Case\/Incident history:<\/strong> Data about the history of criminal incidents.<\/li>\n<\/ul>\nHow Does CJIS Compliance Work?<\/h2>\n
The sensitivity of the types of data that qualify as CJI is an indication of just how complicated the CJIS Security Policy is. To complicate matters further, CJIS (under the FBI and in turn the U.S. Department of Justice) issues regular updates to the Security Policy. The complexity inherent in the national policy, in combination with the pressure of keeping pace with constant changes, has meant that many law enforcement, national security, and intelligence agencies opt not to share data between agencies in lieu of taking the necessary steps to keep it safe in compliance with CJIS.<\/p>\n
Each individual government agency is responsible for managing their own CJIS compliance. And the Security Policy applies to anyone interacting with that data, regardless of what system they use to do so or how they are associated with the agency that owns it. That means law enforcement representatives, lawyers, contractors, and private entities, for example, are all subject to the rules laid out in the CJIS Security Policy. What\u2019s more, state governments and their respective CJIS Security Officers are responsible for managing the application of the Security Policy at the state level.<\/p>\n
One thing to note is that there is no central CJIS authorization body, no accredited pool of independent assessors, nor a standardized assessment approach to determining whether a particular solution is considered CJIS compliant. Backblaze is committed to helping customers meet CJIS requirements.<\/p>\n
![\"A](\"https:\/\/www.backblaze.com\/blog\/wp-content\/uploads\/2023\/03\/pexels-thisisengineering-3861969.jpg\")
<\/p>\n
How To Meet CJIS Requirements<\/h2>\n
Despite all this complexity, CJIS doesn\u2019t issue any official compliance certifications. Instead, compliance with the Security Policy falls under the purview of each individual organization, agency, or government body. Having the right technical controls in place to satisfy all standardized areas of the policy\u2014and managing those controls on an ongoing basis\u2014is the best (and the only) way to achieve CJIS compliance. These are the 13 key areas listed in the Security Policy:<\/p>\n
Area 1: Information Exchange Agreements<\/h3>\n
The information shared through communication mediums shall be protected with appropriate security safeguards. The agreements established by entities sharing information across systems and communications mediums are vital to ensuring all parties fully understand and agree to a set of security standards.<\/p>\n
Area 2: Awareness & Training<\/h3>\n
Any individuals interacting with CJI have to participate in annual specialized training about how they are expected to comply with the Security Policy.<\/p>\n
Area 3: Incident Response<\/h3>\n
Every agency interacting with CJI must have an Incident Response Plan (IRP) in place to ensure their ability to identify security incidents when they occur. IRPs also outline plans to contain and remediate damage as quickly and efficiently as possible.<\/p>\n
Area 4: Auditing & Accountability<\/h3>\n
Organizations have to monitor who accesses CJI, when they access it, and what they do with it. Establishing visibility into interactions like file access, login attempts, password changes, etc. helps dissuade bad actors from accessing data they shouldn\u2019t and also gives agencies the forensic information they need to investigate incidents if breaches do occur.<\/p>\n
Area 5: Access Control<\/h3>\n
Another way to ensure that only authorized users interact with CJI is to limit access based on specific attributes like job title, location, and IP address. Implementing role-based access controls helps limit the availability of CJI, so only the people who need to use that data can access it (and only when absolutely necessary).<\/p>\n
Area 6: Identification & Authentication<\/h3>\n
Because of the rules around auditing, accountability, and access control, the Security Policy also stipulates the importance of authenticating every user\u2019s identity. CJIS\u2019 identification and authentication rules include the use of multifactor authentication, regular password resets, and revoked credentials after a certain number of unsuccessful login attempts.<\/p>\n
Area 7: Configuration Management<\/h3>\n
Only authorized users should be allowed to change the configuration of the systems that store CJI. This includes simple tasks like performing software updates, but it also extends to the hardware realm, for example when it comes to adding or removing devices from a network.<\/p>\n
Area 8: Media Protection<\/h3>\n
Compliant agencies must establish policies to protect all forms of media, including putting procedures in place for the secure disposal of that media once it is no longer in use.<\/p>\n
Area 9: Physical Protection<\/h3>\n
Any physical spaces (like on-premises server rooms, for example) should be locked, monitored by camera equipment, and equipped with alarms to prevent unauthorized access.<\/p>\n
