State and local government
CJIS log review, log protection and incident records.
Security built for state and local government
Public services need a security process that small teams can maintain and oversight bodies can examine. Shared records and clear ownership help agencies investigate while preserving their information boundaries.
Controls
| Source | Control | Requirement | Supporting evidence |
|---|---|---|---|
| CJIS v6.1 | AU-2 | Log logons, access attempts and privileged actions. | AD, LDAP, VPN, database and Windows logs. → |
| AU-6 | Review audit records weekly. | Scheduled review reports by email. → | |
| AU-9 | Protect audit information. | Signed, chained logs and role-based rights. → | |
| AU-11 | Retain audit records. | Retention set per source. → | |
| State law | Ohio R.C. 9.64 | Report within 7 and 30 days. | A case timeline with reporting deadlines. → |
| Florida §282.3185 | Ransomware reported within 12 hours. | A SOAR incident with every step logged. → | |
| Whole of state | Tenancy | Separation between agencies. | Each agency in its own tenant. → |
CJIS AU-6
A scheduled report can organize the week’s relevant activity. Record who reviewed it, what needed follow-up and how those concerns were resolved.
CJIS AU-9
Restricted access and integrity checks help protect the audit record. Signed exports from a SIEM let a reviewer examine whether the retained evidence changed after collection.
Staffing
Repeatable workflows in a SOAR can gather context, assign work and track decisions. A small team can then spend more time judging the evidence, with a clear record for the next responder.
Whole-of-state
A shared service can use separate tenants, access roles and reports for each agency. Define cross-agency administration and response authority before the service begins.
By rule
State law Ohio R.C. 9.64
Report within 7 and 30 days. A SOAR incident workflow retains ownership, evidence, approvals and actions so reviewers can follow the response.
State law Florida §282.3185
Ransomware reported within 12 hours. Relevant operating evidence includes a soar incident with every step logged.
Questions
Can a small team run it?
A focused deployment and repeatable workflows help keep the workload manageable. Choose the operating model, review responsibilities and support needed for the agencies involved.
Who can search the logs?
Users see only the sources they need, and every search is logged.
Where does the data stay?
The deployment can use agency-controlled infrastructure, with hosting, backup and recipient access defined for the service.
What stays with the agency?
The agency owns state reporting, CJIS responsibilities and decisions about access to criminal justice information. The service design identifies the people and providers involved.
Guide
What does the CJIS Security Policy require for logs?
The CJIS Security Policy requires logging access attempts (AU-2), weekly review (AU-6), protection (AU-9) and one year of retention (AU-11).
How often is a CJIS audit?
The FBI CJIS Audit Unit audits each state every three years, and states audit their local agencies.
Can state agencies share one security platform?
Yes. A multi-tenant platform keeps each agency’s data and reports separate.
How ARRTECH takes care of state and local government security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
