Summary
- CJIS v6.1 strengthens requirements across multi-factor authentication, account management, password controls, audit logging, and ongoing compliance demonstration.
- Agencies must move beyond point-in-time compliance and build continuous, auditable security practices.
- MFA is a central pillar of v6.1 — any agency still relying on single-factor access to criminal justice information carries significant policy and operational risk.
- Account management controls, including handling of dormant and shared accounts, are explicitly in scope.
- Audit readiness is no longer an event — v6.1 expects agencies to demonstrate compliance on demand.
What changed with CJIS v6.1
The FBI’s Criminal Justice Information Services Security Policy v6.1 updates the compliance baseline that governs how agencies handle criminal justice information (CJI). The revision tightens expectations across several foundational security domains, with particular emphasis on strong authentication, disciplined account management, password hygiene, comprehensive logging, and the ability to demonstrate compliance at any point — not merely during a scheduled audit cycle.
Priority one: Multi-factor authentication
MFA sits at the top of the v6.1 agenda. Agencies that still permit single-factor access to systems containing CJI are out of step with the policy and expose themselves to both regulatory and operational consequences. The requirement applies to all users accessing CJI, including remote workers and third-party personnel. Agencies should review their current MFA coverage and close any gaps as a first order of business.
Priority two: Account management discipline
V6.1 puts account hygiene firmly in scope. This means regular review and remediation of dormant accounts, shared credentials, and accounts belonging to personnel who have changed roles or departed the organisation. Each of these represents a potential avenue for unauthorised access to sensitive criminal justice data. Agencies need a repeatable process — not a one-off clean-up — to keep account inventories accurate and access rights appropriately scoped.
Priority three: Password controls
Password requirements under v6.1 go beyond minimum length rules. The policy is aligned with current thinking on password security, which emphasises checking credentials against known-compromised password lists and avoiding overly rigid complexity rules that push users toward predictable patterns. Agencies should assess whether their current password policies reflect these principles and whether their technical controls can actually enforce them.
Priority four: Audit logging
Comprehensive logging of access to CJI systems is a v6.1 requirement, and the logs must be of sufficient quality to support both routine review and incident investigation. Gaps in logging — whether from misconfigured systems, excluded endpoints, or inadequate retention periods — undermine an agency’s ability to detect misuse and respond to compliance inquiries. Logging coverage should be audited alongside the systems themselves.
Priority five: Demonstrating ongoing compliance
Perhaps the most significant shift in v6.1 is the expectation that compliance is a continuous state, not a periodic exercise. Agencies need processes and tooling that allow them to produce evidence of compliance on short notice. This means documented policies, current configuration records, training logs, and audit trails that are maintained as a matter of routine rather than assembled under pressure before a review. Agencies that treat CJIS compliance as an annual checklist will find that posture increasingly difficult to defend.
Why it matters
For CISOs in law enforcement agencies or organisations that handle criminal justice information, CJIS v6.1 is not a distant concern — non-compliance can result in loss of access to FBI-managed CJI systems, which would be operationally crippling. Beyond regulatory consequence, the five priority areas map directly to the attack surfaces most commonly exploited in breaches: weak authentication, orphaned accounts, poor credentials, and invisible access trails. Getting these right is sound security practice regardless of the compliance obligation.
What to do now
- Audit current MFA coverage across all systems that touch CJI and remediate any single-factor access points.
- Implement a recurring account review process to identify and disable dormant, shared, or over-privileged accounts.
- Review password policies for alignment with v6.1 requirements, including checks against compromised credential lists.
- Assess audit logging coverage to confirm all CJI-adjacent systems are captured with adequate retention.
- Establish continuous compliance documentation practices so evidence can be produced on demand rather than reconstructed at audit time.