![\"A](\"https:\/\/www.backblaze.com\/blog\/wp-content\/uploads\/2023\/03\/lianhao-qu-LfaN1gswV5c-unsplash-scaled.jpg\")
<\/p>\n
Area 10: System & Communications Protection<\/h3>\n
Cybersecurity best practices should be in place, including perimeter protection measures like Intrusion Prevention Systems, firewalls, and anti-virus solutions. In the category of encryption, FIPS 140-2 certification and a minimum of 128 bit strength are required.<\/p>\n
Area 11: Formal Audits<\/h3>\n
Although the CJIS doesn\u2019t issue compliance certifications, agencies still have to be available for formal audits by CJIS representatives (like the CJIS Audit Unit and the CJIS Systems Agency) at least once every three years.<\/p>\n
Area 12: Personnel Security<\/h3>\n
Any personnel with access to CJI have to undergo a screening process and background checks (including fingerprinting) to ensure their fitness to handle sensitive data.<\/p>\n
Area 13: Mobile Devices<\/h3>\n
In order to remain in compliance, organizations have to develop acceptable use policies that govern how mobile devices are used, how they connect to the internet, what applications they can have on them, and even what websites they can access. In this case, mobile devices include smartphones, tablets, and laptops that can access CJI. When representatives use mobile devices to access CJI, those devices (and that access) are subject to all the areas of the Security Policy.<\/p>\n
CJIS Compliance, Encryption, and Cloud Storage<\/h2>\n
Encrypting data prior to uploading it to cloud storage like Backblaze B2<\/a> is a great tool that can be applied to protect CJI data and help ensure compliance with the vast majority of the CJI requirements. Our team will work with your team to evaluate any remaining CJIS requirements.<\/p>\n","protected":false},"excerpt":{"rendered":"Different industries require different compliance standards\u2014which only makes sense because of the different types of sensitive data. In the world of criminal investigations, the Criminal Justice Information Services’ (CJIS) security policy is the standard. Here’s some things you need to know. <\/p>\n","protected":false},"author":188,"featured_media":108161,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"categories":[7],"tags":[468],"class_list":["post-108160","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-storage","tag-b2cloud","entry"],"acf":[],"yoast_head":"\n
CJIS Security Policy: Ensuring Data Compliance and Protection<\/title>\n<meta name=\"description\" content=\"Discover the CJIS Security Policy's role in law enforcement data protection and how organizations can ensure compliance for sensitive data.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CJIS Security Policy: Ensuring Data Compliance and Protection\" \/>\n<meta property=\"og:description\" content=\"Discover the CJIS Security Policy's role in law enforcement data protection and how organizations can ensure compliance for sensitive data.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/\" \/>\n<meta property=\"og:site_name\" content=\"Backblaze Blog | Cloud Storage & Cloud Backup\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/backblaze\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-02T17:31:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-12-15T00:27:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/03\/bb-bh-What-is-CJIS_-_Design-A-e1677700450788.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1440\" \/>\n\t<meta property=\"og:image:height\" content=\"820\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Mary Ellen Cavanagh\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@backblaze\" \/>\n<meta name=\"twitter:site\" content=\"@backblaze\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mary Ellen Cavanagh\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CJIS Security Policy: Ensuring Data Compliance and Protection","description":"Discover the CJIS Security Policy's role in law enforcement data protection and how organizations can ensure compliance for sensitive data.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/","og_locale":"en_US","og_type":"article","og_title":"CJIS Security Policy: Ensuring Data Compliance and Protection","og_description":"Discover the CJIS Security Policy's role in law enforcement data protection and how organizations can ensure compliance for sensitive data.","og_url":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/","og_site_name":"Backblaze Blog | Cloud Storage & Cloud Backup","article_publisher":"https:\/\/www.facebook.com\/backblaze","article_published_time":"2023-03-02T17:31:10+00:00","article_modified_time":"2025-12-15T00:27:39+00:00","og_image":[{"width":1440,"height":820,"url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/03\/bb-bh-What-is-CJIS_-_Design-A-e1677700450788.png","type":"image\/png"}],"author":"Mary Ellen Cavanagh","twitter_card":"summary_large_image","twitter_creator":"@backblaze","twitter_site":"@backblaze","twitter_misc":{"Written by":"Mary Ellen