Prepare for CJIS audits with evidence collected automatically

The CJIS Security Policy is the FBI's minimum security standard for protecting criminal justice information (CJI), such as criminal history records, fingerprints and case data. It is published by the FBI's Criminal Justice Information Services Division and approved by the CJIS Advisory Policy Board. It applies to CJI at rest and in transit across its whole lifecycle, and sets requirements for access control, authentication, encryption, logging, incident response and more.

Version 6.0, published on 27 December 2024, completed the FBI's modernisation of the policy. It reorganised the requirements into 20 policy areas, with 18 of them following the NIST SP 800-53 Rev. 5 control families, and added families such as Supply Chain Risk Management and System and Services Acquisition. Version 6.1, released in June 2026, corrects and clarifies 6.0 without changing its structure.

Any organisation that accesses, stores, processes or transmits criminal justice information must meet the CJIS Security Policy. That includes police departments, courts, corrections and other criminal justice agencies, plus private contractors, software vendors and cloud providers working on their behalf. Contractors are normally bound through the CJIS Security Addendum and the agreements between the agency and its state CJIS Systems Agency.

No, there is no official CJIS certification for vendors or products. Compliance is verified through audits: the FBI CJIS Audit Unit audits each state CJIS Systems Agency, and those agencies audit the local agencies and contractors that connect through them. Vendors usually demonstrate alignment by signing the CJIS Security Addendum, completing personnel screening and showing evidence that their controls meet the policy.

Non-compliance can lead to audit findings, corrective action plans and, for serious or unresolved issues, suspension or termination of access to CJIS systems and data. For a vendor, that can mean losing the contract. Separately, improper access to or disclosure of criminal history record information can carry state and federal penalties. The policy itself does not set fixed fines.

CJIS version 6.0 is built on NIST SP 800-53 Rev. 5, so an existing 800-53 programme covers much of the groundwork, although CJIS fixes specific values that 800-53 leaves to the organisation. ISO 27001 and SOC 2 overlap with many CJIS controls, such as access control and logging, but neither is accepted as a substitute for CJIS compliance.

Start by identifying where criminal justice information lives and who can reach it, then assess your controls against the 20 policy areas. Key steps include multi-factor authentication, encryption of CJI, audit logging, security awareness training, fingerprint-based background checks for staff with access, and signed agreements with your agency. Keep evidence ready for audits by your state CJIS Systems Agency.

Yes, on request. The CJIS Security Policy v6.0 is mapped in OneClickComply's control library, and we can enable it for your organisation. Once enabled, evidence collected for frameworks such as ISO 27001, SOC 2 or NIST SP 800-53 also counts towards CJIS, and you get automated evidence collection, policy generation and audit support. OneClickComply does not issue CJIS certification.