CJIS compliance FAQ
Short, plain answers to the questions security leads, LASOs and vendor founders ask before they start with Cjis. If your question is about a rule in your state, confirm the final answer with your CJIS Systems Agency (CSA), because state interpretations differ.
Is Cjis an FBI certification?
No. The FBI does not certify companies as "CJIS certified", and Cjis helps you prepare for agency and state CSA review, as explained on our CJIS certification guide.
Is Cjis affiliated with the FBI or the CJIS Division?
No. Cjis is an independent compliance tool and is not affiliated with, endorsed by or certified by the FBI or the CJIS Division.
Is Cjis legal advice?
No. Cjis organizes your controls, policies, people and evidence, and your organization and its CSA decide how the policy applies to you.
Who audits CJIS compliance?
The CSA in each state audits local agencies at least once every three years, the FBI audits each CSA on a triennial cycle, and agencies review the vendors that access their CJI.
What does a vendor need to work with CJI?
A private contractor with access to CJI signs the CJIS Security Addendum, its staff complete the certification page, and people with access pass a fingerprint-based record check and awareness training, see CJIS compliance requirements.
Do we upload CJI into Cjis?
Never. Cjis stores compliance records and evidence that contains no CJI, and every upload shows a notice and runs a file name check.
Where is our data?
Your compliance data is hosted in the US, encrypted in transit and at rest, and you can export it any time.
Who can see our compliance record?
Only the people you invite, with roles and an audit log on Pro and up, and SAML SSO on Enterprise, as described on our security page.
What happens to our data if we cancel?
Your workspace stays available to the end of the paid period, you can export everything before then, and you can ask us to delete it.
Which policy version does Cjis follow?
Cjis follows the v6.0 control families with v5.9.5 mapping for states still auditing on it, and we update it when the FBI publishes changes, see our CJIS Security Policy guide.
Does it replace our state's training platform?
No. Cjis tracks training next to it and reminds people before it expires.
Can a vendor keep separate records per agency?
Yes, from Team with 3 agencies and Pro with 25 agencies, and Enterprise has no limit.
What does the readiness check show?
It scores your answers to 12 questions across the CJIS policy areas, ranks the gaps by priority P1 to P4 and shows the first areas and gaps right away.
Can we bring in our existing personnel list?
Yes. You import personnel from a CSV file and attach existing evidence files to the right controls.
What does the agency report contain?
An assessment summary, control status, a policy list with dates, a personnel compliance table and an evidence index, as a PDF and a shareable read-only link.
Can we pay yearly by invoice?
Yes, on Enterprise annual plans, and every other plan pays by card.
Can we cancel?
Yes, access runs to the end of the paid period, and payments are final per the refund policy.
Is there a plan without a subscription?
No. Every plan is a subscription, from $24 per month billed yearly, and the only thing without payment is the readiness check, see pricing.
Does an upgrade cost extra right away?
Yes. Moving to a higher plan or to yearly billing charges the difference immediately and the new plan starts once it is paid.
Still deciding
Answer 12 questions and see your readiness by policy area in a few minutes.