CJIS Compliance Explained: Requirements and Scope

The FBI, through its Criminal Justice Information Services (CJIS) Security Policy framework, sets the minimum security requirements for any system that touches Criminal Justice Information (CJI). It reaches law enforcement agencies and vendors whose software stores, processes, or transmits that data on their behalf.

CJIS compliance is established state by state through signed agreements and recurring audits, rather than through a federal certification body, accredited assessor pool, or marketplace listing a vendor can point to.

That state-by-state model reshapes how a SaaS compliance program must be built before the first contract closes. For SaaS providers, it affects data classification, contracting, control mapping, cloud architecture, and federal authorization strategy.

Key Takeaways

• CJI scope is broad. The policy protects biometric CJI data, identity history, biographic data, property data tied to personally identifiable information, and case/incident history, with stricter controls on Criminal History Record Information.
• Scope extends broadly. Courts and corrections agencies, authorized noncriminal justice agencies, CJIS cloud providers, information technology (IT) vendors, and even physical contractors near CJI transmission areas all carry obligations.
• The policy baseline is now Version 6.1. The Federal Bureau of Investigation released Version 6.1 in June 2026, succeeding the Version 6.0 reorganization that aligned controls with the National Institute of Standards and Technology (NIST) SP 800-53 Revision 5 catalog, the same catalog Federal Risk and Authorization Management Program (FedRAMP) baselines draw from.
• Architecture does not matter. On-premises, cloud, and hybrid deployments carry identical obligations because the requirements follow the data, not the infrastructure.

CJIS Compliance Protects Criminal Justice Information Across Any Environment

The CJIS Security Policy is the FBI's minimum-security framework for CJI: the data law enforcement and civil agencies draw from FBI systems such as the National Crime Information Center (NCIC) and the Next Generation Identification (NGI) biometric repository.

Policy v5.9.5 defines CJI to include:

• Biometric data, including fingerprints, iris scans, DNA profiles, and other biometric identifiers.
• Identity history.
• Biographic data.
• Property data when accompanied by personally identifiable information.
• Case/incident history.

That scope is broad, and Criminal History Record Information (CHRI) is a subset that carries additional access and dissemination controls because of its sensitivity.

The policy does not distinguish between hosting models: a county's on-premises records system, a cloud-hosted digital evidence platform, and a hybrid deployment all carry the same obligations, since coverage follows the data across whatever infrastructure holds it. That data-first orientation is also what determines who falls under the policy in the first place.

CJIS Compliance Applies to a Wider Group Than Sworn Law Enforcement

The policy covers anyone who accesses or supports criminal justice services and information. In practice, the covered groups include:

• Criminal justice agencies: police departments, sheriffs, prosecutors, courts, corrections, and probation at the federal, state, tribal, and local levels.
• Non-criminal justice agencies with authorized access: organizations granted CJI access for a specific purpose, such as school boards, banks, medical boards, and social services agencies running fingerprint-based background checks.
• Technology vendors: cloud service providers and IT vendors that store, process, transmit, or support CJI.
• Physical contractors and private contractors: personnel who need unescorted access to areas where unencrypted CJI is stored, processed, or transmitted. Private contractors performing criminal justice functions must meet the same training and screening standards as the agencies they serve and remain subject to the same audits.

Vendor and contractor obligations sit within a broader control structure, the same one the policy itself was recently reorganized around.

The CJIS Security Policy Maps Its Requirements to NIST 800-53

The NIST SP 800-53 Rev5 (September 2020) control catalog is the reference framework behind the CJIS Security Policy, and it is the same catalog the FedRAMP Rev5 baselines, approved May 30, 2023 and now set per Certification Class under the Consolidated Rules for 2026, are built from. That shared ancestry matters for any vendor planning to satisfy both.

Version 6.1 Is Now The Current Policy Baseline

The FBI's Security Policy Modernization Task Force released CJIS Security Policy Version 6.0 on December 27, 2024, reorganizing the policy from 13 policy areas into control families aligned with NIST 800-53 Revision 5 at the moderate baseline, and tagging every control with a priority tier from 1 to 4, including multi-factor authentication (MFA) for CJI access outside physically secure locations as a Priority 1 control.

