A CJIS compliance checklist lists what the FBI's Criminal Justice Information Services (CJIS) Security Policy requires from any organization that accesses Criminal Justice Information (CJI) or runs the systems that process, store or transmit it. City and county IT teams look for one when their police department, sheriff's office, courts or dispatch center connect to state and FBI systems, and the people who manage those devices and networks have to show the controls are in place before the next audit.
This guide covers the current version of the policy, the September 30, 2027 deadline and a checklist organized by its 20 policy areas. It then goes deeper into the inventory of devices, software and connections the policy asks for, and the evidence to keep ready for auditors.
What is CJIS compliance?
CJIS compliance means meeting the minimum security requirements of the CJIS Security Policy, which applies to every entity with access to CJI or that operates systems used to process, store or transmit it, as the FBI explains in its CJIS Security Policy Resource Center. CJI covers the FBI-provided data agencies need for their work, including biometric, identity history, biographic, property and case or incident history data.
Compliance is verified through audits. The FBI CJIS Audit Unit audits each state's CJIS Systems Agency (CSA), and the CSA runs the security program for its whole user community, local agencies included. The policy works as the minimum standard, and a state or local agency can add stricter requirements on top of it.
Who it applies to in a city or county
The policy distinguishes two kinds of agencies. A Criminal Justice Agency (CJA) is a court, a governmental agency or a subunit that administers criminal justice and spends a substantial part of its budget on it, such as a police department or a sheriff's office. A Noncriminal Justice Agency (NCJA) provides services mainly for other purposes, which describes most city and county IT departments.
When city or county IT supports police or court systems, a management control agreement is the usual way in: the policy lets a government NCJA designated to perform criminal justice functions for a CJA access CJI under that agreement (control SA-9 and the sample in Appendix D.2). That places IT staff, the devices they manage and the network they run inside the audit scope, so the CJIS view becomes one more slice of the same estate a county already tracks with its Asset Management software for local government.
CJIS Security Policy v6.1 and the September 30, 2027 deadline
The current version is CJIS Security Policy v6.1, approved by the Advisory Policy Board and the Compact Council on June 25, 2026. It builds on version 6.0 (December 2024), which completed the modernization of the policy and organized it into 20 policy areas, most of them families of numbered controls such as AC, CM or SI.
Each modernized control carries a marking. Since October 1, 2024, the requirements that existed before the modernization (marked Existing) and those marked Priority 1 form the sanctionable set, while Priority 2, 3 and 4 requirements sit in a zero-cycle that ends on September 30, 2027. The checklist below shows which items already count in an audit and which ones have to be ready when the zero-cycle ends.
The CJIS compliance checklist
The table follows the 20 policy areas of v6.1 in the policy's own order. Each row names the main requirements to have in place and whether they are already sanctionable, based on the markings of each control.
| Policy area | What to have in place | Sanctionable |
| 1. Information Exchange Agreements | Signed agreements before any CJI is exchanged (CJIS User Agreement, management control agreement, CJIS Security Addendum for contractors), reviewed at least every three years (CA-3) | Yes |
| 2. Access Control (AC) | Account management, least privilege, encrypted and monitored remote access; accounts disabled within one week after 90 days of inactivity (AC-2, AC-3, AC-6, AC-17) | Yes |
| 3. Awareness and Training (AT) | Security literacy training before access to CJI and every year after, role-based training, training records kept three years (AT-2, AT-3, AT-4) | Yes |
| 4. Audit and Accountability (AU) | Audit records with the required content, weekly review of audit records, records kept at least one year (AU-3, AU-6, AU-11) | Partly: event logging (AU-2) is Priority 2 |
| 5. Assessment, Authorization, and Monitoring (CA) | A continuous monitoring strategy (CA-7), control assessments at least once every three years (CA-2), a plan of action and milestones (CA-5) | Partly: CA-7 and CA-3 now, CA-2 and CA-5 after the zero-cycle |
| 6. Configuration Management (CM) | Baseline configuration and network topology drawing (CM-2), configuration settings (CM-6), authorized software list (CM-7), system component inventory (CM-8) | Partly: CM-2, CM-6, CM-7 and CM-8 now; CM-11 and CM-12 after the zero-cycle |
| 7. Contingency Planning (CP) | Contingency plan, backups of user and system information and documentation, recovery procedures (CP-2, CP-9, CP-10) | After September 30, 2027 |
