On 5 October 2026, FBI cyber chief Brett Leatherman blamed a breach on “a security failure of a platform managed by a third-party organization.” A contractor, he said, “failed to implement a security patch explicitly issued to secure the platform” (SecurityWeek). The system held recruiting data, not criminal justice information. Even so, every agency that signs the CJIS Security Addendum relies on contractors in the same way.
CJIS Security Policy v6.1, dated 25 June 2026, now governs those contractors. It corrects v6.0 of December 2024, which rebuilt the policy around NIST SP 800-53 (policy PDF). One summary reports that FIPS 140-2 certificates will no longer be acceptable after 21 September 2026, and that the grace period for Priority 2 to 4 requirements ends on 30 September 2027 (ITNS). CJIS Compliance is therefore an important consideration for agencies and contractors.
Public-safety IT teams and software vendors can speak with a Qualysec expert about scope, controls and audit evidence.
What Is CJIS Compliance?
The FBI’s Criminal Justice Information Services Division publishes a Security Policy for anyone who handles Criminal Justice Information (CJI). Meeting that policy is what agencies and vendors mean by the term. Version 6.1 has 20 policy areas. Areas 2 to 19 map to 18 NIST SP 800-53 control families, while the information exchange and mobile device areas have no NIST family (Salty Cloud).
Three parties share the work. The FBI writes the policy. Each state’s CJIS Systems Agency (CSA) interprets it, can approve or deny access, and can order corrective action (GMR). The agency or vendor implements the controls and keeps the evidence.
Who Must Meet CJIS Compliance Requirements?
| Entity | Role | What it signs | Who audits it |
|---|---|---|---|
| Criminal justice agency | Uses and owns CJIS | State agreements with the CSA | State CSA, FBI sample audits |
| State CSA | Enforces the policy locally | Agreements with the FBI | FBI CJIS Audit Unit |
| Contractor or software vendor | Runs or connects to a criminal justice system | CJIS Security Addendum | Contracting agency and CSA |
| Cloud provider | Hosts CJI | Addendum through the agency | Contracting agency and CSA |
| Authorised recipient of criminal history records | Receives record checks | State user agreement | CSA, FBI audit unit |
The Addendum is what pulls private contractors in. It applies when a contractor manages a criminal justice system or connects to FBI CJIS systems. A contractor must keep a security program consistent with the policy in force at signing and every later version, and violations can end the agreement.
What Does CJIS Security Policy v6.1 Require?
The table lists the CJIS compliance requirements most often tested. Rows marked “reported” come from a secondary summary, so confirm them against the policy text.
| Control | Requirement | Status | Test relevance |
|---|---|---|---|
| AC-17(2) | Cryptographic protection of remote access sessions | Existing, P1 | Test every remote path |
| AC-19(5) | Full-device encryption on mobile devices handling CJI | Existing, P2 | Lost-device and MDM checks |
| AT-2, AT-3, AT-4 | Training before access and annually, role-based training, records kept for three years | Existing, P2 and P4 | Evidence sampling |
| AU-2, AU-6, AU-11 | Event logging, weekly review, one-year retention | Existing, P2 and P4 | Confirm attacks reach logs |
| CA-7 | Continuous monitoring | Sanctionable since 27 December 2024 | Retest after changes |
| RA-5 | Monthly scans, remediation in 15, 30, 60 or 90 days by severity | Reported | Verify fixes by retest |
| SC-13 | FIPS 140-3 validated modules, 256-bit AES | Reported | TLS and storage checks |
| Incident response | Internal report within one hour, plus notice to the FBI CJIS ISO | Reported | Escalation drills |
Priority 1 controls become sanctionable the moment a version publishes them. Requirements carried over from v5.9 are sanctionable now. New Priority 2 to 4 requirements enter a “zero cycle” that began on 1 October 2024, where gaps are noted but not sanctioned until 30 September 2027
Does CJIS Require Penetration Testing?
Not by name. NIST SP 800-53 reserves control CA-8 for penetration testing, and the v6.1 table of contents lists only CA-1, CA-2, CA-3, CA-5, CA-6, CA-7 and CA-9. No CA-8 appears. A buyer who reads “penetration testing requirements” in a vendor questionnaire is therefore reading a contract term or state rule, not policy text.
