New FBI Criminal Justice Information Services (CJIS) Security Rule Requirements
Upcoming Events
Related News
Key Takeaways
From Our Partners
This post is sponsored by our partners at Sectri.
The FBI’s Criminal Justice Information Services (CJIS) Security Policy 6.0 introduces the most significant modernization of CJIS requirements in more than a decade. While enforcement milestones begin earlier, all CJIS agencies are expected to meet the updated requirements by October 1, 2027.
At a high level, CJIS 6.0 shifts agencies away from checklist compliance and toward continuous risk management, governance, and accountability.
Key changes include:
- Stronger identity and access controls
Enhanced requirements for identity proofing, password-based authentication, multi-factor authentication, account lifecycle management, and rapid account disabling when risk is detected.
- Expanded audit and evidence expectations
Agencies must be able to demonstrate, not just assert, that controls are implemented, reviewed regularly, and adjusted based on risk, and operational changes.
- Formalized governance and ownership
Clear expectations for defined security roles, documented responsibilities, and executed oversight of CJIS security, not just IT-level education.
- Ongoing risk assessment and monitoring
CJIS 6.0 aligns more closely with NIST standards, requiring agencies to identify risks, track remediation efforts, and show progress over time rather than relying on point-in-time assessments.
For many agencies, the challenge is not understanding what CJIS 6.0 requires, it’s having a practical way to track compliance, manage evidence, monitor risk, and report progress to leadership across multiple departments and systems.
Platforms like Sectri are designed specifically to help agencies operationalize CJIS 6.0 by centralizing requirements, mapping controls, tracking risk and remediation, and producing audit-ready evidence, without adding administrative burden to already-stretched teams.
With the 2027 deadline approaching, agencies that begin aligning governance, risk management, and compliance activities now will be far better positioned to meet CJIS 6.0 expectations with confidence.
Learn more about how agencies are preparing for CJIS 6.0 requirements.
Related News
Counties and Railroads: Shared Priorities for the Next Surface Transportation Bill
County leaders from across the country have a vital opportunity to ensure their infrastructure priorities are front and center.
House committee passes local broadband permitting preemption bills
The American Broadband Deployment Act of 2025 would enact new restrictions on a variety of state and local land use and zoning authorities pertaining to the deployment of telecommunications infrastructure.