| 8. Identification and Authentication (IA) | Unique user IDs, multi-factor authentication for privileged and non-privileged accounts, authenticator management (IA-2, IA-5) | Partly: IR-6 is Priority 2 |
| 9. Incident Response (IR) | Incident response plan and handling (IR-4, IR-8); suspected incidents reported within one hour of discovery (IR-6) | After September 30, 2027 |
| 10. Maintenance (MA) | Controlled maintenance, approved tools, strong authentication and records for remote maintenance (MA-2, MA-3, MA-4) | Yes |
| 11. Media Protection (MP) | Media access, storage and transport controls; sanitization by overwriting at least three times or degaussing before disposal or reuse (MP-2, MP-4, MP-5, MP-6) | Partly: environmental controls (PE-9 to PE-15) after the zero-cycle |
| 12. Physical and Environmental Protection (PE) | Physical access authorizations, access control and logs for the physically secure location, monitoring (PE-2, PE-3, PE-6) | After September 30, 2027 |
| 13. Planning (PL) | System security and privacy plan, rules of behavior (PL-2, PL-4) | Yes |
| 14. Personnel Security (PS) | State and national fingerprint-based record checks before access (PS-3); access disabled within 24 hours of termination (PS-4) | Partly: PS-3 now, PS-4 after the zero-cycle |
| 15. Risk Assessment (RA) | Vulnerability scanning at least monthly (RA-5); risk assessment (RA-3) | Partly: RA-5 now, RA-3 after the zero-cycle |
| 16. System and Services Acquisition (SA) | External service providers bound by the policy's agreements (SA-9); replacement of unsupported components (SA-22) | Partly: SA-9 now, SA-22 after the zero-cycle |
| 17. System and Communications Protection (SC) | Boundary protection (SC-7); CJI encrypted in transit and at rest outside physically secure locations with FIPS 140-3 certified modules or FIPS 197 (AES) with 256-bit keys (SC-8, SC-13, SC-28) | Yes |
| 18. System and Information Integrity (SI) | Security updates installed within 15, 30, 60 or 90 days by severity (SI-2), malicious code protection (SI-3), system monitoring (SI-4) | Yes |
| 19. Supply Chain Risk Management (SR) | Supply chain risk management plan reviewed every year, component disposal under the media protection rules (SR-2, SR-12) | After September 30, 2027 |
| 20. Mobile Devices | Mobile Device Management (MDM) with centralized administration for devices that access CJI directly; no rooted or jailbroken devices (section 5.20) | Yes |
Information Exchange Agreements and Mobile Devices keep the older section format and carry no markings. The policy treats unmarked sections as existing requirements, so they remain auditable and sanctionable today.
The inventory part: devices, software and connections that touch criminal justice data
A large part of the checklist depends on knowing exactly which devices, software and connections touch CJI. The system component inventory (CM-8) is Priority 1, and the baseline configuration, flaw remediation, vulnerability scanning and the replacement of unsupported components all assume it exists and is current.
This is the part of IT Asset Management (ITAM) that a CJIS audit tests most directly. The sections below follow the controls in the order an auditor usually walks through them.
What the system component inventory must record
CM-8 asks for an inventory that accurately reflects the system, includes every component, avoids counting a component twice or under another system, and works at the level of detail needed for tracking and reporting. The inventory must be reviewed and updated every year, and enhancement CM-8(1) adds that it gets updated as part of every installation, removal and system update.
The control also lists the minimum information each record has to carry. The table below shows those fields, plus the machine names and network addresses the policy's discussion recommends for networked components.
| CM-8 field | What it looks like in practice |
| Date of installation | The day a laptop was imaged and issued, or a switch was racked |
| Model | The exact model, as reported by the device |
| Serial number | A unique identifier for each component, which also prevents duplicates |
| Manufacturer | The hardware vendor |
| Supplier information | The reseller, contract or purchase order the component came from |
| Component type | Laptop, desktop, server, switch, firewall, mobile data terminal, phone |
| Software owner | The person accountable for each application |
| Software version number | The full installed version, so it can be compared against advisories |
| Software license information | License type, quantity and the contract that covers it |
| Hardware and physical location | Building, room, rack or patrol vehicle |
| Machine name and network addresses | Hostname plus IPv4 and IPv6 addresses for networked components |
Mobile devices
AC-19 asks for configuration and connection requirements for agency-controlled mobile devices, including when they leave controlled areas, and for authorization before they connect to agency systems. Section 5.20.2 adds that devices with limited-feature operating systems that access CJI directly need MDM with centralized administration, and that a device with unauthorized changes, such as rooting or jailbreaking, can never be used with CJI.
