CJIS Security Policy Areas

Regular, mandatory training for all personnel with access to CJI, emphasizing best practices for safeguarding sensitive information.

Establish a robust incident response plan that allows for rapid identification, containment, and resolution of security incidents.

Implement comprehensive logging and monitoring systems to track access and modifications to CJI, ensuring accountability and transparency.

Strictly manage and document access to CJI, limiting it only to authorized personnel with legitimate needs.

Use multifactor authentication to verify the identity of users accessing CJI, preventing unauthorized access.

Secure physical locations and devices storing CJI, restricting access to authorized individuals only.

Conduct thorough background checks and screenings for all employees and contractors with access to CJI.

Maintain detailed records of system configurations and changes, ensuring that all adjustments comply with CJIS standards.

Safeguard physical and digital media containing CJI during transport, use, and storage, ensuring no unauthorized access.

Regularly conduct internal audits to verify compliance with CJIS policies, preparing for the triennial FBI audits.

Properly dispose of or sanitize media that is no longer needed, ensuring that CJI cannot be recovered by unauthorized parties.

Implement policies for the secure handling and dissemination of CJI, ensuring it is always protected from unauthorized disclosure.

Secure all remote access to CJI with encryption and authentication measures that meet CJIS standards.

Enforce strict security policies for mobile devices accessing CJI, including encryption and remote wipe capabilities.

Encrypt CJI both in transit and at rest using methods that meet or exceed CJIS encryption standards.

Regularly update and patch systems to protect against known vulnerabilities, maintaining CJIS compliance.

Secure communication channels and system configurations to protect CJI from interception or unauthorized access.

Develop and regularly test disaster recovery plans to ensure continued access to CJI during emergencies.