CJIS Security Policy: Protecting CJI in Texas Audits

Under the FBI CJIS Security Policy Version 6.1, contractors handling Criminal Justice Information must maintain 256-bit symmetric encryption, monthly automated vulnerability scanning, multi-factor authentication at Authenticator Assurance Level 2, and fingerprint clearances before touching agency records. A 60-day audit notice from the Texas Department of Public Safety requires proving these operational controls have already been running, not drafting unexecuted policies. Failing state review risks immediate suspension from Texas municipal and county contracts.

Most commercial contractors treat an upcoming state review as administrative paperwork. If your technical logs cannot prove that controls have been functioning over the prior months, a newly bound manual will fail inspection. Texas DPS evaluates the practical security operating model of your business, not good intentions.

Who Must Comply with the CJIS Security Policy in Texas

Any private contractor handling Criminal Justice Information for a Texas municipal court or county sheriff falls under federal and state statutory mandates. You do not need direct access to police computer terminals to be bound by these rules. Managing an offsite backup repository, maintaining a digital evidence management platform, or supporting court case software subjects your infrastructure and staff to review.

Defining Criminal Justice Information and Restricted CHRI

The Federal Bureau of Investigation divides information gathered by law enforcement into specific tiers. Criminal Justice Information encompasses biometric data and case files collected by criminal justice agencies. Within that umbrella sits Criminal History Record Information (CHRI), which carries distinct statutory restrictions under Title 28, Part 20, Code of Federal Regulations. CHRI includes arrest records, formal criminal charges, and final case dispositions.

When municipal courts share this data with a vendor to process citations or manage infrastructure, that data retains its legal protection. Unencrypted databases containing this information represent massive liability. If a vendor allows unauthorized logical access to these files, both the contractor and the government agency face mandatory reporting to state and federal authorities.

The Mandatory CJIS Security Addendum for Private Contractors

As documented in the CJIS Security Policy Guide by Isora GRC published in September 2026, Version 6.1 spans 473 pages and aligns 18 distinct policy areas with the NIST SP 800-53 Revision 5 control catalog. Every private vendor touching CJI must execute the formal CJIS Security Addendum, located in Appendix H of the policy. This document is a legally binding contract between the business, the public government agency, and the state.

By signing the Addendum, your business commits to enforcing federal and state standards. It grants the FBI and the Texas Department of Public Safety direct authority to audit your facilities, interview your personnel, and inspect your network configurations. You cannot sign an altered version. The addendum guarantees that the vendor assumes direct legal responsibility for protecting agency data across its systems.

How Texas DPS Enforces State and Municipal Vendor Audits

The Texas Department of Public Safety serves as the statewide CJIS Systems Agency. While the FBI establishes federal baseline regulations, Texas DPS oversees daily compliance and conducts formal inspections across municipal and county systems statewide. State enforcement ensures that vendors interacting with the Texas Law Enforcement Telecommunications System (TLETS) and the Texas Crime Information Center (TCIC) operate at or above federal thresholds. Your MSP runs your IT, but nobody runs your security program unless you designate someone to take operational ownership.

The Triennial Audit Rhythm and 60-Day Review Notice

Texas DPS operates on a triennial audit cadence, evaluating criminal justice agencies and their private contractors every three years. When an agency faces its scheduled review, the audit division issues a formal 60-day notification letter. This notice initiates an operational review into system architecture, vendor access controls, and administrative records.

State auditors evaluate specific operational items during an inspection. They check verification of designated liaisons, including the Local Agency Security Officer and Terminal Agency Coordinator. They demand signed copies of the CJIS Security Addendum for all active contractor agreements. Auditors inspect rosters of authorized personnel alongside verified state fingerprint clearances. They review architecture diagrams detailing network boundaries and cryptographic keys. Finally, they pull system logs to verify that monthly vulnerability scans and access reviews occurred on schedule.

Resolving Conflicts Between Federal Baselines and TAC 202

Contractors operating in Texas navigate an overlapping regulatory environment. Companies supporting public agencies face mandates from federal CJIS policy, Texas DPS guidelines, and Texas Administrative Code Title 1, Part 10, Chapter 202, which establishes Information Security Standards for state institutions.

