CJIS Security Policy Support For Criminal Justice Information

The FBI Criminal Justice Information Services (CJIS) Security Policy establishes the security requirements for organizations that access, process, store, or transmit Criminal Justice Information (CJI), including Criminal History Record Information (CHRI).

The policy applies to Criminal Justice Agencies (CJAs) and authorized Non-Criminal Justice Agencies (NCJAs) that handle CJI. It defines requirements for identity management, encryption, auditing, personnel security, incident response, and system protection.

TeamSync helps organizations manage regulated records, security controls, audit evidence, and governance workflows in environments that align with CJIS Security Policy requirements.

What CJIS Security Policy v5.9+ Requires

The policy is organised into 13 policy areas (Sections 5.1–5.13), covering: information exchange agreements, security awareness training, incident response, auditing and accountability, access control, identification and authentication, configuration management, media protection, physical protection, system and communications protection, formal audits, personnel security, and mobile devices.

Notable specific controls include:

• Advanced Authentication (AA) for indirect access, typically enforced through MFA

• Automatic session lock after 30 minutes of inactivity

• FIPS 140-2/3 validated encryption

• A minimum of 365 days of audit-event retention

• Personnel screening, including fingerprint-based background investigations for anyone touching CJI

How TeamSync Supports CJIS Compliance

1. Control implementation across all 13 policy areas
Controls are implemented section by section, with a CJIS-CSP mapping pack provided to show exactly how each requirement is met.

2. Advanced Authentication enforced
MFA is enforced for CJI access, using authentication factors that meet CJIS specifications.

3. FIPS-validated encryption
Cryptographic modules validated under FIPS 140-2/3 protect data both in transit and at rest.

4. Audit retention and integrity beyond the minimum
Audit data is retained well beyond the required 365-day minimum, with a cryptographic audit ledger anchoring its integrity.

5. Personnel screening attestations
Support personnel are US persons who have passed fingerprint-based background investigations, with attestations provided.

6. A separate, stricter compartment for CJI and CHRI
CHRI is kept in a compartmentalised space with stricter access controls, enforcing both "need to know" and "right to know" principles.

7. Compatible with Brady/Giglio and FOIA workflows
eDiscovery supports defence-discovery production and public-records release requests while keeping CJI controls intact.

What Customers Get

Related Rules And Frameworks

• 28 CFR Part 23 (criminal intelligence systems): An adjacent regime

• CJIS Security Awareness Training: Provided to personnel who handle CJI

• State CJIS systems (CLETS / NCIC / Nlets): Relevant interface considerations

Who This Page Is For

• Law-Enforcement Agency CIO

• Federal Agency CIO

• FOIA Officer