How to prepare for a CJIS audit

Agencies that access criminal justice information are audited against the CJIS Security Policy by their state CJIS Systems Agency. Preparation is mostly a matter of knowing what is in scope, collecting evidence before it is requested, and resolving the findings that recur across agencies.

Requirements are revised periodically. Work from the current version of the policy through your state CJIS Systems Agency rather than from a summary.

Steps

1. 1Define the scope precisely

   List every system, network segment, facility, and person that stores, processes, transmits, or can access criminal justice information. Include mobile devices, vendors with remote access, and any cloud service involved. Scope creep in either direction causes findings.

2. 2Reconcile the personnel list

   Confirm that everyone with unescorted access, including contractors and IT staff, has completed fingerprint-based background screening and current security awareness training. Produce the roster with dates before the auditor asks for it.

3. 3Verify authentication everywhere

   Check that advanced authentication is enforced for access from outside physically secure locations, and increasingly for all access. Identify any application still reachable with a password alone and plan its remediation.

4. 4Check encryption in transit and at rest

   Confirm the encryption applied to criminal justice information moving across networks, stored on servers, and held on mobile devices and laptops, and that it meets the standard the policy specifies.

5. 5Produce audit logs and show they are reviewed

   Record-level access logging is required, and so is evidence that someone reviews it. Export a sample, document the review cadence, and keep the review records.

6. 6Review agreements with vendors and other agencies

   Every vendor with access needs the appropriate security addendum, and information exchange agreements with other agencies must be current. Missing agreements are among the most common findings.

7. 7Confirm physical and media controls

   Walk the facilities. Check access control to areas where criminal justice information is processed, visitor logs, screen placement, and the procedures for handling and destroying media.

8. 8Test the incident response path

   Confirm that staff know how an incident involving criminal justice information is reported through the agency to the state, and run a short tabletop to validate it.

9. 9Close known gaps and document the rest

   Fix what can be fixed before the audit. For anything that cannot, document the compensating controls and the remediation plan with dates. An honest plan of action is better received than a surprise.

What you end up with

A defined scope, an evidence package, and a short list of documented gaps with owners and dates. Most agencies find that the preparation itself resolves the majority of what would otherwise be findings.