CJIS v6.0: What's New and How Apptega Helps You Stay Compliant

Version 6.0 of the Criminal Justice Information Services (CJIS) Security Policy became available earlier this year. This long-anticipated update to the FBI’s cybersecurity standard marks a significant evolution in how law enforcement, national security, and intelligence entities protect sensitive information.

CJIS compliance is mandatory for any organization dealing with criminal justice information, including police departments, government agencies, and private organizations handling criminal justice data. And with version 6.0 introducing even more detailed controls and documentation requirements, achieving and maintaining compliance is about to become more complex.  

To support the CJIS community in meeting these new standards, we’ve built out the CJIS v6.0 framework in the Apptega platform, complete with assessments and task packs designed to make implementation fast and simple.  

In this post, we’ll walk through what CJIS v6.0 includes, why it matters, and how Apptega’s framework helps you operationalize compliance with clarity and confidence.  

‍

What Is CJIS?

The Criminal Justice Information Services Division (CJIS) is the largest division within the FBI. Created in 1992, CJIS provides a centralized repository for criminal justice data, including fingerprints, criminal histories, biometric data, and background checks. It serves as the backbone for secure law enforcement communication nationwide.  

Because of the sensitivity of this data, the FBI maintains a CJIS Security Policy, which defines baseline security controls that must be implemented by any entity, public or private, with access to the CJIS network or criminal justice information:  

• Law enforcement agencies  

• Courts and correctional institutions  

• State and local governments  

• Federal partners  

• Third-party service providers and contractors  

The CJIS Security Policy applies to both physical and digital access and covers a wide range of security domains, including encryption, authentication, access control, personnel vetting, and incident response.  

‍

What’s New in CJIS v6.0?

CJIS v6.0 reflects the evolving nature of today’s threats and the increasing sophistication of adversaries targeting law enforcement and intelligence systems. While earlier versions of the policy established a solid foundation, v6.0 introduces significantly more granularity and depth across control areas.  

Here are some of the key components of CJIS v6.0:

• 13 core security control areas with expanded requirements and greater specificity  

• 3 policy/procedure areas addressing broader governance issues  

• 1,578 individual control statements offering detailed expectations for implementing, monitoring, and enforcing policies  

• Stronger emphasis on encryption, identity management, endpoint protection, and supply chain security.  

CJIS v6.0 places greater emphasis on implementation accuracy and documentation. Organizations can no longer simply declare that a policy exists. They must now demonstrate how it’s enforced, monitored, and kept up to date.  

‍

The 13 Core CJIS Control Areas:

While the full CJIS framework is extensive, here’s a high-level look at the main control families:  

Information Exchange Agreements – Agencies must document how they share CJI with other organizations. V6.0 emphasizes more formalized agreements and audit processes for these exchanges.  

Security Awareness Training – Training is now required to be role-specific, ongoing, and tracked with evidence.  

Incident Response – Version 6.0 requires an incident response plan as well as testing, tabletop exercises, and documented lessons learned, documenting continuous improvement.  

Auditing and Accountability – Expanded logging requirements cover more system types, including cloud and mobile platforms. Agencies must define log retention periods and demonstrate log review processes.  

Access Control – Multi-factor authentication is required more broadly, including remote and privileged accounts. Session timeout, least privilege, and just-in-time access are emphasized.  

Identification and Authentication – New requirements address password complexity, credential rotation, and biometric options. Integration with identity providers must also meet CJIS standards.  

Configuration Management – Systems must be hardened according to secure baseline configurations. Version 6.0 requires stronger version control, patch timelines, and change approval documentation.  

Media Protection – Data at rest must be encrypted, and agencies must also track and sanitize retired media.  

Physical Protection – Facility controls such as card access, visitor logs, and surveillance systems are now required to be tested and reviewed periodically. Shared spaces must have additional safeguards.  

System and Communications Protection and Integrity – This area now includes explicit requirements for end-to-end encryption, intrusion, detection/prevention, and protections against supply chain attacks.  

Formal Auditing – Agencies may be required to participate in external assessments, tracking and documenting evidence of remediation and follow-up.  

Personnel Security – Contractors and third-party vendors will require more rigorous background checks, with emphasis on periodic reinvestigation of staff handling CJI.

‍Mobile Device Security – Version 6.0 introduces detailed controls for device management, remote wipe, mobile app restrictions, and mandatory encryption for all CJI stored or transmitted on mobile devices.  

Each area includes multiple sub-requirements, often with nested statements, outlining expectations for technical safeguards, procedural documentation, and verification mechanisms.  

‍

Why CJIS v6.0 Matters

Criminal justice data is some of the most sensitive information that exists. It includes personally identifiable information (PII), biometrics, investigation notes, warrants, and more. If exposed or compromised, the consequences are severe for individuals, agencies, and public trust.  

Recent cyberattacks on law enforcement agencies have shown how vulnerable these systems can be. From ransomware shutting down court systems to breaches of law enforcement data by hacktivist groups, the threat environment has become more volatile.  

