CJIS Security Policy 6.0: What Changed and How to Prepare

On December 27, 2024, the FBI released version 6.0 of the Criminal Justice Information Services (CJIS) Security Policy. It completes a modernization effort that has been underway for several years, and it changes both how the policy is organized and how agencies should think about compliance.

If your agency, or a vendor or contractor working for you, accesses, stores or transmits criminal justice information (CJI), this update applies to you.

What changed

A new structure aligned with NIST. Version 6.0 reorganizes the policy around the control families in NIST Special Publication 800-53. The familiar 13 policy areas of the 5.9.x versions have become 20. Agencies and vendors already working with NIST frameworks will find the language more familiar. Those who aren’t will notice a significant increase in detail.

Modernized requirements across several areas. The update completes modernization of areas such as assessment, authorization and monitoring, personnel security, supply chain risk management, and system and services acquisition. Much of this affects how you buy, build and oversee systems, not just how you configure them.

A phased, priority-based timeline. Rather than making every new requirement auditable at once, the policy assigns priorities so agencies can implement the most critical controls first, with remaining requirements phased in over the next few years.

MFA remains a top priority. The multi-factor authentication requirement introduced in earlier versions became auditable on October 1, 2024, and it remains one of the most important controls in the policy.

What this means in practice

For many agencies, the biggest impact won’t come from a single new control. It will come from the documentation, assessment and vendor oversight the modernized policy expects. Expect to spend more time on:

• Written policies and procedures for each control area
• Regular assessments of whether controls are actually working
• Vendor and supply chain oversight, including what you require in contracts
• Security in acquisitions, so new systems arrive compliant rather than needing fixes later

How to prepare

1. Read the summary of changes and confirm with your CJIS Systems Agency (CSA) how and when your state will audit against version 6.0.
2. Run a gap assessment comparing your current controls to the new requirements, organized by priority.
3. Build a remediation roadmap that tackles the highest-priority gaps first and fits your budget cycle.
4. Review your vendor contracts and procurement templates so new purchases include the right security requirements.
5. Update training for staff, IT personnel and your Local Agency Security Officer (LASO).

How GTEL can help

Our staff are highly versed in CJIS/FBI compliance. We help agencies assess their gaps against version 6.0, prioritize remediation, update policies and procedures, and prepare for audits. We can also serve as your agency’s LASO. Contact us to get started.

Resources: FBI CJIS Security Policy Resource Center