The two top-ranked CJIS compliance checklists on Google still list 13 policy areas, and the FBI finished replacing that structure in December 2024. Count the sections on the checklist your county works from. If you land on 13, you are preparing for an audit against a policy that has since been rebuilt from the ground up.
A CJIS compliance checklist is the working list of controls your agency must meet under the FBI CJIS Security Policy, with an owner and a piece of evidence attached to each one. Under the current version, 6.1, that means 20 policy areas rather than the 13 that many published checklists still describe.
Why Do Most CJIS Checklists Still List 13 Policy Areas?
Because they were written for version 5.9 of the CJIS Security Policy, published in June 2020, and copied forward since. Version 6.0 replaced that structure in December 2024 with 20 policy areas built on NIST SP 800-53 Rev 5. A checklist still counting 13 areas misses whole control families an auditor will ask about.
The 13-policy-area structure comes from version 5.9, published June 1, 2020. Between 2022 and 2024, the FBI’s Security Policy Modernization Task Force rebuilt the policy on top of the NIST SP 800-53 Rev 5 control catalog.
By version 5.9.5 in July 2024 the count was already 19. Version 6.0, published December 27, 2024, finished the job at 20. The current release is version 6.1, dated June 25, 2026, which keeps the 6.0 structure and folds in the corrections the CJIS Advisory Policy Board (APB) approved during 2025. It runs 473 pages, and unlike the older releases, anyone can download it from the FBI’s CJIS Security Policy Resource Center.
A checklist built on 13 areas has no row for Contingency Planning, Maintenance, Risk Assessment or Supply Chain Risk Management, because those families did not exist as separate areas in the old structure. Those families cover recovery plans, maintenance records, risk reviews and vendor vetting, the paperwork a small IT team rarely gets time to write.
A checklist missing four control families only covers the things you already knew about.
Beat the auditor to it
What Are the 20 CJIS Policy Areas?
Version 6.1 organizes CJIS requirements into 20 policy areas. Area 1 covers Information Exchange Agreements and area 20 covers Mobile Devices. Areas 2 through 19 are 18 of the 20 NIST SP 800-53 Rev 5 control families, used under their NIST names and control numbers, from Access Control through Supply Chain Risk Management.
This is the checklist you want: 20 rows your auditor will recognize. The structural change is good news if you have ever touched a NIST framework. The control families, the identifiers and the language all match, so a program already mapped to 800-53 carries most of the way across. What CJIS adds is prescribed values where NIST leaves them open. NIST says to set a limit on failed logon attempts. CJIS sets it at five attempts in a fifteen-minute window, released by an administrator. Checking those fixed values is much of the CJIS-specific work.
Four of the newer areas are planning and process work rather than technology. Contingency Planning, Risk Assessment, Planning and Supply Chain Risk Management ask you to document decisions, not to buy anything. For a two-person IT shop, nothing on that list needs procurement, and nobody else is going to write it.
Contingency Planning is where that paperwork pays off. According to Sophos’s State of Ransomware in State and Local Government 2024, 99% of state and local government organizations hit by ransomware said attackers tried to compromise their backups, and just over half of those attempts succeeded. A tested CP-2 recovery plan is what stands between that statistic and your records system.
The 20 CJIS Policy Areas: Who Owns What
| # | Policy area | NIST family | Who typically owns it |
|---|---|---|---|
| 1 | Information Exchange Agreements | None | Agency: signs and renews agreements with the state CSA |
| 2 | Access Control | AC | Partner configures, agency approves who gets access |
| 3 | Awareness and Training | AT | Agency: delivers training and keeps the records |
| 4 | Audit and Accountability | AU | Partner collects logs in a SIEM and keeps them one year (AU-11); someone reviews them weekly (AU-6) |
| 5 | Assessment, Authorization and Monitoring | CA | Partner runs continuous monitoring, agency signs off |
| 6 | Configuration Management | CM | Partner: baselines, change control, component inventory |
| 7 | Contingency Planning | CP | Shared: partner builds and tests recovery, agency approves the plan |
| 8 | Identification and Authentication | IA | Partner enforces MFA and password rules, agency sets exceptions |
| 9 | Incident Response | IR | Shared: partner detects and contains, agency reports through the LASO |
| 10 | Maintenance | MA | Partner: scheduled maintenance and records |
| 11 | Media Protection | MP | Shared: agency handles physical media, partner handles sanitization standards |
| 12 | Physical and Environmental Protection | PE | Agency: badge access, cameras, visitor logs, server room |
| 13 | Planning | PL | Agency: approves the security plan and rules of behavior |
| 14 | Personnel Security | PS | Agency: fingerprint checks, onboarding and offboarding timing |
| 15 | Risk Assessment | RA | Shared: partner scans and reports, agency accepts or remediates risk |
| 16 | System and Services Acquisition | SA | Agency: procurement decisions and the CJIS Security Addendum |
| 17 | System and Communications Protection | SC | Partner: encryption, boundary protection, key management |
| 18 | System and Information Integrity | SI | Partner: patching and flaw remediation (SI-2), malware protection |
| 19 | Supply Chain Risk Management | SR | Shared: agency owns vendor contracts, partner assesses technical risk |
| 20 | Mobile Devices | None | Partner runs mobile device management (MDM), agency sets and enforces the use policy |
Which CJIS Requirements Are Enforceable Right Now?
