CJIS, the FBI's Criminal Justice Information Services Security Policy, is the framework that governs how local government agencies handle criminal-justice data. For small SW Florida municipalities, it's simultaneously mandatory, dense, and under-resourced. Here's what it actually requires, in plain language.
01Who has to comply.
Any agency that accesses, processes, transmits, or stores criminal justice information (CJI), including NCIC, NLETS, and state-equivalent systems. For most small municipalities, this is the police department, the clerk's office that handles certain record requests, and occasionally code enforcement.
Compliance is enforced through audits by the state CJIS Systems Agency (CSA), which in Florida is FDLE. Findings can result in termination of access to criminal-justice systems, functionally ending the department's ability to operate.
02The five control areas that matter most.
Access control: CJIS requires advanced authentication (MFA) for access to CJI from uncontrolled areas. In practice: any remote access, any access from a mobile device, any access from outside the controlled physical environment.
Encryption: All CJI at rest and in transit must be encrypted using FIPS 140-2 validated cryptography. This is a specific technical requirement, not a generic "encryption" mention.
Physical security: The area where CJI is accessed must be controlled. Dispatch centers, records rooms, and mobile devices all have specific requirements.
Personnel screening: Everyone with CJI access must complete a fingerprint-based background check and CJIS Security Awareness Training. The training is annual.
Audit and accountability: Logs of who accessed what, when. Retained for a minimum of 365 days. Reviewed regularly, with documented review procedures.
03Where small agencies most commonly fail.
MFA on mobile data terminals in patrol vehicles. Most legacy MDT deployments used a single password; the new requirement is a second factor, and the hardware has to support it.
Encrypted email when transmitting CJI. Standard government email systems can do this, but the policy and training to use it correctly are frequently missing.
Wireless network configuration. CJIS has specific requirements for wireless authentication, encryption, and segmentation that default-configured equipment doesn't meet.
Documentation. The audit process requires written policies, procedures, and evidence. "We do this but haven't written it down" is a finding.
04The co-managed reality.
Most small SW Florida municipalities don't have dedicated IT staff with CJIS expertise. The co-managed model, internal IT plus a specialized provider, is the standard. The provider handles CJIS-specific technical controls, documentation, and audit preparation; the internal team handles day-to-day operations.
CJIS Security Awareness Training (CJIS-SAT) must be delivered by an authorized provider. Most MSPs working with government clients now include this as part of the managed program.
05Budget reality for small municipalities.
A 10-50 employee police department with CJIS scope typically needs $25,000–$80,000 in remediation to achieve full compliance from a typical starting point, plus ongoing managed services at $3,500–$8,500/month for the combined IT and CJIS program.
Grant funding (UASI, state homeland security grants) is sometimes available. Lease-to-own financing is common. "Do nothing and hope" is not an option, the cost of an audit finding that terminates system access is an operational catastrophe.
CJIS-scoped work currently underway for a Collier-area police department and a Lee County special district. FBI CJIS 5.9.4 controls, FDLE coordination, quarterly evidence packages, and annual audit support. Fixed-fee readiness assessment runs $9,800 over six weeks; ongoing compliance is priced per sworn-officer seat.