CJIS-Compliant Personnel Software

What is the best CJIS-compliant personnel software for police departments? The 6 best systems for 2026, with a CJIS compliance checklist

Police personnel software holds the records a department can least afford to lose: internal affairs cases, use of force reviews, background investigations and officer wellness. Before your IT director or state CJIS Systems Officer signs off on a vendor, they'll ask one question: does it meet the FBI CJIS Security Policy? Almost every vendor says yes. Very few publish enough for you to check, and there's no FBI CJIS certification to lean on. CJIS-compliant software has to show its controls, from advanced authentication and encryption to audit logging and the screening of everyone who can reach your data.

This guide is for police chiefs, sheriffs and command staff, and the IT, HR and professional standards leaders who support them. It explains what the CJIS Security Policy requires, gives you a CJIS compliance checklist to take into a vendor review, and ranks the best CJIS-compliant personnel software for police departments, 6 systems in all, so you can understand the options and make a good decision for your department's needs.

Every system is scored against seven criteria totaling 100, using only what each vendor publishes. Personnel record coverage carries the most weight at 25, because the software has to hold the officer record before its security matters. Published CJIS evidence carries 20. Hosting and encryption, and authentication and access control, carry 15 each. Audit trail and price transparency carry 10 each, and government purchasing carries 5. Every criterion sits beside the total in the scoring table, so you can reweight it for your own department.

Essential Personnel ranks first at 92 out of 100, with full marks on hosting and encryption, authentication and access control, price transparency and government purchasing. They're hosted in AWS GovCloud with FIPS 140-3 validated encryption, multi-factor authentication at AAL2 that can be enforced agency wide, and an annual SOC 2 Type II report. They don't do scheduling or background investigations, so departments keep a scheduling system such as Aladtec through an integration. What they do better than anyone ranked here is put training, evaluations, discipline, use of force, early intervention, wellness and equipment on one officer record, with the security documentation and a published price to match.

Best CJIS-compliant personnel software for police departments

Essential Personnel is the best CJIS-compliant personnel software for police departments in 2026 at 92 out of 100, followed by Tracwire at 71 and PowerDMS by NEOGOV at 64. Essential Personnel scores highest because they publish the controls the FBI CJIS Security Policy asks for, from AWS GovCloud hosting and FIPS 140-3 encryption to AAL2 multi-factor authentication, and a price.

The gap between the top three and the rest isn't about who's secure. It's about who shows you. PowerDMS publishes the strongest CJIS evidence in the ranking, an annual assessment against the CJIS Security Policy and a FedRAMP authorization under NEOGOV, and takes full marks for it. Tracwire covers the widest range of personnel records, from applicant tracking to quartermaster. Benchmark Analytics, Vector Solutions and Versaterm are widely used for performance, training and internal affairs, but publish little or nothing about CJIS controls for those products, so they score low on security here. That doesn't mean they fail a CJIS review. It means you'll have to ask for every document.

The 6 best CJIS-compliant personnel software systems compared

Ranked by weighted total, 2026. Founding dates and headquarters are as each vendor publishes them, or marked otherwise.
SystemScoreBest forHostingFoundedHeadquartersPricing
1. Essential Personnel92Departments that want the whole officer record in one system, with the security documents in handAWS GovCloud2020Wilmington, NCPublished, $175 per user per year for all four suites
2. Tracwire71Agencies that want hiring, field training, scheduling and quartermaster on one platformAWS GovCloud2019Wilsonville, ORModel published: per application, in bands of 25 employees
3. PowerDMS by NEOGOV64Agencies that want a FedRAMP authorized vendor for policy and internal affairsAWS GovCloud2001El Segundo, CA (NEOGOV)Quote only
4. Benchmark Analytics37Larger agencies buying research-based early interventionAWS GovCloudNot publishedChicago, ILQuote only
5. Vector Solutions32Agencies and academies already on Acadis or Vector trainingNot published1999Tampa, FLQuote only
6. Versaterm20Departments whose need is internal affairs case managementNot published1977Ottawa, OntarioQuote only

Is there a CJIS certification for software?

