A task force partner asks for a full case file by Friday, and the prosecutor wants the recorded interviews with it. The detective’s first move will be to attach everything to an email, which will not survive an audit, but the agency has never put an approved alternative in writing. The file goes out anyway, through whichever channel was open, and no record of the transfer exists.
That distance between what the policy prohibits and what the agency has authorized is where many interagency exchange findings begin. The Criminal Justice Information Services (CJIS) Security Policy does not bar agencies from sharing case material. It does set conditions on how the material moves and what the agency keeps afterward.
The Short Answer
Agencies can share case files with other authorized agencies when a formal agreement is in place and the exchange satisfies the policy’s controls for access, encryption, and recordkeeping. Criminal justice information is built to move, and Nlets exists because interstate exchange is expected work.
Responsibility stays with the agency holding the information, not the vendor supplying the transfer method, and the record of the exchange matters as much as the exchange itself, because an auditor will ask for it long after delivery.
What Must Exist Before the First File Moves
A written information exchange agreement has to be in place before departments begin sharing data. Policy Area 1 of the CJIS Security Policy addresses these agreements directly, and its practical requirement is a document that:
- Names the parties
- States permitted uses
- Assigns security responsibilities on both sides
- Sets incident notification duties
- Specifies what happens to the shared material when the arrangement ends
Two criminal justice agencies will often have an interagency agreement. When a noncriminal justice entity, a contractor, or a hosted service provider is included, the CJIS Security Addendum and a management control agreement apply as well.
In addition, every individual who will handle the material needs a documented right to know and need to know, tied to a specific authorized purpose. Authorization attaches to the person and the purpose, though it may be defined at individual, group, or organizational levels. A detective on the case and a records clerk at that agency do not automatically share access.
Finally, criminal history record information requires a secondary dissemination log recording the date of release, the subject’s name and identifiers, who received it, the receiving agency, the case number, and the purpose code the record was run under. Retention is set by the state CJIS systems agency (CSA) rather than by one federal figure. Auditors request this log by date range, and a log reconstructed after the request arrives can be a finding of its own.
Where Agencies Most Often Slip
Four transfer methods account for most of what happens in practice.
| Method | Status | Why |
| Agency or personal email | Conditional | Lack of end-to-end Federal Information Processing Standard (FIPS) 140-validated encryption and no dissemination record; permitted when utilizing proper authorization, protection, and logging requirements |
| Consumer cloud drives | Conditional | No validated encryption under agency control, no signed CJIS Security Addendum |
| Encrypted physical media | Conditional | Permitted with validated encryption, documented chain of custody, and a recorded handoff |
| Purpose-built exchange platform | Acceptable | Access control, encryption, and dissemination logging enforced by the system, not by user habit |
The Version Problem Nobody Mentions
The current governing document is CJIS Security Policy version 6.1, dated June 25, 2026. It defines 20 policy areas, with Policy Area 1 covering information exchange agreements, Policy Areas 2 through 19 aligned to the 18 National Institute of Standards and Technology (NIST) SP 800-53 control families, and Policy Area 20 covering mobile devices.
Guidance still referring to 13 policy areas is describing version 5.9, which version 6.0 superseded in December 2024. Policy area numbers copied from an older agency standard operating procedure (SOP) will not line up with what the auditor is working from.
Enforcement runs on a separate clock through the Requirements Companion Document, which assigns each control a priority tier. Priority 1 controls became enforceable and sanctionable as of Oct. 1, 2024.
Choosing a Platform That Survives an Audit
Treat any vendor describing its product as CJIS certified as a signal to slow down, because that isn’t a credential issued by a governing authority. The FBI does not certify products, and compliance status cannot pass from a vendor to an agency.
Ask instead for four specific things:
- The executed CJIS Security Addendum that is signed, not a summary or an attestation letter.
- Confirmation that vendor personnel with access to unencrypted criminal justice information have completed fingerprint-based background screening and security awareness training.
- The Cryptographic Module Validation Program (CMVP) certificate number of the cryptographic module the product actually uses, allowing the agency to verify it against the NIST list.
- A live dissemination report showing recipient identity, purpose, and timestamp, exportable in a format the agency keeps on its own.
What surfaces in many vendor conversations is design origin. A product built for criminal justice workflows treats dissemination recordkeeping as a core function, while a general enterprise file service configured for law enforcement treats it as a reporting feature. That difference will show up the first time an auditor sets a date range.
Talk With CPI OpenFox About Interagency File Exchange
CPI OpenFox has been building software for law enforcement and criminal justice agencies since 1989. We now support 31 states and six federal agencies. That exclusive focus allows us to design authentication, audit logging, and transaction-level accountability into the OpenFox Suite natively.
To review your agency’s exchange procedures and CJIS-compliant file-sharing controls against what your CSA audits, request a consultation with CPI OpenFox.
