Criminal Justice Information Services (CJIS) Security Policy

All entities with access to FBI Criminal Justice Information Services data must comply with the CJIS Security Policy. Requirements include advanced authentication for personnel accessing criminal justice information, encryption of CJI data at rest and in transit, personnel security screening, and audit logging.

Agencies must maintain security awareness training programs, incident response plans, and access controls. Physical security of facilities housing CJI systems must meet specified standards. Compliance assessments are conducted every three years.