Table of Contents
A CJIS Compliance Checklist Built on the Current Policy
A CJIS compliance checklist turns the CJIS Security Policy into clear requirements and the evidence to check across all 20 policy areas. Agencies that access criminal justice information (CJI) are audited by their state CJIS Systems Agency (CSA) and the Federal Bureau of Investigation (FBI), and a checklist helps them track where they stand.
The FBI released CJIS Security Policy v6.1 on June 25, 2026. Since many CSAs add their own requirements to that baseline, an audit-ready checklist must reflect both and cover every system, person, and service provider that handles CJI.
This guide walks security and compliance teams through scoping, all 20 CJIS policy areas, the evidence to collect, and the checks to run before an audit. It also includes a crosswalk that maps existing control work to CJIS requirements.
See What CJIS Adds to NIST 800-53
Map NIST 800-53 to CJIS Security Policy v6.1 across 67 controls with CJIS-specific values and five CJIS-only obligations.
Scope Criminal Justice Information Before the Checklist
Before working through a CJIS compliance checklist, agencies must list every system, location, provider, and person that touches CJI, whether in-house or through outside services.
Called the CJIS assessment scope, this list shows which requirements apply and where the controls and evidence are. To build a complete scope, agencies can:
- Map where CJI is processed, stored, and transmitted, including cloud services, mobile terminals, and printed records.
- Confirm the agency’s status with the CJIS Systems Officer (CSO). Whether it is a criminal justice or noncriminal justice agency shapes which agreements and requirements apply.
- List each information exchange requiring a formal agreement, along with the parties responsible for its security controls. Policy Area 1 specifies the agreement requirements.
- Name the employees and contractors whose access triggers screening and training. Under Personnel Security, unescorted access to unencrypted CJI generally requires screening unless a policy exemption applies.
- Document shared cloud responsibilities between the agency and the provider. The v6.1 Requirements Companion Document includes a matrix that can help show which requirements fall to the agency, the provider, or both. The agency remains accountable for compliance, even when a provider manages the controls.
- Collect signed CJIS Security Addendum acknowledgments from any contractor staff with access to CJI, and keep them for audits.
The CJIS Compliance Checklist, by Policy Area
The CJIS compliance checklist below summarizes all 20 CJIS policy areas and the evidence to look for under each. Agencies can use it to find the requirements that apply, then collect the supporting records and review the related technical settings.
A CJIS compliance checklist pairs each applicable CJIS Security Policy requirement with supporting evidence, helping agencies identify gaps before an audit. The checklist should reflect the current version, any applicable state requirements, and the agency’s environment.
| # | Policy area | What it covers | Evidence to Check |
|---|---|---|---|
| 1 | Information Exchange Agreements | The agreements that authorize each exchange of criminal justice information | A written agreement for every exchange, reviewed on cycle, specifying the security requirements and the impact level |
| 2 | Access Control (AC) | Who can reach what, from where, and for how long | Accounts deactivated on departure, permissions updated after role changes, device lock after no more than 30 minutes of inactivity, applicable safety exemptions documented, publicly accessible content reviewed quarterly |
| 3 | Awareness and Training (AT) | Literacy training for everyone, role-based training for named roles | Training completed before access and annually, recorded per person with a date and a role |
| 4 | Audit and Accountability (AU) | What is logged, how long it is kept, and who looks at it | Logs contain the required content, are retained, and are reviewed at least weekly, with evidence the review happened. |
| 5 | Assessment, Authorization, and Monitoring (CA) | Assessing controls and tracking what is not yet fixed | Control assessments performed, and a current plan of action and milestones with owners and dates |
| 6 | Configuration Management (CM) | Known-good configurations and controlled change | Documented baseline configurations, change control records, and least functionality enforced |
| 7 | Contingency Planning (CP) | Operating through disruption and recovering after it | A contingency plan that has been tested, and backups verified by an actual restore |
| 8 | Identification and Authentication (IA) | Proving who a user is before letting them in | User-chosen passwords at least 8 characters, current passwords compared against the blocklist quarterly, rate limiting at no more than five consecutive failed authentication attempts within 15 minutes, and MFA on privileged and non-privileged accounts |
