Getting ready for a CJIS technical security audit

If you support a small police department, sheriff’s office, probation office, or dispatch center, the CJIS technical security audit shows up on a regular cycle whether you’re ready or not. In Illinois it comes through the State Police as part of LEADS; in other states it comes from whichever agency serves as the CJIS Systems Agency (CSA). The shape is the same everywhere: a questionnaire, a request for documentation, and sometimes an on-site review.

The agencies that struggle usually aren’t insecure. They just can’t show what they’re doing, because nobody wrote it down. This is a guide to fixing that before the auditor asks.

This isn’t legal or compliance advice, and your CSA’s interpretation always wins. When in doubt, email your state CJIS audit contact and ask. They would much rather answer a question now than write a finding later.

Know which version of the policy you’re being measured against

The FBI modernized the CJIS Security Policy starting with version 6.0 in December 2024, reorganizing it around NIST SP 800-53. Version 6.1 followed in June 2026. The new version groups controls into priority tiers:

• Priority 1 controls, plus anything that already existed before modernization, are auditable now. Multifactor authentication is in this group and has been sanctionable since October 1, 2024.
• Priority 2 through 4 controls are on a runway that ends in fall 2027.

Different states are moving their audit baselines at different speeds, so the first thing to do is ask your CSA which version your audit uses. Write down the answer and who gave it to you.

Scope it before you document it

Before you gather a single screenshot, figure out where criminal justice information (CJI) actually lives and travels. Most small agencies touch CJI in fewer places than they think, and every system you can prove is out of scope is a system you don’t have to defend.

Walk through it with the chief, sheriff, or office manager:

• Which workstations can reach the state message switch or CJI web portals?
• Which servers store CJI? Think records management, jail management, report archives, and file shares where someone saved a printout as a PDF.
• How does traffic get from those machines to the state network? Which firewall, which VPN, which circuit?
• Who has accounts that can reach any of the above, including you and anyone else at your company?
• Are there mobile devices or in-car laptops involved?

Then draw it. A simple network diagram showing the CJI systems, the boundary firewall, and the path to the state network is one of the most useful documents you can hand an auditor. It doesn’t need to be pretty. It needs to be accurate and dated.

Build the evidence folder

Make one folder for the audit cycle and fill it as you go. Name files so someone else could find things without you. Here’s what I’d have in it:

Network and systems

• The dated network diagram described above
• An inventory of every device in the CJI environment: hostname, OS version, role, and location
• Firewall rules for the CJI boundary, exported or screenshotted, with a note on what each rule is for
• How the connection to the state network is encrypted, and the FIPS validation for the encryption modules involved

Accounts and access

• A current list of users with access to CJI systems, showing each account is unique to one person
• How MFA is enforced, with a screenshot or policy export as proof (see the separate article on the MFA requirement)
• Your password or authenticator policy as actually configured, not just as written
• How and when accounts get disabled when someone leaves

Maintenance and monitoring

• Patch status for the CJI systems, from your RMM, WSUS, or update history
• Antivirus or EDR status on every in-scope device
• What gets logged, where the logs go, and how long they’re kept
• Backups for CJI systems, and whether those backups are encrypted

People and paperwork

• Fingerprint-based background checks for everyone with unescorted access, including contractors
• Signed CJIS Security Addendum certifications for any contractor staff
• Security awareness training records, by person and date
• The agency’s written security policies and incident response plan

If a folder section comes up empty, you’ve found your remediation list. There’s a free, printable version of this list: the CJIS audit evidence checklist.

Encryption deserves a second look this year

If CJI leaves a physically secure location, whether over a VPN, a Wi-Fi link, or on a laptop, it has to be encrypted with FIPS-validated cryptography. Check what your firewall, VPN client, and disk encryption are actually validated against. NIST retired the FIPS 140-2 program in favor of FIPS 140-3, and older certificates moved to historical status in September 2026. If your gear’s validation is only listed under 140-2, find out what your vendor offers and what your CSA will accept.

If you’re the contractor answering the questionnaire

A lot of small agencies hand the technical questionnaire to their IT contractor, and it’s tempting to just fill it all in. Be careful here.

My rule is simple: answer only for what you do, what you were engaged to do, or what you directly observed. If you’re a break-fix provider who comes out when something breaks, you can’t honestly say how the agency handles account reviews or training, because you don’t see it. Don’t guess, and don’t commit your company to remediation work in an audit response. That’s a conversation for a proposal, not a compliance document.

Good contractor answers sound like this:

• “Contractor configured MFA for Windows logon on [date]. Configuration export attached.”
• “Contractor does not manage user account lifecycle for the agency. The agency handles account creation and removal.”
• “Contractor observed that workstation X was running an unsupported OS on the date of the site visit.”

Clear lines protect everyone. The agency knows exactly what it owns, the auditor gets accurate answers, and you don’t end up on the hook for a promise someone made on your behalf.

Also make sure your own paperwork is in order before the audit: your fingerprint check, your CJIS training, and your signed Security Addendum certification. Auditors check the contractor as well as the agency.

After the audit

Findings aren’t a disaster. They’re a list, usually with a deadline. Track each one with an owner, a target date, and the evidence you’ll submit to close it. Then keep the evidence folder alive between audits. The newer policy leans toward showing that controls keep working over time, not just on audit day, so a folder you update quarterly will make the next cycle much easier.

Where to read the actual policy

The FBI publishes the current CJIS Security Policy and supporting documents at the CJIS Security Policy Resource Center. It’s long, but the control you’re being asked about is usually a quick search away, and quoting the control number in your response makes it clear you know what’s being asked. The same page has the Requirements Companion Document, a spreadsheet version that lists each requirement’s priority and when it becomes auditable. It’s the fastest way to sort out what’s due now versus in 2027.

All articles