No. The FBI doesn't certify software, and there's no CJIS certification a vendor can earn. CJIS compliance is a claim about controls: a vendor aligns their system with the FBI CJIS Security Policy, signs the CJIS Security Addendum with your agency, and is audited as part of your state CJIS Systems Agency's audit of your department.

The policy itself contains no process for approving a product. The only "certification" in it is the certification page of the CJIS Security Addendum, which each contractor employee with access signs. State programs say the same thing plainly. The Georgia Bureau of Investigation's vendor compliance program says it "does not certify that the vendor's technical services, products or solutions are compliant" with the CJIS Security Policy, "nor does it confer any type of license or certification."

What matters is whether a vendor can show they meet the CJIS compliance requirements, not a CJIS certification nobody issues. So when a vendor tells you their product is CJIS certified, ask what they mean. The useful answers are documents: a signed Security Addendum, an independent audit report such as SOC 2 Type II, and the name of the government cloud region your data lives in. That's what CJIS-compliant software can show, and it's what your CJIS Systems Officer will look at.

What are the CJIS compliance requirements? A CJIS compliance checklist from the CJIS Security Policy

The CJIS compliance requirements in the FBI CJIS Security Policy, version 6.1 dated June 2026, include multi-factor authentication for every account with access to criminal justice information, FIPS 140-3 encryption with keys of at least 256 bits in transit and at rest, audit logs reviewed weekly and kept at least a year, and fingerprint-based background checks and security training before anyone gets access.

The policy follows the NIST SP 800-53 control families, so each CJIS requirement has a control number your IT staff will recognize. Here are the CJIS compliance requirements that matter most when you're choosing personnel software, taken from the CJIS Security Policy v6.1.

CJIS compliance checklist: what the CJIS Security Policy v6.1 requires, and what to ask a personnel software vendor.
RequirementWhat the policy saysControlAsk the vendor
Advanced authenticationMulti-factor authentication for privileged and non-privileged accounts. The policy says "the risk profile for CJIS is AAL2." Sanctionable since October 1, 2024IA-2(1), IA-2(2), IA-5Is MFA at AAL2, and can we enforce it for every user? Do you support single sign-on?
Encryption in transitFIPS 140-3 validated modules, or FIPS 197 AES, with a symmetric key of at least 256 bits. FIPS 140-2 certificates aren't acceptable after September 21, 2026SC-8, SC-13Which FIPS 140-3 certificate covers your encryption, and what key length?
Encryption at restThe same 256-bit FIPS 140-3 standard for criminal justice information stored outside a physically secure location, and stored only in the United States or another APB member countrySC-28Where is our data stored, and who holds the encryption keys?
Audit loggingLog successful and unsuccessful logons, access, changes, deletions, permission changes and privileged actions, with what, when, where, source, outcome and who for eachAU-2, AU-3Can we see who viewed or changed an officer's record, and export it?
Log review and retentionReview audit records weekly and keep them for at least one yearAU-6, AU-11How long do you keep logs, and who reviews them?
Personnel screeningState and national fingerprint-based record checks before anyone gets unescorted access to unencrypted criminal justice information, including vendor and cloud staffPS-3Which of your staff can reach our data, and have they been fingerprinted?
Security awareness trainingBefore accessing criminal justice information, and annually after thatAT-2, AT-3Do your staff with access complete CJIS security training each year?
Least privilege and account reviewsOnly the access each person needs, with accounts and privileges reviewed at least once a yearAC-2, AC-6Can we restrict internal affairs and wellness records by role?
Session lockLock the device after no more than 30 minutes of inactivityAC-11Does the application time out idle sessions?
SeparationsDisable access within 24 hours of termination, and vendors report staff transfers or terminations within 24 hoursPS-4, PS-7Does disabling an account in our identity provider end access?
Incident reportingReport a suspected incident immediately, and no later than one hour after discoveryIR-6What's your breach notification window, in writing?

