Map CJIS v6.0 Controls to Audit Ready Evidence for U.S. IT Teams

The FBI CJIS Security Policy v6.0 is the federal baseline every U.S. agency and contractor touching criminal justice information must follow. If your organization creates, stores, transmits, or even holds administrative access to CJI, you’re in scope. Start now: define your CJI footprint, map it against the v6.0 control families, turn on multi-factor authentication everywhere it belongs, and begin collecting audit evidence continuously instead of scrambling before the next review.

TL;DR:

• Mapping all data flows and system boundaries is essential to accurately scope CJIS controls, including cloud backups and third-party vendor access.
• Implementing multi-factor authentication at the identity layer across all applications touching CJI is mandatory and should extend beyond VPN gateways.
• Continuous evidence collection of logs, training records, and configuration snapshots is crucial to streamline audits and avoid retroactive fix attempts.
• Agencies must ensure personnel screening, ongoing training, formal agreements, and timely access revocation to mitigate personnel-related compliance risks.
• Vendors and cloud providers require documented CJIS agreements and verified controls, as compliance responsibilities remain with the agency regardless of third-party support.

Table of Contents

• What Does CJIS Scope Actually Cover?
• The 13 CJIS Control Families and What They Require
• How Does MFA Fit Into CJIS Requirements?
• What Personnel Controls and Training Does CJIS Require?
• How Do Agencies Prepare for the CJIS Audit Cycle?
• Are Cloud Providers and Vendors In Scope for CJIS?
• What Incident, Logging, and Device Rules Does CJIS Set?
• How Do You Build a CJIS Readiness Roadmap?
• Common Pitfalls and Pragmatic Tips
• Get Help Closing the CJIS Compliance Gap
• Primary Policy and Guidance Documents
• Sources
• FAQ

What Does CJIS Scope Actually Cover?

Most compliance gaps don’t happen because a policy team missed a control. They happen because nobody drew the scope boundary correctly in the first place. Criminal Justice Information, or CJI, includes any data derived from criminal history records, biometric identifiers, case files, or III/NCIC responses, and it stays in scope through its entire lifecycle: creation, transmission, storage, and destruction.

That lifecycle matters more than most IT teams assume. A records clerk who exports a case file into a spreadsheet has created a new instance of CJI. A backup job that snapshots a database server has replicated it. A vendor technician who remotely accesses a workstation to troubleshoot printing has touched it, even without opening a single file. CJIS follows the data, not the department.

Several roles and agreements structure who’s accountable for what:

• CSA (CJIS Systems Agency): the state or federal agency responsible for CJIS compliance across its jurisdiction.
• CJA (Criminal Justice Agency) and NCJA (Noncriminal Justice Agency): entities authorized to access CJI, either directly for law enforcement purposes or under a support agreement.
• TAC (Terminal Agency Coordinator): manages day-to-day user access and system administration at the local level.
• LASO (Local Agency Security Officer): the point person for security incidents, audits, and policy enforcement within an agency.
• ISO (Information Security Officer): typically at the CSA level, coordinating security programs across affiliated agencies.

The most common scoping mistake is treating “who queries NCIC” as the whole picture. Indirect access counts too. Database administrators, help desk staff who reset passwords for CJI systems, backup operators, and third-party IT vendors with remote access all fall inside the boundary, even if they never see a single record on screen.

To scope correctly, trace your actual data flows rather than your org chart. Map every system that stores or processes CJI, every account with administrative rights to those systems, and every vendor connection that touches them. If a system backs up to the cloud, that cloud environment is in scope. If a managed service provider has a remote monitoring agent installed on a CJI-adjacent server, that provider is in scope too.

The 13 CJIS Control Families and What They Require

CJIS Security Policy v6.0 organizes requirements into control families that will look familiar to anyone who has worked with federal security frameworks. Not every family applies with equal weight to every system. A standalone records terminal with no network connection faces different exposure than a cloud-hosted case management platform, so tailor your controls to your actual architecture rather than treating the list as a uniform checklist.

