What is CJIS (Criminal Justice Information Services)?
Last updated: April 10, 2026
Definition
CJIS is both an FBI division and a compliance standard governing the security and privacy of criminal justice information across the United States. The CJIS Security Policy establishes minimum security requirements for any organization that creates, stores, accesses, or transmits criminal justice data, including law enforcement agencies, court systems, contractors, and cloud service providers.
Key Facts
- Also known as: FBI CJIS Division, CJIS Security Policy, CJIS compliance framework
- Category: Compliance & Risk
- Related standards/protocols: NIST SP 800-53 Rev. 5, FIPS 140-2, FIPS 197 (AES), FedRAMP
- First established: February 1992 (FBI CJIS Division)
- Current policy version: 6.0 (December 2024)
- Key systems: NCIC, NICS, N-DEx, NIBRS, IAFIS, LEEP
How CJIS Works
CJIS compliance operates through a tiered management structure. Each state designates a CJIS Systems Agency (CSA) responsible for enforcing the CJIS Security Policy within its jurisdiction. Criminal justice agencies access FBI systems like NCIC and NICS under agreements with their state CSA. The CSA validates compliance through regular audits and manages the fingerprint-based background check process for personnel with access to unencrypted criminal justice information.
The CJIS Security Policy version 6.0 organizes requirements into 20 policy areas mapped to NIST SP 800-53 Rev. 5 controls. Core requirements include FIPS 140-2 certified encryption for data in transit and FIPS 197 (AES) encryption with minimum 256-bit strength for data at rest. Advanced authentication (MFA) is mandatory for all remote access to criminal justice data. Personnel security requires fingerprint-based background checks coordinated through the state CSA. Access control follows least privilege principles with audit logging retained for at least one year.
Private businesses serving criminal justice agencies comply through vendor management programs. Cloud service providers like those offering GCC High environments achieve CJIS compliance by combining FedRAMP High authorization with additional CJIS-specific controls for data residency (U.S.-only), customer-managed encryption keys, and CSA-coordinated personnel screening with managed security monitoring.
Why CJIS Matters
Criminal justice agencies handle data that directly impacts public safety and individual rights. A breach exposing fingerprint records, case files, or criminal history information compromises investigations and creates legal liability. According to Verizon's 2025 Data Breach Investigations Report, 22% of public sector breaches stem from credential abuse, making identity and access controls critical for agencies accessing CJIS systems.
CJIS requirements apply to more than 19,000 law enforcement agencies participating in the FBI's data sharing programs. For IT teams managing criminal justice systems, CJIS compliance determines whether the agency retains access to NCIC, NICS, and other investigative databases. Non-compliance results in loss of access, financial penalties, or criminal charges. The shift to cloud infrastructure and mobile access has made CJIS compliance more complex, requiring coordination between agency IT teams, cloud providers, state CSAs, and compliance management services to maintain the security controls that protect criminal justice information throughout its lifecycle.
CJIS vs. FedRAMP
| Aspect | CJIS | FedRAMP |
| Primary function | Protects criminal justice information and systems | Standardizes cloud security for federal agencies |
| Scope | Criminal justice agencies and their vendors | All federal agencies using cloud services |
| Used by | Law enforcement, courts, corrections, CJ contractors | Federal agencies, cloud service providers |
| Key difference | Requires U.S.-only data residency, CSA personnel screening | Broader scope, no CJ-specific data restrictions |
| When to use | Any system accessing or storing CJI | Federal cloud deployments across all agencies |
The key difference is that CJIS is criminal justice-specific with stricter data residency and personnel screening requirements, while FedRAMP provides a broader government-wide cloud security baseline that CJIS-compliant cloud providers build upon.
Common Misconceptions
CJIS is not limited to law enforcement agencies. Private businesses providing services to criminal justice agencies (cloud providers, software vendors, contractors) must also comply with the CJIS Security Policy and undergo state CSA audits.
CJIS does not provide a vendor certification program. There is no such thing as a "CJIS-certified" cloud provider or software vendor. Compliance is validated through FBI and state CSA audits of the agencies themselves, not their vendors.
Frequently Asked Questions
CJIS Security Policy version 6.0 defines 20 policy areas mapped to NIST SP 800-53 controls, including FIPS-certified encryption for data in transit and at rest, MFA for remote access, fingerprint-based background checks coordinated through state CSAs, least-privilege access control, and audit logging with minimum one-year retention.
CJIS protects three categories of data: Criminal Justice Information (CJI) including biometrics, identity history, case files, and property records; Criminal History Record Information (CHRI) covering restricted NCIC files like gang registries and sex offender data; and Personally Identifiable Information (PII) when associated with criminal justice contexts.
Cloud providers achieve CJIS compliance by combining FedRAMP High authorization with additional controls: U.S.-only data residency, customer-managed encryption keys, personnel screening coordinated through state CSAs, and continuous compliance monitoring. Compliance is validated through FBI and state agency audits, not vendor self-certification. Organizations working with healthcare IT providers handling criminal justice data must ensure their vendors meet these requirements.
