Technology
The CJIS Security Policy: an overview for agencies and vendors
What the policy covers, who it binds, and the areas that most often cause compliance findings.
The Criminal Justice Information Services Security Policy, published by the FBI, sets minimum security requirements for accessing and handling criminal justice information. It binds law enforcement agencies, the agencies that support them, and the vendors whose systems or staff touch the data.
What is criminal justice information
Data from the FBI's CJIS systems and related state systems, including criminal history, biometric data, identity data, and case and incident information. Agency records systems, dispatch systems, and mobile data systems typically contain it.
Who is bound
Criminal justice agencies, non-criminal justice agencies that access the data under agreement, and contractors. Each state has a CJIS Systems Agency that administers compliance, and agreements between agencies and vendors must address the policy.
Policy areas
The policy is organized into areas covering information exchange agreements, security awareness training, incident response, auditing and accountability, access control, identification and authentication, configuration management, media protection, physical protection, systems and communications protection, formal audits, personnel security, mobile devices, and cloud computing.
Frequent findings
- Staff or contractors with access who have not completed fingerprint-based screening or training
- Missing advanced authentication for remote or non-secure-location access
- Unencrypted data in transit or on mobile devices
- Insufficient audit logging of record access
- Cloud services and vendors without agreements addressing the policy
- Test environments containing real criminal justice information
What to expect from vendors
Expect personnel screening, training, and security addenda in contracts. Design systems with encryption, multi-factor authentication, and record-level audit logging from the start. Use synthetic data outside production.
Keeping current
The policy is revised periodically, and requirements have tightened over time, particularly around authentication. Agencies and vendors should work from the current version through their state CJIS Systems Agency.