Priority 1 controls have been sanctionable since October 1, 2024, along with every requirement carried over from version 5.9. New Priority 2, 3 and 4 requirements sit in a zero cycle and become sanctionable when it closes on September 30, 2027. So about two dozen high-risk controls are live today, and the rest have a deadline.
Start your checklist there. The Priority 1 set includes multi-factor authentication for both privileged and non-privileged accounts under IA-2(1) and IA-2(2), account management (AC-2), least privilege (AC-6), remote access (AC-17) and continuous monitoring (CA-7). It is also where audits are catching agencies. At its October 2025 board meeting, the Michigan State Police listed MFA among its top audit findings, alongside missing policies, BYOD procedures, training records, security agreements, event logging and fingerprinting.
Priority 1 CJIS Controls to Close First
| Control | What it requires | Sanctionable since |
|---|---|---|
| IA-2(1), IA-2(2) | MFA for privileged and non-privileged accounts | October 1, 2024 |
| AC-2 | Account management, including prompt deprovisioning | October 1, 2024 |
| AC-6 | Least privilege | October 1, 2024 |
| AC-17 | Controlled, documented remote access | October 1, 2024 |
| CA-7 | Continuous monitoring strategy | December 27, 2024 |
| RA-5 | Vulnerability scanning at least monthly (v6.1) | Sanctionable now |
MFA is also harder in a sheriff’s office than in city hall. According to NIST IR 8523, published in September 2025, agencies commonly reach criminal justice information through computer-aided dispatch and records management systems that talk to a state-level message switch, so an MFA rollout usually has to integrate with one or both. Plan the CAD and RMS vendors into the project from day one, not after the identity provider is configured.
Encryption moved too, and the date has already passed. According to NIST’s Cryptographic Module Validation Program, every remaining FIPS 140-2 certificate moved to the Historical list on September 21, 2026. NIST still supports historical modules in existing systems, but CJIS is stricter: under SC-13 in version 6.1, FIPS 140-2 certificates stopped being acceptable after that date. Criminal justice information leaving a physically secure location now needs a FIPS 140-3 certified module, or FIPS 197 AES with a key of at least 256 bits, up from 128 bits in version 6.0. Ask each vendor for the CMVP certificate number behind its encryption.
Version 6.1 also tightened the scanning cadence. RA-5, a Priority 1 control, now requires vulnerability scanning of the system and hosted applications at least monthly, up from quarterly, and again whenever a new vulnerability affecting the system is reported. Scan reports and remediation tickets are exactly the evidence an auditor will ask for.
Which Version Will Your Next CJIS Audit Use?
Probably not the current one. FBI audits run against version 5.9.5 through March 31, 2027, and each state CJIS Systems Agency sets its own adoption timeline. Texas DPS, for example, states that all Texas audits through that date use v5.9.5. So you prepare for the version being audited while building toward the one already published.
The audit itself is triennial in both directions. The FBI’s CJIS Audit Unit (CAU) audits each state CJIS Systems Agency at least every three years, including a sample of local agencies, and each CSA audits the agencies connected to it on the same cycle.
Call your state CSA and ask one question: which policy version are you auditing against, and when does that change? Write the answer at the top of your checklist. It is the difference between remediating the right gaps and remediating last cycle’s.
CJIS Policy Versions and What They Mean for Your Audit
| Version | Date | Policy areas | Status for a local agency |
|---|---|---|---|
| 5.9 | June 1, 2020 | 13 | The structure most online checklists still describe |
| 5.9.5 | July 9, 2024 | 19 | The FBI audit baseline through March 31, 2027 |
| 6.0 | December 27, 2024 | 20 | Restructured onto NIST SP 800-53 Rev 5; Priority 1 controls sanctionable |
| 6.1 | June 25, 2026 | 20 | Current policy: corrections, plus a 256-bit minimum encryption key |
Untangle the two versions
What Does Your Team Own, and What Does a Partner Cover?