That doesn’t make testing optional in practice. The CSA interprets the policy for its state, and an auditor who finds a weak control wants proof that it works. Tests supply that proof.
| Control | What it asks | What a test proves | Evidence |
|---|---|---|---|
| CA-2 | Assess controls | Each control holds against a real attack | Test report |
| CA-7 | Monitor continuously | New changes didn’t reopen old gaps | Retest report |
| RA-5 | Scan and remediate | A fix closed the path, not just the ticket | Before and after results |
| AC-17(2) | Protect remote sessions | No access path skips encryption or MFA | Session captures |
| AU-6 | Review logs weekly | Attack traffic appears in the logs | Log samples |
How Do You Test CJIS-Scoped Systems?
The tester first writes down the CJI boundary: which systems store, process or transmit CJI. Each test then follows one loop. Record the baseline, change one input or access condition, try a second route to the same data, capture the evidence and retest after the fix.
CJI applications and APIs
Computer-aided dispatch, records management and state query interfaces get tested for authorisation between roles. A dispatcher token should not reach an administrator route, and one agency’s records shouldn’t be readable from another agency’s account. Direct object references, search filters and export functions each get a try. Logs from the application and the gateway go into the evidence file.
Remote access and multi-factor authentication
Salty Cloud lists two recurring audit gaps: “perimeter-only MFA” and “shared accounts without second-factor enforcement”. The tester therefore checks every path and not just the VPN, including web admin consoles, vendor support tools and API tokens. AC-17(2) asks for encrypted sessions, so session captures confirm that.
Encryption in transit and at rest
TLS settings, certificate handling and stored CJI are inspected, and the module claims are checked too. A product that relies on a FIPS 140-2 certificate needs a 140-3 path after 21 September 2026, per the ITNS summary. The tester asks for the validation record and compares it with what’s deployed.
Cloud environments and the CJI boundary
Storage permissions, tenant separation, identity roles and logging are tested against what the agency agreed with the provider. Cloud staff with logical access to CJI also fall under the Addendum, so that paperwork is requested as evidence. Anything outside the agreed scope stays untouched.
Mobile devices and in-vehicle terminals
AC-19(5) requires full-device encryption. The tester examines a device in a lost state, tries to bypass the management profile, and looks for cached CJI in app storage and screenshots. A terminal that boots to a usable session without re-authentication is a finding.
Audit logging and alerting
After the attack tests, the tester checks that each action left a log entry and that a reviewer would see it. The Texas companion document also requires an alert within one hour of an audit logging failure. So the tester stops a log forwarder and times the alert.
What Is CJIS Clearance?
It isn’t a federal security clearance. It means an individual has passed the agency’s screening to touch CJI. Fingerprint-based screening must finish before access is granted, and access must end promptly when a person leaves or changes role (Salty Cloud). Training under AT-2 comes before access and repeats every year.
Contractor staff add a second item. The contracting agency must give each employee a copy of the Addendum and the policy, then keep signed acknowledgments available for audit.
Is There a CJIS Compliance Certification?
The FBI doesn’t issue any such credential to vendors. Salty Cloud puts it this way: “There is no FBI-issued organisational CJIS certification.” A vendor that calls itself “CJIS certified” is using a term the FBI doesn’t confer.
What a buyer can ask for instead is concrete:
- The signed Security Addendum
- Written approval from the state CSA
- A recent penetration test report with retest results
- Independent attestations such as SOC 2 or FedRAMP, where they exist
Some states run their own vendor programs. Colorado’s CBI vendor management program is one example.
How Does a CJIS Compliance Audit Work?
The FBI CJIS Audit Unit works on a triennial schedule. It reviews each CSA and a sample of local agencies to show how the CSA ensures compliance. Its audits “review policies, procedures, practices, and data,” include interviews on specific processes, and end with a facility tour (FBI). CSAs then audit the agencies and contractors beneath them.
Findings carry deadlines. A CSA can restrict or suspend access when gaps stay open, which can disrupt investigations and dispatch (GMR). Appendix A lists what to have ready.
Worked Example: A Third-Party Patch Failure Behind the FBI’s October 2026 Breach
The FBI’s own account is short. Leatherman said the breach followed a contractor’s failure to apply a patch, and the FBI “has removed the contractor.” Reuters, citing sources, reported that the platform was Oracle PeopleSoft, which the FBI hasn’t publicly confirmed (SecurityWeek). The sources describe an HR system holding employee data. None of them reports that CJI was involved.
The technical detail comes from the vulnerability itself. CVE-2026-35273 in Oracle PeopleSoft allows unauthenticated remote code execution through /PSEMHUB/*. Organisations that couldn’t patch were told to block that path. ShinyHunters rewrote requests as /%50SEMHUB/, since %50 is the encoded form of “P.” Mandiant explained that many firewalls compare the literal path before decoding it, while Oracle WebLogic decodes it and routes the request anyway (BleepingComputer).
