Requirements · Government
CJIS Security Policy
FBI Criminal Justice Information Services. 3 Moraph products list it under “Requirements it supports”. The products support this requirement; meeting it remains your organization’s responsibility.
About the rule
What it is
The CJIS Security Policy is issued by the FBI’s Criminal Justice Information Services (CJIS) Division and sets the minimum security requirements for access to criminal justice information. It applies to criminal justice and noncriminal justice agencies, and to the private contractors that work for them, when they access, store, process or transmit that information; contractors agree to the CJIS Security Addendum. The policy is developed with the CJIS Advisory Policy Board.
Source: FBI: CJIS Security Policy Resource Center. CJIS in the glossary. This summary is for orientation only; read the rule itself or ask your counsel for what it requires of you.
Moraph’s Trust Center lists “CJIS Security Policy” among the frameworks its controls are mapped to: “Microsoft 365 GCC configured to the FBI CJIS Security Policy for criminal justice data.” It also states: “Moraph does not hold a certification or authorization for any framework in this list; where a client needs its own authorization or examination, we provide the control mapping and evidence to support it.”
Citations
How the products cite it
The exact wording on the product pages, with how many products use each.
- FBI CJIS Security Policy 2 products
- 28 CFR Part 20 (Criminal Justice Information Systems) 1 product
- CJIS Security Addendum 1 product
- FBI CJIS Security Policy, where police vehicle data is involved 1 product
For what it requires of your organization, read the rule itself or ask your counsel. CJIS in the glossary.
Products
The 3 products that support it
"Civic-Secure" Microsoft 365
Many local governments struggle to configure cloud suites securely. We deploy Microsoft 365 within the Government Community Cloud (GCC) boundary, specifically configuring it to support the FBI CJIS (Criminal Justice Information Services) Security Policy and documenting how each requirement is addressed. Configuration alone does not make an agency CJIS compliant: its policies, personnel, physical security and audits by the state CJIS Systems Agency remain the agency's responsibility.
Lists:
- FBI CJIS Security Policy
- CJIS Security Addendum
- 28 CFR Part 20 (Criminal Justice Information Systems)
Digital Evidence Management for Local PD
The explosion of body-worn camera footage and CCTV data has created a storage and privacy crisis for local police. This cloud-based repository securely stores digital evidence and utilizes AI to propose redactions of bystander faces and license plates for human review before public release, supporting responses to public records requests. Release decisions and their legal basis under state law remain the agency's.
Lists:
- FBI CJIS Security Policy
Municipal Fleet & Asset IoT Monitor
City operations rely on a vast fleet of vehicles, from police cruisers to snowplows. This system aggregates IoT data to track location, fuel usage, and maintenance health. It includes a public-facing "Proof of Service" map (e.g., "Where is the snowplow?"), improving transparency and reducing citizen complaints during weather events.
Lists:
- FBI CJIS Security Policy, where police vehicle data is involved
Not sure which requirements apply to you? Request a gap analysis. All requirements: Requirements our products support.