Phones and tablets in patrol cars, laptops assigned to detectives and tablets used in courtrooms belong in the same inventory as desktops. Each record should show which MDM manages the device and when it last checked in, so a device that stopped reporting gets noticed before an auditor finds it.
Software allowed to run
Enhancement CM-7(5) is Priority 1: identify the software programs authorized to run, block everything else with a deny-all, permit-by-exception policy, and review the list every year. CM-11 adds agency policies for software that users install, enforced through automated methods and monitored at least weekly, while CM-10 asks to track software covered by quantity licenses.
An authorized list only works when it is compared against what is actually installed. The CM-8 discussion notes that software installed on several systems needs a system association for each instance, which is why the installed software inventory has to come from the devices themselves and stay current.
Connections and where criminal justice data lives
CM-2 (Existing, Priority 1) asks for a current baseline configuration and a current, complete topological drawing of how the agency network connects to criminal justice systems, reviewed every year, after security-relevant changes or incidents, and whenever components are installed or upgraded. CM-12 asks to document where CJI is processed, stored or transmitted, on which components and by whom, and CA-9 asks to authorize, document and review every year the internal connections of components that can handle CJI.
The policy's own example is a local police department that updated its computer-aided dispatch (CAD) system. It tracked every infrastructure change in a configuration management journal, added the new components to its network topology documents and marked that documentation For Official Use Only before storing it securely.
Unauthorized components
Enhancement CM-8(3) is Priority 1. It requires automated detection of unauthorized hardware, software and firmware continuously or at least weekly, and when something is found, disabling or isolating it and notifying the personnel with security responsibilities. IA-3 complements it by requiring agency-managed devices to be uniquely identified and authenticated before they connect.
Detection and isolation usually live in different tools. Discovery and inventory reveal the device, and network access control or switch configuration isolates it, so the evidence for this control is the scan schedule, the list of unknown devices found and the record of what was done with each one.
Unsupported components, patching and disposal
SA-22 asks to replace components once the developer, vendor or manufacturer stops supporting them, or to document alternative support from the original manufacturer or contracted vendor. SI-2 (Existing, Priority 1) sets the clock for security updates: critical within 15 days, high within 30, medium within 60 and low within 90 after release.
Disposal closes the lifecycle. MP-6 requires sanitizing or destroying digital media before disposal, release or reuse, by overwriting at least three times or degaussing, and inoperable media must be destroyed; SR-12 applies those same techniques to system components, so each retired asset should show how and when it was sanitized.
How to keep audit evidence ready
Auditors look for proof that each control runs on its schedule, and the policy sets most of those schedules itself. The table below gathers the recurring evidence a city or county IT team should be able to produce on request.
| Evidence | Control | How often |
| System component inventory with its review date | CM-8 | Every year, and updated with each installation and removal |
| Baseline configuration and network topology drawing | CM-2 | Every year, after security-relevant changes and when components change |
| Authorized software list | CM-7 (5) | Reviewed every year |
| User-installed software compliance checks | CM-11 | At least weekly |
| Unauthorized component detection results | CM-8 (3) | Continuously or at least weekly |
| Vulnerability scan reports | RA-5 | At least monthly |
| Patch records against deadlines | SI-2 | 15, 30, 60 or 90 days by severity |
| Audit record reviews | AU-6 | Weekly |
| Audit records | AU-11 | Kept at least one year |
| Privilege reviews | AC-6 (7) | Every year |
| Training records | AT-4 | Kept at least three years |
| Control assessments | CA-2 | At least once every three years |
| Information exchange agreements | CA-3 | Reviewed at least every three years |
Evidence holds up better when it comes straight from the systems that run the controls, with dates attached, than when someone rebuilds it in a spreadsheet the week before the audit. The same discipline applies to every public body that has to prove what it owns and where it is, as our guide to IT Asset Management for government explains in more detail.
How InvGate Asset Management helps city and county IT
InvGate Asset Management is ITAM software that offers an enterprise experience without the complexity or the price of one, built on ease of use: an intuitive interface, a no-code approach and fast deployment. For city and county IT, it keeps the inventory that a CJIS audit asks for current on its own and turns it into evidence that can be exported or sent on a schedule.
These are the capabilities that map to the inventory part of the checklist. Each one names the control it supports.