CJIS v6.0 aims to raise the bar by ensuring every organization in the ecosystem adopts consistent, rigorous cybersecurity standards.  

Compliance Is Mandatory

Unlike voluntary frameworks like NIST CSF or ISO 27001, CJIS compliance is required for any organization that handles CJI. Noncompliance can result in:  

• Loss of CJIS network access  

• Contract termination (for vendors)  

• Legal penalties  

• Damaged reputation  

• Public sector funding loss  

If you touch criminal justice data, you need to be CJIS-compliant.  

‍

Apptega’s CJIS v6.0 Framework: Built for Real-World Compliance

In response to the CJIS v6.0 release, Apptega has built a robust framework inside our platform to help customers navigate this complex standard with ease and precision.  

Here's what's included in Apptega's CJIS v6.0 support:

• CJIS v6.0 Framework - Full mapping of all 406 controls, organized by control area. Many control statements are broken down further for clarity, while others are grouped to retain accuracy.  

• CJIS v6.0 Assessment - A 406-question assessment (one per control), designed for structured readiness reviews and internal audits.  

• CJIS v6.0 Task Pack - Automatically generates remediation tasks, one for each control/assessment question, to accelerate response and evidence collection.  

This enables organizations to map policies and evidence to each control, track implementation progress, and assign tasks across teams. They can also conduct internal assessments or readiness reviews, and easily report on CJIS posture to stakeholders. Let’s explore each of these components in more depth:  

1. The CJIS v6.0 Framework

Apptega’s CJIS framework contains all 406 CJIS v6.0 controls, organized into the 13 core areas and three procedural areas defined by the FBI.  

While the official policy contains 1,578 individual statements, Apptega has taken a pragmatic approach. In many cases, individual statements are grouped under the larger control they belong to, especially where they’re conceptually and operationally interdependent.  

This provides a clear, readable, and actionable structure, without sacrificing accuracy or completeness.  

Organizations can work directly within the framework by reviewing each control, uploading evidence, and marking implementation status.  

2. The CJIS v6.0 Assessment

Although the CJIS framework is primarily a set of requirements, Apptega has also created a dedicated assessment tool that mirrors the framework, with one question per control (406 total).  

This enables organizations to:  

• Conduct structured self-assessments.  

• Track readiness across departments or systems.  

• Provide auditors with evidence-aligned responses.  

The assessment is designed to be comprehensive but not overwhelming. Each question is written to broadly cover its associated control, ensuring that users can capture compliance without getting lost in the detail, while still leaving room for organizations that want to dive deeper.  

Note: For teams using the assessment only (without the full framework), it's critical that assessors understand the full text of each control to ensure accurate responses.

3. The CJIS v6.0 Task Pack

To simplify implementation and remediation planning, Apptega has built a CJIS v6.0 task pack aligned to the assessment:  

• One task per assessment question/control  

• Designed to summarize the key action required  

• Assignable to owners with due dates and completion tracking  

Each task should be used as a starting point, with reviewers referencing the full control text to ensure coverage of all relevant sub-requirements.  

For example, a task for access control might be labeled: “Implement account lockout policy for failed logins.” But the full control may also require audit logging, administrator notification, and reset processes, which should be considered in task execution.  

Benefits of Using Apptega for CJIS v6.0

Apptega was built to make complex cybersecurity frameworks easier to manage, and our CJIS v6.0 capabilities reflect that mission:  

• Full Coverage - All 406 CJIS v6.0 controls are included, with logical grouping and task alignment.  

• Easy Assessments - Answer each control in a question-based format. Use it as a readiness tool, internal audit mechanism, or external proof-of-compliance process.  

• Action-Oriented Tasking - Auto-generated tasks make it easy to turn assessments into action and track real progress.  

• Evidence Management - Upload supporting documentation directly to each control or task, ensuring a clean audit trail.  

• Stakeholder Reporting - Create dashboards, export status reports, and demonstrate compliance to internal or external stakeholders.  

Who Should Use the CJIS Framework in Apptega?

CJIS v6.0 applies to a wide range of entities. If you fall into one of these categories, the framework is likely essential for your organization:  

• Local, state, or federal law enforcement agencies  

• Courts or correctional facilities  

• Government IT providers handling CJI  

• Managed service providers (MSPs) or third-party contractors supporting law enforcement  

• Cloud service providers or SaaS platforms hosting CJI  

Whether you are a direct CJIS consumer or part of the broader compliance chain, Apptega helps make sure your policies, controls, and documentation meet FBI expectations.

‍

Next Steps

CJIS v6.0 is a major shift in how law enforcement and related organizations must approach cybersecurity. With hundreds of controls and thousands of individual requirements, organizations can no longer afford to manage compliance manually or piecemeal.  

Apptega helps simplify the process so you can focus on protecting what matters most. And the CJIS v6.0 framework, assessment, and task pack are now available in the our platform.  

Please reach out to our team for a demo or consultation to learn how Apptega can help your organization manage CJIS and other critical compliance programs.  

For assessment-only clients or those who need assistance with access, please contact your partner or customer success manager to explore your options.

‍