CJIS

The CJIS Security Policy is the FBI's rulebook for anyone who accesses or handles criminal justice information (CJI) from FBI CJIS systems: state and local law enforcement, courts, dispatch centers, and the contractors and cloud providers that serve them.

Version 6.0 (December 27, 2024) completed the restructuring of the policy around NIST SP 800-53 control families (priority tiers were added in version 5.9.5), and version 6.1, dated June 25, 2026, is the current edition.

Since October 1, 2024, requirements carried over from the earlier version and all Priority 1 requirements have been sanctionable; Priority 2 to 4 requirements are in a grace period that ends on September 30, 2027. Your state CJIS Systems Agency can confirm which version it audits against.

There is no certificate. Compliance is demonstrated through written agreements and documentation: the user agreement between the state CJIS Systems Agency and the FBI and the agreements that local agencies sign with their state agency, the FBI CJIS Security Addendum for every private contractor with CJI access (government IT departments sign a management control agreement instead), personnel screening and security awareness training records, an incident response plan and reporting procedure, and policies covering access control, audit logging, encryption, media protection and physical security.