State enforcement establishes a clear rule of legal precedence: whenever federal CJIS policy, Texas DPS mandates, and TAC 202 conflict, the most restrictive standard strictly governs. For instance, if federal policy permits a specific access mechanism but Texas DPS guidelines prohibit it or TAC 202 demands shorter session timeouts and stricter administrative authorization, the vendor must implement the more stringent control. Designing an architecture merely to satisfy baseline federal requirements leaves compliance gaps under Texas state standards.

Technical Controls for Data at Rest and Data in Transit

Version 6.1 introduced strict technical revisions modeled after NIST SP 800-53 Revision 5. You can no longer rely on commercial-grade defaults or passive firewall rules to protect public safety information. Systems must demonstrate active cryptographic protections and strict identity verification protocols across every layer of the computing stack through an active Enterprise Security Risk Management architecture.

Security Domain	NIST SP 800-53 Control	CJIS Version 6.1 Requirement	Common Contractor Finding
Cryptographic Protection	SC-13	Symmetric encryption keys must be 256-bit for data in transit and data at rest; FIPS 140 validation.	Legacy databases or internal APIs relying on 128-bit encryption or unvalidated commercial ciphers.
Vulnerability Monitoring	RA-5	Automated vulnerability scanning executed at least monthly across all systems touching CJI.	Running ad-hoc or quarterly vulnerability scans instead of the required monthly operational cadence.
Flaw Remediation	SI-2	Documented patch management processes remediating high-risk flaws within defined state windows.	Unpatched perimeter appliances, unmanaged firmware, and untracked service accounts.
Identification and Authentication	IA-2 and IA-5	Multi-Factor Authentication meeting NIST SP 800-63 Authenticator Assurance Level 2.	Using basic SMS codes or software authenticators that lack FIPS 140 Level 1 validation.
Incident Reporting	IR-6	Mandatory, immediate notification of all suspected or unconfirmed security events to state authorities.	Delaying notification to the State CSO while waiting for internal forensic teams to confirm data loss.

256-Bit Cryptographic Standards Under Control SC-13

As detailed in the CJIS Security Policy 6.1 Update by Peak, control SC-13 set the minimum symmetric encryption key strength to 256-bit for data at rest and data in transit. This standard applies to active production databases and offsite storage targets.

For data in transit, standard SSL or outdated TLS protocols fail state review. Web interfaces, database connections, and remote administration pipelines must enforce TLS 1.3 or properly configured TLS 1.2 utilizing FIPS 140-2 or FIPS 140-3 validated cryptographic modules. If a vendor routes municipal citation records or dispatch logs over internal networks using unencrypted cleartext or 128-bit ciphers, auditors issue an immediate non-compliance citation.

Multi-Factor Authentication and Boundary Enclaves

Under federal guidelines detailed in Microsoft Learn's CJIS Compliance Documentation, all organizational users accessing systems containing CJI must authenticate through multi-factor authentication conforming to NIST SP 800-63 Authenticator Assurance Level 2. Authenticators must achieve FIPS 140 Level 1 cryptographic validation. Text-message verification codes or consumer authenticator apps without hardware-backed device binding do not meet AAL2 standards.

Network boundary isolation remains the primary defense against catastrophic audit failure. The first priority when preparing infrastructure is boundary architecture: identifying where municipal records enter, where they are transformed, and where they rest. If your systems do not isolate agency data into a defensible enclave, Texas DPS will expand the scope of their inspection to encompass your corporate headquarters, every connected workstation, and your general corporate network.

Personnel Security and Texas DPS Fingerprint Vetting

Technical controls fall short if personnel security is neglected. CJIS compliance is an enterprise security operational discipline, not merely a cyber problem. Managing physical access badges, escorting technicians, and vetting background histories carry equal statutory weight to cloud firewalls under state review. A cloud enclave with perfect encryption fails state inspection if your physical facility server room lacks badged entry logging, visitor escorts, and physical barrier controls.

The Texas DPS FAST Electronic Fingerprinting Process

Under Texas DPS administrative guidelines, all vendor employees, software developers, systems engineers, and subcontractors who have direct or unescorted logical or physical access to unencrypted CJI must clear a fingerprint-based background check before receiving access. Commercial, name-based background checks through consumer credit bureaus do not fulfill this mandate.

