Who needs CJIS training
The rule is broad on purpose. Anyone with unescorted physical access to a location where CJI is processed, or logical access to systems that store, process or transmit CJI, needs awareness training. That includes sworn officers and civilian staff, dispatchers, records clerks, IT administrators, and the employees of vendors who support those systems. Cleaning and maintenance staff who are not escorted inside a secure area are covered too, at the most basic level.
- Agency personnel with access to CJI or to secure locations
- IT staff, system administrators and security staff
- Vendor and contractor employees covered by the CJIS Security Addendum
- Staff of government noncriminal justice agencies working under a management control agreement
- Anyone whose role changes so that access increases
Before access and every year after
Training must be completed before a person is given access to CJI, or within the window the policy and your state allow, and then repeated every year. A role change that adds access means the person needs the training for the new role. The practical consequence is that every person on your roster has their own due date, and those dates drift apart over time.
- Initial training before access is granted
- Annual refresher for every person, on their own anniversary
- New role-based training when responsibilities change
- State CSAs may set stricter timing, so confirm local rules
Missing one person's annual refresher is enough for a finding. Most agencies do not fail because nobody trained. They fail because nobody can show that everyone trained on time.
CJIS security awareness training levels
Earlier versions of the policy describe security awareness training in four levels, assigned by role. Many state programs and auditors still use these level names, so they remain the common language of CJIS training.
- Level 1 covers people with physical access only, such as facilities or maintenance staff who enter secure areas without escort
- Level 2 covers all personnel with access to CJI, including those who handle printed records
- Level 3 covers people with logical access to systems that process CJI
- Level 4 covers IT and privileged roles, such as system and network administrators and security staff
Current versions of the policy describe the same idea as literacy training for everyone plus role-based training for people with specific security responsibilities. In practice the mapping is close: basic awareness for all, and deeper content for those who administer systems or handle incidents. Your state program decides the names and content your auditor uses. Our CJIS Security Policy guide explains how the versions relate.
Records an auditor expects to see
During a state CJIS audit, the auditor typically picks names from your personnel list and asks for proof. The proof is a completion record with a date and, where the platform issues one, a certificate. A training policy that says who trains, at what level and how often is usually requested as well.
- A complete list of people with access, matched to the training level for each role
- Completion dates for initial and annual training
- Certificates or exports from the training platform
- A written awareness training policy and its last review date
- Evidence that access was not granted before training, or that it followed the allowed window
Keeping these in a spreadsheet works until the first person leaves, the second changes roles and the third trains on a vendor platform you cannot see. Training records also connect to the other personnel requirements described on our CJIS compliance requirements page, such as fingerprint-based background checks.
CJIS security awareness training and your state platform
Many states require or provide a specific platform for CJIS security awareness training, and agencies often must use it. Cjis does not replace that platform. It works alongside it. People keep taking the official course where your state says they should, and Cjis keeps the record of who is due, who is late and where the certificate is. For vendors whose staff train for several agencies, Cjis keeps one view across all of them.
- Keep your state-mandated course exactly where it is
- Record completion dates and upload certificates in one place
- See every person's status across agencies and systems
- Prove training to an auditor without logging into several portals
How often is CJIS training required
Every year, plus before initial access and after a role change that adds access.
Is there a single official CJIS training course
No single national course exists; many states require or provide their own platform, so ask your CSA.
Do vendor employees need CJIS training
Yes, vendor and contractor staff with access to CJI need awareness training at the level of their role.
Does Cjis replace our state training platform
No. Cjis tracks completion next to it, reminds people before expiry and stores the certificates.
How Cjis tracks CJIS training for every person
The Cjis training module sits inside the personnel register. Every person with access has a role, a training level and a due date. Cjis reminds the person and their manager 30 days and 7 days before training expires, records completion, and stores the uploaded certificate next to the person's background check date and Security Addendum certification page. A built-in role-based awareness briefing with a short quiz covers Level 1 to 4 topics as a supplement for refreshers and onboarding, not as a replacement for a state-mandated course. When the auditor arrives, the agency report shows a personnel compliance table with every training date in one place.
Cjis is an independent compliance tool, not affiliated with, endorsed by or certified by the FBI or the CJIS Division. It is not legal advice, and it never stores CJI. If you also need the vendor side of this story, read what CJIS certification really means.
- Due dates per person, by role and training level
- Reminders 30 and 7 days before expiry
- Certificate upload and completion history
- Role-based awareness briefing with a short quiz as a supplement
- Personnel compliance table in the agency report