CJIS Compliance Requirements for Software and Cloud Storage

Law enforcement agencies on local, state and federal levels are involved in accessing and dealing with Criminal Justice Information (CJI) databases to track criminal activities, criminal histories and other sensitive data as directed by the CJIS Division of the U.S. Federal Bureau of Investigation (FBI).

Criminal Justice Information Services or CJIS compliance is one of the most crucial compliance standards for legal organizations and entities dealing with criminal justice information.

Therefore, government agencies are bound to strictly follow the CJIS standards to safeguard criminal justice information while handling and processing criminal justice data.

Protecting such data is a legal requirement that can result in heavy consequences if the standards are ignored.

This guide covers the main areas of the CJIS Security Policy, what they require of cloud storage and software that hold CJI, and how to meet them.

What is CJIS Compliance?

The Criminal Justice Information Services, or CJIS, was first established in 1992 and currently remains the largest division of the Federal Bureau of Investigation (FBI). In the United States, CJIS serves as the centralized source of criminal data for Government agencies and other authorized third parties.

Several systems fall under the CJIS Division, including the National Crime Information Center (NCIC), the National Data Exchange (N-DEx), the National Instant Criminal Background Check System (NICS) and the Next Generation Identification (NGI) system, which replaced the Integrated Automated Fingerprint Identification System (IAFIS).

The CJIS is responsible for monitoring criminal activities using analytics and statistics and maintaining the record on their databases. Government entities have access to all this information whenever they require it.

With rising concerns about cybersecurity attacks, data breaches and privacy protection, CJIS formulated the security standards for different organizations and presented the CJIS Security Policy.

Security is vital when it comes to protecting criminal justice information. Organizations must ensure that their systems and processes meet the requirements and standards of the CJIS Security Policy.

Let's dive deeper into the topic!

The FBI CJIS Security Policy

The CJIS Security Policy sets the minimum security requirements for protecting criminal justice information from unauthorized access, disclosure and misuse. The current version, 6.1, has 20 policy areas: Information Exchange Agreements, Mobile Devices, and 18 control families adopted from NIST SP 800-53, such as Access Control (AC), Personnel Security (PS) and System and Communications Protection (SC). The requirements agencies and their vendors work through most often are below:

Information Exchange Agreements

Before sharing or exchanging information between agencies, there should be a formal user agreement that highlights specific security controls committed and signed by both agencies respectively.

The organizations or agencies must specify in the user agreement document the systems and services that can be accessed and the security policies that must be followed by the agencies while handling criminal data. The agreement must include:

• Audits
• Logging
• Quality assurance
• Pre-employment screening
• Security
• Timeliness
• Training
• Use of systems

Security Awareness and Training

Everyone with access to CJI, including managers and contractors, must complete security and privacy literacy training before first accessing it and annually after that.

The training is required to explain the roles and responsibilities of individuals and how to maintain the integrity and security of CJI at all levels.

Incident Response

Personnel must report a suspected incident to the agency's incident response capability within one hour of discovery, and the agency reports it to its CJIS Systems Officer (or the equivalent state or interface agency official) and to the FBI CJIS Information Security Officer. There must be proper procedures formulated by organizations to detect, analyze and recover all major incidents in a timely manner.

Auditing and Accountability

All organizations must generate audit reports for defined activities and events related to data security. The following events should be logged in an audit report:

• Successful and Unsuccessful login attempts
• Assign, create, edit and delete user permissions on accounts
• Attempts to modify, access and destroy audit log files
• Attempts to modify passwords
• Date and time of events
• Type of actions or events

Access Control

The type and level of access must be allocated to each user accessing the criminal justice information. The least privileged access must enforce the restrictive set of permissions as needed by the user to secure all sorts of criminal data by all means.

There should be access control criteria on a need-to-know basis based on the job, location, IP address etc.

Identification and Authentication

Organizations requiring access to sensitive legal records must have standard identification and authentication methods to authenticate account users. The current policy requires multifactor authentication for both privileged and non-privileged accounts.

Configuration Management

Only authorized individuals should have access to information system components for the purpose of initiating changes, upgrades and modifications.

Planned or unplanned changes to the hardware, software and firmware components must be documented and done by authorized personnel only.

Media Protection

Documented and implemented media protection policies and procedures ensure that access to digital or non-digital media in all forms is restricted to authorized individuals using authenticated methods and processes.

Physical Protection

Physical protection policy and procedures shall be documented and implemented to ensure CJI and information system hardware, software and media are physically protected through access control measures.

System and Communication Protection

Information systems, applications and communications must have the capability to ensure system integrity through detection and protection against unauthorized access and modifications done to the software. Prevent unencrypted data transmission across the public network.

CJI outside a physically secure location must be encrypted in transit and at rest with FIPS 140-3 certified cryptographic modules, or with FIPS 197 (AES), using a symmetric key of at least 256 bits.

Formal Audits

The FBI CJIS Division and the CJIS Systems Agency conduct periodic audits, typically every three years, to verify compliance. Agencies must support these audits and maintain evidence of their controls.

Personnel Security

Anyone with unescorted access to unencrypted CJI must pass personnel screening, including state-of-residency and national fingerprint-based record checks, before access is granted.

Mobile Devices

Accessing CJI from mobile or wireless devices requires added controls: device management, encryption, and strong authentication to address the risks of mobility.