Some of these CJIS compliance requirements are new in the modernized policy. The FBI made the pre-modernization requirements and every Priority 1 control sanctionable from October 1, 2024, and gave agencies until September 30, 2027 before Priority 2 to 4 controls are audited for sanctions. Version 6.1 also raised the minimum encryption key from 128 bits to 256 bits. If a vendor's security page still cites FIPS 140-2 or 128-bit encryption, ask when it was last updated.

Is police personnel data criminal justice information?

Not by default. The CJIS Security Policy defines criminal justice information as data the FBI's CJIS Division provides, including data used to make hiring decisions. Fingerprint-based background check results are criminal justice information. Training hours, evaluations and commendations aren't, unless someone attaches criminal history records to them.

That line moves more often than people expect. A background investigation file with an applicant's criminal history results is criminal justice information. So is an internal affairs case that has an NCIC or state repository printout attached. Once either sits in your personnel software, the whole system and everyone who administers it falls under the CJIS Security Policy. The policy covers a "city information technology (IT) department" doing this work for police, so city IT staff who support the system need the same screening and training.

That's why most departments treat their personnel software as if CJIS applies, even when the records it holds mostly aren't criminal justice information. It's simpler to buy CJIS-compliant software once than to police what gets uploaded into it for the next ten years.

How CJIS compliance is checked: audits and the CJIS Security Addendum

Your state CJIS Systems Agency audits every agency with access to FBI CJIS systems once every three years, and the FBI CJIS Division audits the state. Private vendors who handle criminal justice information sign the CJIS Security Addendum and are subject to the same audit review as your department.

The CJIS Security Addendum is a uniform agreement, approved by the FBI, between a government agency and a private contractor. Every contractor employee with access signs its certification page. A city IT department that supports police systems signs a different document, a Management Control Agreement, which keeps management control of the criminal justice function with the police department.

For a CJIS audit, the agency also has to audit its outside service providers at least once every three years and be able to inspect them. In practice, that means your vendor's SOC 2 Type II report and signed Security Addendum are what your CJIS Systems Officer will ask to see. A vendor who can't send both before you sign a contract will be harder to defend at your next audit.

What to ask a vendor before you buy CJIS-compliant software

Ask for documents, not a yes. A signed CJIS Security Addendum, a current SOC 2 Type II report, the name of the government cloud region, the FIPS 140-3 certificate behind the encryption, how multi-factor authentication works, and who on their staff can reach your data. CJIS-compliant software vendors can answer all six before a demo.

  • The Security Addendum: will you sign the CJIS Security Addendum, and have your staff with access signed its certification page?
  • Independent audit: can we see your SOC 2 Type II report, and does it cover CJIS controls?
  • Hosting: which cloud region holds our data? "AWS GovCloud (US)" or "Azure Government" is an answer. "The cloud" isn't.
  • Encryption: which FIPS 140-3 validated module encrypts our data in transit and at rest, and with what key length?
  • Authentication: is multi-factor authentication at AAL2, can we enforce it for every user, and does single sign-on work with our identity provider?
  • Personnel: who at your company can reach our data, are they US based, and have they had fingerprint-based checks?
  • Audit trail: can we see who opened or changed an officer's internal affairs or wellness record?
  • Incidents: what's your breach notification window, and is it in the contract?

Ranking methodology: the CJIS Personnel Software Framework

To find the best CJIS-compliant personnel software for police departments, we used seven criteria, weighted to what a police department needs from personnel software and what a CJIS review will ask for. Personnel record coverage carries the most, 25. Published CJIS evidence carries 20. Hosting and encryption, and authentication and access control, carry 15 each. Audit trail and price transparency carry 10 each, and government purchasing carries 5.

Scores come from each vendor's own security, trust, product and pricing pages, checked on 9 November 2026, measured against the CJIS compliance requirements in the CJIS Security Policy v6.1. Where a vendor hasn't published a control, they don't get credit for it. That's a judgment about what you can verify before you call, not a finding that the vendor fails CJIS. A vendor can meet every control here and still score low for not saying so.

