The FBI's Criminal Justice Information Services Security Policy governs the access, use, and protection of criminal justice information. CJIS compliance is mandatory for any organisation accessing FBI criminal justice databases or handling criminal justice information.
What is CJIS?
The FBI's Criminal Justice Information Services (CJIS) Security Policy establishes minimum security requirements for the access, use, and protection of Criminal Justice Information (CJI). It applies to all entities, government agencies, contractors, and cloud service providers, that access or process CJI from FBI databases such as the National Crime Information Center (NCIC).
CJIS compliance is enforced through triennial audits conducted by state CJIS Systems Agencies (CSAs) or the FBI. Non-compliance can result in loss of access to FBI criminal justice databases, which is critical for law enforcement agencies and their technology vendors.
Cloud service providers seeking to host CJI must execute a CJIS Security Addendum and demonstrate compliance with all applicable CJIS Security Policy requirements, including FBI-approved encryption standards.
Compliance requirements
The CJIS Security Policy covers 13 policy areas, with particularly stringent requirements for personnel security, access control, and encryption.
Implement background checks, security awareness training, and ongoing personnel vetting for all staff with access to criminal justice information.
Implement physical security controls to prevent unauthorised access to systems and media containing criminal justice information.
Implement controls to ensure only authorised personnel can access criminal justice information, including multi-factor authentication and least privilege.
Implement comprehensive audit logging and monitoring to detect and respond to unauthorised access or misuse of criminal justice information.
Establish an incident response capability with mandatory reporting requirements to the FBI CJIS Division for security incidents involving CJI.
Establish and maintain secure baseline configurations for all systems accessing or processing criminal justice information.
Implement encryption and other controls to protect criminal justice information in transit and at rest, including FBI-approved encryption standards.
Audit process
Netru manages the complete CJIS compliance journey, from scoping your CJI environment through to triennial audit preparation and ongoing monitoring.
We identify all Criminal Justice Information (CJI) in your environment and define the system boundary for CJIS compliance.
We assess your current controls against all CJIS Security Policy requirements, producing a prioritised remediation roadmap.
We prepare the required CJIS Security Addendum for execution with your state CJIS Systems Agency (CSA).
Your compliance manager guides implementation of required controls, with evidence collection throughout.
We support the personnel security requirements including background check processes and security awareness training.
We prepare for and support the triennial CJIS compliance audit conducted by your state CSA or the FBI.
How Netru delivers it
Our team has deep experience in CJIS compliance for law enforcement technology vendors and cloud service providers. We scope your CJI environment, implement controls, prepare your Security Addendum, and manage the triennial audit process.
Talk to our teamBefore you talk to anyone