CJIS compliance for vendors that sell to law enforcement
Your product is ready for the agency. The agency is not ready to sign until it sees how you protect criminal justice information. Cjis keeps your controls, policies, people and evidence in one current record, so every CJIS questionnaire gets a fast, consistent answer and every agency gets its own audit-ready report.
Built for gov-tech teams that touch CJI
If your software or service stores, processes or transmits criminal justice information, or your staff can reach systems that do, the agency must treat you as a contractor under the CJIS Security Policy. That covers most of the products police departments buy today.
- Records management (RMS) and computer-aided dispatch (CAD) vendors
- Body-worn camera and digital evidence platforms
- Jail management, e-citation and court case software
- Cloud providers and hosting partners running agency workloads in AWS GovCloud or Azure Government
- MSPs and MSSPs that administer agency networks, endpoints or identity
Procurement stops at the CJIS questionnaire
The demo goes well, the agency wants the product, and then a security questionnaire arrives with dozens of questions about advanced authentication, FIPS 140 validated encryption, audit logging, incident response and personnel screening. The answers live in a shared drive, three spreadsheets and the memory of one engineer. Each new agency asks the same things in a different format, and each answer is written from scratch. Weeks pass while the agency's procurement clock keeps running.
- Answers differ between agencies because nobody owns one source of truth
- Background check and training dates for staff are scattered across HR, IT and email
- Evidence such as MFA settings or encryption configs is collected again for every review
- A gap found late in review restarts the conversation
The CJIS Security Addendum and agency vendor programs
Private contractors with access to CJI sign the CJIS Security Addendum, and each of your staff members with access completes the certification page that comes with it. Many agencies and state CJIS Systems Agencies (CSAs) also run a vendor management program: they keep a file on each contractor, review your controls, confirm fingerprint-based record checks for your people and check that awareness training stays current. Rules and forms vary by state, so always confirm the exact process with the agency and its CSA. What does not vary is that they expect proof, kept up to date, for every agency you serve.
- Track which agencies you have signed the Security Addendum with and when
- Record the certification page for every employee and subcontractor with access
- Keep fingerprint-based background check status per person, per state where it applies
- Attach signed agreements and agency approvals to the agency record as evidence
A separate, clean compliance record for each agency
Every agency wants to see its own picture: which of your systems it uses, which of your people can reach its data, and which controls protect it. Cjis keeps one record per agency on top of your shared controls, so you answer once and present the right slice to each customer. The Team plan covers 3 agencies, Pro covers 25 and Enterprise has no limit. See every plan on the CJIS compliance software pricing page.
- Shared controls and policies, reused across every agency record
- Per agency systems, people, agreements and open items
- Status per agency, so sales and security see the same answer
- Separate records for each agency an MSP supports
Every person with access in one register
Your people are part of the audit. The personnel register lists everyone with unescorted or logical access to CJI: role, access level, background check date and status, Security Addendum certification, awareness training due date, and the dates access was granted and revoked. Cjis reminds owners before training expires and flags anyone who has access without a recorded check. Read more about CJIS training and how it is tracked.
- Import staff by CSV and keep the register current as people join and leave
- Reminders 30 and 7 days before awareness training expires
- Clear status for new hires waiting on a fingerprint-based check
- Revocation dates recorded the day access ends
The report the agency reads
When an agency asks for proof, you send one PDF or a read-only link instead of a folder of attachments. The agency report includes the readiness summary by policy area, control status, policies with approval and review dates, the personnel compliance table and an index of evidence. The link is read-only, scoped to that agency and can be revoked when the review ends. Learn how it works from assessment to report.
- PDF export and a shareable read-only link per agency
- Evidence index with file names and dates, with no CJI anywhere in it
- Policies listed with version, owner and next review date
- The same structure every time, so reviewers know where to look
For the person who signs
You are the founder, CEO or COO, and you care about one thing here: contracts that close. When the security answer is ready the day the agency asks, procurement keeps moving instead of waiting on your team. Cjis replaces repeated consultant hours and spreadsheet chasing with one current record that your security lead maintains and your sales team can rely on. Renewals and new agencies get the same report without a new project each time.
- Deals unblocked at the security review stage
- Consultant hours replaced by a record your own team keeps current
- One answer for every agency, not a new questionnaire project each time
- A clear view of open gaps before an agency finds them
What Cjis is and what it is not
Cjis is an independent compliance tool. It is not affiliated with, endorsed by or certified by the FBI or the CJIS Division, and the FBI does not certify companies as "CJIS certified". The agency and its CSA decide whether you meet the policy. Cjis is not legal advice. Cjis never stores CJI; it stores compliance records and evidence that contain no criminal justice information. For the full picture of what agencies expect, see CJIS compliant software.