FBI's CJIS v6.1: What Security Teams Need to Know.
FBI's CJIS Security Policy v6.1 strengthens encryption and vulnerability scanning requirements.
The FBI's CJIS Security Policy v6.1 has been released, refining version 6.0 with updated requirements for encryption strength (256-bit for data in transit and at rest) and increasing vulnerability scanning frequency to monthly. Agencies are advised to align with these changes, as audit requirements are shifting towards continuous assessment, with some controls already sanctionable and others phased in until late 2027.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Specops Software?
Get an email when a new story names Specops Software, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe FBI's updated CJIS Security Policy v6.1 introduces stricter requirements for encryption (256-bit for data in transit and at rest) and mandates monthly vulnerability scanning — a significant increase in frequency from prior guidance. Agencies that fail to align with these updated controls risk sanctions, as some requirements are already enforceable while others phase in through late 2027. This matters because criminal justice information is highly sensitive, and outdated encryption or infrequent scanning creates exploitable windows for threat actors. The shift toward continuous assessment signals that point-in-time audits are no longer sufficient for protecting this class of data. Organizations must treat compliance not as a checkbox exercise but as an ongoing operational discipline.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.