Cavanagh","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/#article","isPartOf":{"@id":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/"},"author":{"name":"Mary Ellen Cavanagh","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/person\/bd6dcea2ad6301102946e17f52ab188b"},"headline":"What Is the CJIS Security Policy?","datePublished":"2023-03-02T17:31:10+00:00","dateModified":"2025-12-15T00:27:39+00:00","mainEntityOfPage":{"@id":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/"},"wordCount":1303,"commentCount":2,"publisher":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/#primaryimage"},"thumbnailUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/03\/bb-bh-What-is-CJIS_-_Design-A-e1677700450788.png","keywords":["B2Cloud"],"articleSection":["Cloud Storage"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/","url":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/","name":"CJIS Security Policy: Ensuring Data Compliance and Protection","isPartOf":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/#primaryimage"},"image":{"@id":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/#primaryimage"},"thumbnailUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/03\/bb-bh-What-is-CJIS_-_Design-A-e1677700450788.png","datePublished":"2023-03-02T17:31:10+00:00","dateModified":"2025-12-15T00:27:39+00:00","description":"Discover the CJIS Security Policy's role in law enforcement data protection and how organizations can ensure compliance for sensitive data.","breadcrumb":{"@id":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/#primaryimage","url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/03\/bb-bh-What-is-CJIS_-_Design-A-e1677700450788.png","contentUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/03\/bb-bh-What-is-CJIS_-_Design-A-e1677700450788.png","width":1440,"height":820,"caption":"A decorative image of a computer displaying a lock with a magnifying glass hovering over the screen. Also a title that reads What is CJIS?"},{"@type":"BreadcrumbList","@id":"https:\/\/www.backblaze.com\/blog\/what-is-the-cjis-security-policy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What Is the CJIS Security Policy?"}]},{"@type":"WebSite","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#website","url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/","name":"Backblaze Cloud Solutions Blog","description":"Cloud Storage & Cloud Backup","publisher":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#organization","name":"Backblaze","url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/www.backblaze.com\/blog\/wp-content\/uploads\/2017\/12\/backblaze_icon_transparent.png?fit=512%2C512&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.backblaze.com\/blog\/wp-content\/uploads\/2017\/12\/backblaze_icon_transparent.png?fit=512%2C512&ssl=1","width":512,"height":512,"caption":"Backblaze"},"image":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/backblaze","https:\/\/x.com\/backblaze","https:\/\/www.youtube.com\/user\/Backblaze","https:\/\/en.wikipedia.org\/wiki\/Backblaze"]},{"@type":"Person","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/person\/bd6dcea2ad6301102946e17f52ab188b","name":"Mary Ellen Cavanagh","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/03\/ME_Headshot-150x150.jpeg","url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/03\/ME_Headshot-150x150.jpeg","contentUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/03\/ME_Headshot-150x150.jpeg","caption":"Mary Ellen Cavanagh"},"description":"Mary Ellen Cavanagh is a seasoned technologist specializing in data protection and storage. After 25 years of experience as a partner ecosystem solutions engineer, she now tells it like it is as a Sr. Partner Marketing Manager at Backblaze. When she's not busy developing go-to-market strategies and campaigns with Backblaze's channel partners, she can be found doing Sunday New York Times crossword puzzles\u2014in pencil\u2014with her wasband and cuddling with her five fur babies. Connect with her on LinkedIn","url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/author\/maryellen\/"}]}},"jetpack_featured_media_url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2023\/03\/bb-bh-What-is-CJIS_-_Design-A-e1677700450788.png","_links":{"self":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/posts\/108160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/users\/188"}],"replies":[{"embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/comments?post=108160"}],"version-history":[{"count":0,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/posts\/108160\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/media\/108161"}],"wp:attachment":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/media?parent=108160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/categories?post=108160"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/tags?post=108160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"A](\"https:\/\/www.backblaze.com\/blog\/wp-content\/uploads\/2023\/03\/bb-bh-What-is-CJIS_-_Design-A-e1677700450788.png\")
<\/p>\n