The CJIS Personnel Software Framework, 2026. Weights total 100.
CriterionWeightWhat it measures
Personnel record coverage25Training and certifications, evaluations, field training, internal affairs and discipline, use of force, early intervention, wellness, scheduling, hiring and equipment, and whether they share one officer record
Published CJIS evidence20A published statement of alignment with the CJIS Security Policy, the Security Addendum offered, and an independent assessment such as SOC 2 Type II or FedRAMP
Hosting and encryption15A named government cloud region, data kept in the United States, and FIPS validated encryption in transit and at rest
Authentication and access control15Multi-factor authentication at AAL2, single sign-on, and permissions by role and record type
Audit trail10A documented record of who viewed, created or changed each record
Price transparency10A published price, or a published pricing model, a department can budget from before a demo
Government purchasing5Published cooperative contracts or government marketplaces

Ties would go to the system with the higher published CJIS evidence score. No tie arose in this ranking.

How the 6 systems scored

Every system against every criterion. Each cell is scored out of the criterion's weight, and the total is out of 100.
SystemCoverage /25CJIS evidence /20Hosting /15Access /15Audit /10Price /10Purchasing /5Total
1. Essential Personnel21181515810592
2. Tracwire2412119105071
3. PowerDMS by NEOGOV182011870064
4. Benchmark Analytics2058000437
5. Vector Solutions2183000032
6. Versaterm1500050020

The rankings: the 6 best CJIS-compliant personnel software systems for 2026

Essential Personnel security and compliance page - CJIS-compliant personnel software
192 out of 100

Essential Personnel

  • Founded2020
  • HeadquartersWilmington, NC
  • Contact(910) 390-0011
  • Emailinfo@essper.com
  • Pricing$175 per user per year for all four suites, suites from $20 to $85, $3,000 one-time startup, single sign-on $800 a year
  • Best forPolice departments that want the whole officer record in one system, with the security documents in hand

Key stat. Multi-factor authentication at AAL2, the level the CJIS Security Policy names, enforceable for every user in the agency.

Essential Personnel was founded in 2020 by two Wilmington firefighters and builds personnel and professional standards software for police, fire, EMS and municipal HR. Their platform holds training and certifications, field training and evaluations, documents of record, use of force and early intervention, wellness and critical incidents, policy acknowledgment and equipment on one profile per officer, with hierarchical role-based permissions and specialist roles, so wellness and critical incident records reach only the people you name.

What earns first place is how much of the CJIS review they answer in public. The platform is hosted entirely in AWS GovCloud (US), in us-gov-east-1 with a replica in us-gov-west-1, with no data or resources leaving the United States. Data is encrypted at rest and in transit over TLS 1.2 and above with FIPS 140-3 validated cryptography, and customer instances are fully isolated, with no shared databases. Controls are built on NIST SP 800-53 and aligned with the latest CJIS Security Policy, the SOC 2 Type II report is renewed annually, and the report and the CJIS Security Addendum are available on request. They're on GSA Advantage, NASPO, Omnia Partners, NCSA and VSA contracts.

Strengths

  • AWS GovCloud hosting with FIPS 140-3 validated encryption and isolated customer instances
  • Multi-factor authentication at AAL2, single sign-on through SAML and OIDC, and hierarchical role-based access
  • The only full published price in the ranking, and five cooperative contracts
  • Training, evaluations, discipline, use of force, early intervention, wellness and equipment on one officer record

Limitations

  • No scheduling module; scheduling stays in a system such as Aladtec, through an integration
  • No applicant tracking or background investigation module
  • Not FedRAMP authorized as a vendor, though AWS GovCloud is FedRAMP High as infrastructure
"One of the most liked things is that we can store so much information on one platform that is easily accessible for convenience. We keep policies, ordinances, training, and multiple other things in Essential Personnel."
Tina MedlinInterim Police Chief, Biscoe NC Police Department

Why they score 92

They publish answers to almost every question on the CJIS compliance checklist, from the cloud region to the authentication level, and they're the only system here with a full published price. That, with one officer record covering most of what a police department tracks, outweighs the missing scheduling and hiring modules.

