Home > Security and Compliance Blog > Secure File Sharing > 5 Steps to Achieving CJIS Compliance With Secure File Sharing

5 Steps to Achieving CJIS Compliance With Secure File Sharing

by Izak Bovee updated September 15, 2022 Secure File Sharing

Reading Time: 8 minutes

Law enforcement agencies need to follow strict regulations to ensure that sensitive data like crime scene photographs, eyewitness statements, and police reports are protected. The Criminal Justice Information Services (CJIS) Policy is one such regulation. CJIS is a set of guidelines designed to provide adequate security controls for the management, transmission, and storage of criminal justice information (CJI).

It is crucial for law enforcement agencies to ensure they have secure solutions for storing and sharing files containing CJI that comply with CJIS. In this post, we share five steps that law enforcement agencies can take with their secure file sharing applications to achieve CJIS compliance.

What Is the CJIS Security Policy and How Does It Relate to the CJIS Regulation?

The CJIS regulation is a set of guidelines created by the FBI to ensure the security of criminal justice information. Protecting CJI and ensuring chain of custody are the roots of CJIS compliance. In the words of the FBI, the purpose of CJIS is:

… to provide appropriate controls to protect the full lifecycle of CJI, whether at rest or in transit. The CJIS Security Policy provides guidance for the creation, viewing, modification, transmission, dissemination, storage, and destruction of CJI. This Policy applies to every individual—contractor, private entity, noncriminal justice agency representative, or member of a criminal justice entity—with access to, or who operate in support of, criminal justice services and information.

The CJIS Security Policy, a subset of the broader CJIS regulation, outlines specific security requirements and procedures that must be followed by organizations that have access to criminal justice information. The CJIS Security Policy ultimately recognizes the need for law enforcement agencies to protect CJI from tampering, which includes data leaks.

The CJIS Security Policy includes guidelines for access control, data encryption, physical security measures, and more. The policy is designed to help organizations meet the requirements of the CJIS regulation by providing specific guidance on how to secure criminal justice information. Together, the CJIS regulation and the CJIS Security Policy in particular ensure that criminal justice information is protected and used appropriately by authorized personnel.

To demonstrate CJIS compliance, today’s law enforcement agencies must:

Make CJI securely available to authorized users, including users in different agencies and users working remotely. While mobile devices provide users the ability to access information and capture photos and videos, law enforcement needs a solution that enables CJI to be exchanged efficiently from the field while meeting strict data security and compliance requirements for secure mobile file sharing.
Ensure that data security and data governance best practices are followed in any scenario. The latest cloud and mobile technologies can improve data access and productivity, but they most do so without creating new challenges for data security and data governance. This can be a challenge when CJI is shared between agencies on different systems, or on mobile devices in the field.
Enforce the CJIS Security Policy consistently, across all internal platforms and cloud services in use. This is all the more challenging as data is distributed across a variety of Enterprise Content Management (ECM) platforms and file storage services, such as Microsoft SharePoint, Windows File Shares, Google Drive, Microsoft OneDrive, Box, Dropbox, and other content sources. Secure mobile file sharing and other security features should be available to all authorized users, regardless of which ECM platform or file storage service they’re using.

Why Is CJIS Compliance Important?

CJIS compliance is important for several reasons. First, CJIS compliance ensures that the sensitive information related to law enforcement agencies and criminal justice services is secure and protected from unauthorized access, use, or disclosure. Second, CJIS compliance ensures that the information stored and communicated through the criminal justice system is accurate, reliable, and consistent. This promotes the fairness and accuracy of the justice system. Third, CJIS compliance promotes interoperability and collaboration among different law enforcement agencies and criminal justice services. This helps in sharing information quickly and efficiently, which is critical in solving crimes and preventing further criminal activity. Overall, CJIS compliance is crucial for the effective functioning of the criminal justice system and maintaining public trust in the fairness and accuracy of the justice system.

The CJIS Security Policy is an essential component of CJIS compliance, namely maintaining the integrity of criminal justice data and ensuring that it is adequately protected. Noncompliance can lead to severe consequences such as loss of funding, criminal sanctions, or civil penalties.

