Security
CJIS for software teams: what actually changes when you touch criminal justice data
A practical summary of the CJIS Security Policy requirements that affect developers and integrators.
The FBI's CJIS Security Policy governs criminal justice information: the data in records systems, dispatch systems, and anything that connects to state and national crime databases. If your software or your staff touch that data, the policy applies to you. Here is what that means in practice for a development or integration team.
Personnel
Everyone with unescorted access to criminal justice information, including developers with access to production data, needs fingerprint-based background screening through the agency and must complete CJIS security awareness training within a set period of assignment and periodically thereafter. Plan for this in staffing and schedules.
Encryption
Criminal justice information in transit outside a secure facility must be encrypted to the standard the policy specifies, and encryption at rest is required in many scenarios. This affects integrations, backups, laptops, and cloud storage.
Authentication
Advanced authentication, which in practice means multi-factor, is required for access from outside physically secure locations and increasingly for all access. Design your application's authentication with this in mind rather than bolting it on.
Logging and auditing
Access to criminal justice information must be logged with enough detail to answer who accessed what and when, and logs must be retained. Your application needs audit logging that captures record-level access, not only logins.
Cloud and vendors
Cloud services hosting criminal justice information must meet the policy's requirements, and the agency's agreement with the provider must address them. Development and test environments must not contain real criminal justice information unless they meet the same standards; use synthetic data.
Incident response
Incidents involving criminal justice information must be reported through the agency to the state CJIS systems agency. Your incident procedures should include that path.
None of this is exotic. It is discipline about who has access, how data moves, and what gets logged. Building it in from the start is far cheaper than retrofitting it.