Here’s what each family typically demands, along with the evidence auditors expect to see:

• Access control: role-based permissions, unique user IDs, and session timeout settings. Evidence: access control lists, provisioning tickets, quarterly access reviews.
• Awareness and training: documented security training before system access and on a recurring cycle. Evidence: training completion logs and curriculum records.
• Audit and accountability: logging of system events, especially authentication and data access. Evidence: log retention policies and sample log exports.
• Configuration management: baseline configurations and change control. Evidence: configuration snapshots, patch management records.
• Identification and authentication: unique credentials and multi-factor authentication. Evidence: identity provider configuration, MFA enrollment reports.
• Incident response: a documented plan and reporting chain. Evidence: incident response plan, tabletop exercise records.
• Media protection: handling and destruction of physical and digital media containing CJI. Evidence: media sanitization logs, destruction certificates.
• Physical and environmental protection: controlled facility access where CJI is stored or processed. Evidence: badge access logs, visitor logs.
• System and communications protection: encryption in transit and at rest. Evidence: encryption configuration documentation, network diagrams.
• System and services acquisition: security requirements built into procurement and vendor contracts. Evidence: contract language, security addenda.
• System and information integrity: malware protection and vulnerability management. Evidence: patch compliance reports, scan results.
• Personnel security: background screening before granting access. Evidence: screening records and periodic re-screening documentation.
• Risk assessment: periodic evaluation of threats and vulnerabilities. Evidence: risk assessment reports and remediation tracking.

Auditors don’t want a narrative describing your intentions. They want artifacts: dated, specific, and tied to a named system. A policy document that says “we require MFA” carries little weight next to a configuration export showing MFA actually enforced on every account with CJI access.

How Does MFA Fit Into CJIS Requirements?

Multi-factor authentication is not optional guidance buried in an appendix. It’s a hard requirement under CJIS Security Policy v6.0, and NIST IR 8523 exists specifically to help agencies implement it correctly rather than just checking a box.

NIST IR 8523 recommends authentication assurance levels of AAL2 or higher for most CJI access, with AAL3 and phishing-resistant methods (like hardware security keys or certificate-based authentication) recommended for privileged accounts and remote administrative access. SMS-based one-time codes technically satisfy a minimum bar in some configurations, but they’re increasingly viewed as the weak option, not the standard.

The mistake we see most often at Total Cyber is architectural, not procedural. An agency enables MFA on its VPN gateway and considers the job done. But once a user authenticates through the VPN, they often land on a flat network with unrestricted access to CJI applications, file shares, and databases, all protected by nothing more than a username and password at that point. VPN-only MFA protects the front door while leaving every interior door unlocked.

A stronger pattern applies MFA at the identity layer through single sign-on, so every application, not just the network perimeter, requires a verified second factor. This also simplifies deprovisioning: disable one identity and access to everything tied to it disappears immediately, instead of hunting through a dozen local accounts.

Build toward this checklist:

• Centralize identity through a single provider (Azure AD/Entra ID, Okta, or similar) rather than managing separate credentials per system.
• Eliminate shared or generic accounts; every user gets a unique, traceable identity.
• Apply least-privilege access so users only reach the CJI they need for their role.
• Extend SSO and MFA to every application touching CJI, not just the network edge.
• Lock down service accounts with credential rotation and monitoring, since these are frequently exempted from MFA and become the easiest target.

Pro Tip: Audit your service accounts and API keys before your next assessment. Human MFA gets attention because it’s visible; machine identities quietly accumulate standing access that nobody remembers to review.

What Personnel Controls and Training Does CJIS Require?

Technology controls fail quietly when the people using the systems aren’t screened, trained, or bound by the right agreements. CJIS treats personnel security as its own control family for good reason: most serious data exposures trace back to a person, not a firewall rule.

