CJIS v6.1 Sets Five Priorities for Agency Compliance

Sponsored article by Specops Software. It outlines five areas agencies handling Criminal Justice Information (CJI) should address under CJIS v6.1: multifactor authentication (MFA), account management, passwords, audit logging and audit readiness.

The article says CJIS v6.1 requires MFA for privileged and non-privileged accounts across local, network and remote access. It recommends reviewing coverage, including for legacy applications and administrative accounts, and maintaining processes to enroll, replace and revoke authenticators. It names FIDO2 security keys as a phishing-resistant option and describes Specops Secure Access as supporting Windows logons, RDP, RADIUS and offline access.

For account management, the article recommends tracking user, administrative, service and temporary accounts, applying least privilege, separating administrative work from everyday activity, and automating account changes where possible. It says accounts and privileges should be reviewed at least annually; temporary and emergency accounts must be removed within 72 hours, and accounts inactive for 90 days disabled within one week.

It says control IA-5 sets an eight-character password minimum and that the control has been sanctionable since October 2024. The article recommends longer, unique passphrases and approved password managers, while noting that IA-5 still specifies yearly password changes. It also recommends capturing and protecting audit logs, reviewing them regularly, and maintaining compliance evidence between audits, which it says occur at least once every three years. Specops Password Auditor is described as a free, read-only Active Directory scan for password-policy gaps and risks.