What is the CJIS Security Policy? Explained simply

The problem it is meant to solve

Police, courts and dispatchers look up criminal records, fingerprints and case files daily, much of it from FBI systems. In the wrong hands, that information can ruin a life or put an officer in danger.

The data passes through many hands: a state agency, a county IT department, a software company, a cloud host. The CJIS Security Policy (CJIS stands for Criminal Justice Information Services, the FBI division behind these systems) sets one minimum standard for protecting that information, wherever it goes.

What it actually asks you to do

It applies to every person and organization with access to criminal justice information, including private contractors.

Know exactly who can see the data, and screen them first, including a fingerprint-based criminal record check. Train everyone before they get access and every year after. Give each person their own login, with a second step beyond a password (called multi-factor authentication).

Encrypt the data when it travels and when it is stored outside a physically secured, access-controlled area. Keep logs of who did what. Make sure staff report a suspected security incident to your own incident response team within one hour of finding it, and pass it on to the state's CJIS officials and the FBI.

Write it all down, in policies and signed agreements, for an auditor.

What it is not

It is not a certificate. There is no official "CJIS certification" for a company or a product. Compliance is checked through government audits of the agencies that use the data and the contractors that serve them, not by a private certifier.

It is also not something you join on your own. You fall under it because an authorized agency needs you to handle its data and puts the policy into your contract.

What it looks like in a real company

Take a 40-person software company that sells records software to police departments and hosts it in the cloud. A city police department wants to buy it, and the department's contract says the vendor must follow the CJIS Security Policy.

The contract includes the FBI's Security Addendum, a standard set of security terms that only the FBI can change. Every employee who will be able to see the department's data signs the addendum's certification page. Each of those people is fingerprinted for a state and national criminal record check, and a designated official decides whether they may have access.

A felony conviction means access is denied, although that official can review a case in unusual circumstances.

It trains those staff, sets up the required logins, encryption and logging, and writes an incident response plan. It should then expect an audit at least every three years, usually by the state's CJIS Systems Agency, which may also inspect without notice.

Who deals with it day to day

Inside a police department, one person is usually the security contact with the state, often called the local agency security officer. When a department signs a contract with a vendor, it also names an agency coordinator to manage that relationship.

At a vendor, it usually falls to whoever runs security or IT, with human resources handling background checks and training records.

Why a business bothers

Because there is no other way in. A private contractor can only be given access to criminal justice information under an agreement that includes the policy. For software, hosting or IT services that touch this data, it is a condition of the contract.

An agency that fails to follow its agreement with the FBI can face sanctions, and the most serious is losing access to the FBI's systems.

Who writes it and who checks it

The FBI's CJIS Division publishes the policy. Changes go through its Advisory Policy Board, made up of criminal justice and national security agencies, and the Compact Council, which covers criminal records used for purposes like hiring, and are approved by the FBI Director.

Each state has one CJIS Systems Agency, the state body that connects local users to the FBI's systems. It audits the agencies and contractors in its state at least every three years. The FBI's own CJIS Audit Unit audits each state agency on the same three-year cycle.

The policy was recently rewritten to line up with the main federal catalog of security controls, published by the National Institute of Standards and Technology. The rewrite was finished in version 6.0 in December 2024, and version 6.1, dated June 25, 2026, is the current edition.

Requirements that existed before the rewrite, plus those marked Priority 1, have been subject to sanctions since October 1, 2024. The remaining newer requirements are in a grace period that ends September 30, 2027. Ask your state's CJIS Systems Agency which version it audits against today.

Where it leads next

If your work touches criminal records used for hiring or licensing rather than policing, the Compact Council's outsourcing rules may apply to you instead of, or alongside, the Security Addendum. Your contracting agency or your state's CJIS Systems Agency can tell you which applies.

If you sell to agencies in several states, you will deal with several state CJIS Systems Agencies. The policy lets one state's agency audit a contractor's facility and share the results with another, which can save repeat visits.