Any agency in Texas or Oklahoma that touches criminal justice information, from a city police department to a county sheriff's office to a municipal dispatch center, must comply with the FBI's Criminal Justice Information Services (CJIS) Security Policy. The requirements are dense, the audits are real, and the consequences of failing them range from remediation deadlines to losing access to state and federal criminal-justice systems. This guide explains what CJIS demands, how the audit process works, and how to build an environment that passes inspection without a last-minute scramble.
What CJIS compliance covers
The CJIS Security Policy governs how criminal justice information (CJI) is accessed, transmitted, stored and protected. CJI includes everything from criminal history records and fingerprint data to information returned from systems like NCIC and TLETS. The policy applies to everyone who touches that data: sworn officers, civilian staff, dispatchers, and the IT vendors who support them.
In Texas, agencies coordinate through the Texas Department of Public Safety (DPS), which serves as the CJIS Systems Agency; in Oklahoma, that role falls to the Oklahoma State Bureau of Investigation (OSBI). Both enforce the same federal baseline, both require a designated local agency security officer (LASO), and both conduct audits on a recurring cycle.
Critically, responsibility doesn't transfer to your vendors. If an MSP, cloud provider or software platform handles CJI on your behalf, your agency remains accountable, which is why CJIS-aware vendors sign security addendums and submit their personnel to the same background standards as your staff.
The core technical requirements
The CJIS Security Policy spans 13 policy areas covering everything from incident response to physical security. The technical controls that most often determine whether an agency passes or fails include the following.
- Advanced authentication (multi-factor) for any access to CJI, including from patrol vehicles
- Encryption of CJI in transit and at rest using FIPS 140-validated cryptography
- Strict access control and least-privilege permissions, reviewed regularly
- Detailed audit logging, and the ability to produce those logs on demand
- Personnel security, including fingerprint-based background checks for anyone with access
- Mobile device and in-car (MDT) security for field operations
- Documented incident response and a tested plan for handling a breach of CJI
How the CJIS audit actually works
Agencies are typically audited on a recurring cycle (often every three years), with the state CJIS Systems Agency providing advance notice and a pre-audit questionnaire. The auditor reviews documentation, interviews staff, inspects physical and technical controls, and verifies that what's written in your policies matches what's actually happening day to day.
Findings are documented, and the agency is given a remediation window to correct any deficiencies. Minor gaps usually mean a corrective-action plan; serious or unresolved issues can escalate to restricted access to criminal-justice systems, which directly affects an agency's ability to do its job. The agencies that fare best treat the audit as a checkpoint on an ongoing program, not a test they cram for.
Common audit findings, and how to avoid them
Most agencies don't fail audits because of exotic vulnerabilities. They fail on the basics: missing or inconsistent multi-factor authentication, incomplete or unavailable audit logs, undocumented or outdated policies, staff who never completed security-awareness training, or background checks that lapsed.
The other recurring theme is drift: controls that were configured correctly at one point but quietly fell out of compliance as systems changed, staff turned over, or new devices were added without going through the same hardening process.
The agencies that pass cleanly treat compliance as a continuous program, not a once-a-year fire drill. Documentation stays current, access is reviewed on a schedule, training is tracked, and every new system is configured to CJIS standards from day one rather than retrofitted before the auditor arrives.
Building continuous CJIS compliance
Staying compliant year-round is far less painful, and far less risky, than scrambling before an audit. A managed approach keeps you ready at all times and turns the audit itself into a formality.
- Engineer CJIS controls into every system, device and cloud service before it goes live
- Maintain living documentation, asset inventories and change records
- Run continuous monitoring, log retention and quarterly access reviews
- Track security-awareness training and background checks so nothing lapses
- Keep an IT partner experienced with Texas DPS and Oklahoma OSBI audits and willing to sign a CJIS security addendum
The role of a CJIS-experienced IT partner
Few agencies have the in-house IT staff to manage CJIS controls, audit logs, encryption and documentation on top of running day-to-day operations. A managed IT partner that specializes in public safety closes that gap, handling the technical controls, maintaining the evidence auditors ask for, and standing alongside your LASO during the audit itself.
The right partner doesn't just react to findings; they keep your environment in a constant state of readiness, brief your team on policy changes, and make sure the next new laptop, server or cloud app is CJIS-ready before it ever touches criminal justice information.
Key Takeaways
- CJIS applies to any Texas or Oklahoma agency that touches criminal justice information.
- Texas DPS and Oklahoma OSBI both enforce the same federal CJIS baseline and audit on a cycle.
- Most audit failures come from basics: MFA, logging, documentation, training and lapsed checks.
- Responsibility never transfers to vendors. Your agency stays accountable for CJI.
- Continuous compliance beats annual scrambles. Engineer controls in from day one.