Screening requirements typically call for a fingerprint-based criminal history check before granting unescorted access to CJI, with re-screening at defined intervals, often every five years, depending on your CSA’s specific implementation. Training follows its own cadence: security awareness training is expected before or within a short window of system access, generally within six months, with refreshers required biennially after that. Agencies running NCIC-connected systems face additional certification cycles tied specifically to NCIC use, layered on top of general CJIS awareness training.

CJIS materials consistently flag training documentation as an audit focal point, alongside screening records and system-access reviews at defined intervals. Skipping the paperwork trail is one of the fastest ways to generate a finding even when your actual training program is solid.

Several agreements need signatures before access is granted, not after:

• Criminal Justice User Agreement: signed by individual users acknowledging their responsibilities and the consequences of misuse.
• Management Control Agreement: required when a noncriminal justice agency provides IT support to a criminal justice agency, clarifying who controls the systems.
• Security Addendum: attached to vendor and contractor agreements, extending CJIS obligations to private companies with system access.

Operationally, your personnel controls need to handle the full employment lifecycle. Terminated employees need same-day access revocation, not end-of-week cleanup. Transferred employees need access re-evaluated against their new role, not carried forward from their old one. Policy violations need a documented sanctions process, so “we talked to them” isn’t your only response when someone mishandles CJI.

How Do Agencies Prepare for the CJIS Audit Cycle?

The DOJ CJIN audit process runs on a triennial cycle, meaning most agencies face a formal review roughly every three years, though your specific CSA may layer additional interim checks on top of the federal schedule.

The process typically unfolds in phases. First, an online questionnaire captures your current control posture across the policy areas. Second, your CSA or DOJ auditors review supporting evidence against your questionnaire answers. Third, for higher-risk findings or larger systems, an onsite verification may follow. The output is a findings report paired with a corrective-action plan, and agencies get a defined window to close identified gaps before re-verification.

Auditors consistently ask for the same categories of evidence:

1. Access and authentication logs showing who accessed what CJI system and when, with MFA enforcement visible in the configuration.
2. Training completion records tied to specific individuals and dates, not a generic “training program exists” statement.
3. Personnel screening documentation proving background checks happened before access was granted, with re-screening dates tracked.
4. Signed agreements including user agreements, management control agreements, and security addenda for every vendor with system access.
5. Configuration baselines demonstrating encryption, patching, and access control settings match your documented policy.
6. Incident response records, including any reportable incidents and how they were handled.

Agencies that treat evidence collection as a scramble before the audit window consistently fare worse than those running continuous collection. Rebuilding two years of access logs from a system that only retains 90 days of history isn’t a paperwork problem; it’s a gap you can’t retroactively fill. Continuous evidence management, meaning logs, screening records, and configuration snapshots captured and indexed as they happen rather than reconstructed later, is what separates a smooth audit from a stressful one.

The most common findings we see repeat across agencies: missing or expired security addenda for vendors, training records that don’t cover every individual with access, and logging configurations that technically exist but don’t retain data long enough to satisfy the review window. Every one of these is fixable in advance and painful to fix retroactively.

Are Cloud Providers and Vendors In Scope for CJIS?

Yes, and this is where a lot of agencies get exposed without realizing it. Moving CJI into a cloud environment or handing IT support to a managed service provider doesn’t transfer your compliance obligation. The CJIS Security Policy resource center makes clear that the CJA retains management responsibility even when a vendor handles the technical work.

That means every cloud provider or vendor touching CJI needs a documented agreement defining exactly what they can access and what they’re responsible for securing. At minimum, agencies should have in place: a signed security addendum extending CJIS obligations to the vendor’s own personnel, an information exchange agreement specifying what data flows where, and formal CSA acceptance of the arrangement before go-live.

Paper agreements alone aren’t enough. You need to verify, not just trust, that a vendor’s controls actually match what they’ve promised in writing:

• Confirm encryption is applied both in transit and at rest, not just claimed in a sales deck.
• Review the vendor’s logging practices and confirm you retain audit access to relevant logs, not just summary reports.
• Verify personnel screening for any vendor staff with access to your CJI, matching the same standard you’d apply internally.
• Confirm the vendor will support your CSA’s audit process directly, including providing evidence on request, not routing every question through a support ticket queue.

