CJIS compliance: 5 priorities agencies need to address before October 2027

On October 1, 2027, the FBI's remaining Priority 2 through 4 modernized Criminal Justice Information Services (CJIS) Security Policy requirements become enforceable. Public safety agencies have less than a year to resolve outstanding gaps, some of which may be considerably harder to close than their compliance reports suggest.

Consider an agency that has deployed multifactor authentication (MFA) to nearly every employee. The project appears almost finished. But officers still struggle to authenticate from patrol vehicles, and a legacy records management system doesn't support the agency's preferred authentication method.

That last stretch of deployment could require more work than everything completed so far.

Research from Imprivata and Lexipol reveals how widespread these challenges are. Among 336 public safety professionals surveyed, 79% identified CJIS compliance as a top or high cybersecurity priority, yet only 32% reported being fully compliant. Another 55% described their agencies as mostly compliant, with minor gaps remaining.

Those gaps deserve a closer look. An exception affecting a heavily used application may carry more operational significance than its size suggests.

Under the FBI's CJIS Security Policy, version 6.1, existing and Priority 1 requirements are already subject to sanctions for noncompliance. The zero-cycle period for Priority 2 through 4 modernized requirements ends September 30, 2027.

Agencies need to use the remaining time wisely. These five priorities offer a place to start.

1. Treat compliance as a continuous responsibility

Passing an audit provides a snapshot of compliance. It doesn't guarantee that access permissions will remain appropriate six months later. Compliance on its own isn’t enough.

Personnel change roles. Vendors finish assignments but retain active accounts. New applications introduce access paths that weren't part of the last review.

These changes can gradually create security gaps unless agencies have reliable processes for managing them.

Among survey respondents who weren't fully compliant, 40% identified limited IT or security staff as a leading barrier. For those agencies, automation and clearly assigned responsibilities can help prevent routine access reviews from falling behind.

Action before October 2027: Audit the process for granting and removing access. Confirm that permissions change when employees transfer and that temporary vendor accounts expire. Assign responsibility for ongoing reviews so access governance doesn't depend on institutional knowledge.

2. Close the MFA gaps hiding behind high deployment rates

Only 38% of surveyed professionals reported full MFA implementation across all applicable users and devices. Another 38% said MFA covered most users or devices.

An agency can have MFA in place across its administrative workforce and still struggle to enforce it on mobile data terminals or shared dispatch workstations. These environments often expose limitations that aren't apparent during an office-based deployment. Field connectivity may be unreliable. Some legacy applications don't integrate easily with newer authentication technologies.

Agencies also need to examine authentication strength. The National Institute of Standards and Technology (NIST) explains that manually entered one-time passcodes aren't phishing-resistant because attackers can potentially relay them through fraudulent authentication services.

Phishing-resistant authentication deserves consideration where appropriate, but agencies must evaluate specific methods against applicable CJIS requirements.

Action before October 2027: Map MFA coverage across systems that provide access to criminal justice information. Identify exceptions and test proposed authentication methods in the environments where personnel will use them. Focus remediation on uncovered access paths rather than deployment percentages alone.

3. Remove authentication friction that puts security at risk

The research found that 95% of respondents experienced some form of access or security friction when reaching critical systems. Multiple logins across applications (36%) and slow authentication (35%) were the most common complaints.

For officers moving between applications in a patrol vehicle, repeated authentication can become a significant interruption. Dispatchers working across shared systems face similar challenges.

When access becomes cumbersome, personnel may leave sessions open longer than permitted or rely on someone else's authenticated session to complete a task. Those workarounds weaken individual accountability. NIST's authentication usability guidance recognizes that authentication burden can encourage insecure behavior.

Agencies should examine where repeated logins are affecting daily work and determine whether single sign-on (SSO) or passwordless authentication could reduce those interruptions while preserving required controls.

The City of Marietta, Georgia, offers a practical example. The city implemented Imprivata Enterprise Access Management to support authentication for police officers accessing national crime databases from patrol vehicles. Badge-based and biometric authentication helped simplify access to supported applications, and the city expanded the solution to other departments.

