Compliance — CJIS Security Policy¶

Scope: Criminal Justice Information Services (CJIS) Security Policy compliance for organizations handling Criminal Justice Information (CJI) on the CSA-in-a-Box platform. This document maps platform controls to CJIS policy areas and provides implementation guidance for law enforcement and public safety workloads.

What is CJIS?¶

The CJIS Security Policy is published by the FBI's Criminal Justice Information Services Division and establishes the minimum security requirements for any organization that accesses, transmits, stores, or processes Criminal Justice Information (CJI). CJI includes data from the National Crime Information Center (NCIC), the Interstate Identification Index (III), fingerprint records, and any data derived from these systems.

Compliance is mandatory — not voluntary — for:

• Law enforcement agencies (federal, state, local, tribal)
• Private contractors and vendors providing IT services to law enforcement
• Cloud service providers hosting systems that process CJI
• Any organization with access to FBI CJIS data through a Criminal Justice Agency (CJA)

The current version is CJIS Security Policy v5.9.x, updated periodically by the CJIS Advisory Policy Board (APB). Violations can result in termination of access to FBI CJIS systems — a severe operational consequence for any law enforcement agency.

Policy areas crosswalk¶

The CJIS Security Policy defines 13 policy areas. The table below maps each to CSA-in-a-Box capabilities and the relevant Azure services.

Azure CJIS compliance¶

Microsoft Azure maintains a CJIS Information Agreement with participating states. This agreement is a contractual commitment between Microsoft and the state's CJIS Systems Agency (CSA) that governs how Azure personnel handle CJI.

Before deploying CJI workloads, you must verify that Microsoft has an active CJIS Information Agreement with your state's CJIS Systems Agency. Not all states have completed this agreement. Contact your state CSA or Microsoft's compliance team to confirm.

Critical requirements¶

Encryption — FIPS 140-2 validated¶

CJIS requires FIPS 140-2 validated cryptographic modules for all encryption of CJI at rest and in transit.

// Key Vault with FIPS 140-2 Level 2 HSM — deploy/bicep/DMLZ/modules/KeyVault/
resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = {
  properties: {
    sku: {
      family: 'A'
      name: 'premium'  // Premium SKU = HSM-backed keys (FIPS 140-2 L2)
    }
    enablePurgeProtection: true
    enableSoftDelete: true
    softDeleteRetentionInDays: 90
    enableRbacAuthorization: true
  }
}

• At rest: AES-256 with infrastructure double encryption on Storage; CMK via Key Vault HSM. See deploy/bicep/DMLZ/modules/Storage/.
• In transit: TLS 1.2 minimum enforced by Azure Policy; HTTPS-only on all endpoints.

Advanced Authentication (MFA)¶

CJIS requires Advanced Authentication (multi-factor) for all access to CJI from any location. This is not optional.

• Entra ID Conditional Access policies enforce MFA for all users accessing CJI systems.
• Phishing-resistant methods (FIDO2 keys, Windows Hello for Business, certificate-based auth) are recommended over SMS/phone-call MFA.
• No exceptions for VPN-connected users, service desk personnel, or "trusted network" locations — CJIS requires MFA regardless of network origin.

Background checks¶

All personnel with unescorted access to unencrypted CJI must pass a state and national fingerprint-based background check. This applies to:

• Your organization's staff who administer the platform
• Microsoft personnel with potential access (covered under the CJIS Information Agreement)
• Third-party contractors with logical or physical access

Background check requirements apply to all personnel — including database administrators, help desk staff, and developers — if they have the ability to access unencrypted CJI. There are no exceptions for "read-only" access.

Audit logging — minimum 1 year retention¶

CJIS Policy Area 4 requires that audit logs be retained for a minimum of one year. Log entries must capture:

• User ID and terminal/session
• Date and time of access
• Successful and failed access attempts
• Type of event (create, read, update, delete)
• System resources accessed

// Log Analytics workspace with 365-day retention
resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
  properties: {
    retentionInDays: 365  // CJIS minimum 1 year
    features: {
      immediatePurgeDataOn30Days: false
    }
  }
}

Session timeout¶

CJIS requires that sessions accessing CJI be locked or terminated after a maximum of 30 minutes of inactivity. Configure this via:

• Entra ID Conditional Access sign-in frequency policies
• Application-level session timeouts in portal configuration
• Azure Virtual Desktop session limits for desktop-based CJI access

CSA-in-a-Box CJIS configuration¶

Key Vault with FIPS 140-2 Level 2+ HSM¶

The platform's Key Vault module (deploy/bicep/DMLZ/modules/KeyVault/) deploys with Premium SKU by default, providing HSM-backed keys validated to FIPS 140-2 Level 2. Purge protection and 90-day soft delete are enforced, preventing accidental or malicious key destruction.

Entra ID Conditional Access for advanced authentication¶

Conditional Access policies should be configured to require MFA for all applications that process CJI. The platform's identity architecture (Identity & Secrets Flow) supports this through Entra ID integration with no fallback to local authentication.

Azure Monitor with 1-year log retention¶

Diagnostic Settings on every deployed resource route logs to a central Log Analytics workspace. Configure the workspace retention to 365 days minimum. For long-term archival beyond the active retention window, configure export rules to immutable blob storage.

Network isolation with private endpoints¶

Every data-plane service in the platform deploys with Private Endpoints and publicNetworkAccess: Disabled. Combined with the Hub-Spoke Topology and Azure Firewall, this ensures CJI never traverses the public internet. NSG rules enforce deny-by-default with explicit allow rules for authorized traffic.

Common CJIS audit findings¶

Issues frequently identified during CJIS audits and how CSA-in-a-Box addresses them:

Request a CJIS Security Addendum from Microsoft as part of your Azure contract. This is separate from the state-level CJIS Information Agreement and provides additional contractual protections specific to your deployment.

Related¶

• Compliance — NIST 800-53 Rev 5 — CJIS controls map to NIST 800-53
• Compliance — FedRAMP Moderate — overlapping control set for federal systems
• Compliance — StateRAMP — state/local government variant
• Best Practices — Security & Compliance
• Government Service Matrix — Azure service availability per cloud
• FBI CJIS Security Policy: https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center
• Microsoft CJIS: https://learn.microsoft.com/azure/compliance/offerings/offering-cjis