Confirm CJIS applies and what it asks
Who it covers, what it asks for in plain words, and the dates that matter. The regulator has the final say; we read it with you.
Federal & defense · FBI CJIS Division
FBI CJIS Security Policy 6.0
Anyone handling criminal justice information, including contractors, with full compliance expected by October 1, 2027.
Rather skip the call? Get a fixed-fee CJIS 6.0 quote in writing.
One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing
Who it applies to
The businesses that carry CJIS 6.0, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Which packages prepare you for it
Cyber and Data Protection Assessment
Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year
There is no CJIS 6.0 package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the CJIS 6.0-specific requirements are scoped with you in a 30-minute call.
What it asks for
In plain English, what CJIS 6.0 expects you to have in place.
- The CJIS Security AddendumSigned by every vendor with access to criminal justice information, through the agency you serve, and the controls it commits you to.
- Personnel screeningFingerprint-based background checks for everyone with unescorted access, before access is granted.
- Security awareness trainingRole-based training at hire and every year after, with records the agency can audit.
- Advanced authenticationMulti-factor authentication for access to criminal justice information from outside a physically secure location.
- EncryptionFIPS-validated encryption for criminal justice information in transit and at rest outside a physically secure location.
- Audits by the agencyLogs kept and reviewed, and audits by the CJIS Systems Agency, which can find you out of compliance and cut access.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Where it starts
Your one-stop shop for CJIS
The CJIS Security Policy applies to every agency and contractor that touches criminal justice information: MFA, encryption, personnel screening, audit logs, incident reporting and an agreement with the agency that shares the data.
We scope the information, run the gap assessment against the policy areas, fix the gaps and prepare the evidence the state CJIS systems officer asks for.
Trace the information: tick what is true
Tick what applies and we show which policy areas you have to evidence.
The steps
Six steps from "does CJIS apply to us?" to evidence you can show
The whole CJIS journey, short version. We handle every step with you.
Scope it
Which systems, data, people and vendors are in. A clear boundary is a smaller job and a cleaner answer.
With AccuSights: we scope it with you from the intake form and put it in writing.
Run the gap assessment
What you have versus what the rule expects: tooling, configurations, policies and the records that prove each one.
With AccuSights: your engineer tells you how far each control needs to go.
Fix and document
Most gaps are in the policies and workflows nobody wrote down, not the firewall.
With AccuSights: remediation is in-house or with your IT provider, verified in your real environment.
Stay continuously compliant
Controls drift between reviews. Someone has to notice.
- MFA on CJI systemsPassing
- Screening on file for every userPassing
- Logs reviewed this weekPassing
- Agency agreement currentPassing
With AccuSights: our endpoint agent and monitoring catch the drift and flag it to your engineer.
Report, renew, reuse
The evidence that proves it, filed where the next inspector, auditor or customer can find it, and mapped to the next framework you need.
With AccuSights: evidence keeps collecting itself, so next year is a renewal and not a rerun.
Why AccuSights
Why small teams pick AccuSights for CJIS
Most compliance platforms assume you have a security team. We built this for the companies that do not.
Priced for a startup, not a Series D
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
The endpoint agent is built in
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A human who has done this before
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
Written once, read everywhere
One control set is mapped to every framework you carry, so evidence is produced once and reused.
What it costs
What CJIS costs, in plain numbers
Here is what is published, with who published it and when.
$0The FBI does not charge for the policy; the state CJIS systems agency audits. The cost is the controls and the screening.Source: FBI CJIS Security Policy (2025)
A fixed feeReadiness and the fixes, in writing within 24 hours of the intake form.Source: AccuSights pricing page (2026)
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Self-serve compliance software
- You get a portal and drive it yourself.
- Expert help is often a separate purchase or a partner referral.
- Device checks usually need an MDM you set up first.
- Pricing comes after a sales call.
AccuSights
- A named engineer runs it with you.
- Guidance and remediation are included, not referred out.
- The endpoint agent ships with the platform.
- A fixed fee, in writing, within 24 hours of the intake form.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
More on CJIS 6.0, in plain words.
Questions
CJIS questions we get every week
What changed in CJIS Security Policy 6.0?
Version 6.0, released in December 2024, reorganized the policy around the NIST SP 800-53 Revision 5 control families and raised several requirements, with agencies and vendors expected to reach full compliance by 1 October 2027. Vendors that already map to NIST controls will find most of the evidence familiar.Source: FBI, CJIS Security Policy resource center
Is there a CJIS certification?
No. The FBI does not certify vendors. Compliance is shown through the CJIS Security Addendum, the agency's agreements, and audits by the state CJIS Systems Agency and the FBI. A vendor that says it is CJIS certified usually means it has passed those reviews with a particular agency.Source: FBI, CJIS Security Policy resource center
Do vendor staff need background checks?
Yes. People with unescorted access to unencrypted criminal justice information need a fingerprint-based record check under the policy's personnel security requirements, plus security awareness training. Plan for it in hiring and onboarding, because the agency will ask for the list.Source: FBI, CJIS Security Policy resource center
Does CJIS require MFA and encryption?
Yes. The policy requires multi-factor authentication for access to criminal justice information outside physically secure locations and encryption of the data in transit and at rest, with FIPS-validated cryptography. Both are common audit findings for small vendors.Source: FBI, CJIS Security Policy resource center
Do you certify CJIS compliance?
No. The state CJIS Systems Agency and the FBI audit and decide. We prepare you: the gap assessment against Policy 6.0, the controls, the evidence and the policies, built on the same NIST control set we use for NIST SP 800-171.
Where do we start with CJIS 6.0?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do CJIS 6.0 separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.
Also in Federal & defense: CMMC 2.0 · NIST 800-171 · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for CJIS 6.0.
Book the demo and see how one control set carries CJIS 6.0 and everything else you owe. Or leave your details and an engineer replies within one business day.