CJIS doesn't care about your title.
It cares about access.

Quite possibly, because CJIS is access-based, not title-based. The policy doesn't care about your job title or department name; it cares about whether you create, store, access, or transmit Criminal Justice Information. That sweeps in far more than police and courts: non-justice government agencies, IT administrators, managed service providers, cloud and software vendors, and even on-call support staff who can reach systems holding CJI.

CJI itself is broad — criminal history records, arrest and warrant data, fingerprints and mugshots, jail and inmate records, dispatch logs, and court records tied to criminal cases. Compliance is enforced at the individual level, not just organizationally, so the people with access must meet requirements like background screening, security awareness training, and strong authentication. If you support law enforcement in any way through technology, records, or infrastructure, assume CJIS likely applies and confirm it deliberately.

They represent the current state and near future, and you need both. Version 5.9.5 (July 2024) is the policy that audits are currently conducted against, so it's your primary reference today. Version 6.0 (December 2024) is a major modernization — roughly half new content — that shifts CJIS away from point-in-time, checklist compliance toward continuous governance, risk management, and audit-ready accountability, revising areas like assessment and authorization, continuous monitoring, personnel security, and supply chain risk.

Agencies are expected to meet the modernized requirements by October 1, 2027, with enforcement milestones phasing in before then, so the right posture is to keep meeting 5.9.5 while running gap assessments against 6.0. CJIS is also moving to a faster rhythm — version 6.1 is expected in 2026, with updates roughly every six to twelve months — which is itself a reason to treat compliance as an ongoing program, not a periodic project.

Yes. MFA is no longer optional: every account that accesses Criminal Justice Information must use it, so a stolen or guessed password alone cannot grant access to CJI. The policy doesn't lock you into a single product, but it points to NIST SP 800-63 Digital Identity Guidelines, which describe phishing-resistant authentication — an important nuance, because not all MFA is equally strong against modern credential-phishing.

Alongside MFA, the modernized policy tightens authenticator hygiene, including a banned or commonly-compromised password list and rules on how often certain authenticators must change. For most agencies and vendors, the challenge isn't understanding that MFA is required — it's implementing it consistently across every system and account that can reach CJI, including service accounts, admin access, and third-party connections, without breaking the workflows officers and staff depend on. That complete coverage is what an auditor looks for.

CJIS is not a certification you earn once; it's a security policy you're audited against on a recurring basis. Oversight is tiered: the FBI's CJIS Division sets the national policy, and within each state a CJIS Systems Agency (CSA) administers access to FBI criminal justice information and ensures the agencies and vendors under it comply. Audits are typically conducted on a recurring cycle — commonly every three years — by the FBI and the state CSA, assessing whether your technical, administrative, and physical controls actually meet the policy in practice.

Because version 6.0 emphasizes continuous accountability rather than a point-in-time snapshot, the expectation is increasingly that you can demonstrate compliance at any time, not just the week before an audit. That's why the durable approach is to build CJIS into ongoing operations — identity, monitoring, personnel security, and documentation maintained continuously — so an audit becomes a confirmation of what you already do. We help agencies and vendors reach that state and prepare for the CSA audit itself.