The FBI published Version 6.1 on June 25, 2026, superseding 6.0 as the current baseline. As with any policy update, individual state CJIS Systems Agencies set their own timelines for when a new version governs audits, so vendors and agencies operating under 6.0 should confirm with their state contact whether 6.1 has been adopted for audit purposes in that jurisdiction before treating it as authoritative for compliance work. Version 5.9.5 remains the FBI audit standard through March 31, 2027.

Each Policy Area Maps to Specific NIST Controls

The FBI's CJIS Information Security Officer publishes a companion document mapping the policy to many mapped "best fit" NIST 800-53 controls. The common mappings fall into several control families:

• Access control requirements correspond to the AC family.
• Incident response requirements correspond to the IR family.
• Personnel security requirements correspond to the PS family.
• Encryption requirements correspond to SC controls such as SC-13.

The mapping document is explicit that the correspondence between CJIS controls and federal controls may not always be exact, and that agencies must still meet CJIS Security Policy requirements directly during audits. For cloud service providers (CSPs), Version 6.0 direction is similarly direct: a CSP must employ appropriately tailored security controls from the moderate baseline defined in the policy. That mapping gives cloud and SaaS providers a clear starting point, but it doesn't replace the separate contractual and audit obligations a provider must satisfy on its own, where the compliance work actually begins.

Cloud Providers Must Take Specific Steps to Support CJIS Compliance

A cloud or SaaS provider handling CJI has four core obligations:

1. Sign the CJIS Security Addendum. This uniform contract, approved by the U.S. Attorney General, authorizes access to CHRI, limits use to its intended purpose, and provides for sanctions. It is executed through applicable state or agency agreements; no central FBI-CJIS authorization body exists.
2. Implement the required technical controls. Encryption of CJI must use Federal Information Processing Standards (FIPS) 140-3 validated cryptography (FIPS 140-2 certificates moved to NIST's Historical List on September 22, 2026 and remain usable only for existing systems). FIPS 140-3 requirements draw on the same NIST 800-53 basis FedRAMP uses, along with MFA and documented access management.
3. Support personnel screening. State and national fingerprint-based background checks are required before anyone gets unescorted access to unencrypted CJI. Personnel without completed checks must be escorted by authorized staff at all times.
4. Undergo ongoing audits. State CJIS Systems Agencies audit contractors at least triennially, on the same terms as local user agencies, and the FBI may conduct unannounced inspections of contractor facilities.

Meeting these four obligations gets a provider into the compliance conversation, but it doesn't make that posture portable. A vendor's standing with one agency doesn't automatically carry over to the next.

A Cloud Platform's Compliance Does Not Automatically Cover Its Customers

CJIS compliance runs through state and agency processes, and the FBI offers no marketplace-style endorsement that a vendor can use across all states. Any vendor marketing itself as "CJIS certified" at the federal level is overstating what that decentralized model provides.

Shared Responsibility Still Applies

Agencies should not assume a FedRAMP-authorized or State Risk and Authorization Management Program (StateRAMP)-authorized product necessarily puts them in compliance with the security policy. Shared responsibility divides obligations across:

• Agencies: configuration, access control, data classification, and vendor oversight.
• Vendors: personnel policies and application-level controls, with training records to support review.

Colorado's Bureau of Investigation notes that the same vendor may run a compliant configuration for one client and a non-compliant one for another. That variability directly reflects how the policy treats infrastructure: it doesn't set architectural requirements; it sets data requirements, which is worth examining directly.

CJIS Is Architecture Independent

Section 2.2 states that it focuses on the data, services, and protection controls that apply regardless of implementation architecture. Appendix G.3 applies that principle directly to the cloud, noting that device and architecture independence permits using cloud computing without changing the underlying security requirements.

Two cloud-specific constraints still apply:

• Storage location: CJI may only be stored within Advisory Policy Board (APB) member country boundaries, regardless of which cloud provider or region a vendor uses.
• Encryption key control: anyone with access to the encryption keys can decrypt stored files and therefore has unescorted access to unencrypted CJI. Key management is the main architectural lever in CJIS system design.

