Hello everyone! 

Hope your summer is going well. I’m sure you’ve all heard that the latest update to the CJIS Security Policy (CJISSECPOL) version 6.1, hit the streets back at the end of June. If you haven’t, you can access it here.

Most of the future changes to the CJISSECPOL are going to be clarifications and updates; the big policy changes were accomplished during the modernization. Here’s a quick overview of the changes in 6.1:

• AC-1 b., IA-1 b., IR-1 b., MA-1 b., MP-1 b., and RA-1 b. were updated to standardize the language designating “organizational personnel” with “information security” responsibilities and not just “security” responsibilities. 

• CM-12, RA-2, and MA-6 were updated to standardize the phrase “process, store, or transmit” with the remainder of the policy.

• The discussion of PE-1 was updated to include the information about physically secure locations.

• The term "egress" was removed from PE-3 a. 2..

• AT-3 was updated to provide latitude to the CSOs to accept security awareness related training from other states.

• AT-2(a)(2) was updated to align the term “incident” with the remainder of the policy.

• A number of incorrect cross-references were fixed.

• IR-6 was updated regarding notification of incidents and that the FBI ISO needs to be notified.

• Several inaccuracies in MP-6 were clarified.

• IA-5(j) (6) & (7) were updated to apply only to federal agencies regarding authenticators procured for MFA.

• SI-2 (2) was updated to require monthly scanning for flaw remediation.

• The change with the most likely impact is the level of encryption, which was updated in SC-13 and SC-28 from 128-bit to 256-bit. If you have older systems, this could be problematic.

As always, don’t forget that CJIS ACE is here to help whether it's an assessment, to discuss all of the requirements, with CJIS Insight, where you can track them, or with some consulting hours, to discuss certain control families.

If you’d like to know more, I’d enjoy a chance to talk with you. Gimme a call or send me an email at info@cjisace.com!

Y'all take care,

Larry Coffee