Mapped to the policy:
- Contractor accountability: the Addendum binds contractors to the policy, and the agency stays accountable for them.
- RA-5 scanning and remediation: the failure was a released patch that nobody applied.
- Boundary rules: a firewall rule on /PSEMHUB/ missed the encoded path, so the control didn’t hold.
- AU-6 log review: Mandiant advised searching WebLogic access logs for /PSEMHUB/ and encoded variants.
A penetration test would try the patched build with encoded and mixed-case paths, and it would pass only if both forms are rejected. That tests the patch and not the rule written around it.
Teams that want this kind of mapping applied to their own contractor platforms can book a scoping call with Qualysec.
What Should a CJIS Penetration Test Report Include?
A report earns its place in an audit file when an agency can trace each finding to a control and a fix. This structure does that.
1.ID, title, system
2.CJI boundary status
3.CJIS control reference
4.Environment and versions
5.Interface and preconditions
6.Reproduction steps
7.Expected vs observed
8.Evidence
9.Severity and impact
10.Remediation owner and due date
11.Audit artifact
12.Retest status
How does Qualysec help with CJIS compliance?
It tests the systems inside and beside your CJIS boundary, then gives you the files an auditor asks for. One honest note: the FBI issues no CJIS certification, and Qualysec doesn’t claim one.
Here’s how the services line up.
Web App and API Pentesting go after dispatch and records tools, where one role slips into another. Cloud Pentesting checks the setup you agreed with your provider. Internal and External Network Pentesting test the boundary itself, with Wireless Pentesting covering the airwaves around it. Mobile App Pentesting and Endpoint Security testing deal with the devices officers carry.
What lands in your hands? An executive summary, a full technical report and a Letter of Attestation. You also get daily status updates, real-time vulnerability updates and vulnerability fixing support. Then comes the retest report, because a closed ticket proves little.
All of it stays inside the written scope your agency approves.
Scoping a CJI boundary? Book a call with Qualysec’s team.
Conclusion
The FBI’s October 2026 incident turned on one unapplied patch at a contractor, and the same pattern sits behind many findings an auditor writes. CJIS compliance rests on controls that can be shown to work: a stated boundary, tested access paths and a retest after each fix. Teams that gather that evidence before the audit date answer the CSA’s questions with files and not promises.
How do you map your systems to the policy? Discuss your CJI boundary and audit timeline with Qualysec!
FAQs
What is CJIS compliance?
It means meeting the FBI’s CJIS Security Policy for any system or person that handles Criminal Justice Information. Version 6.1, dated 25 June 2026, sets the controls; the state CJIS Systems Agency enforces them locally, and agencies and contractors implement them and keep evidence. Private vendors enter scope by signing the CJIS Security Addendum.
Is there a CJIS compliance certification?
No. The FBI issues no CJIS certification to vendors, and a company calling itself “CJIS certified” is using a label the FBI doesn’t confer. What exists instead is a signed Security Addendum, approval from the state CSA, and test evidence. A buyer should ask for those documents and check them against the policy.
Does CJIS require penetration testing?
The policy doesn’t name it. The v6.1 control list includes CA-2 assessments, CA-7 monitoring and RA-5 scanning, but no CA-8 penetration testing control. A state CSA, a contract or an agency policy can still require a test. A report with retest results is strong evidence that the controls work, and that is why many agencies ask vendors for one.
How often is a CJIS audit conducted?
The FBI CJIS Audit Unit works on a triennial schedule, reviewing each state CSA and a sample of local agencies. A CJIS compliance audit by the CSA then covers agencies and contractors under it, and audits can also follow an incident or a risk indicator. Findings come with remediation deadlines and follow-up reviews.
Who needs CJIS background screening?
Anyone with unescorted access to CJI needs it, including contractor staff. CJIS clearance in this sense is fingerprint-based screening completed before access is granted, plus training before access and every year after. The contracting agency must also keep each contractor employee’s signed Security Addendum acknowledgment on file and ready for audit review.
How fast must vulnerabilities be fixed?
One v6.1 summary reports windows of 15 days for critical, 30 for high, 60 for medium and 90 for low severity, with scans at least monthly. Because that comes from a secondary source, confirm the numbers against the RA-5 text. Whatever the window, a retest should confirm that the fix actually closed the path.
