FBI CJIS security policy updates to version 6.1

Bleeping Computer reports that the FBI's Criminal Justice Information Services (CJIS) Security Policy has undergone significant updates with the release of version 6.1 on June 25, 2026. This update refines the modernized policy introduced in version 6.0, addressing omissions and corrections while maintaining the overall control-based structure aligned with NIST SP 800-53.

Version 6.1 introduces stricter encryption requirements, increasing the minimum symmetric cipher key strength for CJI in transit and at rest outside physically secure locations from 128-bit to 256-bit. Vulnerability scanning frequency has also been increased from quarterly to at least monthly. While version 6.0 established a control-based structure, version 6.1 emphasizes the need for continuous assessment and demonstration of control effectiveness. Priority 1 controls are already sanctionable, with others entering a "zero-cycle" status until September 30, 2027.

Common audit findings include multi-factor authentication (MFA) issues, new policies, training, and event logging. The policy continues to reinforce strong identity and authentication measures, including MFA for all account types and regular password strength checks against compromised credential databases, aligning with a direction similar to Zero Trust principles by focusing on verifying identity and device posture rather than solely network location.

Source: Bleeping Computer