The risks of noncompliance with CJIS regulations include the loss or theft of sensitive data, unauthorized access, or data breaches. Therefore, it is of utmost importance that law enforcement agencies have proper systems, procedures, and processes in place for securely sharing and storing CJI.

Secure File Sharing for CJIS Compliance

Secure file sharing is an essential part of achieving CJIS compliance. A secure file sharing system allows for secure transmission, storage, and management of CJI and ensures that only authorized personnel have access to this very sensitive information.

A secure file sharing system must therefore meet strict requirements for encryption, access control, and authentication to ensure the protection of CJI. These five steps will help law enforcement agencies align their secure file sharing solutions, processes, and procedures with the CJIS Security Policy.

CJIS Compliance Step 1: Identify Your CJIS Obligations

Before undertaking any measures to ensure CJIS compliance, a law enforcement agency must first understand its obligations. The first step in achieving CJIS compliance is for each law enforcement agency to identify its role in relation to CJIS, understand the CJIS Security Policy, and review it carefully. Let’s take a closer look to see how you and your law enforcement agency should proceed.

Identifying your role in CJIS involves understanding whether your agency is a criminal justice agency, non-criminal justice agency, or a private contractor. The CJIS Security Policy has different requirements for different types of agencies (and other organizations), and identifying your specific category is crucial in understanding the necessary compliance measures.

Understanding the CJIS Security Policy requires reading and genuinely understanding the requirements outlined in the policy. This includes identifying the different types of CJI, understanding how to handle and transmit CJI, and understanding the various security controls needed to ensure the protection of CJI.

Reviewing the CJIS Security Policy regularly ensures that your agency is up to date with the latest requirements and best practices for maintaining CJIS compliance.

CJIS Compliance Step 2: Evaluate Your Current File Sharing System

The next step in achieving CJIS compliance is to evaluate your current file sharing system. To properly evaluate your system, you must identify your current file sharing system’s capabilities and limitations, as well as any risks and vulnerabilities. You must then conduct a gap analysis. This step is crucial in determining whether your system meets CJIS compliance.

A file sharing system capabilities and limitations analysis involves identifying what your system is capable of and what it lacks. Understanding the capabilities and limitations of your file sharing system is vital in determining whether it meets the necessary security requirements for handling CJI.

A risk and vulnerabilities analysis involves assessing the potential threats to your file sharing system. This includes identifying attack vectors or other vulnerabilities in the system that expose the system to threats like unauthorized access, cyberattacks, sabotage, or data breaches.

Conduct a gap analysis to compare the capabilities of your current file sharing system against the requirements outlined in the CJIS Security Policy. This helps to identify the gaps that exist in your system and what needs to be done to close those gaps.

CJIS Compliance Step 3: Choose a Secure File Sharing Solution

Before choosing a secure file sharing solution, you should consider several variables that will either facilitate or impede CJIS compliance. These variables include essential security features, deployment options, ease of use, cost, and others.

Essential security features include end-to-end encryption, access control, and authentication to ensure that only authorized personnel have access to CJI. Integrations with other technologies in your security infrastructure, like data loss prevention (DLP), antivirus (AV), advanced threat protection (ATP), single sign-on (SSO), content disarm and reconstruction (CDR), and security information and event management (SIEM), should also be strongly considered.

Choosing between cloud-based vs. on-premises solutions involves weighing the benefits and disadvantages of each deployment option. Cloud-based solutions provide scalability, accessibility, and cost-effectiveness, while on-premises solutions offer greater control and customization.

Choosing a secure file sharing solution also, obviously, entails evaluating potential providers. Research and compare different providers based on their security and compliance capabilities and features, ease of use, flexibility, certifications, and industry reputation.

CJIS Compliance Step 4: Implement a Secure File Sharing Solution

Implementing a secure file sharing solution involves choosing the right deployment method, configuring user access and permissions, and training employees on the new system.

Choosing the right deployment method involves deciding whether to deploy on-premises, cloud-based, or hybrid solutions. On-premises solutions offer greater control, but cloud-based solutions provide flexibility and scalability. Hybrid solutions offer the best of both worlds.

Configuring user access and permissions involves setting up user accounts and determining who has access to specific files or folders. It is essential to ensure that only authorized personnel have access to sensitive CJI.

