/
← Voltar ao feed
low government law enforcement

Sponsored guidance: five CJIS v6.1 compliance priorities for agencies protecting Criminal Justice Information

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 10:51 · coletado há 3 dias

This is a sponsored article by Specops Software, not a report on a threat or incident. It sets out five priorities for agencies protecting Criminal Justice Information (CJI) under CJIS v6.1: multi-factor authentication, account management and least privilege, password policy, audit logging, and continuous audit readiness. It promotes Specops Secure Access, Specops Password Policy and Specops Password Auditor as ways to meet these requirements. It cites the Verizon Data Breach Investigations Report figure that stolen credentials are involved in 44.7% of breaches. It has no direct threat intelligence value, only compliance context.

Detalhes técnicos

  • MFA: controls IA-2(1) and IA-2(2) require MFA for privileged and non-privileged accounts across local, network and remote access. Phishing-resistant methods such as FIDO2 keys are recommended.
  • Account management: keep an inventory of user, administrative, service and temporary accounts. Temporary and emergency accounts must be removed within 72 hours, and accounts inactive for 90 days must be disabled within one week. Reviews are at least annual.
  • Passwords (IA-5): an eight-character minimum, a Priority 1 control that has been sanctionable since October 2024. Blocklists of compromised passwords should be updated at least quarterly, and failed logins limited to five per account. IA-5 still specifies a yearly change or refresh, so agencies should confirm this with their CJIS Systems Agency.
  • Audit logging: capture who did what, when and with what outcome, protect logs against tampering, and centralize them in a SIEM.
  • Audit cycle: agencies are audited at least every three years. Under CA-5, remediation plans should be updated at least every six months.

Remediação

  • Review MFA coverage, especially legacy applications and administrative accounts, and maintain processes to enroll, replace and revoke authenticators.
  • Automate account provisioning and removal, and make access reviews continuous.
  • Block weak or reused passwords at creation or reset, and screen against compromised-password lists.
  • Keep organized evidence of MFA configurations, access reviews, logs, policies, training and assessments, and run internal assessments before formal audits.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 20/10/2026 10:51 · coletado 20/10 11:00 primeiro registro

    Sponsored guidance: five CJIS v6.1 compliance priorities for agencies protecting Criminal Justice Information

    ler a análise desta fonte

    This is a sponsored article by Specops Software, not a report on a threat or incident. It sets out five priorities for agencies protecting Criminal Justice Information (CJI) under CJIS v6.1: multi-factor authentication, account management and least privilege, password policy, audit logging, and continuous audit readiness. It promotes Specops Secure Access, Specops Password Policy and Specops Password Auditor as ways to meet these requirements. It cites the Verizon Data Breach Investigations Report figure that stolen credentials are involved in 44.7% of breaches. It has no direct threat intelligence value, only compliance context.

    Technical Details

    • MFA: controls IA-2(1) and IA-2(2) require MFA for privileged and non-privileged accounts across local, network and remote access. Phishing-resistant methods such as FIDO2 keys are recommended.
    • Account management: keep an inventory of user, administrative, service and temporary accounts. Temporary and emergency accounts must be removed within 72 hours, and accounts inactive for 90 days must be disabled within one week. Reviews are at least annual.
    • Passwords (IA-5): an eight-character minimum, a Priority 1 control that has been sanctionable since October 2024. Blocklists of compromised passwords should be updated at least quarterly, and failed logins limited to five per account. IA-5 still specifies a yearly change or refresh, so agencies should confirm this with their CJIS Systems Agency.
    • Audit logging: capture who did what, when and with what outcome, protect logs against tampering, and centralize them in a SIEM.
    • Audit cycle: agencies are audited at least every three years. Under CA-5, remediation plans should be updated at least every six months.

    Remediation

    • Review MFA coverage, especially legacy applications and administrative accounts, and maintain processes to enroll, replace and revoke authenticators.
    • Automate account provisioning and removal, and make access reviews continuous.
    • Block weak or reused passwords at creation or reset, and screen against compromised-password lists.
    • Keep organized evidence of MFA configurations, access reviews, logs, policies, training and assessments, and run internal assessments before formal audits.