CJIS Security Policy v6.1, published June 25, 2026, refines the modernized control-based framework introduced in v6.0 by increasing cryptographic protection requirements for CJI in transit and at rest to at least 256-bit strength. It also tightens vulnerability management by increasing scanning frequency from quarterly to monthly. Audit enforcement remains phased, with Priority 1 controls sanctionable since October 2024 and other priorities in zero-cycle status until September 2027. Identification and Authentication controls, including mandatory MFA for all accounts and quarterly password checks against compromised lists, remain consistent with v6.0. The policy encourages continuous assessment and stronger evidence of control effectiveness. Specops solutions are highlighted as tools to assist agencies in meeting password and MFA requirements. CJIS v6.1 aligns with principles similar to Zero Trust by emphasizing identity verification and device trust, though it is not formally a Zero Trust standard.

The updated policy increases security requirements for agencies handling CJI by mandating stronger encryption and more frequent vulnerability scanning, which reduces the risk of data compromise. The emphasis on MFA for all accounts and maintaining lists of compromised passwords aims to mitigate credential-based breaches. The phased audit approach means agencies must progressively comply with these controls, with Priority 1 controls already enforceable. Failure to meet these requirements could result in audit findings and sanctions. The policy's focus on continuous assessment and evidence of control effectiveness increases operational security demands on agencies.

Agencies should implement encryption with at least 256-bit strength for CJI in transit and at rest as required by SC-13 and SC-28 controls. Vulnerability scanning should be conducted at least monthly to comply with updated vulnerability management requirements. Organizations must enforce MFA for all privileged and non-privileged accounts and maintain and update lists of commonly used or compromised passwords quarterly, checking new passwords against these lists. Agencies should confirm current audit expectations with their State CJIS Systems Agencies (CSAs) due to phased audit enforcement. Utilizing tools like Specops Password Auditor, Password Policy, and Secure Access can assist in meeting password and MFA requirements and provide evidence for audits. Since the policy is not a Zero Trust standard but aligns with its principles, agencies may consider adopting device trust and least privilege access controls to further reduce risk.