CJIS & Regulatory Compliance

What this covers

Agencies that handle criminal justice information, health data, cardholder data, or federal tax information are bound by specific security policies. HQT helps agencies interpret those requirements, implement the controls, and prepare for audits.

Typical activities

• Scoping which systems, people, and vendors fall under each policy
• Gap analysis against the current CJIS Security Policy, HIPAA Security Rule, PCI DSS, or IRS Publication 1075
• Control implementation, including encryption, logging, access control, and personnel screening processes
• Policy and procedure development
• Vendor and cloud service review for compliance obligations
• Audit preparation and response support

What you receive

A compliance scope statement, gap analysis, implemented controls, written policies, and an audit evidence package.

Why it matters

Non-compliance can mean loss of access to state and federal systems that agencies depend on, in addition to the risk of a breach. Getting the scope right avoids both over-spending and under-protecting.

Signals that this work is due now

Compliance questions usually surface on someone else's schedule. These conditions mean the work should start before that.

• Your CJIS Systems Agency has scheduled a review, or the last one closed with findings that were explained rather than remediated.
• A system holding regulated data is moving: a new computer-aided dispatch or records system, a hosting change, or a new interface to the state message switch.
• A vendor, integrator, or managed service provider holds administrative access without an executed CJIS Security Addendum, a HIPAA business associate agreement, or the safeguarding terms a federal tax information agreement calls for.
• Staff reach regulated systems from personal devices, home networks, or shared terminals that were never assessed.
• The agency is standing up online payments or changing processors, and no one has determined which PCI DSS validation path now applies.
• A program is about to receive federal tax information for the first time, and no one owns the safeguarding obligations that come with it.

Where compliance programs break down

The CJIS Security Policy and IRS Publication 1075 both align to the NIST SP 800-53 control catalog, and the HIPAA Security Rule, though written at a higher level, addresses the same control areas. That overlap is why one control set mapped to each requirement tends to work better than a separate binder per framework. The recurring failure modes are recognizable.

• Written policy that does not match the running configuration, because policy was drafted by one party and the system built by another.
• A boundary drawn around system names rather than data flows, leaving a reporting database, test environment, or backup target outside it while holding the same data.
• Evidence assembled in the weeks before an audit rather than produced by normal operations, with undated screenshots as the usual symptom.
• Compensating controls in use without written justification or acceptance by the authority that has to accept them.
• The last audit's finding list treated as the requirement set, so anything the auditor did not sample goes unaddressed.
• Encryption called finished before key custody, use of validated cryptographic modules, and provider access to keys or plaintext are settled.

Roles and vendors inside the boundary

Much of this work is coordination with parties outside the agency. The CJIS Systems Agency and its CJIS Systems Officer interpret the policy for your state, and the local agency security officer and, in many states, a terminal agency coordinator hold named duties that a contractor cannot assume on the agency's behalf. A cloud provider's government region supplies infrastructure controls, not compliance: everything on the agency side of the shared responsibility line still has to be implemented and evidenced. Remote support deserves particular attention, because screen sharing and privileged remote access can put a vendor's staff in scope for screening and training, and access from outside the United States is restricted under some of these requirements. For payments, a processor's attestation covers the processor's own environment only. Counties running health programs may need a hybrid entity designation so that HIPAA obligations land on the components that hold protected health information.

What to require in a solicitation

1. Name each standard and the policy version in effect at award, and state how a version change mid-project is handled.
2. Require a responsibility matrix that assigns every applicable control to the agency, the contractor, or a named subcontractor or hosting provider.
3. Require the CJIS Security Addendum, background screening, and security awareness training before any access is granted, and require the same terms to flow down to subcontractors.
4. State where regulated data may rest and from where administrative access may originate, and prohibit access from anywhere else.
5. Require incident notification to the agency quickly enough for the agency to meet its own reporting obligations to the CJIS Systems Agency or the relevant federal program office.
6. Require named support during the audit window, including a person who answers auditor questions directly.

Working with HQT on this

HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.

Frequently asked questions