CJIS Security Policy

No changes recorded yet — we are watching, and nothing has been published.

1. 2027-09-30 in 325 days Zero-cycle ends for Priority 2, 3 and 4 modernized requirements (began 1 October 2024)
2. 2026-06-25 CJIS Security Policy v6.1 published
3. 2024-12-27 CJIS Security Policy v6.0 approved
4. 2024-10-01 Pre-modernization (v5.9) requirements and Priority 1 requirements become the sanctionable set

1. 2026-06-25
   CJIS Security Policy v6.1 RevisionCurrent

   Incorporated calendar year 2025 changes approved by the APB and Compact Council. source

   More

   • Three Spring 2025 APB topics addressed omissions, corrections and additions to the modernized Policy (Parts 1 to 3).
   • Administrative changes approved by the Security and Access Subcommittee on 14 November 2025.
2. 2024-12-27
   CJIS Security Policy v6.0 Major version

   Completed the Policy modernization by the Security Policy Modernization Task Force. source

Applies to every agency, contractor and private entity with access to criminal justice information or the systems that handle it.

Scope

The Policy applies to all entities with access to, or that operate systems used to process, store or transmit, CJI, from creation through dissemination or destruction. source

Individuals

It applies to every individual (contractor, private entity, noncriminal justice agency representative or criminal justice employee) with access to, or supporting, these services. source

Private contractors

Private contractors performing criminal justice functions get access to CJI under the CJIS Security Addendum, which limits use and provides for sanctions. source

Minimum standard

Agencies may use the Policy as their sole security policy or add stricter local policies, but the Policy is always the minimum standard. source

Phased priorities

Modernized requirements are marked Existing or Priority 1 to 4; Priority 2 to 4 requirements are in a zero-cycle from 1 October 2024 to 30 September 2027. source

Noncriminal justice use

Entities exchanging criminal history record information across states for noncriminal justice purposes are also governed by Compact Council rules. source

Compliance is checked through triennial audits by the CJIS Systems Agencies and by the FBI CJIS Division.

CSA audits

Each CSA, Interface Agency or State Identification Bureau audits every agency with access through its systems once every three years. source

FBI audits

Each authorized CSA, Interface Agency or State Identification Bureau is itself audited triennially by the CJIS Division. source

Service providers

External service providers with access to the system are audited at least triennially and may face unannounced security inspections. source

Requirements companion

The FBI publishes a Requirements Companion Document (PDF and Excel) alongside the Policy on its resource center. source

Non-compliance with sanctionable requirements can lead to administrative sanctions, loss of service and criminal penalties.

Sanctionable set

From 1 October 2024 the sanctionable requirements are those existing before modernization (v5.9) and those marked Priority 1. source

Misuse of records

Improper access, use or dissemination of criminal history and NCIC Non-Restricted Files information may bring administrative sanctions, termination of services and state and federal criminal penalties. source

Personnel sanctions

Agencies must run a formal sanctions process for individuals who fail to comply with security policies and procedures (control PS-8, marked Priority 4). source

1. Standard CJIS Security Policy v6.1 (25 June 2026)
2. Guidance CJIS Security Policy Resource Center
3. Template CJIS Security Policy Requirements Companion Document

1. NIST SP 800-53

   NIST SP 800-53 is a general federal control catalogue; the CJIS Security Policy sets the minimum controls for criminal justice information.

2. GovRAMP

   GovRAMP authorises cloud products for state and local government; the CJIS Security Policy is the FBI's requirement for anyone handling criminal justice information.

3. FedRAMP

   FedRAMP certifies cloud services for federal agencies; the CJIS Security Policy governs access to FBI CJIS systems and criminal justice information.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to CJIS Security Policy (RSS)