What is Criminal Justice Information (CJI)?

CJI is the term used to describe all data provided by the FBI CJIS Division, including biometric data (fingerprints, palm prints, iris scans), identity history records, person and property records from NCIC, stolen vehicle information, active warrants, and any data derived from those sources. CJI also includes Criminal History Record Information (CHRI), which is the subset of CJI that contains an individual's arrest and conviction history. The CJIS Security Policy applies to CJI in all forms: electronic, printed, or verbal.

Does CJIS compliance require FIPS 140-3 or is FIPS 140-2 still accepted?

As of the CJIS Security Policy v5.9.5, the requirement specifies FIPS 140-2 validated cryptographic modules. FIPS 140-3 validated modules also satisfy the requirement, as FIPS 140-3 is the successor standard. NIST has transitioned the CMVP to accept only FIPS 140-3 submissions for new validations as of September 2021, but existing FIPS 140-2 certificates remain valid. Organizations deploying new solutions should prefer FIPS 140-3 validated modules for future-proofing.

Can CJI be stored in a commercial cloud environment?

Yes, but with strict conditions. The cloud service provider must execute a CJIS Security Addendum, all personnel with potential access to CJI must pass fingerprint-based background checks, data must be encrypted at rest and in transit with FIPS-validated modules, and CJI must remain within the United States. AWS GovCloud, Azure Government, and Google Assured Workloads provide infrastructure designed to meet these requirements. However, proper configuration of the cloud environment is the customer's responsibility, and many organizations fail CJIS audits despite using a compliant cloud platform due to misconfiguration.

What happens if an organization fails a CJIS audit?

Audit findings are categorized by severity. Critical findings require immediate remediation (typically within 30 days). If an organization fails to remediate critical findings, the state CSA can suspend or terminate that organization's access to CJIS systems. For a law enforcement agency, this means losing the ability to query NCIC, run background checks, or access criminal history records, which would severely impair operations. For contractors and vendors, loss of CJIS access means losing the contract.

Do IT vendors and managed service providers need to comply with CJIS?

Yes. Any contractor, vendor, or service provider whose personnel have access to CJI, or who could access CJI through their administrative access to systems processing CJI, must comply with all applicable CJIS requirements. This includes managed IT providers, cloud hosting companies, software vendors, and even janitorial companies with unescorted physical access to secure areas. Vendors must sign the CJIS Security Addendum and ensure all relevant personnel are fingerprinted and background-checked.

How does CJIS relate to FISMA?

The Federal Information Security Modernization Act (FISMA) requires federal agencies to implement security controls based on NIST SP 800-53 through the Risk Management Framework (RMF). CJIS and FISMA share the same foundational control catalog (NIST 800-53), but they serve different purposes. FISMA applies to federal information systems broadly, while CJIS specifically governs access to criminal justice databases. An organization subject to both frameworks can leverage significant control overlap, as both are rooted in the same NIST controls.

Is CJIS compliance required for body camera and evidence management systems?

If a body camera or digital evidence management system stores, processes, or transmits CJI (for example, by linking video evidence to NCIC records or criminal history information), then that system must comply with the CJIS Security Policy. Many modern evidence management platforms integrate with criminal justice databases, which triggers CJIS requirements for the entire system, including encryption, access controls, audit logging, and personnel security for anyone who administers the system.

What is the CJIS Security Addendum?

The CJIS Security Addendum is a contractual document that must be executed between any non-criminal justice agency or private contractor and the contracting government agency before the contractor can access CJI. The addendum incorporates the CJIS Security Policy requirements by reference, making them legally binding contractual obligations. It covers data handling, personnel screening, security controls, incident reporting, and the right of the CSA to audit the contractor's compliance. PTG executes CJIS Security Addenda with all clients who require CJIS-regulated services.

CJIS Compliance

CJIS Security Policy Complete Compliance Guide

Q: How often are CJIS audits conducted?

Formal CJIS audits are conducted on a triennial (every three years) cycle. The FBI CJIS Division audits state CSAs, and state CSAs audit agencies and contractors within their jurisdictions. Between formal audits, agencies are expected to perform internal self-assessments. PTG recommends conducting annual internal assessments to identify and remediate drift before it becomes a formal finding.

The FBI's CJIS Security Policy governs access to the nation's most sensitive law enforcement databases. Expert assessment, implementation, and monitoring across all 13 policy areas.

CMMC Registered Practitioner Org | BBB A+ Since 2003 | 23+ Years Experience

Start CJIS Compliance Call 919-348-4912

The Framework

What CJIS Compliance Covers

13 policy areas mapping to NIST SP 800-53 control families, governing every organization that touches Criminal Justice Information.

Technical Controls

FIPS 140-2 validated encryption for CJI at rest and in transit
Advanced authentication (MFA) for all remote CJI access
Comprehensive audit logging with minimum 1-year retention
Role-based access control with account lockout policies

Administrative Controls

Information exchange agreements with all CJI-accessing entities
Security awareness training within 6 months, refreshed biennially
Incident response plan with CSA reporting requirements
Physical security for facilities housing CJI systems

Our Services

CJIS Compliance Services

Comprehensive support across all 13 CJIS Security Policy areas.

Gap Assessment

Full evaluation across all 13 policy areas identifying gaps, risk-ranked findings, and a prioritized remediation roadmap.

FIPS Encryption Deployment

Deploy and verify FIPS 140-2 validated cryptographic modules for CJI at rest and in transit across your environment.

Advanced Authentication

Enterprise MFA solutions that satisfy CJIS requirements across all access points, including local workstations in secure facilities.

Audit Log Monitoring

Continuous monitoring that flags anomalous CJI access patterns in real time, maintaining compliance between triennial audits.

Incident Response Planning

Documented response procedures covering detection, containment, eradication, and mandatory CSA/FBI reporting.

Security Awareness Training

CJIS-specific training programs covering policy requirements, social engineering threats, and incident reporting procedures.

Process

How It Works

Assessment across all 13 CJIS policy areas

Remediation plan with risk-ranked priorities

Technical control implementation

Policy and procedure documentation

Staff training and awareness programs

Triennial audit preparation and ongoing monitoring

Who Must Comply

Built For

Law Enforcement Agencies Courts and Prosecutors Corrections Departments 911 Dispatch Centers IT Vendors to Public Safety Cloud Service Providers

FAQ

Frequently Asked Questions

What is the CJIS Security Policy?

The FBI's mandatory security framework governing access to criminal justice databases including NCIC, III, and NICS. It contains 13 policy areas that map to NIST SP 800-53 controls.

Who must comply with CJIS?

Any organization accessing CJI: law enforcement, courts, corrections, public safety agencies, private IT vendors, cloud providers, and non-criminal justice agencies authorized to receive CJI.

How often are CJIS audits conducted?

The CJIS Audit Unit or your state CSA conducts triennial audits. Organizations should also perform interim self-assessments to maintain continuous compliance.

What happens if we fail a CJIS audit?

Organizations risk losing access to FBI databases entirely, which can cripple law enforcement operations. Agencies may face sanctions, remediation orders, and potential criminal penalties.

Does CJIS require encryption?

Yes. CJI must be encrypted using FIPS 140-2 validated cryptographic modules both at rest and in transit. This is the most frequently cited audit finding.

Ready for Your Next CJIS Audit?

Contact Petronella Technology Group for a comprehensive CJIS compliance assessment across all 13 policy areas.

Schedule a Consultation Call 919-348-4912