For any platform that touches criminal justice data, the FBI's Criminal Justice Information Services (CJIS) Security Policy is the benchmark. It governs how Criminal Justice Information (CJI) must be stored, transmitted, and accessed — and law enforcement agencies cannot adopt tools that fall short of it.
What CJIS covers
The CJIS Security Policy is a comprehensive set of controls spanning more than a dozen policy areas. For a cloud forensic platform, the most consequential are:
- Access control. Every user is uniquely identified, and access to CJI is restricted to authorized personnel on a need-to-know basis.
- Advanced authentication. Multi-factor authentication is required for access to CJI.
- Encryption. CJI must be encrypted in transit and at rest using validated cryptographic standards.
- Auditing and accountability. Systems must log access to CJI and retain those logs for review.
- Personnel security. Individuals with access to CJI are subject to background screening.
- Physical protection. Data centers housing CJI must meet defined physical-security standards.
How a cloud platform meets the bar
Meeting CJIS in the cloud comes down to demonstrable controls rather than promises:
- Identity and access. Role-based permissions ensure each user sees only what their role allows, and mandatory two-factor authentication satisfies the advanced-authentication requirement.
- Encryption everywhere. Data is encrypted at rest and protected in transit with modern TLS, so CJI is never exposed in the clear.
- Comprehensive audit trails. Every access, download, and share is logged immutably, producing exactly the accountability record CJIS expects.
- Certified infrastructure. Evidence Locker operates in redundant data centers certified for SOC 2 and ISO 27001, providing the physical and operational assurances underpinning CJIS compliance.
Why it matters for investigators
CJIS isn't a checkbox — it's what lets an agency trust a platform with sensitive case data and what keeps that data admissible and protected. When evidence is challenged, being able to point to documented, certified controls is far stronger than asserting "we take security seriously."
A shared responsibility
It's worth remembering that compliance is shared between the platform and the agency. The platform provides compliant infrastructure, encryption, and audit logging; the agency is responsible for managing its users, enforcing least-privilege access, and following its own policies. Evidence Locker is built to make the platform side of that bargain straightforward — so your team can focus on the investigation, confident that the data handling will hold up.