Periodic cybersecurity training for employees on the new system is crucial to ensure that the new system is used properly. Training should cover security best practices, the correct use of the new system, and how to report any security incidents.

CJIS Compliance Step 5: Maintain CJIS Compliance With Secure File Sharing

Maintaining CJIS compliance with secure file sharing involves performing regular audits and reviews, upgrading and patching the system, and monitoring and responding to security incidents.

Performing regular audits and reviews involves reviewing the system periodically to ensure that it is still compliant with CJIS regulations. It is necessary to identify any gaps and address them as quickly as possible.

Upgrading and patching the system involves making sure that the system is up to date with the latest security patches and updates. This ensures that any security vulnerabilities are addressed, and the system remains secure.

Monitoring and responding to security incidents involves monitoring the system for any unusual activity and responding quickly to any incidents. It is essential to have an incident response plan in place to respond quickly and effectively to any security incidents.

Kiteworks Secure File Sharing for CJIS Compliance

The Kiteworks Private Content Network is an enterprise-class, CJIS-compliant solution that enables the secure and efficient exchange of sensitive information with external parties.

Kiteworks leverages a law enforcement agency’s existing investments in enterprise content management (ECM) and email platforms with secure content access and Microsoft Office 365 integrations that control, protect, and track all file activity to ensure content governance, security, and regulatory compliance. Whether you choose an on-premises, private/hybrid cloud, or FedRAMP deployment option, you maintain full control of your content, including sole ownership of your encryption keys. In addition, all content is audited, and can optionally be held to collect information for use in industry-standard eDiscovery tools.

With Kiteworks, law enforcement professionals can securely capture and transfer CJI with their mobile phones. For example, photos are secured and automatically uploaded to the Kiteworks server, bypassing the phone’s camera roll entirely. With no evidence available on the device, the risk of data leaks is eliminated; however, a complete audit trail of the chain of custody is preserved, aiding with CJIS compliance.

Government and law enforcement agencies such as the City of Pleasanton, Abbotsford Police Department, South Carolina Attorney General’s Office, Texas Juvenile Justice Department, County of Sacramento, and others rely on Kiteworks to ensure maximum information security and demonstrate CJIS compliance when sharing CJI and other sensitive information from any location, using any device. Strong security controls and the industry’s broadest deployment options enable organizations to ensure CJIS compliance through the protection of CJI and other sensitive information. In addition, comprehensive management and control over all information sharing activities allow for the highest levels of data security and compliance.

The Kiteworks platform demonstrates CJIS compliance in all applicable policy areas, including:

Policy Area 4: Auditing and Accountability – Full auditing and accountability through reports accessible through Admin dashboards, as well as through Syslog and SNMP. Administrators can comply with legal requests to preserve and collect all relevant files and metadata, and set content retention policies to meet CJIS compliance requirements.
Policy Area 5: Access Control – Access control through LDAP, SSO, 2FA, and local databases for external user authentication. The Kiteworks platform also provides granular permissions for individual folders for collaboration.
Policy Area 6: Identification and Authentication – Authentication through LDAP, SSO, and 2FA. Whatever combination of these best-practice authentication measures is applied helps with CJIS compliance.
Policy Area 7: Configuration Management – Full administrative control over configuration management. The Kiteworks platform also provides access restrictions for changes.
Policy Area 10: System and Communications Protection and Information Integrity – End-to-end encryption of data in transit and data at rest. The Kiteworks platform is available in FIPS 140-2 certified and compliant configurations. Customers also retain sole ownership and control of their encryption keys.
Policy Area 13: Mobile Devices – Major mobile operating systems supported. Native MDM-light capabilities such as remote data wipe, secure encrypted containers, access PINs, token lifetime configuration, and mobile app whitelisting are all available through the Kiteworks platform. The mobile productivity suite makes it easy for authorized users to create, edit, share, and collaborate on files on mobile devices. Secure mobile file sharing becomes fast and easy.

In total, the Kiteworks Private Content Network enables law enforcement agencies to take full advantage of the latest advances in mobile devices and cloud computing, while meeting strict requirements for CJIS compliance.

To learn more about Kiteworks and its features for CJIS compliance, schedule a custom demo of Kiteworks today.

Additional Resources