- A complete inventory (CM-8). Assets come in through the Agent, network discovery, integrations and manual or CSV import, and each record holds serial number, model, manufacturer, owner, location, acquisition date, installed software with full versions, contracts and vendors.
- Scheduled discovery (CM-8(3)). Each discovery source runs on the schedule IT sets, daily, weekly or with a custom frequency, and the devices network discovery finds wait in the Discovery view until IT converts them into assets, in bulk when needed, or excludes them.
- Change history (CM-8(1)). The Activities tab of each asset keeps a record of its changes.
- Mobile devices (AC-19 and section 5.20). Integrations with Microsoft Intune, Jamf, SOTI MobiControl and Google Workspace bring MDM-managed devices into the inventory, and Intune devices can be filtered by last check-in to spot the ones that stopped reporting.
- Authorized software (CM-7(5) and CM-11). Authorization policies classify software as allowed, under review or banned and flag unauthorized installations, and a health rule can mark every device where banned software is detected.
- Device posture (SC-28, SI-2 and SI-3). Health rules flag computers with encryption, antivirus or firewall deactivated or missing, and with operating system updates pending.
- Privileged users (AC-6). A filter shows which computers have local administrator users.
- Unsupported components (SA-22). The Atlas AI Agent adds End-of-Support and End-of-Life dates to assets, and a Smart Tag can group everything that reaches End of Support in the coming months.
- CJI scope (CM-12). Smart Tags mark every asset inside the boundary where CJI is processed, stored or transmitted, and saved views and scheduled reports send that list to whoever needs it.
- Annual review (CM-8). Physical audits run by location from the mobile app with QR codes or RFID tags, and each asset keeps the date and result of its last audit.
- Access to the inventory itself. Role-based permissions control who can see people records, locations and device geolocation.
InvGate Asset Management can be deployed in the cloud, on-premises, in hybrid setups or in air-gapped environments, so agencies that want the inventory inside their own network can keep it there. InvGate was also included as a Representative Vendor in the Gartner® Market Guide for Hardware Asset Management Tools (February 2026).
How the Judicial Branch of Arizona in Maricopa County built its inventory in five days
The Judicial Branch of Arizona in Maricopa County serves more than 4.7 million residents with 3,000 employees and 160 judicial officers. Its IT assets were tracked in spreadsheets that depended on one or two people, and when the county allocated a multi-million-dollar budget for endpoint replacement in 2025, the team needed an accurate inventory to show where the money would go.
The team deployed the InvGate Agent through Microsoft Intune, reached every endpoint in 18 hours and had a complete inventory of roughly 4,000 machines across five judicial divisions five days later. "We were able to produce a breakdown of what we have in our environment in just 15 minutes," said Keith Bluestein, Deputy CIO, in the Judicial Branch of Arizona in Maricopa County case study.
Conclusion
A CJIS compliance checklist for city and county IT starts with the 20 policy areas of v6.1 and the markings that say what is sanctionable today. Existing and Priority 1 requirements already count in an audit, and the rest have to be in place when the zero-cycle ends on September 30, 2027.
The inventory sits underneath most of those controls, from configuration management to patching and disposal, so keeping it complete and current is the most practical place to start. To see how InvGate Asset Management keeps that inventory and its evidence ready, start a free trial or talk to Sales.
Frequently Asked Questions
These are the questions city and county IT teams ask most often when they start working on CJIS compliance. Each answer refers back to the policy sections covered above.
What version of the CJIS Security Policy is current?
The current version is CJIS Security Policy v6.1, approved on June 25, 2026. The FBI publishes it, together with a requirements companion document, on its CJIS Security Policy Resource Center.
What changes after September 30, 2027?
That date ends the zero-cycle for requirements marked Priority 2, 3 and 4. Existing and Priority 1 requirements have been sanctionable since October 1, 2024, so agencies should have the remaining modernized requirements in place by the end of the zero-cycle.
Does city IT have to comply if it isn't a police department?
Yes, when it supports systems or people with access to CJI. City or county IT usually works as a noncriminal justice agency under a management control agreement, which brings its staff, devices and network into the audit scope.
How often does the CJIS inventory need to be reviewed?
The system component inventory must be reviewed and updated every year and whenever components are installed, removed or updated. Detection of unauthorized components has to run continuously or at least weekly.
How many policy areas does the CJIS Security Policy have?
Version 6.1 has 20 policy areas, from Information Exchange Agreements to Mobile Devices. Many older guides list 13, which reflects the structure of versions before the modernization.
