CJIS v6.1 compliance requires agencies to enforce MFA, strict account management, and audit readiness

Criminal justice agencies protecting Criminal Justice Information must now demonstrate ongoing compliance with CJIS v6.1 security requirements, according to a report by BleepingComputer. The updated standards require agencies to maintain strong authentication, account security, and audit controls rather than simply installing security tools.

Meeting these requirements involves proving that security controls work effectively across daily operational systems. Agencies often struggle to apply these controls consistently due to legacy infrastructure, limited IT resources, and changing access needs, even when they possess strong security practices.

Compliance Priorities and Authentication

CJIS v6.1 explicitly requires multi-factor authentication for both privileged and non-privileged accounts under controls IA-2(1) and IA-2(2). This mandate covers local, network, and remote access scenarios. The primary challenge for agencies is ensuring that no accounts are excluded from these protections, particularly within legacy applications or administrative environments.

Agencies should review their current multi-factor authentication coverage to identify gaps. When implementing these controls, the guidance suggests considering phishing-resistant methods such as FIDO2 security keys. Reliable processes for enrolling, replacing, and revoking authenticators are also necessary to maintain security posture and audit readiness.

Account Management and Least Privilege

Access permissions frequently become outdated as employees change roles or leave an organization. CJIS v6.1 aims to reduce this risk by enforcing effective account management and the principle of least privilege. Agencies must start by maintaining an accurate inventory of all user, administrative, service, and temporary accounts within their environment.

Permissions should be limited to only what is necessary for each specific role. Administrative privileges must be separated from everyday activities to minimize exposure. Automating account provisioning and removal processes can help maintain accuracy. Agencies are advised to review accounts and privileges at least annually to ensure continued compliance.

What should you do?

Agencies should immediately audit their environments to ensure multi-factor authentication is enabled for all privileged and non-privileged accounts. This includes checking legacy systems and remote access points. IT teams need to establish clear procedures for managing authenticator enrollment and revocation to support future audits.

Organizations must also verify that their account inventories are current and that permissions align with the principle of least privilege. Regular reviews of administrative and service accounts are essential to prevent privilege creep. Ensuring these controls are documented and effective is critical for meeting CJIS v6.1 standards.

What to do and how to stay safe: CJIS

• Audit all privileged and non-privileged accounts to ensure multi-factor authentication is enforced for local, network, and remote access.
• Maintain an accurate inventory of user, administrative, service, and temporary accounts to support least privilege enforcement.
• Implement reliable processes for enrolling, replacing, and revoking authenticators to ensure ongoing compliance and audit readiness.
• Review account permissions and privileges at least annually to remove outdated access and separate administrative duties from daily tasks.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific controls does CJIS v6.1 mandate for authentication?

CJIS v6.1 requires multi-factor authentication for both privileged and non-privileged accounts under controls IA-2(1) and IA-2(2).

How often should agencies review account privileges?

Agencies should review accounts and privileges at least annually to ensure they align with current roles and least privilege principles.

What challenges do agencies face in meeting CJIS v6.1?

Agencies struggle with legacy systems, stretched IT teams, and constantly changing access needs, making consistent control application difficult.