Contractors must process personnel through the Texas DPS Fingerprint Applicant Services of Texas (FAST) system. Technicians schedule appointments at authorized electronic capture facilities, where fingerprints are captured digitally and checked directly against the Texas Crime Information Center and FBI Next Generation Identification databases. Granting an unvetted software engineer administrative credentials to troubleshoot a production database containing agency records is an immediate breach of the CJIS Security Addendum.

Role-Based Security Training and Recertification Cadence

Background clearance must be paired with structured security awareness education. Every contractor employee who touches agency systems must complete role-based CJIS Security Awareness Training prior to gaining system access. This training cannot be treated as a one-time onboarding milestone.

Cleared personnel must recertify their security training at least once every two years under CJIS personnel rules. Your business must maintain an auditable register documenting completion dates, training curriculum versions, and scores for every individual. When state auditors conduct their triennial review, they cross-reference active personnel access rosters with training dates and FAST clearance certificates. Any record gap leads to an immediate finding.

The 8-Step Texas Vendor CJIS Audit Readiness Checklist

When operating inside a 60-day Texas DPS audit notification window, there is no time for trial and error. Follow this operational checklist to prepare your staff, infrastructure, and governance models for state evaluation. If your team lacks dedicated leadership to enforce this cadence across the enterprise, a virtual CSO program ensures someone actively runs the operational controls across physical and digital boundaries.

Stages 1 to 4 Governance, Vetting, and Boundary Isolation

1. Execute and Validate the CJIS Security Addendum (Appendix H)
   This establishes the legal baseline for contractor access and proves vendor accountability to the state.
   Ensure the addendum is properly countersigned by executive leadership and the authorized representative of the contracting agency. Verify that every subcontractor supporting the engagement has executed identical addenda.
2. Audit All Personnel Against Texas DPS FAST Clearances
   Unvetted personnel accessing unencrypted records represent an immediate contract breach.
   Compare active administrative and developer user rosters against physical fingerprint clearance records from the Texas FAST network. Immediately revoke access for any employee whose paperwork is pending, expired, or missing.
3. Verify Biennial Security Awareness Training Records
   This confirms that all operators understand current data handling, social engineering, and boundary rules.
   Review personnel training files to ensure all training certifications fall within the mandatory two-year validity window. Verify that training records match the employee's specific operational role rather than relying on generic corporate office training.
4. Enforce and Document Physical and Logical Enclave Isolation
   This prevents Texas DPS auditors from expanding their review to your entire corporate network.
   Isolate servers, databases, and network links handling CJI into a dedicated security enclave. If you manage physical servers, verify that the server room utilizes badged entry controls, visitor sign-in logs, and continuous escort procedures.

Stages 5 to 8 Encryption, Access Hygiene, Scanning, and Incident Response

5. Validate 256-Bit Cryptography for Data in Transit and at Rest (SC-13)
   This eliminates automatic non-compliance findings for weak or outdated cryptographic ciphers.
   Audit all storage volumes, virtual disks, database backends, and external transmission pipelines. Ensure symmetric encryption runs at 256-bit with FIPS 140 validation, and disable legacy TLS 1.0 or 1.1 configurations on web gateways.
6. Audit Non-Human Identities, Service Accounts, and API Keys
   Automated pipelines and software integrations frequently harbor excessive administrative privileges.
   According to research published by the Non-Human Identity Management Group, 80% of identity-related security breaches involve machine credentials such as service accounts and API tokens, with 97% carrying excessive access privileges. Locate all service accounts moving CJI, rotate static API keys, eliminate shared administrative credentials, and enforce the principle of least privilege.
7. Transition Vulnerability Scanning to a Monthly Operational Rhythm (RA-5)
   Version 6.1 increased scanning frequency from quarterly to monthly.
   Organizations frequently present quarterly scan reports to state auditors, failing control RA-5. Execute automated monthly vulnerability scans across all enclave assets and establish documented remediation tracking under control SI-2.
8. Revise Incident Response Plans to Report Suspected Incidents (IR-6)
   CJIS 6.1 removed the qualifier requiring incidents to be confirmed before notification.
   Update your organizational incident response protocol to require immediate notification to the FBI CJIS Information Security Officer, State CJIS Systems Officer, and State Identification Bureau Chief upon suspecting unauthorized access. Waiting for internal digital forensics to confirm data exfiltration violates state reporting rules.