| 9 | Incident Response (IR) | Detecting, reporting, and handling security incidents | An incident response capability tested annually, with suspected incidents reported to the organizational response capability immediately and no later than one hour after discovery, and required reporting recipients documented |
| 10 | Maintenance (MA) | Who touches the systems and under what supervision | Controlled and logged maintenance, authorized personnel, and nonlocal maintenance governed |
| 11 | Media Protection (MP) | Physical and removable media holding CJI | Media marked, stored, transported and sanitized to policy, with disposal evidenced |
| 12 | Physical and Environmental Protection (PE) | The rooms and buildings where CJI is handled | Physically secure locations defined, access authorized and monitored, visitor records kept and reviewed quarterly |
| 13 | Planning (PL) | The security plan and user responsibilities for the system | A current system security plan and rules of behavior, acknowledged by users |
| 14 | Personnel Security (PS) | Vetting people before access, and removing it afterwards | Required state record and national fingerprint-based checks completed before access for personnel with unescorted access to unencrypted CJI, including contractors; screening authority and applicable exemptions documented; termination and transfer procedures followed |
| 15 | Risk Assessment (RA) | Assessing threats, vulnerabilities, and potential consequences | Risk assessment performed and reviewed, and vulnerability scanning at least monthly |
| 16 | System and Services Acquisition (SA) | Security requirements for acquisitions and external services | Security requirements written into acquisitions, and external system services governed by agreement |
| 17 | System and Communications Protection (SC) | Protecting CJI in transit and at rest | Boundary protection in place, and 256-bit cryptographic protection verified for CJI in transit and at rest outside physically secure locations |
| 18 | System and Information Integrity (SI) | Keeping systems patched, monitored and clean | Flaw remediation status checked at least monthly, with malicious code protection and system monitoring active |
| 19 | Supply Chain Risk Management (SR) | Risk arriving through suppliers and components | Supplier assessments performed and component authenticity addressed |
| 20 | Mobile Devices | The extra controls once CJI leaves a secure location | Applicable device management and access controls verified, with any AC-11 safety exemption documented |
Evidence to Collect
Each checklist row summarizes one policy area. The evidence behind it typically includes the following:
- Account rosters
- Audit logs
- Patch reports
- Encryption settings
- Network diagrams
The Texas Technical Audit guide shows how a state audit reviews these records, although it is based on the older version of CJIS, 5.9.5.
Checks to Include in Your Audit Preparation
Before a CJIS audit, check controls against the current policy and any state requirements, then fix the gaps, starting with the highest risks. That includes:
- Tailored policies: Make sure written policies describe the controls the agency actually uses. According to Utah’s 2022 audit presentation, copied or generic policies are a common audit finding.
- Current accounts and permissions: Remove access for anyone who has left, and update permissions when roles change.
- MFA coverage: Check that MFA is on for every required privileged and non-privileged account, including workstation and administrator access. Record the setup and any gaps for review.
- Personnel screening: Confirm that employees and contractors with access to CJI have completed the required screening. For IT and cloud providers, also document who handles screening and any exemptions that apply.
- Audit-log review: Verify that logs are collected, kept, and reviewed as required, and save evidence of each review and its follow-up.
- Contractor acknowledgments: Keep signed Security Addendum acknowledgments for every current contractor, and update them when arrangements change.
These checks work alongside the full checklist above. For the requirements agencies must maintain year-round, see the CJIS compliance guide.
How CJIS Requirements Differ From NIST 800-53
CJIS Policy Areas 2 through 19 align with the 18 control families in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53. Unlike NIST, which leaves some control settings to the organization, CJIS sets specific values. For example:
- Identification and Authentication (IA-2): CJIS requires multi-factor authentication (MFA) for both privileged and non-privileged accounts. NIST Interagency Report 8523 offers practical MFA guidance for criminal justice systems, but agencies must still verify that their setup meets CJIS requirements.
- Device Lock (AC-11): Where NIST lets each organization choose how long a device can sit idle, CJIS sets a maximum of 30 minutes, with limited exemptions for certain criminal justice vehicles, dispatch systems, and alert terminals.
