CJIS basics for integrations: what city IT should know
When an integration touches criminal justice information, the CJIS Security Policy applies. A plain-language overview of what it asks of integrations, and the questions to put to any vendor.
Integrations in a police department, a jail, a court or a dispatch center can carry criminal justice information. When they do, the FBI's CJIS Security Policy applies to how that data is handled, and so does your state's CJIS Systems Agency.
This post is a plain-language overview for city IT staff. It is not a substitute for the policy itself or for your agency's CJIS contact, who has the final word on what is in scope.
First: is it CJI at all?
Not every public safety system holds criminal justice information. Before anything else, work out what the integration actually moves.
- Likely CJI: criminal history, information from state or national criminal justice databases, and identifying details tied to them.
- Possibly CJI: incident records, warrants and booking data, depending on source and use.
- Usually not CJI: fleet maintenance, staff scheduling, public crime maps built from released data.
Ask your CJIS contact to confirm. Getting this right early saves months of work on systems that didn't need it, and prevents gaps in ones that did.
No product is "CJIS certified"
There is no official CJIS certification for a software product. Compliance is about how your agency uses a system, under agreements with the vendor and oversight from your state. Be cautious with marketing that says otherwise.
What vendors can do is support the controls the policy asks for, and sign the agreements your state requires.
What the policy asks of an integration
The policy is long. For integrations, these areas come up most often.
Strong sign-in
People who can reach CJI need multi-factor authentication. For an integration platform, that means everyone who can view runs, change flows or manage connections, not just the end users of the source system.
Encryption
CJI must be encrypted in transit outside a physically secure location, and at rest when stored outside one. The policy names specific standards for the cryptography used. Ask vendors precisely what they use, rather than accepting "encrypted" as an answer.
Audit and accountability
Systems must log events such as sign-ins, changes and access, and keep those logs. Your agency should be able to review them, and ideally send them to its own security tools.
Personnel security
People with unescorted access to unencrypted CJI, including vendor staff, generally need fingerprint-based background checks and security awareness training. This is often the hardest part for a cloud vendor.
Media and data handling
Copies of CJI, including in logs, backups and exports, must be protected and eventually destroyed properly. Every extra copy widens what you have to control.
How integration design helps
Some design choices make CJIS questions much easier.
| Choice | Why it helps |
|---|---|
| The platform keeps no copy of records | No logs, queues or backups holding CJI |
| It runs on your own network | The data never leaves your controlled environment |
| An outbound-only relay | Internal systems are reached without opening inbound ports |
| Field protection inside the flow | Sensitive fields can be removed or encrypted before delivery |
| Only the fields needed are mapped | The destination receives the minimum |
Questions to ask any vendor
- Does the platform store record contents anywhere, including logs, retry queues and backups?
- Can it run on our servers or inside our network?
- Is multi-factor authentication available and enforceable for every account?
- What encryption is used in transit and at rest, and with what modules?
- Can we export the audit log and send it to our SIEM?
- Which of your staff could ever see our data, and have they had fingerprint-based checks?
- Will you sign the CJIS Security Addendum or your state's equivalent?
A clear "not yet" is a better answer than a vague "yes".
Keep the scope small
The safest CJI integration is one that moves as little as possible. Before building, ask whether the destination truly needs the sensitive fields, or whether an ID and a status would do. Often, the answer is the second.
Where SentraBridge stands
SentraBridge keeps no copy of the records it moves, and can run on your own servers or reach internal systems through its outbound-only relay. It offers two-step sign-in for every account, 256-bit field encryption, and a tamper-evident activity log you can export and forward. It is preparing for, not certified against, outside frameworks, and staff fingerprint checks are still to do. The trust center says plainly what is done and what isn't.