For agencies responsible for protecting Criminal Justice Information (CJI), meeting CJIS requirements means more than putting security controls in place. Those controls need to work across the systems staff use every day, and agencies need to be able to prove they're effective.
But, between legacy systems, stretched IT teams, and constantly changing access needs, even agencies with strong security practices can struggle to apply controls consistently and keep the evidence auditors expect.
So, where should you focus your efforts? In this article, we'll walk through five key areas agencies should be paying attention to under CJIS v6.1, with practical advice to make compliance easier to manage.
Multi-Factor Authentication
CJIS v6.1 requires MFA for both privileged and non-privileged accounts under controls IA-2(1) and IA-2(2), covering local, network, and remote access. The challenge is making sure no accounts slip through the cracks.
Start by reviewing MFA coverage across your environment, paying particular attention to legacy applications and administrative accounts. When implementing MFA, consider phishing-resistant methods such as FIDO2 security keys.
You'll also need reliable processes for enrolling, replacing, and revoking authenticators.
Solutions like Specops Secure Access help agencies comply by extending MFA protection to Windows logons, RDP, RADIUS, and offline access, with flexible options including authenticator apps and YubiKeys. Its event API integrations also help provide evidence for compliance audits.
Remember, MFA isn't a one-time fix. Revisit your configurations as systems and access needs change.
Account Management and Privileges
Access permissions can quickly become outdated as employees change roles or leave, a risk which CJIS v6.1 aims to reduce by enforcing effective account management and least privilege.
Start by keeping an accurate inventory of user, administrative, service, and temporary accounts. Limit permissions to what is needed for each role, separate administrative privileges from everyday activities, and automate account provisioning and removal where possible.
Review accounts and privileges at least annually. Temporary and emergency accounts must be removed within 72 hours, while accounts inactive for 90 days must be disabled within one week. The key is making access reviews an ongoing process, not just an annual exercise.
Passwords
IA-5 sets an eight-character password minimum and is a Priority 1 control, so has been sanctionable since October 2024. Aligning with NIST recommendations, agencies should encourage longer, unique passphrases and use approved password managers to reduce reuse.
Agencies should also:
- Screen for compromised passwords, updating password blocklists at least quarterly and whenever compromise is suspected.
- Block weak or reused passwords during creation or reset.
- Limit failed login attempts to no more than five per account.
This is where Specops Password Policy can help. It simplifies password policy management across Active Directory, continuously checking against over 6 billion compromised passwords and scanning daily for newly exposed credentials.
Customizable grace periods help reduce unnecessary lockouts when a compromised password is found, while compliance templates and reporting make it easier to track your progress.
Finally, check annual password change requirements with your CJIS Systems Agency, as IA-5 still specifies a yearly change or refresh despite guidance discouraging unnecessary resets.
Logging
Audit logs help agencies detect suspicious activity and investigate security incidents. However, collecting logs isn't enough. Agencies also need to capture the right events, review records regularly, and protect them against tampering.
Start by checking logging coverage across systems handling CJI. Make sure records capture who did what and when, as well as the outcome. Centralizing logs in a SIEM can make suspicious activity easier to spot.
Audit Readiness
Agencies are audited at least once every three years, but you’re expected to maintain compliance between audits. Rather than scrambling to pull evidence together at the last minute, it’s better to treat CJIS compliance as an ongoing responsibility.
Some best practices include:
- Maintaining an inventory of applicable security controls and identifying who is responsible for implementing, reviewing, and documenting each one.
- Keeping evidence organized, including records of MFA configurations, access reviews, audit logs, security policies, training, and assessment results. That makes it easier to demonstrate compliance.
- Documenting identified weaknesses and setting deadlines for resolving them. In line with CA-5, you should update remediation plans at least every six months or when new information becomes available.
- Conducting internal assessments to identify issues before a formal assessment.
- Building security monitoring and compliance reviews into everyday IT operations, so changes or new risks don't go unnoticed.
By making audit preparation part of routine security management, agencies can identify gaps earlier, reduce the work involved in formal assessments, and maintain a stronger compliance posture between audits.
Strengthen Your CJIS Compliance Posture
CJIS compliance isn't a one-and-done exercise. As systems and security risks change, agencies need to make sure their controls keep pace. By regularly reviewing controls and keeping evidence organized, you can make compliance easier to manage while strengthening your agency's security.
Passwords are a good place to start when assessing your CJIS compliance. But how do you know where the gaps are?
Specops Password Auditor offers a free, read-only Active Directory scan that highlights password policy gaps against CJIS requirements and flags risks, including compromised passwords. It’s a quick way to see where you currently stand and what needs attention.
If you’re looking to simplify meeting CJIS password and MFA requirements, book a demo with Specops and see how we can help your agency strengthen security and maintain compliance.
Sponsored and written by Specops Software.