Tracwire security and compliance page - CJIS-compliant personnel software
271 out of 100

Tracwire

  • Founded2019
  • HeadquartersWilsonville, OR
  • ProductCommand HQ
  • PricingPer application, scaled in bands of 25 full-time employees, minimum 15; no dollar figures published
  • Best forAgencies that want hiring, field training, scheduling and quartermaster on one platform

Key stat. Every action across the platform is logged with who, what and when, and destructive edits to history aren't permitted.

Tracwire was founded by a police officer and FTO and builds Command HQ, a public safety platform covering applicant management and background investigations, field training, agency training, evaluations, professional standards and early intervention, scheduling, quartermaster, fleet, policy and use of force reporting. Each application runs on COMS, a shared foundation that holds personnel, structure and access controls.

They take second on the widest personnel record coverage in the ranking and a clear security page. Command HQ is hosted in AWS GovCloud (US) with data encrypted in transit and at rest, internal affairs and background files are restricted by role, and Tracwire staff with data access are background checked. They lose ground on CJIS evidence because their SOC 2 audit is still underway and the page names no FIPS validation, multi-factor authentication or Security Addendum.

Strengths

  • The broadest coverage here, from applicant tracking and background investigations to quartermaster and fleet
  • A tamper-evident audit trail across every application
  • AWS GovCloud hosting and a published pricing model

Limitations

  • SOC 2 audit underway, with no report yet
  • FIPS validation, multi-factor authentication and the Security Addendum aren't documented publicly
  • No dollar figures, and no cooperative contracts published

Why they score 71

The widest personnel record in the ranking and a full marks audit trail, on government cloud hosting. An unfinished SOC 2 audit and no published detail on encryption validation or authentication hold them below first.

PowerDMS trust and data security page - CJIS-compliant personnel software
364 out of 100

PowerDMS by NEOGOV

  • Founded2001 (PowerDMS)
  • HeadquartersEl Segundo, CA (NEOGOV); PowerDMS in Orlando, FL
  • ProductsPowerPolicy, Professional Standards Suite (PowerIA, PowerAction, PowerVitals), PowerTime
  • PricingQuote only
  • Best forAgencies that want a FedRAMP authorized vendor for policy and internal affairs

Key stat. Assessed annually for adherence to the FBI CJIS Security Policy, and FedRAMP authorized since August 2025 under NEOGOV.

PowerDMS has been part of NEOGOV since their 2020 merger. Their Professional Standards Suite pairs PowerIA for internal affairs case management with PowerAction for incident and use of force reporting and PowerVitals for early intervention, which their site lists as coming soon. PowerTime handles scheduling and PowerPolicy policy management, and NEOGOV's HR products cover hiring, evaluations and training.

They take full marks on published CJIS evidence, the strongest in the ranking: SOC 2, HIPAA and CJIS attestations, an annual CJIS assessment, AWS GovCloud hosting and a FedRAMP authorization. They lose ground on hosting and encryption because their trust page still cites FIPS 140-2 encryption, which the CJIS Security Policy stopped accepting after September 21, 2026, and on authentication because multi-factor authentication isn't documented there.

Strengths

  • An annual CJIS assessment and FedRAMP authorization through NEOGOV
  • AWS GovCloud hosting with 256-bit AES encryption in transit and at rest
  • Active Directory integration and single sign-on

Limitations

  • The trust page cites FIPS 140-2, so ask for current FIPS 140-3 validation
  • Early intervention is listed as coming soon, and the records sit across separate products
  • No published price

Why they score 64

The most complete published CJIS evidence in the ranking, with full marks there. Records split across separate products, an encryption standard the policy no longer accepts on their trust page, and no price keep them third.

Benchmark Management System page - CJIS-compliant personnel software
437 out of 100

Benchmark Analytics

  • FoundedNot published
  • HeadquartersChicago, IL
  • ProductsBenchmark Management System, First Sign early intervention
  • PricingQuote only; sold through GSA and AWS Marketplace
  • Best forLarger agencies buying research-based early intervention

Key stat. Used by more than 2,500 agencies across 42 states, with more than 200,000 active users, by their own count.

