Companion to: Getting ready for a CJIS technical security audit

CJIS audit evidence checklist

What to have in your evidence folder before the auditor asks. Check items off as you gather them, then save it as a PDF or Word file for your audit binder.

AgencyAudit datePrepared by

Scope and network0/7

Confirmed with the CSA which CJIS Security Policy version this audit uses (name, date)
List of every workstation, server, and mobile device that can access, store, or process CJI
Dated network diagram showing CJI systems, the boundary firewall, and the path to the state network
Device inventory: hostname, OS version, role, and location
Boundary firewall rules exported, with a note on the purpose of each rule
How CJI is encrypted in transit, with the FIPS validation for each encryption module
Wireless networks that touch CJI systems, and how they are secured

Accounts and authentication0/6

Current list of users with CJI access, each account unique to one person
Proof MFA is enforced for every CJI login: Windows, apps, VPN, remote support, admin accounts
Password or authenticator policy as configured (screenshot or export)
Procedure for disabling accounts when someone leaves, with a recent example
List of administrative accounts and who holds them
Break-glass account documented, with how its credentials are protected

Maintenance and monitoring0/5

Patch status for every in-scope system
Antivirus or EDR status for every in-scope device
What is logged, where logs are kept, and for how long
Backups of CJI systems, including whether backups are encrypted
Any unsupported operating systems or software, with a replacement plan

People and paperwork0/6

Fingerprint-based background checks for everyone with unescorted access, including contractors
Signed CJIS Security Addendum certifications for contractor staff
Security awareness training records by person and date
Written security policies, dated and approved
Incident response plan, with contact information that is current
Physical security: who has keys or badge access to areas with CJI

After the audit0/2

Each finding logged with an owner, target date, and planned evidence
Evidence folder kept current between audits (reviewed quarterly)

Notes

This checklist is a starting point, not legal or compliance advice. Your state CJIS Systems Agency's requirements always take priority. Current policy documents are published at the FBI CJIS Security Policy Resource Center. Free from smalltownsysadmin.com

From Small Town Sysadmin. Free to print and share. More at Free checklists.

In the works

Want the complete CJIS audit prep pack?

Fill-in-the-blank policy templates, an evidence-tracking workbook, and an audit-day kit, written for small agencies. Join the waitlist and you'll hear first when it's ready. You'll also get new guides by email, and you can unsubscribe anytime.