A SOC 2 report or ISO 27001 certification looks reassuring on a vendor’s website, but neither substitutes for CJIS-specific evidence. Those frameworks weren’t built around personnel screening cycles, CSA acceptance, or the specific control mapping CJIS auditors expect. Treat them as supporting context, not proof of compliance.

Pro Tip: Ask every vendor bidding on a CJI-adjacent contract to name their assigned security contact and describe their last CJIS-specific audit experience. A vague answer here tells you more than their marketing materials ever will.

What Incident, Logging, and Device Rules Does CJIS Set?

When something goes wrong, CJIS expects a defined reporting chain, not an ad hoc scramble. Significant incidents typically flow from the local agency to the CSA, then to affiliated agencies as needed, with the FBI CJIS Information Security Officer notified for incidents meeting a severity threshold, particularly anything involving unauthorized disclosure of CJI.

Logging exists to make that chain possible. Without detailed, retained logs, you can’t reconstruct what happened during an incident, and you can’t prove to an auditor that your access controls were actually enforced rather than just documented. Logs need to capture authentication events, data access, and administrative actions, retained long enough to satisfy both your incident response needs and your audit review window.

Media protection covers the physical and digital handling of anything containing CJI:

• Removable media (USB drives, external hard drives, backup tapes) needs encryption and a documented chain of custody.
• Destruction of media containing CJI requires a defined sanitization method, not just deletion, with a record of when and how it happened.
• Printed CJI needs the same handling discipline as digital records, including secure disposal.

Mobile devices raise their own set of concerns. Agencies issuing phones or tablets that access CJI need mobile device management (MDM) in place to enforce encryption, remote wipe capability, and device certificates that verify the device before it connects. Photograph and screen-capture restrictions on CJI-displaying screens matter too. A records clerk’s phone camera is a data exfiltration path that no firewall will catch.

How Do You Build a CJIS Readiness Roadmap?

A workable roadmap moves in a specific order, and skipping steps to get to “MFA enabled” faster usually creates rework later. Start by identifying every system, user, and data flow touching CJI. Map each in-scope system against the applicable v6.0 control families. Establish your agreements and name your security roles (TAC, LASO, ISO) before you touch a single technical control. Then implement identity and MFA, encryption, logging, and endpoint protections. Collect evidence continuously from day one rather than treating it as a pre-audit task. Run a gap assessment against your evidence. Remediate what’s missing. Prepare formally for your CSA’s audit cycle.

A control-to-evidence matrix keeps this manageable instead of overwhelming. The columns matter more than the format:

Prioritize remediation in a specific order: MFA and identity controls first, since they close the widest attack surface fastest. Logging and audit trails second, since you can’t prove anything without them. Personnel controls and agreements third, since they take longer to execute (screening and training have built-in lead times) but carry heavy audit weight.

This is where managed compliance support tends to pay for itself. Mapping thirteen control families against your actual architecture, standing up managed logging that retains what auditors expect, and running recurring awareness training on a defensible schedule are exactly the kind of ongoing work that’s easy to plan and hard to sustain without dedicated resources.

Common Pitfalls and Pragmatic Tips

The gap between agencies that pass audits smoothly and those that scramble almost never comes down to technical sophistication. It comes down to scope discipline and evidence habits. The most frequent misstep is a scope blind spot: an agency secures its primary records system tightly while a vendor’s remote access tool or a backup process quietly falls outside the review entirely.

The second recurring mistake is starting evidence collection the month before an audit instead of the day a control goes live. By then, ninety days of log retention has already erased the six months an auditor wants to see.

The third: treating a vendor’s SOC 2 badge as proof of anything CJIS-specific. It isn’t, and auditors know it.

