About this Framework
The FBI CJIS Security Policy establishes minimum security requirements for all agencies and vendors accessing Criminal Justice Information (CJI) through FBI CJIS systems (NCIC, NICS, NGI biometrics). Version 5.9+ requirements cover advanced authentication, mobile device and cloud computing security, encryption standards (FIPS 140-2), incident response and personnel security. State and local agencies and any private entity providing cloud, managed services or software accessing CJI must comply through state agency CJIS system agreements with the FBI.
Key Control Domains
Policy & Implementation Area
Information Exchange Agreements
Security Awareness Training (annual)
Incident Response Planning
Auditing & Accountability
Identification & Authentication (Advanced Auth)
Configuration Management
Media Protection
Physical Protection
System & Communications Protection (Encryption)
Formal Compliance Audits
Personnel Security (background checks)
Mobile Device Security
Cloud Computing Compliance
Who Needs This?
- Federal, state and local law enforcement agencies
- Courts, prosecutors and public defenders offices
- Corrections, probation and parole departments
- Private cloud, managed service and software providers processing CJI
- Records management system (RMS) and dispatch system vendors
Compliance Benefits
- Legal requirement for CJI system access — non-compliance triggers immediate access termination
- Structured security framework protecting highly sensitive law enforcement data
- Required certification pathway for state and local law enforcement technology vendors
- Alignment with NIST SP 800-53 and FIPS 140-2 federal encryption standards
Official Reference
FBI CJIS Security Policy
https://le.fbi.gov/cjis-division
Assessment Details
Share this Assessment
Share this permanent link with your team, clients or auditors.
https://grcopilot.app/frameworks/cjis-security-policy-assessment