Criminal Justice Information Services Division (CJIS)

WHAT IS CJIS COMPLIANCE?

Given the large volume and sensitive nature of the data CJIS collects, stores, and uses, security is critical to the integrity of CJIS information. As such, the CJIS Security Policy outlines the standards for handling crime-related data under the FBI’s jurisdiction. (Note: CJIS does not require agencies to use any specific technology product to comply with this policy, but does require documentation that the stipulations of the policy have been met.)

The CJIS Security Policy provides Criminal Justice Agencies (CJA) and Noncriminal Justice Agencies (NJCA) with a minimum set of security requirements for access to FBI CJIS systems and information for the protection and safeguarding of CJI. EasyITGuys manages the compliance with CJIS Security Policy requirements where applicable, such as providing states with fingerprint cards for EasyITGuys employees with access to CJI and signing CJIS security addendum agreements with our clients. 

To access the FBI’s CJIS Security Policy itself, please visit the FBI’s CJIS Security Policy Resource Center. Quick link: CJIS Security Policy v5-9

The policy is broken down into 13 areas:

1. Information Exchange Agreements: Requires a written agreement of security compliance between organizations exchanging CJIS information
   
2. Security Awareness Training: Requires regular security training for users with authorized access to CJIS
   
3. Incident Response: Requires agencies to establish an incident response plan
   
4. Auditing and Accountability: Requires logging for login attempts, system changes, file modifications, and similar events related to accessing CJIS data
   
5. Access Control: Requires the ability to control who can access CJIS data and the actions authorized users may perform
   
6. Identification and Authentication: Requires regular password updates, multi-factor authentication, and similar credential standards
   
7. Configuration Management: Requires a limit on who can perform configuration changes or upgrades to an organization’s information systems
   
8. Media Protection: Requires protection measures for CJIS data of all kinds at all times
   
9. Physical Protection: Requires specific protocols for how physical documents or devices are stored and managed
   
10. Systems and Communications Protection and Information Integrity: Requires internal security measures like encryption, endpoint protection, and network firewalls
    
11. Formal Audits: Requires organizations to allow the FBI and other agencies to conduct formal audits of systems and policies
    
12. Personnel Security: Requires security screening for all authorized users
    
13. Mobile Devices: Requires security controls and usage restrictions on authorized users’ mobile devices

Criminal Justice Information (CJI), Defined

CJI refers to all of the FBI’s CJIS-provided data necessary for law enforcement agencies to perform their mission and enforce the laws. CJI includes biometric, identity history, person, organization, property and case/incident history data. It also includes FBI’s CJIS-provided data necessary for civil agencies to perform their mission, including data used to make hiring decisions.

Protecting CJI

CJI must be protected until the information is either (a) released to the public through an authorized disclosure, such as in a crime report; or (b) purged or destroyed in accordance with applicable record retention rules. The CJIS Security Policy outlines a minimum set of security requirements that create security controls for managing and maintaining CJI data. There is no centralized body authorized to certify compliance with the CJIS Security Policy.

Many vendors incorrectly state that their solution is “CJIS certified.” There is no such thing as being “CJIS certified.”

The FBI has advised that CJAs and NCJAs are ultimately responsible for ensuring compliance, even when they engage with a third-party vendor to provide software or services relating to the agency’s CJI.

Conclusion

Data security is constantly evolving, and the requirements around CJIS compliance are no exception. EasyITGuys takes its data security and CJIS compliance obligations seriously, and continuously works to enhance and refine its data security programs. 

We are committed to partnering with our clients in this effort. The resources we have committed to that partnership are significant. We will continue leveraging internal resources to foster a culture of compliance across our company.