What to Do If Your Systems Fail a Texas DPS Compliance Audit

Receiving an audit finding from the Texas Department of Public Safety does not automatically terminate your municipal contract, but your response in the subsequent 72 hours dictates whether you retain it. State auditors issue formal deficiency reports that demand an immediate operational response.

Developing an Immediate Corrective Action Plan

When an auditor cites non-compliance, you must submit a formal Corrective Action Plan within the timeframe specified in your deficiency notice, typically 30 days. This document cannot be a collection of promises.

1. Isolate the Finding: Identify precisely which NIST SP 800-53 control, TAC 202 requirement, or Texas DPS guideline was breached.
2. Implement Immediate Containment: If the finding involves unencrypted data pipelines or an unvetted contractor, sever access or suspend the affected subsystem immediately to halt further compliance exposure.
3. Establish Defensible Technical Controls: Deploy the necessary technical remedies, such as upgrading encryption modules to 256-bit or locking down non-human identity credentials.
4. Document Operational Evidence: Collect system configuration dumps, audit logs, and policy updates proving the remediation is active in daily operations.
5. Submit the Remediated Architecture: Present the updated documentation and proof of operational enforcement back to the Texas DPS audit liaison and the contracting agency.

Engaging Executive Leadership to Preserve Agency Contracts

Most commercial IT Managed Service Providers handle desktop tickets, hardware provisioning, and basic network uptime. Your MSP runs your IT, but nobody runs your security program. Commercial providers do not take legal accountability for statutory compliance programs, nor do they write and defend Corrective Action Plans before state law enforcement agencies. Relying on an IT provider to navigate a Texas DPS audit deficiency leaves your executive team exposed.

Preserving your contracts requires active executive security leadership. You need an operator who reviews your architecture, interfaces directly with the Texas DPS audit division, and translates state requirements into daily practice. If your 60-day notice has arrived or you must remediate state audit findings, book a 30-minute risk discussion online or call 817-677-0515 with Total 360 Security to build, run, and defend your compliance program.

Frequently Asked Questions

What is the current version of the CJIS Security Policy?

The current operational standard is CJIS Security Policy Version 6.1, released by the FBI on June 25, 2026. This release spans 473 pages, maps 18 distinct policy areas directly to NIST SP 800-53 Revision 5 controls, enforces 256-bit symmetric encryption under control SC-13, and mandates at least monthly vulnerability scans under control RA-5.

Can our commercial IT managed service provider handle CJIS compliance for us?

No. Commercial IT providers manage helpdesk tickets, network uptime, and software patches, but they do not assume legal accountability for state regulatory defense. CJIS compliance requires managing physical facility security, executing statutory FAST electronic fingerprint clearances, and actively operating enterprise controls that general IT providers disclaim in their standard contracts.

What happens if a private vendor fails a Texas DPS CJIS audit?

If a private contractor fails an audit, Texas DPS issues formal deficiency citations requiring the submission of an immediate Corrective Action Plan. If deficiencies are severe or remain uncorrected within the designated remedy window, the state revokes systems access, forcing municipal and county agencies to terminate the vendor's commercial contracts immediately.

What background check is mandatory for contractor staff under Texas CJIS rules?

All contractor personnel who have direct or unescorted logical or physical access to unencrypted CJI must undergo a fingerprint-based criminal history check processed through the Texas DPS Fingerprint Applicant Services of Texas (FAST) network. Commercial name-based screenings through consumer reporting services do not satisfy state requirements, and personnel must clear the check before receiving system access.

How does Texas Administrative Code 202 interact with the federal CJIS policy?

Under Texas state legal precedence, whenever federal CJIS standards, Texas DPS requirements, and Texas Administrative Code Title 1, Part 10, Chapter 202 (TAC 202) conflict, the most restrictive requirement strictly governs. Contractors servicing Texas agencies must build their operational posture around the strictest standard across all three authorities rather than merely meeting the federal baseline.