Skip to main content
govconCyber — Federal Cybersecurity Law Reference
Browse requirements
X-CUI-CJIS Informational

Protect Criminal History Records Information

Official citation: 28 CFR Part 20; FBI CJIS Security Policy

Class: informational · Severity: medium

Requirement text

28 CFR Part 20; FBI CJIS Security Policy

What it means

Criminal Justice Information is governed by the FBI CJIS Security Policy and 28 CFR Part 20. Contractors that access CHRI must meet CJIS personnel-screening, training, and technical controls, including a management control agreement. CJIS controls are detailed and audited by the state CJIS Systems Agency.

Required by

  • IT/Cloud — 28 CFR Part 20; FBI CJIS Security Policy
  • Legal — 28 CFR Part 20; FBI CJIS Security Policy
  • GovCon — 28 CFR Part 20; FBI CJIS Security Policy

Educational reference only — not legal advice. Consult a qualified assessor or attorney for binding compliance determinations.