff's offices and state police
- Courts, prosecutors, probation, corrections and jails
- County and city IT departments that support criminal justice systems, under a management control agreement
- Private contractors and technology vendors with access to CJI, under the CJIS Security Addendum
- Cloud and managed service providers that host or administer systems processing CJI
- Individual staff members, through training, background checks and signed acknowledgments
Vendors often meet the policy for the first time in a procurement questionnaire. Our page on CJIS certification explains why there is no FBI certificate for companies and what an agency approves instead.
CJIS Security Policy versions from v5.9.5 to v6.0
For years the policy was organized into thirteen policy areas, with version 5.9.5 as the last release in that structure. Version 6.0, released in December 2024, reorganized the policy around the control families of NIST SP 800-53 Rev. 5 and gave each requirement a priority from P1 to P4. The content did not start from zero; most familiar requirements remain, but they are now expressed as controls with identifiers that match the NIST catalog.
Because the change is large, many states still audit against v5.9.5 during the transition while agencies and vendors move to the new structure. The FBI keeps publishing updates to the policy, and Cjis follows each release, mapping its assessment and checklist to the current version and keeping the v5.9.5 view for states that still audit against it.
- v5.9.5 uses policy areas such as access control, identification and authentication, and personnel security
- v6.0 uses NIST SP 800-53 Rev. 5 control families with priorities P1 to P4
- Your state CSA decides which version your next audit uses
- Updates continue, so the version you prepared for may not be the one you are audited against
Control families of CJIS Security Policy v6.0
The table lists the control families and supporting areas Cjis uses to organize the assessment, the compliance requirements and the evidence.
| Control family | What it covers | What Cjis tracks |
|---|---|---|
| Access Control | Account management, least privilege, remote access, session controls | Account reviews, revocation dates, access policy |
| Awareness and Training | Literacy and role-based security awareness training | Due dates per person, completion records, certificates |
| Audit and Accountability | Event logging, log review, retention, protection of logs | Log review evidence, logging policy, review dates |
| Assessment, Authorization and Monitoring | Security assessments, continuous monitoring, plans of action | Assessment results, open gaps, remediation owners |
| Configuration Management | Baselines, change control, least functionality | Baseline documents, change records, policy |
| Contingency Planning | Backups, recovery plans, testing | Plan versions, test dates, evidence |
| Identification and Authentication | Unique IDs, multi-factor authentication, password rules | MFA coverage, password policy, exceptions |
| Incident Response | Plan, handling, reporting, testing | Plan, test date, incident records without CJI |
| Maintenance | Controlled maintenance, remote maintenance, maintenance staff | Maintenance procedures, escort records |
| Media Protection | Media access, marking, transport, sanitization and destruction | Sanitization procedure, destruction logs |
| Physical and Environmental Protection | Physically secure locations, visitor control, escorts | Location list, visitor procedure, evidence |
| Planning | System security plans, rules of behavior | Plans, signed acknowledgments |
| Personnel Security | Fingerprint-based record checks, termination, transfer | Check dates and status, access revocation dates |
| Risk Assessment | Risk assessments, vulnerability scanning | Assessment dates, scan evidence |
| System and Services Acquisition | Security in contracts and development | Contract clauses, vendor records |
| System and Communications Protection | Boundary protection, encryption in transit and at rest | FIPS 140 validation evidence, network diagrams |
| System and Information Integrity | Patching, malware protection, monitoring | Patch records, alert handling evidence |
| Supply Chain Risk Management | Supplier risk, component integrity | Supplier list and reviews |
| Information Exchange Agreements | Security Addendum, management control agreements | Signed agreements, certification pages |
| Mobile Devices | Device management for devices that touch CJI | MDM coverage, mobile policy |
Priorities P1 to P4 and how they phase in
Version 6.0 assigns each requirement a priority. P1 requirements are the most urgent and are audited first; P2, P3 and P4 phase in over time according to published FBI guidance and your state's audit schedule. The priorities do not make lower ones optional. They tell you what to fix first if you cannot fix everything at once.
- P1 covers the requirements auditors check first
- P2 to P4 follow in later audit cycles
- A gap list sorted by priority is the fastest path to a clean first audit
- Confirm with your CSA which priorities apply at your next audit
How states interpret the policy
Each state CSA audits its local agencies at least once every three years, and the FBI audits each CSA on a triennial cycle. Between those audits, states publish their own guidance: which training platform to use, how often background checks are repeated, which policy version applies, and what evidence they expect. Two agencies in different states can follow the same policy and still face different paperwork. Always confirm details with your CSA, and use our CJIS compliance checklist and CJIS audit guide to prepare.
How Cjis keeps you aligned with the CJIS Security Policy
Cjis organizes the whole policy into one workspace. The readiness assessment asks questions mapped to each control family and policy area, scores every area and ranks gaps from P1 to P4. Each requirement becomes a task with an owner, status, due date and linked evidence. Policy templates, the personnel register and the evidence locker fill in what auditors ask for, and the agency report turns it into one PDF and a shareable read-only link. When the FBI publishes a new release, Cjis updates the mapping so your record stays current.
Cjis is an independent compliance tool, not affiliated with, endorsed by or certified by the FBI or the CJIS Division. It is not legal advice. Cjis never stores CJI; it stores compliance records and evidence that contain no CJI.