Identity, access challenges slow CJIS compliance: survey

Only 32 percent of public safety agencies surveyed by Imprivata and Lexipol said they are fully compliant with the Federal Bureau of Investigation’s (FBI) Criminal Justice Information Services (CJIS) Security Policy 6.0, even as 79 percent described compliance as a top or high cybersecurity priority.

The gap reflects the difficulty of securing access to sensitive systems without slowing officers, dispatchers, and other personnel who depend on them during time sensitive work, the survey found.

The security policy provides a standardized set of security controls and protocols designed to protect Criminal Justice Information (CJI). Compliance is mandatory for any individual, government entity, or private contractor that accesses, processes, or stores CJI.

The National Association of Counties said Security Policy 6.0 “introduces the most significant modernization of CJIS requirements in more than a decade.”

Full compliance with all levels of Security Policy 6.0 is required by October 1, 2027, and marks the end of the “zero-cycle” rollout, meaning all new controls must be continuously met across all physical, environmental, and technical operations.

Imprivata’s report is based on a survey of 336 public safety professionals across the U.S., including respondents from local, county, state, and federal law enforcement agencies, as well as other public safety organizations. Participants represented cybersecurity, IT, compliance, and public safety leadership roles.

The survey found that 95 percent had experienced access or security friction, including repeated logins, slow authentication, field challenges with multifactor authentication, and password lockouts.

Imprivata said the findings suggest that while agencies understand the importance of CJIS compliance, many continue to face significant operational and technology challenges that make compliance difficult to achieve and maintain.

The survey pointed to aging infrastructure, staffing constraints, and increasingly complex identity and access management requirements that “remain roadblocks, even as agencies invest in modernization initiatives” ahead of the deadline.

“This research highlights a broader shift taking place across public safety organizations,” said Nick Stohlman, Imprivata’s vice president of CJIS program strategy. “CJIS compliance is increasingly tied to how agencies manage identities, control access, and maintain visibility across users, devices, and systems.”

Stohlman added that “as public safety environments become more complex, agencies need identity security strategies that strengthen security and accountability while ensuring personnel can access critical systems and information without disrupting operations.”

Among respondents whose agencies were not fully compliant, competing priorities and aging infrastructure were each cited by 47 percent as barriers. Limited IT or security staffing followed at 44 percent.

The report also found that only 38 percent had fully implemented multifactor authentication for all applicable users and devices.

The survey frames CJIS compliance less as a discrete IT project than as a continuing test of whether agencies can verify and audit access across shared workstations, mobile devices, remote users, and legacy applications.

Managing access across multiple systems was the leading operational challenge, cited by 40 percent of respondents.

Agencies said they plan to invest in identity governance, role-based access controls, single sign-on, expanded multifactor authentication, audit logging, and privileged access management over the next two years.

“For many agencies, the challenge is no longer understanding CJIS requirements, but rather finding the resources, technology, and operational capacity needed to implement and sustain compliance,” Imprivata said.

“These challenges are exacerbated by increasingly complex IT environments and workflows that often include legacy systems, shared devices, mobile users, and limited IT staff,” the company added.

Article Topics

cybersecurity  |  digital identity  |  identity access management (IAM)  |  identity management  |  identity security  |  Imprivata