What is CJIS compliance?

CJIS information is sensitive, sometimes confidential information that is housed inside of law enforcement networks.  Whether it's criminal histories, criminal intelligence, investigative case files, these are all things that must be protected.  This is why the CJIS policy was created by the federal government.

The FBI CJIS Security Policy is the regulatory policy for CJIS compliance.  Each year or so it is updated to ensure the highest information security standards.  It covers a multitude of topics such as;  CJIS fingerprinting, audits, data security, password requirements, encryption,, and CJIS Level 4 testing.

CJIS Online is a web portal that agencies can use to set up and administer CJIS certifications for department members and vendor employees.   This is the CJIS portal you can issue CJIS Level 4 certifications.  CJIS Level 4 is for information system professionals that have logical un-escorted access to CJIS Information Systems.  This would be for your IT staff, or vendors that have the same access to your network.

CJIS security awareness training (or cybersecurity awareness training) is CRITICAL in making sure your CJIS systems and network are protected.  Since these systems store critical and sensitive data, you must ensure your agency personnel understand the cyber risk and attack methods being used to compromise CJIS systems.

Besides assigning staff members and vendors CJIS Level 4 certifications, there is no such thing as CJIS certified.  Many companies seek out a overall CJIS certification for their software or products, however, this does not exist.  Each product has to meet the CJIS standards at which time you must be approved through each states regulatory agency (such as FDLE- Florida Department of Law Enforcement).  Your system then will be able to operate inside the CJIS network.

When speaking of CJIS compliance this is associated with agencies policies, procedures, and meeting the FBI CJIS Security Policy.  Once every three years, law enforcement agencies around the county have to go through a CJIS audit.  This audit measures the agencies compliance with the CJIS policy and points out any areas of non-compliance.  These audits are challenging, and making sure you gain CJIS compliance after you fix your audit issues is crucial.