CJIS compliance process in four clear steps
CJIS compliance is not a one-time project. It is a cycle: find out where you stand, close the gaps, keep proof and show it to the agency or auditor. Cjis turns that cycle into four steps that you repeat with less effort every time, because the record stays current between audits.
Assess where you stand
You start with a readiness assessment mapped to the CJIS Security Policy areas and the v6.0 control families. Questions are short and specific: is multi-factor authentication enforced for every account that reaches CJI, is encryption in transit and at rest done with FIPS 140 validated modules, does every person with access have a fingerprint-based record check. Each answer moves the score of its area, and every gap gets its priority from P1 to P4. You can run the first check on the homepage before you create an account.
- A score per policy area and one overall readiness view
- Gaps ranked by priority, P1 first
- Separate assessments per system on Pro and Enterprise
- Mapping to v5.9.5 for states still auditing on it
Fix and assign every gap
Each gap becomes a task in the requirements checklist with an owner, a status, a due date and a note. The LASO or security lead no longer carries the whole list alone: IT owns the MFA rollout, HR owns background check paperwork, the records supervisor owns media sanitization. Policies come from editable templates, so the written part of a fix takes an afternoon instead of a week. Read the CJIS compliance requirements to see what each area covers.
- Assign tasks to named owners with due dates
- Filter by priority, policy area or system
- Start policies from templates and record approval
- Open P1 items stay at the top until they are closed
Prove each control with evidence
An auditor or agency reviewer does not accept "yes, we do that". They ask to see it. In Cjis you attach evidence to the control it supports: a screenshot of your MFA policy, an encryption configuration, a signed CJIS Security Addendum, an exported log review, a training certificate. The evidence locker accepts compliance documents only. Cjis never stores CJI, and every upload shows a notice and checks the file name before it is saved.
- Evidence linked to the control, policy or person it proves
- Dates on every file, so stale evidence is easy to spot
- Personnel register with background check and training records
- No CJI stored, ever
Report to the agency or auditor
When the agency asks for proof or the CSA audit is on the calendar, you produce the agency report: readiness summary by area, control status, policies with review dates, the personnel compliance table and an evidence index. Send it as a PDF or a read-only link that you can revoke when the review ends. Vendors serving several agencies keep one report per agency. Learn what auditors look for in the CJIS audit guide.
- PDF export and a shareable read-only link
- One report per agency, with the right systems and people
- The same structure every time the agency asks
What you need to start
You do not need a consultant or a finished policy binder to begin. Bring what you already have and Cjis shows you what is missing.
- 01 A list of people with access to CJI, in a spreadsheet you can import as CSV
- 02 The systems that store, process or transmit CJI, and where they run
- 03 Any existing policies, agreements and audit findings you want to keep
- 04 Training and background check dates, if you track them anywhere today
Setup that fits around your real job
Most of the first session is the assessment and the personnel import, and many teams finish both in a single sitting. Policies and evidence come in over the following weeks as owners close their tasks. Nothing has to be complete on day one: the score tells you where to spend time first, and the record improves every time someone closes a task.
- 01 Assessment and import first, the rest in order of priority
- 02 Templates instead of blank pages
- 03 Progress visible to everyone on the team
Reminders keep it current between audits
Compliance decays quietly. Training expires, people leave, a policy misses its annual review, a vendor agreement needs renewal. Cjis sends reminders before each of those dates, so the record is still accurate when the agency or the auditor asks next time. See all reminders and modules on the features page, and compare plans on pricing.
- 01 Awareness training reminders 30 and 7 days before expiry
- 02 Background re-investigation reminders per your state's rules
- 03 Annual policy review and audit date countdown
- 04 Reminders on open P1 gaps until they are closed