CJIS-Compliant Hosting for Law Enforcement and Their Vendors
The FBI CJIS Security Policy applies to every entity that stores, processes, or transmits Criminal Justice Information — over 18,000 law enforcement agencies and the technology vendors serving them. Our infrastructure is built around CJIS pillars: fingerprinted US citizen support, Advanced Authentication, US-only data residency, FIPS 140-2 encryption, and full audit accountability.
What CJIS Means for Your Organization
The FBI Criminal Justice Information Services Division publishes the CJIS Security Policy — a unified, prescriptive standard for safeguarding Criminal Justice Information. Compliance is a contractual condition between the FBI and every state CJIS Systems Agency, flowing down to local agencies and any vendor handling CJI on their behalf. Audits are real, deficiencies have consequences, and the policy is moving fast.
Mandatory for LE Agencies
Every state, local, and federal agency that accesses NCIC, III, NICS, or other FBI CJIS systems is contractually bound to enforce the CJIS Security Policy across their infrastructure and personnel.
Flow-Down to Vendors
Vendors hosting, integrating, or supporting LE systems are obligated through agency contracts, Management Control Agreements, and CJIS Security Addenda to satisfy applicable policy areas — including personnel screening.
Mapped to NIST 800-53 Rev 5
CJIS Security Policy v6.0 explicitly mapped its requirements to NIST 800-53 Rev 5, aligning the LE community with broader federal cybersecurity practice and easing dual-compliance burdens for federal/SLED workloads.
Triennial FBI Audits
FBI CJIS auditors review state CSAs every three years, with state CSAs auditing local agencies on a similar cadence. Findings result in corrective action plans — and in serious cases, suspension of CJIS access.
13 Policy Areas Governing Criminal Justice Information
The FBI CJIS Security Policy organizes safeguards into 13 policy areas covering the full lifecycle of Criminal Justice Information. Version 6.0 is the most aggressive update in years — explicitly mapped to NIST 800-53 Rev 5 and aligning CJIS with broader federal cybersecurity practice.
The Pillars That Decide CJIS Eligibility
Three requirements drive most CJIS hosting decisions: who can touch the data, how strongly identity is verified, and where the data physically resides. Get any of these wrong, and the rest doesn’t matter.
Fingerprinted & Vetted
- Fingerprint-based background check required
- Channeled through state CSA
- Required for any administrative or unescorted access
- Re-vetting on a defined cadence
Advanced Authentication
- MFA mandatory outside physically secured location
- Hardware tokens, smartcards, biometric, or risk-based
- SMS as a second factor is no longer accepted
- Re-authentication on session timeout
US Data Residency
- Storage in US-based facilities only
- Backups, replicas, and DR copies all in-country
- No foreign-national administrative access
- US citizen support staff for all privileged operations
How GovDataHosting Inherits the CJIS Burden
Many CJIS policy areas have heavy infrastructure components that hosting providers can satisfy on a tenant’s behalf. The remaining policy areas — training, agreements, agency-specific procedures — are work only your agency or vendor can do. The split below shows where we lift the load and where you stay accountable.
Your Path to CJIS Compliance
Our proven methodology shortens timelines and reduces risk by combining inheritable controls, dedicated compliance staff, and direct experience with CJIS-aligned authorizations.
Scope CJI Footprint
Identify every system, dataset, and integration that touches CJI. Define your CJIS authorization boundary as tightly as possible.
Sign the Security Addendum
Execute the CJIS Security Addendum with your state CSA. Establish Management Control Agreements with hosting and SaaS vendors.
Migrate & Inherit
Move workloads onto CJIS-aware infrastructure. Inherit Advanced Authentication, FIPS 140-2 crypto, and US persons-only support.
Audit Readiness
Maintain audit logs, training records, and personnel screening documentation. Prepare for triennial CSA / FBI CJIS audits.
CJIS Solutions by Audience
CJIS applies to over 18,000 law enforcement agencies and to every vendor whose systems store, process, or transmit Criminal Justice Information on their behalf — including cloud, SaaS, and managed service providers.
State & Local Government
State police, county sheriffs, municipal police, fusion centers, courts — the largest population of CJIS-subject agencies, and our most common CJIS customer profile.
Federal Law Enforcement
FBI components, DEA, ATF, US Marshals, and federal investigators all operate under CJIS Security Policy when handling FBI-sourced criminal justice information.
CJIS Vendors & SaaS Providers
Records management, computer-aided dispatch, body camera, evidence management, and SaaS providers serving LE — required to satisfy CJIS through customer agreements.
CJIS FAQs
Does CJIS apply to a vendor that never sees CJI directly — for example, a hosting provider with full encryption?
Yes. The CJIS Security Policy explicitly addresses ‘incidental access’ — situations where a vendor’s personnel could potentially access CJI through privileged operations even if they don’t in normal practice. Hosting providers, MSPs, backup vendors, and any party with administrative reach into CJI-bearing systems must satisfy applicable policy areas, including personnel screening, regardless of whether they routinely view the data.
What is Advanced Authentication and what counts?
Advanced Authentication is CJIS shorthand for multi-factor authentication. Acceptable factors include hardware tokens, smartcards (including PIV), biometric verification, certificate-based authentication, and risk-based methods that meet the policy’s thresholds. SMS-based second factors are no longer considered compliant. AA is required for any CJI access from outside a physically secured location, including remote work, mobile devices, and field operations.
Is CJIS the same as StateRAMP / GovRAMP for state agencies?
No, but they often coexist. StateRAMP / GovRAMP is a state-level analog to FedRAMP, focused on cloud authorization for state and local government generally. CJIS is a specialized federal policy specifically for criminal justice information. A SaaS vendor serving a state police agency may need to satisfy both: GovRAMP for the underlying cloud authorization and CJIS for the law enforcement-specific data handling.
How does GovDataHosting’s personnel screening work for CJIS?
We employ US citizen support and engineering staff, all of whom undergo fingerprint-based background checks coordinated through the appropriate state CSA channel before being granted privileged access to CJIS-tagged tenant environments. We maintain documentation, logs, and re-vetting cadence per CJIS Section 5.12 requirements. During state CSA audits, we participate directly — providing personnel records, system documentation, and audit log evidence as required.
Ready to Host CJI on Compliant Infrastructure?
Schedule a free CJIS readiness review. We will walk through the 13 policy areas, identify what you can inherit, and coordinate with your state CSA on the documentation path.