CJIS v6.1 Compliance: 5 Practical Priorities for Agencies

Meeting CJIS v6.1 Requirements

Agencies protecting Criminal Justice Information (CJI) must ensure security controls are effective across all systems and provide auditable proof. Challenges include legacy systems, limited IT resources, and evolving access needs, which can hinder consistent application of controls.

Multi-Factor Authentication (MFA)

CJIS v6.1 mandates MFA for both privileged and non-privileged accounts, covering local, network, and remote access under controls IA-2(1) and IA-2(2). Agencies need to review MFA coverage across their environment, focusing on legacy applications and administrative accounts. Phishing-resistant methods like FIDO2 security keys are recommended.

Reliable processes for enrolling, replacing, and revoking authenticators are necessary. Solutions such as Specops Secure Access can extend MFA protection to Windows logons, RDP, RADIUS, and offline access, offering flexible options and event API integrations for audit evidence. MFA configurations require regular review as systems and access needs change.

Account Management and Privileges

CJIS v6.1 emphasizes effective account management and the principle of least privilege to mitigate risks from outdated access permissions. Agencies should maintain an accurate inventory of user, administrative, service, and temporary accounts. Permissions must be limited to essential functions for each role, and administrative privileges should be separated from everyday activities.

Automating account provisioning and removal is advised where possible. Accounts and privileges require review at least annually, and temporary or emergency accounts must be removed promptly after use.