Industry Insights · Law enforcement · 9 min read
CJIS Compliance: What the FBI CJIS Security Policy Requires
CJIS compliance explained: what criminal justice information (CJI) is, who must follow the FBI CJIS Security Policy, and what version 6.1 requires.
Any agency that uses FBI criminal justice data, and any contractor that stores or processes it for them, works to the same baseline: the FBI CJIS Security Policy. Its modernization was completed in December 2024 and the policy was updated again in June 2026, so controls and contracts based on older versions may need another look.
This guide covers what CJIS compliance means, what counts as criminal justice information and what the current policy asks for.
What is CJIS compliance?
CJIS compliance means meeting the FBI CJIS Security Policy, the minimum security requirements for every agency, contractor and vendor with access to criminal justice information (CJI) or to systems that process, store or transmit it. The policy protects CJI through its whole life, from creation to destruction, whether at rest or in transit.
CJIS stands for Criminal Justice Information Services, the FBI division that collects, stores and shares CJI with law enforcement, criminal justice and other authorized agencies. The policy sets a minimum: state, local, tribal and federal agencies can add stricter requirements.
What is criminal justice information (CJI)?
Criminal justice information is the FBI's term for the CJIS-provided data that law enforcement and civil agencies need to carry out their work. The policy groups it into five categories:
- Biometric data: fingerprints, palm prints, iris scans and facial recognition data used to identify people.
- Identity history data: the history of criminal or civil events linked to a person's biometric record.
- Biographic data: information about people connected to a specific case.
- Property data: details of vehicles and property linked to crime, when accompanied by personally identifiable information.
- Case and incident history: records of past criminal incidents.
Criminal history record information (CHRI) is a subset of CJI with extra controls on access and dissemination. Transaction control numbers, such as an ORI or NIC, are exempt when they appear without CJI or personal information.
The current CJIS Security Policy: version 6.1
The current version is CJIS Security Policy 6.1, dated June 25, 2026, and published through the FBI's CJIS Security Policy Resource Center. It incorporates corrections and additions approved by the CJIS Advisory Policy Board in 2025. Version 6.0, dated December 27, 2024, completed the policy's modernization, which rebuilt it around the control families and control numbers of NIST SP 800-53, the federal catalog of security and privacy controls.
The policy now has 20 policy areas: information exchange agreements, mobile devices and 18 control families, such as access control (AC), identification and authentication (IA), audit and accountability (AU) and system and communications protection (SC). Requirements carried over from before the modernization, and new requirements marked Priority 1, have been sanctionable since October 1, 2024. Other new requirements, marked Priority 2 to 4, are in a "zero-cycle" period that runs until September 30, 2027.
Who has to follow the CJIS Security Policy?
The policy applies to every entity with access to CJI, or that operates systems used to process, store or transmit it. That includes criminal justice agencies, noncriminal justice agencies that use CJI for purposes such as hiring decisions, and private contractors, including cloud and software providers.
Each state or territory has one CJIS Systems Agency (CSA), the criminal justice agency on the CJIS network that serves users in its area. The CSA runs the security program for its user community, appoints a CJIS Systems Officer and can impose stricter requirements than the FBI baseline, so details can vary between states. Private contractors that handle CJI sign the CJIS Security Addendum, an FBI-approved agreement that limits how they may use the information, and they face the same audits as the agencies they serve.
CJIS Security Policy requirements at a glance
The table summarizes six requirement areas that apply directly to systems holding CJI.
| What the policy asks for | How DekkoDEMS supports it | |
|---|---|---|
| Access control (AC) | Enforce approved authorizations and give each user only the access their duties require (least privilege). | Permissions by user, group, agency and case |
| Identification and authentication (IA) | Multi-factor authentication for privileged and non-privileged accounts, both marked Priority 1. | Two-factor authentication on user accounts |
| Encryption (SC) | Encrypt CJI in transit and at rest outside a physically secure location, using FIPS 140-3 certified modules or AES (FIPS 197) with keys of at least 256 bits. | AES-256 encryption |
| Audit and accountability (AU) | Log events such as logons, file access and permission changes; record what happened, when, where, who was involved and the outcome; keep records for at least one year. | Immutable audit trails on every file and case |
| Media protection (MP) | Restrict access to digital and paper media, store it securely and encrypt digital media that leaves a secure location. | Evidence stays in the platform, never on removable media |
| Personnel security (PS) | State and national fingerprint-based record checks before a person is given access. | Agency process, outside the software |
The policy also requires security and privacy training before anyone accesses CJI and every year after that. CJIS compliance is shared: software can provide controls, but the agency's own policies, screening and training complete it.
Is there an official CJIS certification?
No. The CJIS Security Policy contains no certification for vendors or products. Compliance is shown through agreements, screening and audits:
- Contractors sign the CJIS Security Addendum and meet the same training requirements as government staff doing similar work.
- Under the CJIS User Agreement, each CSA audits the agencies that connect through it every three years, and the FBI CJIS Division audits each CSA on the same cycle.
- Agencies audit external service providers with access to their systems at least every three years.
Georgia's CJIS vendor compliance program, for example, states that it does not certify a vendor's products or services as compliant. A "CJIS certified" label is the vendor's own description, so ask which controls a product supports and how.
Where DekkoDEMS fits
DekkoDEMS helps agencies meet the FBI CJIS Security Policy for handling criminal justice information, with the controls it calls for already in place. Permissions are set by user, group, agency and case, user accounts use two-factor authentication, and evidence is encrypted with AES-256. Every file and case has an immutable audit trail, and evidence stays in the platform, never on removable media. See how DekkoDEMS works for law enforcement or explore DekkoDEMS.
Common questions
Frequently Asked Questions
What does CJIS stand for?
CJIS stands for Criminal Justice Information Services, a division of the FBI. The CJIS Division shares criminal justice information with authorized agencies and publishes the CJIS Security Policy, which sets how that information must be protected.
What is the latest version of the CJIS Security Policy?
The latest CJIS Security Policy is version 6.1, dated June 25, 2026. Version 6.1 updates version 6.0, released December 27, 2024, which restructured the policy around NIST SP 800-53 control families. Agencies should confirm with their CJIS Systems Agency which version their next audit will use.
Does CJIS require FIPS 140-3 encryption?
The CJIS Security Policy requires CJI outside a physically secure location to be encrypted with FIPS 140-3 certified modules, or with AES as defined in FIPS 197, using keys of at least 256 bits. The policy also states that FIPS 140-2 certificates are not acceptable after September 21, 2026.
Does CJIS require multi-factor authentication?
Yes. The CJIS Security Policy requires multi-factor authentication for both privileged and non-privileged accounts, and both requirements are marked Priority 1, which means they have been sanctionable since October 1, 2024.
Do cloud and software vendors need to follow CJIS?
Cloud and software vendors must follow the CJIS Security Policy when they access CJI or run systems that process, store or transmit it. Vendors sign the CJIS Security Addendum, and their staff with access pass fingerprint-based checks. CJI stored in the cloud must stay within the United States, its territories, Indian Tribes or Canada.
How long do CJIS audit logs need to be kept?
The CJIS Security Policy requires audit records to be kept for at least one year, or longer while they are still needed for administrative, legal, audit or other operational purposes. CJIS audit records must show what type of event occurred, when and where it happened, its source, its outcome and who was involved.