CJIS v6.1: Five Security Priorities for Agencies
Summary
A sponsored guide outlines five CJIS v6.1 priorities for agencies: MFA, account management, passwords, logging, and audit readiness, with specific review timelines and compliance practices.
Key points
- CJIS v6.1 requires MFA for privileged and non-privileged accounts, including local, network, and remote access; the article recommends reviewing coverage and considering phishing-resistant methods.
- The guide recommends maintaining account inventories, limiting permissions by role, separating administrative use, and automating provisioning and removal where possible.
- It says temporary and emergency accounts must be removed within 72 hours, while accounts inactive for 90 days must be disabled within one week.
- Password guidance includes an eight-character minimum, screening for compromised passwords, blocking weak or reused passwords, and limiting failed logins to five per account.
- For logging, the article recommends capturing who did what and when, recording outcomes, regularly reviewing logs, and considering centralized SIEM collection.
- Agencies are audited at least every three years but should maintain evidence and compliance continuously; remediation plans should be updated at least every six months or when new information arises.
- The article is sponsored and written by Specops Software and promotes its MFA, password-policy, and auditing products.
Article Details
- Defense Focus
- Help agencies maintain CJIS v6.1 security compliance through effective MFA, account and privilege management, password controls, logging, and ongoing audit readiness.
- Detection Methods
- Review MFA coverage, especially for legacy applications and administrative accounts.
- Screen passwords against compromised-password data and block weak or reused passwords during creation or reset.
- Review account and privilege inventories, including temporary and inactive accounts.
- Review audit records for who performed an action, when it occurred, and its outcome.
- Conduct internal assessments to identify compliance gaps before formal assessments.
- Data Sources
- MFA configuration and authenticator enrollment records
- User, administrative, service, and temporary account inventories
- Password policy and compromised-password screening results
- Audit logs from systems handling CJI
- Access reviews, security policies, training records, and assessment results
- Platforms
- Active Directory
- SIEM
- Defensive Actions
- Require MFA for privileged and non-privileged accounts across local, network, and remote access; consider phishing-resistant methods such as FIDO2 security keys.
- Establish processes to enroll, replace, and revoke authenticators.
- Apply least privilege, separate administrative privileges from routine activity, and automate account provisioning and removal where possible.
- Remove temporary and emergency accounts within 72 hours; disable accounts inactive for 90 days within one week; review accounts and privileges at least annually.
- Encourage longer, unique passphrases, use approved password managers, update password blocklists at least quarterly and when compromise is suspected, and limit failed logins to no more than five per account.
- Check annual password-change requirements with the CJIS Systems Agency.
- Centralize logs where appropriate, review them regularly, and protect them against tampering.
- Maintain organized compliance evidence, document weaknesses and remediation deadlines, and update remediation plans at least every six months or when new information becomes available.
Vendors
Products
FIDO2When implementing MFA, consider phishing-resistant methods such as FIDO2 security keys.Microsoft Active DirectoryIt simplifies password policy management across Active Directory, continuously checking against over 6 billion compromised passwords and scanning daily for newly exposed credentials.RADIUSSolutions like Specops Secure Access help agencies comply by extending MFA protection to Windows logons, RDP, RADIUS, and offline access, with flexible options including authenticator apps and YubiKeys.SIEMCentralizing logs in a SIEM can make suspicious activity easier to spot.Specops Password AuditorSpecops Password Auditor offers a free, read-only Active Directory scan that highlights password policy gaps against CJIS requirements and flags risks, including compromised passwords.Specops Password PolicyThis is where Specops Password Policy can help.Specops Secure AccessSolutions like Specops Secure Access help agencies comply by extending MFA protection to Windows logons, RDP, RADIUS, and offline access, with flexible options including authenticator apps and YubiKeys.YubiKeysSolutions like Specops Secure Access help agencies comply by extending MFA protection to Windows logons, RDP, RADIUS, and offline access, with flexible options including authenticator apps and YubiKeys.