Primary references
Use the original standards below to check terminology and requirements. These references explain the standards; they do not endorse CISGuard or independently verify its product coverage.
All frameworks
CJIS Security Policy Automation
CJIS Security Policy controls,proven on every scan.
CISGuard automates the technical CJIS Security Policy areas that audits hinge on: access control, auditing and accountability, and configuration management, with air-gapped deployment for criminal justice networks.
United StatesLaw Enforcement, Courts, Corrections, Government Vendors
- Governing body
- FBI CJIS Division, with state CJIS Systems Agencies (CSAs)
- Protected data
- Criminal Justice Information (CJI): criminal history, biometrics, case data
- Who must comply
- Law enforcement, courts, corrections, and their vendors and cloud providers
- Control alignment
- Requirements aligned with NIST 800-53; CISGuard maps 50 controls
- Enforcement
- Periodic audits by the FBI and state CJIS Systems Agencies
- Air-gapped support
- Yes; suits isolated criminal justice and dispatch networks
Overview
What is CJIS?
The FBI CJIS Security Policy governs the protection of Criminal Justice Information (CJI): criminal histories, fingerprints, case data, and related records. It binds every entity that accesses CJI, including police departments, sheriffs, courts, corrections, dispatch centers, and the private vendors and cloud providers that serve them. The policy defines requirement areas spanning access control, identification and authentication, auditing and accountability, configuration management, and system and communications protection, and its recent revisions align the requirements with NIST 800-53 controls. Compliance is enforced through the CJIS Systems Agency in each state and periodic FBI audits. Because most CJIS technical requirements are configuration requirements on the systems that touch CJI, CISGuard's continuous CIS benchmark scanning evidences them directly, on networks that are frequently isolated by design.
How CISGuard automates CJIS evidence
CJIS audits examine whether the systems that store, process, or transmit CJI are configured to policy: password and MFA settings, audit logging, least functionality, encryption, and documented change control. Agencies and vendors usually reconstruct this evidence manually before each audit cycle. CISGuard makes it a standing record instead: continuous CIS benchmark scans across every in-scope Windows and Linux system show per-control pass/fail against hardening baselines aligned with the NIST 800-53 controls CJIS requirements map to; drift detection documents that configurations stayed compliant between scans; the immutable audit trail evidences the auditing and accountability area. Because many criminal justice networks are segmented or fully isolated, CISGuard's on-premises and air-gapped deployment matters: full scanning, reporting, and evidence generation with zero internet dependency. CISGuard is not an auditor and does not grant CJIS compliance; it produces the technical evidence your CSA and FBI audits examine.
Configuration evidence supports an assessment; it does not by itself establish certification, authorization or full compliance. Review coverage boundaries and evaluation evidence.
Control mapping
CJIS Security Policy areas CISGuard automates.
Each CIS control is tagged with its framework reference. One scan produces the per-framework coverage report, with satisfied, partially satisfied and not-met status for every control.
| Control area | Controls | Mapped by |
|---|---|---|
| Access Control | Least privilege, session lock, unsuccessful login limits | CIS Account + Privilege Management benchmarks |
| Identification and Authentication | Password standards, MFA for CJI access | CIS Password Policy + MFA configuration benchmarks |
| Auditing and Accountability | Auditable events, log content, log protection | CIS Audit Policy benchmarks (Windows + Linux) |
| Configuration Management | Least functionality, baseline configurations, change control | Continuous CIS scanning + drift detection |
| System and Communications Protection | Encryption in transit, boundary protection | CIS Cryptography + Network benchmarks |
| Formal Audits | Evidence production for FBI / CSA audit cycles | Framework Coverage Report + immutable audit trail |
Auditor evidence
Evidence artifacts CISGuard generates.
Auditor-grade outputs in PDF, HTML, JSON, CSV and SARIF. No spreadsheets, no screenshots, no manual cross-referencing.
- Per-asset CIS benchmark results for every system in the CJI environment
- Configuration management evidence: baselines, drift events, change history
- Audit-policy verification evidence for auditing and accountability requirements
- Password, session, and MFA configuration status across in-scope systems
- Framework Coverage Report mapped through NIST 800-53 for audit preparation
- Air-gapped deployment evidence for isolated criminal justice networks
Frequently asked
CJIS questions, answered directly.
Who has to comply with the CJIS Security Policy?
Every entity that accesses Criminal Justice Information: police departments, sheriffs' offices, courts, corrections, prosecutors, dispatch centers, and, critically, the private vendors, IT contractors, and cloud providers that handle CJI on their behalf. Vendor personnel and systems fall under the same requirements as agency systems, typically formalized through agreements with the agency and the state CJIS Systems Agency.
Does CISGuard make my agency CJIS compliant?
No single tool makes you CJIS compliant, and CISGuard is not an auditor or certifying body. CJIS compliance spans policy, personnel screening, physical security, and training as well as technical controls. What CISGuard automates is the technical-control evidence: continuous proof that in-scope systems meet hardening, access control, auditing, and configuration management requirements, which is the portion of the audit that consumes the most preparation time.
How does CISGuard map to CJIS requirements?
Recent CJIS Security Policy revisions align the requirements with NIST 800-53 controls, and CISGuard tags the CIS benchmark checks that evidence its 50 mapped 800-53 controls with those control IDs. Scan results therefore roll up to the control families behind CJIS areas such as access control, identification and authentication, auditing and accountability, and configuration management. The Framework Coverage Report presents that rollup with drill-down to per-asset scan evidence.
Can CISGuard run on an isolated or air-gapped criminal justice network?
Yes. CISGuard deploys fully on-premises and supports air-gapped operation: installation from secure media, local scanning, local reporting, and zero external dependency. This fits CJI environments where internet-connected SaaS scanners are unacceptable or simply unreachable, including segmented dispatch networks and isolated records systems. Updates to benchmark content are applied through the same offline media process.
How does CISGuard help with FBI and CSA audit cycles?
Audits are periodic, but the policy expects controls to operate continuously between them. CISGuard's scheduled scans every 4-24 hours build a timestamped history showing each system's compliance posture across the entire audit interval, not just audit week. When the FBI or your CJIS Systems Agency arrives, the Framework Coverage Report and drift history are already assembled, replacing weeks of screenshot collection.
CJIS readiness, on request.
Our compliance engineers have helped organizations achieve regulatory readiness through a seamless, fully managed deployment.