A managed IT partner can carry most of the technical controls: account management (AC-2), encryption (SC-13), log collection, patching, configuration baselines and continuous monitoring (CA-7). Your agency keeps everything that requires authority or a signature, including policy approval, personnel screening, training records, physical security, vendor agreements and the incident reporting chain.
The split matters because CJIS does not let you delegate accountability, whether the data is an NCIC hit on a patrol laptop or a booking record in your RMS. Your agency signs the user agreement with the state. Your agency names the people who answer for it. Three roles in particular have to be yours:
- The Local Agency Security Officer (LASO) is your agency’s primary security contact and the first stop when something goes wrong. Name a backup too.
- The Terminal Agency Coordinator (TAC) is required at each agency with devices that reach CJIS systems.
- The CJIS Systems Officer (CSO) sits at the state level, not yours, but you report through that office.
Shared city networks add one more document. When a city or county IT department supports the police department or sheriff’s office, the criminal justice agency signs a Management Control Agreement with that IT department, which keeps control of the criminal justice function with the agency. Auditors check for it, and it is easy to have never signed one.
Incident reporting runs through those roles, and several published checklists get one detail wrong. Your staff notify the LASO within one hour of discovery under IR-6. The LASO notifies your state CSA Information Security Officer, and the CSA ISO escalates to the FBI CJIS ISO. The chain runs through your state, not straight to the FBI, and a checklist that says otherwise will send someone down the wrong path during the worst hour of their year.
If you are still weighing which government IT solutions for municipalities fit a team your size, settle this split first, because your CJIS program inherits whatever answer you land on. Whoever you bring in has to sign the CJIS Security Addendum, and their staff need fingerprint-based background checks before touching unencrypted CJI. The Addendum is a rolling obligation: a contract signed under version 5.9 still carries a version 6.1 duty today.
How Do You Build a CJIS Compliance Checklist That Survives an Audit?
Give every control four fields: the owner, the current status, the evidence you would hand an auditor, and the review date. A checklist without an evidence column is a list of intentions. To an auditor, a control with nothing to prove it looks the same as a control that does not exist.
Habits that keep a small team audit-ready:
- Tie reviews to a calendar, not an audit notice. AU-6 requires a weekly review of audit records; access reviews, training and policy refreshes run on their own fixed schedule.
- Keep training current. Literacy training is required before access under AT-2 and annually after, and version 6.1 revised the role-based training content under AT-3, so material written for 6.0 needs updating.
- Keep evidence in one shared, access-controlled repository organized by control ID (AC-2, IA-2, SC-13 and so on), so anyone on the team can pull it for an auditor. If it lives in one person’s inbox, it does not exist.
- Check cloud data residency. CJI can only sit in datacenters in the United States, its territories, Indian Tribes or Canada.
- Check password hygiene under IA-5: keep a list of common and compromised passwords, update it at least quarterly, and check every new or changed password against it.
In a typical CJIS readiness engagement with a small municipal IT team, the first thing we see is a control that works and a file that does not exist. MFA is enforced through conditional access, but nobody exported the policy or the sign-in report that proves it. Backups run nightly, but the last documented restore test is two years old. The LASO is named on the org chart and has never read the incident procedure. An auditor cannot grade what you cannot show them, so the fastest audit win is rarely new technology. It is a folder.
Back to that checklist on your screen. Twenty areas, an owner on each line, evidence behind each one, and a note at the top saying which version your state is auditing against. None of it is glamorous, and all of it separates a clean report from a corrective action plan.
Frequently Asked Questions
Is there such a thing as CJIS certification?
No. The FBI does not issue a CJIS certification to agencies, vendors or cloud providers, and there is no accredited assessor market like FedRAMP has. Agencies and vendors demonstrate compliance through signed agreements, the CJIS Security Addendum for contractors, and audits by your state CJIS Systems Agency. If a vendor advertises itself as CJIS certified, ask what they actually mean.
What are the CJIS security requirements for 2026?
Version 6.1, published June 25, 2026, is the current policy. Priority 1 controls including MFA are already sanctionable, and FIPS 140-2 encryption certificates stopped being acceptable after September 21, 2026. Remaining Priority 2 through 4 requirements become sanctionable on September 30, 2027.
How often must CJIS training be completed?
Security literacy training is required before someone gets access to criminal justice information and annually after that, under AT-2. Role-based training under AT-3 applies to people with specific security responsibilities, and version 6.1 revised that content, so training material built for version 6.0 needs a refresh.
