The Public Defender's Guide to
CJIS Compliance.
Understand the FBI's requirements for handling criminal justice data, when they apply to your office, and how EqualLaw is built to meet them.
December 2024 Update
Federal Security Framework
Data Never Leaves the US
Your Data Stays Private
What is the CJIS Security Policy?
CJIS is the FBI's Criminal Justice Information Services Division — the organization behind national criminal justice systems and services. The CJIS Security Policy (CJISSECPOL) is the FBI's baseline cybersecurity standard for systems that store, process, transmit, or access Criminal Justice Information (CJI) — including vendors and contractors supporting those systems.
CJISSECPOL is not a product “certification” you buy. In practice, compliance is governed and validated through state CJIS authorities, required agreements, and audit expectations (which can vary by state).
What Data Does It Cover?
The policy protects Criminal Justice Information (CJI) — specifically, FBI CJIS-provided data. Discovery materials may contain CJI when they include Criminal History Record Information (CHRI), National Crime Information Center (NCIC)-derived data, or other FBI CJIS-provided records.
Criminal Justice Information (CJI)
CJISSECPOL scope when sourced from FBI CJIS systems
- CHRI / Interstate Identification Index (III) criminal history records
- NCIC-derived data (e.g., warrants, stolen property, missing persons)
- Biometrics & identity history from FBI CJIS systems (e.g., fingerprint / Next Generation Identification (NGI)-derived records)
- Person/property/case/incident history from FBI CJIS systems
Also Sensitive (But Not Automatically CJI)
These items are often governed by state law, protective orders, and confidentiality/ethics rules, even when they are not FBI CJIS-provided CJI:
- Body camera & surveillance footage
- Police reports & incident narratives
- Witness statements & local records
If your workflow includes FBI CJIS-provided records, CJISSECPOL controls may apply. Otherwise, we use CJIS-aligned controls as a high-security baseline for discovery.
Does CJIS Apply to Public Defenders?
A common misconception is that CJIS compliance is only for law enforcement and prosecution offices. The reality is more nuanced — and the risk of getting it wrong falls on your office.
I. The General Rule
“The CJISSECPOL applies to all entities with access to, or that operate systems which are used to process, store, or transmit CJI.”
The policy applies to entities with access to FBI CJIS-provided Criminal Justice Information (CJI) or operating systems that process, store, or transmit it. A Criminal Justice Agency (CJA) is defined as a governmental agency which “performs the administration of criminal justice... and which allocates a substantial part of its annual budget to the administration of criminal justice.” Whether a defender office is treated as a CJA or authorized recipient is state-specific and often depends on direct CJIS/CHRI access arrangements with the state CJIS Systems Agency (CSA).
II. The Judicial Exception
Many defenders rely on the exemption in Section 4.1:
“CJI introduced into the court system pursuant to a judicial proceeding that can be released to the public via a public records request is not subject to the CJIS Security Policy.”
III. Why the Exception Is Not Enough
While the judicial exception exists, relying on it for your entire data infrastructure is risky. The exemption is fact-dependent and limited: by its own terms, it applies only to CJI that has been introduced into the court system and that can be released to the public via a public records request. Before introduction, the exception does not apply. And whether data “can be released publicly” is jurisdiction-dependent — protective orders, sealed filings, and statutory exemptions can all prevent public release. Discovery materials that contain FBI CJIS-provided data (e.g., CHRI, NCIC-derived records) remain subject to CJIS controls unless the judicial-public-record exception clearly applies.
Separate from CJISSECPOL, many states set retention and security expectations for criminal-justice evidence systems (especially law-enforcement capture and storage programs). Those expectations often flow downstream into vendor requirements, protective orders, and local practice:
Conclusion
Whether or not your office is subject to direct FBI audits, if your office (or a vendor acting on your behalf) has access to CJI as defined in CJISSECPOL under state CJIS/CSA arrangements, CJIS-aligned controls are typically expected for the systems that store, process, or transmit that data. Separately, court orders, confidentiality duties, and state evidence-handling rules can impose independent security and retention obligations even for non-CJI material.
How EqualLaw Implements the Policy
CJIS v6.0 maps to the National Institute of Standards and Technology (NIST) 800-53 control framework, organizing security requirements into 20 control families. We group these into 4 operational pillars. The policy assigns each control a priority level (1 through 4): P1 controls and those already existing in prior CJIS policy versions are sanctionable now; remaining P2 through P4 controls become sanctionable after September 30, 2027.
Each control family below shows the FBI mandate, how EqualLaw implements it, and what your office is responsible for.
Looking for the full control-by-control breakdown? Our CJIS Audit Matrix covers all security controls with detailed mandates, audit evidence requirements, and implementation status.
Information Exchange Agreements
Agreements must be executed "before exchanging CJI" and must specify security controls, data ownership, and roles.
EqualLaw executes the official FBI CJIS Security Addendum (Appendix H) with every agency. This legally binds us to FBI security mandates and establishes your ownership of the data.
Designate an "Agency Coordinator" to maintain visibility into our security posture and manage the agreement.
Access Control
Systems must enforce "Least Privilege" (AC-6), limit failed logins to 5 attempts (AC-7), automatically lock sessions (AC-11), and strictly regulate External Systems/Bring Your Own Device (BYOD) usage (AC-20).
EqualLaw enforces RBAC (Role-Based Access Control) to ensure attorneys only access assigned cases. We implement automated 90-day inactivity disabling (AC-2), AES-256 encrypted remote access (AC-17), and restrict data downloads on unmanaged devices.
