GoKawiilCJIS v6.1 update sharpens focus on MFA and password security for law enforcement IT
A security advisory outlines five priority areas agencies must address to comply with CJIS v6.1, the FBI's data security policy for handling Criminal Justice Information. Among the top priorities is multi-factor authentication, now required for both privileged and non-privileged accounts under controls IA-2(1) and IA-2(2), covering local, network and remote access. The guidance also points to tools like Specops Secure Access and Specops Password Policy as options for extending MFA coverage and blocking compromised passwords.
GoKawiil's interpretation of the reporting above, not reported fact.
Agencies managing sensitive criminal justice data often rely on legacy systems and stretched IT teams, which could make consistent enforcement of new MFA and password rules difficult without dedicated tooling. The emphasis on audit-ready evidence suggests regulators expect not just technical controls but documented proof they are functioning, which could raise the compliance burden for smaller agencies. Citing Verizon's finding that stolen credentials factor into 44.7% of breaches underscores why authentication controls are being prioritized in this compliance cycle.
- CJIS v6.1 mandates MFA for privileged and non-privileged accounts under controls IA-2(1) and IA-2(2).
- Agencies are advised to prioritize phishing-resistant MFA methods like FIDO2 security keys and maintain reliable authenticator lifecycle processes.
- Third-party tools such as Specops Secure Access and Password Policy are positioned to help extend MFA coverage and provide audit evidence.
YubiKey 5 Series Security Key — CJIS v6.1 explicitly calls out phishing-resistant MFA, and FIDO2 hardware security keys like the YubiKey 5 are a proven way to meet that bar for both privileged and non-privileged accounts. They're durable, work across local and remote access scenarios, and help agencies close the MFA coverage gaps auditors look for.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-20
Published there as: “CJIS v6.1 Compliance: 5 Practical Priorities for Agencies”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.