Protecting Criminal Justice Information has never been just a matter of installing the right software and moving on. Under CJIS Security Policy v6.1, agencies that handle CJI must show that their security controls are not only in place but working consistently, day after day, across every system where officers and staff touch sensitive data. That distinction - between having controls and proving they function - is where many agencies run into trouble.
Legacy infrastructure, thin IT staffing, and constantly shifting access needs make consistency hard to sustain. An agency might pass an audit cleanly and still find gaps emerging within months as new accounts are created, old ones linger, or configurations drift. The following five areas are where CJIS v6.1 places the sharpest focus, and where practical attention pays off most.
Multi-Factor Authentication That Covers Everything
CJIS v6.1 requires multi-factor authentication for both privileged and non-privileged accounts under controls IA-2(1) and IA-2(2), spanning local, network, and remote access. The real difficulty is coverage: legacy applications, administrative accounts, and remote access points are the places MFA most often gets missed. Agencies should audit their environment specifically for these blind spots and consider phishing-resistant methods, such as FIDO2 security keys, over older one-time-code approaches that remain vulnerable to interception.
Equally important are the processes surrounding authentication - how authenticators get issued, replaced when lost, and revoked when someone leaves. Tools that extend MFA across Windows logons, RDP sessions, RADIUS authentication, and offline access can close gaps that point solutions leave open, while integration with event logging systems helps generate the evidence auditors expect to see. MFA configurations also need revisiting as systems change, rather than being treated as a one-time deployment.
Account Management, Passwords, and Logging
Outdated access permissions are one of the most persistent risks in any organization, and CJIS v6.1 addresses this through strict account management and least-privilege requirements. Agencies need an accurate inventory of every user, administrative, service, and temporary account, with permissions limited to what each role actually requires. Temporary and emergency accounts must be removed within 72 hours of no longer being needed, and accounts inactive for 90 days must be disabled within a week. Annual reviews are the minimum; ongoing monitoring is what actually keeps access current.
Password requirements under IA-5 have been sanctionable since October 2024, with an eight-character minimum as a Priority 1 control. Aligning with NIST guidance, agencies should favor longer passphrases over complex but short passwords, screen continuously for compromised credentials, update blocklists at least quarterly, and cap failed login attempts at five. Annual password change requirements still apply under IA-5, even as broader guidance discourages unnecessary resets, so agencies should confirm specifics with their CJIS Systems Agency.
Logging ties these controls together. Collecting logs is not sufficient on its own - records need to capture who did what, when, and with what outcome, across every system handling CJI. Centralizing this data in a SIEM makes anomalies far easier to spot than reviewing scattered logs system by system.
Treating Audits as an Ongoing Discipline
Formal CJIS audits happen at least once every three years, but compliance is expected continuously in between. Agencies that scramble to assemble evidence only when an audit is announced tend to find gaps they didn't know existed. A more durable approach includes:
- Maintaining a clear inventory of applicable controls with named owners for implementation and review
- Keeping organized records of MFA setups, access reviews, audit logs, policies, and training
- Updating remediation plans at least every six months under CA-5, or sooner when new risks emerge
- Running internal assessments ahead of formal reviews to catch issues early
- Folding compliance checks into routine IT operations rather than treating them as separate exercises
Built this way, compliance becomes a byproduct of good security practice rather than a periodic scramble - and agencies end up with stronger protection for the sensitive information they're trusted to safeguard, not just a cleaner audit file.