Letting us know promptly when someone leaves your office helps us revoke their access quickly, though this can also be self-service. If your staff accesses case files from personal phones, we recommend establishing a BYOD policy, though EqualLaw restricts data downloads on unmanaged devices by default.
Identification & Authentication
Systems shall enforce MFA at Authenticator Assurance Level 2 (AAL2) for all users (IA-2). Passwords must be checked against "banned password lists" (IA-5), and users must re-authenticate every 12 hours or after 30 minutes of inactivity (IA-11). Remote users must undergo "Identity Proofing" (IA-12) with address confirmation (IA-12(5)).
EqualLaw enforces AAL2 phishing-resistant MFA using Federal Information Processing Standards (FIPS) 140-validated cryptographic modules. We implement automated 30-minute session re-authentication and block weak or compromised passwords using a real-time banned-password API. Our onboarding includes IAL2-compliant identity verification to ensure every user is a uniquely resolved individual.
MFA is enforced automatically by the platform. If a staff member loses an MFA device, letting us know allows us to reset their credentials quickly. During onboarding, we handle identity verification to bind each user to their account.
Personnel Security
All personnel with unescorted access to CJI must undergo national fingerprint-based record checks (PS-3). Upon termination or transfer, system access must be disabled within 24 hours (PS-4, PS-5). Agencies must maintain a formal list of all authorized users (PS-3).
Every EqualLaw engineer with logical access to our production environment has passed a state and national fingerprint-based background check. We maintain a rigorous internal "Insider Threat" program and execute annual security re-attestations. Our SaaS architecture ensures that while we manage the application, your data remains encrypted such that the underlying cloud provider (AWS) never has access (PS-7).
When someone leaves your office, an admin can revoke their access directly from the platform. You can also contact us and we will handle it for you.
Awareness & Training
Per AT-2 and AT-3, all personnel must complete security training "prior to accessing CJI" and "annually thereafter." Training must specifically cover social engineering, insider threats, and Personally Identifiable Information (PII) handling. Training records must be retained for a minimum of 3 years (AT-4).
EqualLaw mandates rigorous role-based training for all internal engineering staff (Privileged Users). To assist your compliance, our platform includes a "General User" training tracking module to help you log completion status.
If your office handles CJI directly, annual security awareness training may be required by your state CSA. Our platform includes a training tracking module to make this easy if you need it.
Who Does What
CJIS compliance is a shared responsibility. Here is how it breaks down between our infrastructure provider, EqualLaw, and your office.
Physical Layer
Data Center, Power, Cooling, Destruction
Application Layer
Encryption, Access Control, Audit Logs
User Layer
Device Passwords, Screen Privacy, Offboarding
Where We Stand
There is no federal “CJIS certification” that vendors can obtain. Compliance is a contractual and operational commitment — which is why we publish a detailed CJIS Audit Matrix that maps every control family to our implementation.
Here is exactly where EqualLaw stands on our compliance journey.
CJIS v6.0 Architecture
Core engineering alignment complete
Personnel Screening
Background checks for all engineering staff
Appendix H Execution
Ready to sign Security Addendums
SOC 2 Type II
In Progress
Frequently Asked Questions
Do you have a "CJIS Certification"?
No — the FBI does not issue a "CJIS certification" for vendors or products. Compliance is governed and validated through state CJIS authorities, required agreements, and audit expectations (which vary by state). We sign the CJIS Security Addendum (Appendix H), which legally binds us to meet the policy's security requirements.
Where is my data hosted?
All data is hosted in the United States on AWS infrastructure. We utilize data centers that meet CJIS physical security requirements. Your data never leaves the US legal jurisdiction.
What is the "Shared Responsibility" model?
Security is a partnership. AWS secures the physical data center (gates, guards, power). EqualLaw secures the application (encryption, access controls, audit logs). Your office secures your local devices (passwords, screen privacy, offboarding). We provide the tools to make your part easy. That said, the technology is secure on its own — adopting EqualLaw doesn't require your office to change how it operates. If your office chooses to risk-accept the user-layer responsibilities, nothing else needs to change on your end.
What happens to my data if we cancel?
Per Media Sanitization (MP-6) protocols, we provide a full export of your case files followed by a cryptographic deletion of all data from our servers. We do not retain “ghost copies” of your client data.
Do public defenders need CJIS compliance?
It depends on whether your office handles FBI CJIS-provided data (CHRI, NCIC records, etc.). If it does — through direct CJIS access arrangements or by receiving CJI in discovery — then CJIS controls apply to that data. A narrow judicial exception exists for CJI introduced in court and publicly releasable, but it does not cover all pretrial or sealed materials. Even where CJIS does not strictly apply, state evidence-handling rules, court orders, and professional ethics duties often set independent security expectations — making CJIS-aligned controls a defensible baseline.
Resources & Further Reading
Official CJIS documentation, technical standards, and resources for deeper research.
CJIS v6.0 Control Audit Matrix
All security controls with mandates, audit evidence, implementation blueprints, and status tracking
FBI CJIS Security Policy v6.0
Official CJIS Security Policy document (December 2024)
FBI CJIS Division
Official FBI CJIS program information and resources
CJIS Advisory Process
Board that provides input on CJIS policies and procedures
NIST Special Publication 800-88 Rev. 1
Guidelines for Media Sanitization (referenced in CJIS policy)
AWS CJIS Compliance
AWS documentation on CJIS compliance capabilities
See How This Works in Practice
Walk through our security documentation with us, ask the hard questions, and see the platform handling real discovery workflows.