CJIS with ARRTECH
Records for a CJIS audit.
Audit records for systems that touch criminal justice information
Criminal justice information needs controlled access and an activity record that can be examined. Logging, incident history and media controls contribute evidence to the agency’s CJIS program.
Requirements
| Clause | What it asks | Security support |
|---|---|---|
| CJIS AU-2 | Event logging. | Events in common categories. → |
| CJIS AU-9 | Audit information protected. | A signature chain that breaks on change. → |
| CJIS SI-4 | System monitoring. | Events tagged and correlated. → |
| CJIS IR-5 | Incidents tracked. | Case records with history. → |
| CJIS MP-7 | Media use restricted. | DLP controls USB devices. → |
Scope
The information a SIEM holds and the functions it performs affect its place in the CJIS environment. Scope directory-based access, such as Active Directory or LDAP, to the people and sources required for the work, and retain the history of administrative changes.
Logging
Common event categories in a SIEM let reviewers search across different source formats. Keep the original records available and use relevant MITRE ATT&CK context to help explain a finding.
Integrity
Signed records from a SIEM and their verification material let an auditor check integrity outside the original console. The review also considers source accuracy, collection coverage and the meaning of the events.
Incidents
An incident record brings together ownership, evidence, decisions and actions. Response workflows in a SOAR can carry out approved procedures and preserve the result of each step, including failures and requests for human approval.
Media
DLP device policies can limit removable media by device, user or computer. Content controls and recorded exceptions help support legitimate transfers while preserving the reason they were permitted.
Limits
The following responsibilities belong to the organization’s wider security and governance program. Their owners maintain the evidence needed for review.
CJIS IA-2
Identification and authentication. The agency’s identity system holds the record.
CJIS Security Addendum
Screening and a signed addendum for anyone with access to CJI, including vendor support staff.
By rule
Use these references to connect the requirement with relevant operating evidence. The organization defines the scope and implementation being assessed.
CJIS AU-2
Log the event types the Policy defines. Common event categories in a SIEM let reviewers search related activity across supported sources.
CJIS AU-9
Protect audit information from unauthorized access, modification and deletion. Restricted access, signed records and administrative history support protection and review of the audit trail.
CJIS SI-4
Monitor the system to detect attacks and indicators of attack. Correlation in a SIEM connects related events across sources while preserving the records behind the resulting finding.
CJIS IR-5
Track and document incidents. A SOAR incident workflow retains ownership, evidence, approvals and actions so reviewers can follow the response.
CJIS MP-7
Restrict the use of system media. DLP device policies restrict supported removable media, with approved exceptions and activity retained for review.
Questions
Does the SIEM fall under the Policy?
Yes, if its logs contain criminal justice information.
Can our assessor check the logs without ARRTECH?
Yes. A signed SIEM export includes the verification material and a standalone verifier, allowing an independent check of record integrity.
Which version is mapped?
CJIS Security Policy v6.1, Jun 25, 2026, which supersedes v6.0.
Guide
What is the CJIS Security Policy?
The FBI policy for protecting criminal justice information wherever it is stored or processed.
Who is audited?
Agencies and CJIS Systems Agencies, with contractors bound through the CJIS Security Addendum.
What changed in v6.1?
Version 6.1, published Jun 25, 2026, supersedes v6.0.
How ARRTECH takes care of CJIS evidence
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