Quick wins that pay off immediately: enforce MFA at the identity layer this week, not next quarter. Inventory every privileged account, including service accounts, since these get forgotten fastest. Name your ISO, LASO, and TAC formally, with documentation, even if one person wears multiple hats. And talk to your CSA early about compensating controls if you have a legitimate gap. Auditors respond far better to a documented plan in progress than to a surprise finding with no context.

— Alden

Get Help Closing the CJIS Compliance Gap

Some providers offer a more integrated approach to compliance than piecing together solutions across multiple vendors. Security can be embedded in managed services by experienced cybersecurity professionals.

Mapping CJIS control families against your actual systems, standing up MFA that covers more than your VPN, running managed cybersecurity services that retain the logs auditors ask for, and delivering cybersecurity training on a defensible cadence are exactly the kind of work Total Cyber handles daily for organizations that can’t afford to guess at compliance. Policy Compliance consulting, vulnerability analysis, and vCSO leadership round out a readiness program built for agencies and their vendors alike, all backed by transparent, all-inclusive pricing and U.S.-based support.

If your organization needs a clear picture of where CJIS gaps exist before your next audit cycle, request a discovery call and get a straight answer on what needs attention first.

Primary Policy and Guidance Documents

Every claim in this article traces back to a document you can read yourself. Bookmark these before your next control mapping session:

• CJIS Security Policy v6.0, the current federal baseline covering all thirteen control families.
• The CJIS Security Policy resource center, including appendices on vendor and cloud responsibilities.
• NIST IR 8523, the implementation guidance for CJIS-required multi-factor authentication.
• NIST SP 800-53 Rev. 5, a controls catalog useful for mapping CJIS objectives to broader security frameworks.
• DOJ CJIN audit policy and questionnaire materials, describing the triennial audit cycle and evidence expectations.

Sources

• Criminal Justice Information Services (CJIS) Security Policy
• Multi-Factor Authentication for Criminal Justice Information Systems: Implementation Considerations for Protecting Criminal Justice Information
• DOJ CJIN Audit Policy / Audit Questionnaire (sample materials)
• NIST SP 800-53 Rev. 5

FAQ

What Are the Compliance Requirements for CJIS?

CJIS compliance requirements center on the thirteen control families in CJIS Security Policy v6.0, covering access control, identification and authentication, audit logging, personnel screening, incident response, and media protection. Every organization with access to or administrative responsibility for criminal justice information must map these controls to its systems and maintain evidence for the DOJ triennial audit cycle.

What Are the CJIS Compliance Requirements for 2026?

The requirements in 2026 remain anchored to CJIS Security Policy v6.0, published in December 2024 and still the current federal baseline. Agencies should expect continued emphasis on mandatory multi-factor authentication, documented vendor agreements for cloud and managed services, and continuous evidence collection ahead of the triennial audit cycle.

What Are the MDM Requirements for CJIS Compliance?

Mobile devices accessing CJI need mobile device management enforcing encryption, remote wipe capability, and device certificates that verify the device before it connects to CJI systems. Policies should also restrict photograph and screen-capture functions on devices displaying criminal justice information, since a device camera can bypass every other technical control in place.

How Often Is CJIS Training Required?

Initial security awareness training is generally expected before or within six months of gaining system access, with refresher training required on a biennial cycle after that. Personnel working with NCIC-connected systems often face additional certification cycles specific to NCIC use, layered on top of general CJIS awareness training.

Can Total Cyber Help With CJIS Compliance Consulting?

Yes. Total Cyber offers Policy Compliance consulting alongside managed cybersecurity services designed to help map CJIS control families to your specific systems and build the evidence trail auditors expect. Current pricing for these engagements is available directly through Total Cyber rather than published on a rate card, since scope varies by agency size and system complexity.

Recommended

• Cybersecurity Maturity Model Certification (CMMC)
• Amid CMMC Pause: Government Contractor Cybersecurity for U.S. SMBs
• Cyber Awareness Training
• Penetration Testing