FBI’s CJIS v6.1 Raises Encryption and Vulnerability-Scanning Requirements
Summary
CJIS v6.1 raises encryption requirements for covered criminal justice information to 256-bit strength and increases vulnerability scanning from quarterly to monthly. The article also outlines audit timelines and identity and authentication requirements.
Key points
- CJIS v6.1 requires at least 256-bit encryption for covered information in transit outside physically secure locations and at rest in those locations.
- Vulnerability scanning to check for applicable software and firmware updates must occur at least monthly, up from quarterly under v6.0.
- Publication of v6.1 does not automatically establish one immediate audit baseline; agencies should check implementation and assessment guidance with their State CJIS Systems Agency.
- Priority 2, 3 and 4 controls remain in “zero-cycle” status until September 30, 2027; Texas is continuing audits against v5.9.5 through March 31, 2027, according to the article.
- The article reports that Michigan State Police listed MFA among its leading audit findings and is moving toward more continuous assessment.
- CJIS IA-2 requires MFA for privileged and non-privileged accounts, while IA-5 calls for checking passwords against lists of commonly used, expected or compromised passwords.
Article Details
- Event Type
- Update to the FBI CJIS Security Policy, version 6.1
- Impact
- Version 6.1 raises specified encryption strength for CJI in transit and at rest to at least 256 bits and changes vulnerability scanning from quarterly to at least monthly. It retains requirements for MFA across privileged and non-privileged accounts. Audit timing remains phased, and agencies should confirm current expectations with their State CJIS Systems Agency.
Vendors
Products
Specops Device TrustThat makes technologies such as Specops Device Trust a natural complement to the direction of the policy.Specops Password AuditorSpecops Password Auditor gives organizations a good starting point by performing a read-only scan of Active Directory to identify password-policy gaps and highlight compromised passwords already in use.Specops Password PolicySpecops Password Policy then enforces password length and granular organization-defined password rules while checking passwords against compromised credentials.Specops Secure AccessSpecops Secure Access addresses another frequent audit pain point by adding MFA to Windows authentication.