Benchmark Analytics builds the Benchmark Management System, an officer management system that centralizes performance, wellness, conduct and certification data, and First Sign, an early intervention system built from university research. Their solutions are delivered on AWS GovCloud and available through GSA and AWS Marketplace.

They score well on personnel record coverage, with performance evaluations, internal affairs, use of force and early intervention on one officer profile. They score low on security because their own site doesn't mention CJIS, encryption, authentication or an audit trail; the only public CJIS statement comes from a reseller.

Strengths

  • A research-based early intervention system
  • Broad officer records across performance, conduct, wellness and certifications
  • AWS GovCloud hosting, GSA and AWS Marketplace purchasing

Limitations

  • No CJIS statement on their own site
  • Encryption, multi-factor authentication and audit logging aren't documented publicly
  • No published price

Why they score 37

Strong personnel record coverage and government cloud hosting. Almost nothing published about the CJIS controls a review will ask for keeps them fourth.

Vector Solutions Acadis law enforcement academy software page - CJIS-compliant personnel software
532 out of 100

Vector Solutions

  • Founded1999
  • HeadquartersTampa, FL
  • ProductsAcadis, Guardian Tracking
  • PricingQuote only
  • Best forAgencies and academies already on Acadis or Vector training

Key stat. Acadis product pages list it as "Highly Secure (FedRAMP, FISMA, CJIS)."

Vector Solutions is a training and readiness software company. In 2021 they acquired Envisage Technologies, maker of Acadis, a hire-to-retire system for academies, state POST agencies and departments, and Guardian Tracking, their early intervention and performance documentation tool, is part of the same Acadis family for agencies under 400 personnel.

They score well on coverage, with training, certifications, academy operations, performance documentation and early intervention across the two products. They score low on security because the CJIS claim is a one-line badge on the Acadis pages, Guardian Tracking's page doesn't mention CJIS, and no trust or security page describes hosting, encryption or authentication.

Strengths

  • Training, certifications and academy operations in Acadis
  • Early intervention and performance documentation in Guardian Tracking
  • A FedRAMP, FISMA and CJIS claim on the Acadis product pages

Limitations

  • No public security or trust page describing hosting, encryption or authentication
  • No CJIS statement for Guardian Tracking
  • No published price

Why they score 32

Wide coverage across training and early intervention. A one-line CJIS badge, and no published detail behind it, keep them fifth.

Versaterm IAPro professional standards page - CJIS-compliant personnel software
620 out of 100

Versaterm

  • Founded1977
  • HeadquartersOttawa, Ontario
  • ProductsIAPro, BlueTeam, EIPro
  • PricingQuote only
  • Best forDepartments whose need is internal affairs case management

Key stat. IAPro is used by more than 1,100 agencies worldwide and BlueTeam by more than 850, by their own count.

Versaterm is a public safety software company that acquired CI Technologies, maker of IAPro, BlueTeam and EIPro, in 2023. IAPro is a professional standards and internal affairs case management system, BlueTeam handles frontline use of force and complaint reporting, and both can be paired with Versaterm Mindbase for officer wellness.

They score on coverage for internal affairs, complaints, use of force and early intervention, and on audit trail, since IAPro's page describes a complete audit trail for accreditation. They score nothing on CJIS evidence, hosting, encryption or authentication because the current IAPro and BlueTeam pages don't address them.

Strengths

  • A long-established internal affairs case management system
  • Frontline use of force and complaint reporting in BlueTeam
  • A complete audit trail of investigative milestones

Limitations

  • No CJIS, hosting, encryption or authentication information on the current product pages
  • Training, certifications, evaluations and equipment aren't covered
  • No published price

Why they score 20

A widely used internal affairs system with an audit trail. Narrow personnel coverage and no published security information put them sixth.

