NewsPublished 21 Sep 2026

FBI's CJIS v6.1: What Security Teams Need to Know.

Source Bleeping Computer

Description

The FBI's CJIS Security Policy version 6.1 updates encryption requirements and vulnerability scanning frequency for agencies handling Criminal Justice Information (CJI). It raises encryption strength for data in transit and at rest to at least 256-bit and requires monthly vulnerability scans instead of quarterly. While audit requirements are phased, agencies should prepare for more continuous assessments and stricter compliance verification, especially around password and multi-factor authentication (MFA) controls. The policy emphasizes stronger identity verification and device assurance but is not a Zero Trust standard. Agencies are encouraged to review and enhance password policies and MFA coverage to meet the updated requirements.

Impact

The updated policy increases security requirements for agencies handling CJI by mandating stronger encryption and more frequent vulnerability scanning, which reduces the risk of data compromise. The emphasis on MFA for all accounts and maintaining lists of compromised passwords aims to mitigate credential-based breaches. The phased audit approach means agencies must progressively comply with these controls, with Priority 1 controls already enforceable. Failure to meet these requirements could result in audit findings and sanctions. The policy's focus on continuous assessment and evidence of control effectiveness increases operational security demands on agencies.

Defensive guidance

Agencies should implement encryption with at least 256-bit strength for CJI in transit and at rest as required by SC-13 and SC-28 controls. Vulnerability scanning should be conducted at least monthly to comply with updated vulnerability management requirements. Organizations must enforce MFA for all privileged and non-privileged accounts and maintain and update lists of commonly used or compromised passwords quarterly, checking new passwords against these lists. Agencies should confirm current audit expectations with their State CJIS Systems Agencies (CSAs) due to phased audit enforcement. Utilizing tools like Specops Password Auditor, Password Policy, and Secure Access can assist in meeting password and MFA requirements and provide evidence for audits. Since the policy is not a Zero Trust standard but aligns with its principles, agencies may consider adopting device trust and least privilege access controls to further reduce risk.

Summary

CJIS Security Policy v6.1, published June 25, 2026, refines the modernized control-based framework introduced in v6.0 by increasing cryptographic protection requirements for CJI in transit and at rest to at least 256-bit strength. It also tightens vulnerability management by increasing scanning frequency from quarterly to monthly. Audit enforcement remains phased, with Priority 1 controls sanctionable since October 2024 and other priorities in zero-cycle status until September 2027. Identification and Authentication controls, including mandatory MFA for all accounts and quarterly password checks against compromised lists, remain consistent with v6.0. The policy encourages continuous assessment and stronger evidence of control effectiveness. Specops solutions are highlighted as tools to assist agencies in meeting password and MFA requirements. CJIS v6.1 aligns with principles similar to Zero Trust by emphasizing identity verification and device trust, though it is not formally a Zero Trust standard.

References

bleepingcomputer.com/news/security/fbis-cjis-v61-what-security-teams-need-to-know/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Sep 2026, 14:16 UTC

References

Community reviews