Is any storage product CJIS certified?

No. The FBI does not certify or endorse products against the CJIS Security Policy, and there is no national CJIS certification for technology. Compliance is assessed at the agency by its CJIS Systems Agency. Evaluate storage on the specific controls it supports and the evidence it produces.

What should we ask a storage vendor about FIPS for CJIS?

Ask for the CMVP certificate number of the module that encrypts data at rest, confirm it is FIPS 140-3 and active, and confirm the software version it covers. CJIS v6.1 requires FIPS 140-3 cryptography with 256-bit keys and states that FIPS 140-2 certificates are not acceptable after September 21, 2026.

Does a storage vendor need to sign the CJIS Security Addendum?

It depends largely on whether the vendor’s personnel can access CJI, and the agency’s CJIS Systems Agency makes that determination. A vendor that does not host the data, has no remote connectivity, and whose support staff never see file contents is in a very different position from a hosted service. Ask each vendor to describe its access precisely and confirm with your CSA.

CJIS Storage Checklist: 15 Vendor Questions

Key takeaways

The FBI does not certify products against CJIS. Judge storage on the controls it supports and the evidence it produces.
Ask for certificate numbers, not adjectives. "FIPS compliant" is not a CJIS answer; a FIPS 140-3 CMVP certificate is.
Custody questions come first: who hosts the data, who can connect to the system, and who holds the keys.
The audit and recovery questions should be answered by demonstration, on your data, not by a slide.
Run the list against every vendor in the evaluation, including us.

Every storage vendor that sells to law enforcement has a CJIS page, and most of them say the same thing. That is because there is no CJIS certification for products. The FBI does not certify or endorse technology against the CJIS Security Policy, and compliance is assessed at the agency by its CJIS Systems Agency. What a vendor can do is support specific controls and produce the evidence an auditor asks for.

The fifteen questions below turn the CJIS Security Policy v6.1 controls that land on storage into answers you can check. The right-hand column is how BrickStor SP answers each one. Use the same list for every vendor in your evaluation, including us.

Custody: who can reach the data

Start here, because these answers decide which agreements your CSA will expect and how much of the rest matters.

Question	A strong answer	BrickStor SP
1. Where does our data physically live?	In your facility or a location you control, within an APB-member jurisdiction.	In your data center, on a RackTop appliance, a gateway in front of your arrays, or a VM. RackTop does not host it.
2. Can your company connect to the system remotely?	No standing connectivity; any support access is initiated and controlled by the agency.	RackTop has no remote connectivity to agency systems.
3. What can your support engineers see?	System configuration and health, not file contents.	Support works with system controls and configuration, never file contents.
4. Who holds the encryption keys?	The agency, in a key manager it controls.	The agency, in the built-in key manager or the agency’s own KMIP server.

Encryption: SC-13 and SC-28

CJIS v6.1 requires FIPS 140-3 cryptography with 256-bit keys, and states that FIPS 140-2 certificates are not acceptable after September 21, 2026. Ask for numbers you can look up on the NIST CMVP site.

Question	A strong answer	BrickStor SP
5. What is the CMVP certificate number for the module that encrypts our data at rest?	An active FIPS 140-3 certificate number, and the software version it covers.	CMVP #5423, FIPS 140-3 Level 1, in BrickStor SP 23.9 and later. AES-256 per dataset.
6. Is there a second, independent encryption layer?	Yes, with its own validation, and a clear statement of where it applies.	FIPS 140-3 Level 2 validated self-encrypting drives on RackTop appliances shipped since 2022 with FIPS drives. Not on SAN gateway or VM deployments.
7. Is data encrypted in transit on every path?	Yes, for management, replication, and file protocols.	TLS 1.2 or 1.3 and SSH v2 for management, TLS for replication, SMB3 encryption, NFSv4 with Kerberos.

Identity and access: AC and IA

Question	A strong answer	BrickStor SP
8. How do administrators sign in, and is MFA supported?	Unique named accounts with phishing-resistant MFA available.	Named local or directory accounts; Hub sign-in supports passkeys (FIDO2) and one-time codes.
9. Can storage administration be separated from data access?	Distinct roles, including read-only.	Hub Admin, Storage Admin, and a read-only Hub User role; file permissions enforced on every SMB and NFS access.

Audit: AU-2, AU-3, AU-9, AU-11

Ask for these answers as a demonstration: open a file, then find the record.

Question	A strong answer	BrickStor SP
10. Does the system log every file read, not just writes and logins?	Yes, including denied attempts, per dataset.	User Behavior Auditing records reads, writes, deletes, renames, and permission changes, and denied attempts are logged.
11. What fields are in each record?	User, client address, operation, full path, outcome, and a UTC timestamp.	All of them, plus role and protocol, from an NTP-synchronized clock.
12. Can a storage administrator alter or delete the audit record?	Not the copy the auditor relies on.	Records forward to your SIEM over TLS syslog (RFC 5424 or CEF), outside any storage administrator’s reach.
13. How long can audit records be kept?	At least one year, configurable, with an off-system copy.	Local retention by time and capacity, plus your SIEM and a replication partner for long-term retention.

Detection and recovery: SI, CP, IR

Question	A strong answer	BrickStor SP
14. What happens when an account starts mass-encrypting or bulk-copying files?	The platform detects it and stops the session, not just alerts.	Active Defense detects it inline and terminates the session in under a second, then alerts through webhooks and email.
15. Can recovery copies survive an attacker with an administrator credential?	Yes, and recovery can restore only the files that were touched.	Immutable snapshots no credential can delete, ImmutaVault isolated copies, and Intelligent Bulk Remediation for file-level restore.

What the answers will not tell you

Some controls stay with the agency no matter which platform you buy. MFA for officers and staff happens at workstation and directory sign-in. The weekly audit review under AU-6 is a process someone has to own. Reporting a suspected incident within one hour under IR-6 is a people-and-process control, though storage that pushes alerts automatically makes it easier to meet. And your CJIS Systems Agency decides which agreements each vendor needs.

A vendor that is clear about what it does not cover is usually the one that is accurate about what it does.

Frequently asked questions

: No. The FBI does not certify or endorse products against the CJIS Security Policy, and there is no national CJIS certification for technology. Compliance is assessed at the agency by its CJIS Systems Agency. Evaluate storage on the specific controls it supports and the evidence it produces.
: Ask for the CMVP certificate number of the module that encrypts data at rest, confirm it is FIPS 140-3 and active, and confirm the software version it covers. CJIS v6.1 requires FIPS 140-3 cryptography with 256-bit keys and states that FIPS 140-2 certificates are not acceptable after September 21, 2026.
: It depends largely on whether the vendor’s personnel can access CJI, and the agency’s CJIS Systems Agency makes that determination. A vendor that does not host the data, has no remote connectivity, and whose support staff never see file contents is in a very different position from a hosted service. Ask each vendor to describe its access precisely and confirm with your CSA.