CJIS Compliance Pressure Test for Municipal IT Director

Policy & Governance 

⏹️ No up-to-date signed CJIS policies or proof of distribution.

⏹️ Compliance steps rely on "tribal knowledge" (few people know).

⏹️ Policies haven't been reviewed against the latest Security Policy in 12+ months.

⏹️ Over-reliance on manual processes and Excel.

⏹️ Lack of capacity to focus on CJIS compliance.  

 

User/Personnel Management & Training 

⏹️ Cannot produce a complete list of personnel with CJI access.

⏹️ Some users haven’t completed CJIS Security Awareness Training in the last 2 years.

⏹️ No streamlined process for removing access when someone leaves or changes roles.

⏹️ Staff turnover has created compliance knowledge gaps.

⏹️ Bandwidth/workload issues hinder CJIS compliance. 

 

Technology & Infrastructure 

⏹️Systems use end-of-life operating systems or hardware.

⏹️ No full inventory of CJI devices (including mobile/BYOD).

⏹️ Not fully compliant with CJIS MFA requirements.

⏹️ Manual log management and unclear log retention. 

 

Vendor & Third-Party Risk 

⏹️ Uncertain if all vendors handling CJI have signed a CJIS-compliant addendum.

⏹️ Don’t regularly review cloud/service provider compliance.

⏹️ Too many vendors/tools causing compliance conflicts. 

 

Audit Preparedness 

⏹️ No central location for storing compliance evidence.

⏹️ Difficult to identify compliance gaps or track progress.

⏹️ Struggling to implement required CJIS controls, leading to security gaps and extra costs.

⏹️ Hard to produce proof of compliance (encryption, training, policies) on short notice. 

Lack the resources and expertise to stay up on compliance? Reach out to ThinkGard today.