Agencies already following NIST 800-53 often have much of the groundwork in place for CJIS compliance. Still, their controls must meet CJIS’s specific requirements. Our CJIS requirements guide breaks down each control with the exact values CJIS sets.
Free CJIS↔NIST 800-53 Crosswalk
The free CJIS↔NIST 800-53 crosswalk is a filterable spreadsheet that maps existing NIST control work to CJIS v6.1 requirements.
Our crosswalk lets agencies see exactly where CJIS differs from 800-53. It includes:
- 67 NIST 800-53 controls with CJIS-specific values
- Side-by-side comparisons of what NIST leaves open and CJIS prescribes
- Columns for recording current values and flagging gaps
From there, security teams can plan a gap review.
How to Simplify CJIS Compliance
The simplest way to manage CJIS compliance is to keep everything—CJI scope records, screening and training records, Security Addendum acknowledgments, and audit evidence—all in one place. That way, compliance work stays current as the CJIS Security Policy evolves, CSAs add requirements, and contractors and systems change.
Isora GRC gives agencies a single connected workspace for CJIS compliance. In Isora, teams can choose which requirements apply, and connect the assessments, evidence, and findings behind them.
See the GRC Assessment Platform™ in action →
Inventory Management
Record systems that handle CJI, assign owners, and classify assets to define the scope of CJIS assessments. In Isora, inventory records link each asset to its assessment history and supporting documents, helping teams find system-specific evidence for CJIS audits.
Learn more about Inventory Management →
Assessment Management
Assign and track CJIS assessments so each review has clear ownership and deadlines. In Isora, assessment series group reviews by compliance goal, while live progress tracking and automated reminders help teams follow up on unfinished work.
Learn more about Assessment Management →
Questionnaires & Surveys
Collect control responses and supporting evidence to assess applicable CJIS requirements. In Isora, multiple contributors can complete one questionnaire and upload evidence alongside specific answers, helping reviewers check each response against its supporting records.
Learn more about Questionnaires & Surveys →
Reports & Scorecards
Review assessment results to identify CJIS gaps and prepare findings for audit review. In Isora, scorecards summarize assessment data and let teams drill down to individual responses and evidence, keeping findings traceable without manually compiling separate reports.
Learn more about Reports & Scorecards →
Key Takeaways
CJIS compliance starts with scoping every system, person, and provider that touches CJI, followed by checking all 20 policy areas against CJIS Security Policy v6.1, plus any state CSA requirements.
Existing NIST 800-53 programs can give agencies a head start, but each control must still meet CJIS’s more specific requirements.
Before every audit, confirm that written policies match the controls in use and that accounts and permissions reflect current staff and roles. Then, check MFA on all required accounts, screen for everyone with access to CJI, audit-log reviews with evidence, and signed Security Addendum acknowledgments for every contractor.
For ongoing requirements and the full audit process, see our CJIS compliance guide. Or, access the free crosswalk to compare existing compliance work with CJIS requirements.
Learn more about Isora GRC for CJIS compliance →
CJIS Compliance Checklist FAQs
What is a CJIS compliance checklist?
A CJIS compliance checklist breaks the CJIS Security Policy into 20 policy areas and the evidence to check for each. Area 1 covers information exchange agreements, Areas 2 through 19 follow 18 of the 20 NIST SP 800-53 control families, and Area 20 covers mobile devices.
How many items should a CJIS checklist have?
A CJIS checklist should have at least 20 items, one for each policy area in CJIS Security Policy v6.1. Agencies can then add control-level checks for the requirements that apply to their environment and any their state CSA adds.
What official resources support CJIS checklist preparation?
The FBI publishes the CJIS Security Policy and a Requirements Companion Document to support preparation. An agency’s CJIS Systems Officer can help identify the applicable state audit materials and evidence requirements.
What should an agency check first?
An agency should check its scope first, meaning every system, location, and person that touches CJI. That starts with confirming the agency’s status with the CJIS Systems Officer and mapping where CJI is processed, stored, and transmitted.
Does a checklist prove CJIS compliance?
No, a checklist only helps agencies prepare. Compliance is confirmed through audits by the state CSA and the FBI, which review agency policies and evidence that controls are in place. According to the FBI, its audits also include interviews, facility tours, and records review.
This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.
Other Relevant Content 