CJIS Security Policy

What is the CJIS Security Policy?

The CJIS Security Policy sets the minimum security requirements for protecting criminal justice information (CJI): fingerprints, criminal history records, case files and the other data that flows through the FBI’s criminal justice systems. It is written by the FBI’s Criminal Justice Information Services (CJIS) Division and approved by the CJIS Advisory Policy Board. The current release is version 6.1, dated 25 June 2026.

It is not a law, and there is no certificate. It applies through agreements: any agency that connects to FBI CJIS systems, and any organisation that agency shares CJI with, must meet it.

Who does it apply to?

The policy describes a shared responsibility between the FBI, each state’s CJIS Systems Agency (CSA), state identification bureaus and the local agencies that connect through them. In practice it reaches:

• police, courts, prosecutors and corrections agencies (criminal justice agencies);
• public and private bodies that use criminal history for non-criminal purposes, such as fingerprint-based background checks for licensing or employment;
• private contractors, including cloud and software providers, which sign the CJIS Security Addendum through the agency that contracts with them.

For a technology company, that last point is the usual way in: selling a records system, a body-camera platform or a hosted service to a police department brings the whole service into scope.

How is it structured?

Earlier versions were organised around 13 CJIS policy areas. The modernised policy, rolled out from version 5.9.1 onwards, rebuilds most areas around the control families of NIST SP 800-53, such as access control, audit and accountability, identification and authentication, configuration management and supply chain risk management. Version 6.1 has 20 policy areas, ending with mobile devices, and lists each control with a priority.

What do the priorities mean?

Each modernised control is marked Existing, Priority 1, or Priority 2 to 4. Existing requirements and Priority 1 requirements are auditable and can lead to sanctions now. Priority 2 to 4 requirements are in a zero-cycle, from 1 October 2024 to 30 September 2027: they are reviewed in audits but not sanctioned until the cycle ends. That window is the time to close the gaps.

How is compliance checked?

The CSA in each state audits the agencies it serves, and the FBI CJIS Division audits each CSA. Audits run on a three-year cycle, which is why the policy ties some record-keeping periods to three years. Contractors are assessed through the agencies they serve, so expect your customers to ask for evidence, sign the Security Addendum and arrange fingerprint-based checks for staff with unescorted access to CJI.

Where does it fit with other frameworks?

Because the modernised policy follows NIST SP 800-53, work done for FedRAMP or GovRAMP maps well onto it, though neither replaces it. CJIS adds requirements of its own, such as personnel screening and its rules on advanced authentication and encryption. Always read the current policy from the FBI’s resource centre, because the FBI revises it regularly through the Advisory Policy Board.