CJIS Requirements for Cloud Storage

The CJIS Security Policy allows criminal justice information to be stored in the cloud, in government or commercial data centers. No body certifies a cloud service for CJIS, so cloud storage is CJIS compliant when the provider and the agency's use of it meet the policy's controls. For a cloud host, four requirements decide most of it:

• The CJIS Security Addendum. A private contractor given access to CJI, such as a vendor that hosts or operates the system, works under an agreement with the agency that incorporates the CJIS Security Addendum. The addendum is standard FBI-approved text that only the FBI can modify. The contractor signs its certification page, and each contractor employee signs an acknowledgment.
• Screening of provider personnel. Personnel security applies to every provider employee whose unescorted logical or physical access lets them view, change or use unencrypted CJI. Each must pass state-of-residency and national fingerprint-based record checks before access is granted, and the agency keeps a list of everyone authorized. Where the agency alone holds the encryption keys and provider staff have no way to reach unencrypted CJI, the policy does not require fingerprint checks for them.
• FIPS-validated encryption. CJI outside a physically secure location is encrypted in transit and at rest with FIPS 140-3 certified cryptographic modules, or with FIPS 197 (AES), using a symmetric key of at least 256 bits. Metadata derived from unencrypted CJI gets the same protection, and a cloud provider may not use it for advertising or other commercial purposes.
• Where data may reside. CJI, encrypted or not, may be stored only in cloud environments physically within an APB-member country (the United States, U.S. territories, Indian Tribes and Canada) and under the legal authority of an APB-member agency.

External service providers with access to the system must also be audited at least once every three years.

CJIS-Compliant Deployments with VIDIZMO

VIDIZMO DEMS supports CJIS-compliant deployments, with CJIS-aligned hosting available on Microsoft Azure Government. The agency holds the CJIS compliance obligation, and VIDIZMO's controls support it. Content is encrypted with AES-256 at rest and with TLS in transit, using FIPS 140-3 validated cryptographic modules on supported infrastructure such as Azure Government. VIDIZMO staff hold no standing access to customer environments. Access is break-glass only, time-bound, MFA-enforced and logged.

Where the data resides depends on the deployment model:

• VIDIZMO-hosted SaaS. The agency selects the Azure storage region for its files. Metadata, the database and content processing run primarily in U.S. East data centers, on Azure Commercial or Azure Government.
• Dedicated deployment. The whole deployment runs in the cloud region the agency chooses, on infrastructure not shared with other customers.
• Agency-controlled infrastructure. A private cloud deployment in the agency's own Azure or AWS subscription, including AWS GovCloud, or an on-premises installation keeps the data and the platform inside infrastructure the agency controls, so the agency decides who can reach it.

Key custody decides whether a provider's staff fall under the screening requirement at all, because a vendor that can use the keys can reach the data. What CJIS actually requires when AI touches criminal justice data covers key custody, and where CJI may be stored and processed, in more detail.

How to Meet CJIS Compliance Security Standards?

Governmental organizations such as law enforcement agencies, as well as non-criminal justice organizations that require access to the CJIS database, need to be compliant in their practices for storing, managing and sharing criminal justice information (CJI).

This raises concern for legal organizations regarding how to secure their confidential data in accordance with the standards presented by CJIS compliance security policy areas.

Let's take an example!

Law enforcement agencies are frequently involved in collecting digital evidence and other case-relevant data; how do they ensure that their data is protected and is not being misused or tampered with?

In addition to security concerns, another big challenge is the huge volumes of sensitive criminal data in digital form!

What can be done to overcome these challenges?

The solution is simple...

They need to have CJIS-compliant software that makes their job easier and solves all their security-related challenges. Software that is competent enough to follow the rules and regulations set by the legal compliances.

What to Look for in CJIS-Compliant Software

When evaluating CJIS-compliant software for evidence management, choose a solution that centralizes all data types and supports the CJIS Security Policy controls. The capabilities that matter most are:

• Secure storage of data: AES 256-bit encryption
• Secure data sharing with restricted options
• Data management: Searching, indexing and filtering.
• Generate Audit log report
• Redaction: Individual's privacy protection
• Role-Based Access Control
• SSO authentication

When the software also runs AI on CJI, such as transcription, search or case summaries, the same controls apply to the model, to where it runs and to the logs it writes. CJIS-compliant AI covers what that changes.

Several vendors offer digital evidence management software built to support these controls. One of them is VIDIZMO’s Digital Evidence Management System (DEMS).

Resolve All Your Compliance Challenges with VIDIZMO

VIDIZMO DEMS is the centralized platform to ingest, store, manage, and share digital evidence (videos, audio recordings, images and documents) with top-notch security and trusted AI features.

With security maintained at every step, VIDIZMO meets the CJIS Security Policy controls applicable to a service provider and supports commercial and government organizations in meeting requirements such as CJIS, HIPAA, and FOIA for data storage and management. The agency holds the CJIS compliance obligation, and VIDIZMO's controls support it. Deployment options include Azure Government Cloud, AWS Cloud, on-premises, and hybrid infrastructure.

So, how can you meet the security standards with VIDIZMO DEMS?

Some of the key capabilities of VIDIZMO DEMS are as follows:

• AES-256 encryption at rest and TLS encryption in transit, using FIPS 140-3 validated cryptographic modules on supported infrastructure, along with password protection for individual media, reason-for-access logging and HTTPS-only portals.
• Integration with multiple SSO identity providers and provides IAM services for user authentication.
• Role-Based Access Control, where each user is assigned a specific role to access the system with the default set of permissions.
• Tamper detection, which records a SHA-384 hash when a file enters the system and re-verifies it on demand, so any later change to the file is detectable.
• Automatic detection and redaction of faces, people and custom objects such as license plates, weapons and vehicles visible in video evidence before sharing with third parties.

But that’s just the tip of the iceberg!

Get in touch with the experts...

Or you can opt for our product demo!