Action before October 2027: Observe authentication during actual shifts. Identify workflows where personnel repeatedly enter credentials or encounter disruptive timeouts. Prioritize improvements that reduce those obstacles while maintaining the individual accountability that CJIS requires.

4. Modernize access without waiting to replace legacy systems

Among respondents who weren't fully compliant, 47% cited aging infrastructure and legacy systems as a leading barrier.

Replacing legacy systems such as Computer-Aided Dispatch (CAD), Records Management Systems (RMS), and other applications containing Criminal Justice Information (CJI) can be costly, time-consuming, and operationally challenging. One often-overlooked issue is the inability to fully migrate historical data into replacement systems. As a result, agencies are frequently forced to maintain their older systems alongside newer technology to preserve access to historical records and critical CJI. Rather than simplifying operations, this can create additional systems for personnel to access, more usernames and passwords to manage, increased IT support requirements, and additional security and compliance challenges.

Modernization does not always mean replacing legacy systems. Agencies must also consider how to secure, manage, and maintain CJIS compliance across both existing and new technology. A strategy that strengthens identity security, simplifies user access, and provides consistent auditing across multiple systems can help agencies reduce risk while extending the useful life of critical technology investments.

The security risks associated with aging government technology are well documented. In a July 2025 report, the U.S. Government Accountability Office examined 11 critical federal legacy systems identified as needing modernization. Seven operated with known cybersecurity vulnerabilities, while four relied on unsupported hardware or software.

Although these findings concern federal systems rather than the agencies surveyed, they illustrate why modernization can't always be postponed.

An interoperable access management solution may help extend stronger authentication to compatible legacy applications while agencies plan larger infrastructure changes. Still, that approach has limits. Authentication improvements won't correct unsupported software or other underlying vulnerabilities, which require separate remediation.

Action before October 2027: Identify legacy applications that fall short of applicable security requirements. Determine which access gaps can be addressed through integration, and which require additional safeguards. Establish remediation plans for systems that cannot be adequately secured in their current state.

5. Make audit readiness part of daily operations

An auditor asks who accessed a particular criminal justice record. The agency has logs, but the record was accessed from a shared workstation using a generic account.

Can the agency identify the individual responsible?

Shared devices make this question especially important. A record of workstation activity may be insufficient if the agency cannot associate access with the correct user.

The CJIS Security Policy includes requirements for audit and accountability. Agencies need to understand what evidence those requirements demand and whether their current systems can produce it.

The survey found that 25% of respondents planned investments in audit and logging improvements, while 24% identified privileged access management as an investment priority over the following 12 to 24 months.

Those capabilities can improve oversight, particularly when vendors require elevated access to agency systems. But agencies don't need to wait for new technology to assess their current visibility.

Action before October 2027: Select a recent access event (or several, if you’ve had more than one recently) and attempt to reconstruct it. Verify the identity of the user and whether the access was authorized. If that information cannot be established reliably, identify the missing evidence and address the gap before an auditor discovers it. This allows you to understand how well you’ll be able to reliably respond to an audit.

The deadline is approaching, so prioritize the gaps that matter most.

The Imprivata and Lexipol research shows that agencies understand the importance of CJIS compliance. The remaining work is concentrated in environments where enforcing security requirements can be difficult.

And the consequences extend beyond an audit finding. When asked about potential CJIS-related data breaches, 51% of survey respondents identified operational disruption as a leading concern. Another 42% cited loss of public trust.

Agencies should use the remaining months to establish which requirements are unmet and direct resources toward the most consequential gaps.

Imprivata helps public safety organizations address access challenges through interoperable access management and privileged access security solutions. These solutions support authentication across shared workstations and compatible legacy applications while helping agencies maintain oversight of user access.

October 2027 provides a deadline for specific requirements. Agencies should emerge from that process with security controls their personnel can use, and their IT teams can maintain.

See where public safety agencies stand on CJIS compliance.

Download CJIS compliance in focus: The identity security challenges facing public safety agencies to explore the complete research findings and the challenges shaping agency security investments.