CJIS Compliance for Law Enforcement & Local Government
The FBI CJIS Security Policy applied to the systems that touch criminal justice information: advanced authentication, encryption, personnel screening, training, logging and incident response — for agencies and the county IT that supports them.
Overview
The agency owns the records. Everyone whose systems touch them inherits the policy.
The CJIS Security Policy governs how criminal justice information is accessed, stored, transmitted and destroyed — and it applies not only to the police department but to the county IT staff who run its network, the vendor who hosts its records system, the dispatch center, the courthouse and anyone else whose systems touch the data. Each is audited, through the state's CJIS Systems Agency, on a recurring cycle, and the findings are not theoretical: unencrypted laptops, shared logins, missing fingerprint-based screening and untrained staff are the usual results.
We implement the policy's technical and operational requirements as part of managed IT for the agency or the local government that supports it: advanced authentication for every access to criminal justice information, encryption meeting the policy's standard in transit and at rest, mobile device management for in-car and handheld devices, audit logging retained for the required period, security awareness training with records, personnel screening tracked for anyone with access including our own technicians, and an incident response plan that meets the reporting requirements.
Because the policy changes — the current version adds requirements phased in over the coming years — the work is ongoing. We track the changes so the agency does not have to read every revision.
Capabilities
What's included
- CJIS gap assessmentEvery system and person with access to criminal justice information, assessed against the current policy.
- Advanced authenticationMulti-factor authentication for access to CJI from every device, including in-car and remote.
- Encryption and device managementPolicy-compliant encryption in transit and at rest; laptops, tablets and phones managed and wipeable.
- Logging and retentionAudit logs captured where CJI is accessed and retained for the period the policy requires.
- Personnel screening and trainingScreening tracked for everyone with access, including our staff; security awareness training with records.
- Audit preparationDocumentation organized to the policy's structure and our team present for the state audit.
How It Works
Delivered through managed IT
Device encryption, patching, endpoint protection, mobile device management and access changes are managed and recorded in NinjaOne, our enterprise management platform, which produces much of the evidence a CJIS audit requests. Atlas technicians with access to agency systems complete the fingerprint-based screening and training the policy requires of support personnel.
Why Atlas
Secure. Reliable. Responsive.
Flat monthly fee
Predictable per-device pricing. No surprise invoices and no hourly meter running while your team waits for help.
Proactive, not reactive
Monitoring, patching, and automation run around the clock — so most issues are resolved before your staff ever notice them.
Responsive & accountable
One team that knows your environment and answers fast. You reach a real technician, not a ticket queue in another time zone.
Month-to-month
We earn your business every month. No multi-year lock-in — you stay because the service works, not because a contract traps you.
Common Questions
Questions we get asked
Does CJIS apply to our county IT department or just the sheriff's office?
Both. The policy follows the information: if county IT runs the network, the servers, the email or the devices that criminal justice information passes through, county IT is within scope and its staff need the same screening and training. The same is true of any vendor, including us, which is why our technicians complete the required screening.
What is advanced authentication and where is it required?
The policy's term for multi-factor authentication: something you know plus something you have or are. It is required whenever criminal justice information is accessed from outside a physically secure location, which in practice means every patrol vehicle, every remote connection and most workstations. Implementing it well, so it does not slow officers down, is a large part of the work.
Who audits us, and how often?
Your state's CJIS Systems Agency conducts technical security audits on a recurring cycle, typically every three years, and the FBI audits the state. Findings have to be remediated and reported. We prepare the documentation to the policy's structure, fix findings through the managed IT program, and attend the audit with you.
Can officers use personal phones for work?
Only under conditions the policy spells out: the device has to be managed, encrypted, protected by advanced authentication and able to be wiped, with criminal justice information kept inside a controlled application. Many agencies find it simpler to issue managed devices. We implement either approach so that it actually meets the policy.
We use a cloud records system. Isn't compliance the vendor's job?
The vendor is responsible for its platform and should be able to show you its own CJIS posture. The agency remains responsible for the devices, the network, the accounts, the authentication, the training and the people. A compliant records system reached from an unmanaged laptop with a shared password is still an audit finding.
Secure. Reliable. Responsive.
Book a consultation and we’ll map out a managed IT plan for your business. contact@atlasbm.net · (417) 619-6518