CJIS compliance changed significantly when CJIS Security Policy 6.0 was released on Dec. 27, 2024. The updated policy introduced modernized control families and established implementation priorities, changing how agencies evaluate security obligations over the next several years.

When Criminal Justice Information Services (CJIS) Security Policy Version 6.1 took effect on June 26, 2026, agencies gained additional clarification while retaining the modernization framework introduced in version 6.0.

Agencies should confirm which policy version their state CJIS Systems Agency audits against before evaluating current compliance obligations and future implementation deadlines. As organizations assess current CJIS requirements, technology decisions increasingly influence compliance planning, documentation practices, audit preparation, and long-term security management.

MessengerNow was developed to support agencies working through those requirements with browser-based messaging, centralized audit capabilities, and security features that address current CJIS expectations.

The platform can support agency compliance efforts, but compliance remains the responsibility of the agency operating the system.

How the Modernized Policy Changed

Dec. 27, 2024 marked the beginning of a significant restructuring of CJIS policy requirements. Under CJIS Security Policy 6.0, controls were organized into priority categories that established implementation schedules and compliance timelines.

Priority 1 controls became sanctionable on Oct. 1, 2024. Priority 2, Priority 3, and Priority 4 controls remain on a phased implementation schedule that extends through Oct. 1, 2027. Agencies must satisfy current obligations while preparing for controls that become applicable later in the implementation cycle.

Criminal Justice Information Services (CJIS) Security Policy Version 6.1 incorporated updates approved through the CJIS Advisory Policy Board while preserving the modernization framework already established under version 6.0. The update refined policy guidance while maintaining the phased implementation approach introduced through modernization.

Technology reviews now require more than a feature comparison. Agencies increasingly evaluate whether a platform can help support documentation efforts, improve audit readiness through centralized logging, strengthen encryption oversight, and address security requirements associated with the modernized policy framework. MessengerNow includes those capabilities within a browser-based environment built for criminal justice communications.

The Deadlines That Matter

Oct. 1, 2024 established the enforcement date for Priority 1 controls. Those requirements are already subject to sanctions and therefore demand immediate attention from agencies responsible for Criminal Justice Information.

A second deadline carries equally important planning implications. Oct. 1, 2027 represents the implementation target for the remaining control priorities introduced through modernization. Agencies that wait until the final stages of the rollout may face compressed implementation schedules, competing technology projects, and increased audit preparation demands.

Many agencies are now reviewing systems through the lens of future compliance obligations rather than current requirements alone. Messaging platforms, authentication controls, encryption standards, and logging capabilities all contribute to that discussion.

A platform will not replace a compliance program. It can, however, reduce the administrative effort associated with document retention, activity review, security oversight, and preparation for a CJIS audit.

Encryption Requirements for Messaging

Version 6.1 introduced more specific guidance around encryption standards for the protection of Criminal Justice Information. Current policy language specifies the use of FIPS 140-3 validated cryptographic modules or FIPS-validated Advanced Encryption Standard (AES) with a minimum 256-bit key for applicable transmissions of Criminal Justice Information. These requirements reflect the policy’s focus on protecting data during transmission and access by authorized parties.

The transition from FIPS 140-2 vs. 140-3 has important implications for agencies evaluating technology platforms. FIPS 140-3 supersedes FIPS 140-2, and FIPS 140-2 certificates moved to NIST’s Historical List after Sept. 21, 2026. Agencies reviewing messaging platforms should understand which cryptographic standards their vendors currently support rather than relying on older validation status.

According to CPI OpenFox documentation, MessengerNow uses OpenSSL 3 to support FIPS 140-3 validated encryption across Criminal Justice Information messaging and attachment workflows. This approach helps protect message content and associated files within a browser-based environment while supporting current CJIS security expectations.

Encryption remains only one part of the broader compliance picture. Agencies must also document how Criminal Justice Information is accessed, stored, transmitted, reviewed, and audited throughout its lifecycle.

Audit Logging and Accountability

Reviewers frequently ask the same questions during compliance assessments: Who accessed the information? What actions occurred? When did those actions take place?

Answering those questions requires complete and accessible records. Audit reviews become more efficient when agencies can quickly locate user activity and administrative history.

MessengerNow includes built-in audit logging that captures user activity and administrative events within a centralized environment. Administrators can review records from a single location rather than collecting data from multiple workstations distributed throughout the agency.

Authentication records and administrative activity often become important during a CJIS audit. Those same records can assist during internal reviews or investigations involving unusual system activity.

The modernized policy places greater emphasis on documentation and accountability. Rapid access to audit records can therefore reduce the administrative workload associated with reviews, investigations, compliance preparation, and audit support activities.

The Agency Retains Some Responsibilities

The boundary between product capabilities and agency responsibility remains one of the most important concepts in CJIS compliance. Understanding that distinction helps agencies accurately evaluate vendor claims and compliance obligations.

The FBI does not certify products as CJIS-compliant. Vendors can provide technology that supports security objectives and documentation requirements, but compliance ultimately depends on how an agency implements, manages, documents, and reviews its controls. CJIS compliance reviews are conducted through state CJIS Systems Agencies rather than a federal product-certification program. Agencies should evaluate how a platform supports compliance objectives rather than viewing any technology solution as a compliance guarantee.

MessengerNow supports CJIS compliance through centralized audit logging and browser-based administration, along with FIPS 140-3 encryption. Those capabilities can help agencies address requirements established under the modernized policy framework. Responsibility for compliance, however, remains with the agency operating the system.

Technology is only one part of a compliance program. Personnel screening requirements, physical security controls, documentation practices, and audit preparation activities remain agency responsibilities. CPI OpenFox offers CJIS consulting services that help agencies evaluate those requirements alongside their technology environment.

Schedule a consultation with CPI OpenFox to review how MessengerNow supports your agency’s CJIS compliance plan ahead of the Oct. 1, 2027 implementation deadline.