CJIS shares technical lineage with federal cloud authorization and operates through different legal and audit mechanics. That distinction matters most when vendors try to use one authorization posture to support another market.

CJIS and FedRAMP Share a Foundation but Serve Different Missions

The FedRAMP authorization program governs cloud services that hold federal data through a centralized Rev5 authorization model. An accredited independent assessment service (formerly Third-Party Assessment Organization, 3PAO) validates the system, and the package is listed on the FedRAMP Marketplace. Each agency issues its own Authority to Operate (ATO).

That assessment structure matters for vendors that use an outside platform. Under the Consolidated Rules for 2026, FedRAMP control baselines are set per Certification Class: Class B requires at least 155 controls, Class C at least 322, and Class D at least 409.

CJIS runs the opposite way. Each state or territory has exactly one CJIS Systems Agency (CSA); compliance is established through signed addenda rather than a marketplace listing, and CSAs audit their agencies and vendors at least every 3 years. CJIS also adds CJIS-specific requirements for encryption and audit-log retention, with fingerprint-based screening handled through personnel controls.

The overlap helps vendors reuse evidence across federal, state, and local justice markets, though each reviewing authority still requires its own agreement and audit package. That reuse potential becomes most visible when a vendor is trying to sell into both markets at once.

SaaS Vendors Serving Justice and Public Safety Agencies Face a Compliance Layering Problem

For a SaaS vendor selling into justice and public safety, CJIS is rarely the whole compliance bill. Federal buyers require FedRAMP; state and local agencies expect CJIS obligations met in each jurisdiction where they operate. The layers stack:

• The federal authorization itself. The traditional path takes 12 to 36 months, and costs exceed $3.5 million once you add assessment and remediation, plus diverted engineering time.
• Per-state agreements. A growth-stage vendor faces a state-by-state motion with a fraction of the staff.
• Per-state personnel vetting and training, each on the local CSA's cadence and paperwork.
• Parallel audit calendars: triennial CSA audits in every covered state on top of FedRAMP continuous monitoring.

Every layer draws on the same NIST 800-53 catalog, yet each is evidenced, signed, and audited separately. What if the largest single layer, the federal authorization, were already built?

Meeting CJIS Requirements Starts With a Strong Federal Authorization Foundation

Because CJIS and FedRAMP both draw on the NIST 800-53 catalog, a vendor that builds its FedRAMP posture first arrives at every state CSA conversation with the evidence base those reviews rely on. The CJIS-specific remainder, state addenda plus fingerprinting and training cadence, becomes an incremental exercise instead of a second full compliance program.

Knox Systems is built for that sequence. Vendors deploy into Knox's pre-authorized FedRAMP boundary and inherit up to 80% of the NIST 800-53 control evidence CJIS reviews draw on. Knox supports FedRAMP Moderate, FedRAMP High, and DISA IL-4, with IL-5 targeted for December 2026, across AWS, Azure, and Google Cloud Platform.

To scope the fastest path to signed addenda and a federal authorization in hand, book a meeting with Knox.

FAQs about CJIS compliance

What penalties apply for CJIS non-compliance?

Sanctions include termination of CJIS service, and violations of the criminal history record regulations in Title 28 of the Code of Federal Regulations (CFR), Title 28 Part 20 regulations, carry civil penalties of up to $11,000 per violation. States may add sanctions, including criminal prosecution, for misuse.

What is a Management Control Agreement?

A Management Control Agreement (MCA) is required when a noncriminal justice government entity, such as city or county IT, supports criminal justice functions. It gives the criminal justice agency authority to set and enforce priorities, personnel standards, and policies for every system component that touches CJI.

How often is CJIS security awareness training required?

Role-based training is required within six months of assignment, with annual refreshers; contractors meet the same criteria as government personnel.

Does CJIS Require An Independent Assessor Like FedRAMP's Independent Assessment Service?

No. Unlike FedRAMP, which mandates an accredited independent assessment service to validate a system before authorization, CJIS compliance is audited directly by the state CJIS Systems Agency on a triennial cycle, with no equivalent accredited third-party assessor market. That's one structural difference that makes CJIS a state-audit model rather than a centralized authorization model like FedRAMP.

‍