FBI Releases CJIS Security Policy v6.1 with Stricter Encryption and Vulnerability Scanning

CJIS Policy Modernization Continues

The FBI's Criminal Justice Information Services (CJIS) Security Policy version 6.1 was published on June 25, 2026. This release builds upon the modernization efforts initiated with version 6.0, which moved the policy towards a control-based structure aligned with NIST SP 800-53. Version 6.1 addresses omissions, corrections, and additions identified throughout 2025, maintaining the overall direction for security teams already implementing v6.0 requirements.

Key Technical Changes in v6.1

Version 6.1 introduces specific technical updates. Under SC-13, cryptographic protection for CJI in transit outside physically secure locations now requires a symmetric cipher key of at least 256-bit strength, an increase from the 128-bit requirement in v6.0. Similarly, SC-28, which covers CJI at rest outside physically secure locations, also mandates encryption strength of at least 256-bit.

Another significant change is in vulnerability management. While v6.0 required agencies to use vulnerability scanning tools at least quarterly, v6.1 mandates this frequency to be at least monthly. This change applies to determining whether security-related software and firmware updates have been installed and following security incidents involving CJI.

Audit and Compliance Considerations

Although v6.1 is the current CJIS Security Policy, agencies should not assume an immediate switch to a single new audit baseline. The modernized policy uses priority levels and phased audit and sanction dates. Priority 1 controls have been sanctionable since October 1, 2024, while Priority 2, 3, and 4 controls are in a “zero-cycle” status until September 30, 2027.

State CJIS Systems Agencies (CSAs) may provide their own implementation and assessment guidance. For example, Texas is auditing against v5.9.5 until March 31, 2027, allowing agencies time to prepare for v6.1. Organizations are advised to confirm current audit expectations with their relevant CSA while working towards the newer requirements.