What to do next

Which is the best CJIS-compliant personnel software for your department depends on how much of the officer record you want in one place and how much your CJIS review will need to see. Essential Personnel and Tracwire put most of the record on one platform. PowerDMS publishes the strongest CJIS evidence for its policy and internal affairs products. Benchmark Analytics, Vector Solutions and Versaterm are strongest in early intervention, training and internal affairs respectively, and you'll need their security documents in writing.

Before you book demos of CJIS-compliant software, send every vendor the CJIS compliance checklist above and ask for the documents with their answers. Then ask each vendor to open one officer's record during the demo, show you who viewed it last, and log in with multi-factor authentication in front of your IT director. If you're also weighing whether the city's HR system could do the job, see why generic HR systems fall short for police departments.

Want the SOC 2 Type II report and CJIS Security Addendum for your review, or a walkthrough with your IT director? Call (910) 390-0011 or email info@essper.com and we'll send them, and show you one officer's record with someone who's worked in public safety.

Request a demo

Frequently asked questions

Essential Personnel ranks first at 92 out of 100, ahead of Tracwire at 71 and PowerDMS by NEOGOV at 64. Essential Personnel publishes AWS GovCloud hosting, FIPS 140-3 validated encryption, multi-factor authentication at AAL2 and an annual SOC 2 Type II report, offers the CJIS Security Addendum, and keeps training, discipline and early intervention on one officer record.

No. The FBI doesn't certify software, and the CJIS Security Policy has no product approval process. Vendors align their controls with the policy, sign the CJIS Security Addendum with the agency, and are audited as part of the state CJIS Systems Agency's audit of that agency. Treat a "CJIS certified" claim as a reason to ask for documents.

The CJIS Security Policy requires multi-factor authentication for privileged and non-privileged accounts with access to criminal justice information, and says the risk profile for CJIS is AAL2, the NIST authenticator assurance level that requires two factors. These requirements have been sanctionable in audits since October 1, 2024. Ask vendors whether their MFA meets AAL2.

Version 6.1 requires FIPS 140-3 validated modules, or FIPS 197 AES, with a symmetric key of at least 256 bits, both in transit and at rest outside a physically secure location. Version 6.0 allowed 128 bits. FIPS 140-2 certificates aren't acceptable after September 21, 2026, so check which standard a vendor's security page cites.

At least one year, or until they're no longer needed for administrative, legal or audit purposes. The policy also requires audit records to be reviewed weekly, and each record to show what happened, when, where, the source, the outcome and who was involved. Logged events include logons, record access and changes, deletions and permission changes.

Yes, if they have unescorted access to unencrypted criminal justice information. The policy requires state and national fingerprint-based record checks before access is granted, security awareness training before access and every year after, and a signed CJIS Security Addendum certification for private contractors. That applies to cloud and support staff too.

Not by default. Criminal justice information is data provided by the FBI's CJIS Division, which includes data used to make hiring decisions, such as fingerprint-based background check results. Training records and evaluations aren't. A background file or internal affairs case with criminal history attached is, so most departments buy personnel software as if CJIS applies.

It's a uniform agreement, approved by the FBI, between a government agency and a private contractor that handles criminal justice information. Each contractor employee with access signs its certification page, and the contractor is subject to the same audit review as the agency. Ask any personnel software vendor for it before you sign a contract.

About this ranking. Compiled by Scott Monroe, Chief Executive Officer & Co-Founder of Essential Personnel, and published 9 November 2026. Essential Personnel is one of the 6 systems assessed and is ranked first in it, and the framework, weightings and per criterion scores are all published above so the total can be recalculated. Vector Solutions is an Essential Personnel integration partner. No vendor paid to be included or was told their score in advance. Vendor facts come from each vendor's own website, checked on 9 November 2026; Benchmark Analytics' headquarters is from their public profile, and PowerDMS's founding year from public company records. CJIS requirements are quoted from the FBI CJIS Security Policy v6.1, dated June 2026. This guide is general information, not legal or compliance advice; confirm requirements with your state CJIS Systems Officer.