CJIS Security Policy v6.1 and BrickStor SP
Criminal Justice Information ends up in files: case folders, digital evidence exports, and records attachments, stored beside body-worn video and interview recordings.
BrickStor SP protects that data at the storage layer with FIPS 140-3 validated encryption, a per-file audit record, and Active Defense, on hardware that stays in your facility. Sheriff's offices and local municipalities already run it for forensic evidence, body-worn camera footage, and fixed building-camera video, several for more than five years. This datasheet maps BrickStor SP to the CJIS v6.1 controls an auditor applies to the storage holding CJI.
Download the Datasheet
Two pages, ready for your ISO, your CJIS Systems Agency, or a procurement file.
Download PDFBrickStor SP runs in your facility as a RackTop appliance, a gateway in front of storage arrays you already own, or a virtual machine. RackTop does not host or store your data and has no remote connectivity to your systems. When RackTop support helps your team, engineers work with system controls and configuration, never the contents of your files. Encryption keys stay with you in the built-in key manager or your own KMIP server.
- CJIS now follows NIST SP 800-53 control families, and every requirement carries its own priority and sanction date.
- SC-13 and SC-28 require FIPS 140-3 cryptography at 256-bit strength. The policy states that FIPS 140-2 certificates are not acceptable after September 21, 2026.
- Existing and Priority 1 requirements, including multi-factor authentication, have been sanctionable since October 1, 2024. Priority 2 through 4 requirements leave the zero cycle on September 30, 2027.
Control mapping for the storage that holds CJI
| Control | Status under v6.1 | How BrickStor SP helps |
|---|---|---|
| Access Control | ||
| AC-2 Account Management | Sanctionable now | Local accounts and Active Directory or LDAP accounts, with the full create, enable, modify, disable, and remove lifecycle. A directory account disabled in AD loses access at its next authentication, and every administrative change is recorded in the Hub audit log. |
| AC-3 Access Enforcement | Sanctionable now | File and directory permissions are enforced on every SMB and NFS access, for local and directory identities. BrickStor SP also enforces attribute-based (ABAC) labels set by an external policy engine, so access to a case can depend on more than group membership. |
| AC-6 Least Privilege | Sanctionable now | Three management roles (Hub Admin, Storage Admin, and a read-only Hub User) keep storage administration separate from data access, and non-administrators cannot reach management interfaces. |
| AC-17 Remote Access | Sanctionable now | Every management path (the Hub web console over TLS, SSH, the REST API, and the BMC) requires authentication. Data-plane access can be restricted per dataset by host. |
| Identification and Authentication | ||
| IA-2 Identification and Authentication, including MFA | Sanctionable now | Every user is uniquely identified through local or directory accounts, and every file action is tied to that identity. Hub sign-in for administrators supports passkeys (FIDO2) and time-based one-time codes. |
| IA-5 Authenticator Management | Sanctionable now | Directory accounts inherit your AD password policy. Local accounts support complexity, lifetime, and reuse rules, and local passwords are stored as SHA-512 hashes. |
| Audit and Accountability | ||
| AU-2 / AU-12 Event Logging and Audit Record Generation | Zero cycle to Sept 30, 2027 | Three audit streams: the Hub audit log for every administrative action (including CLI service actions), User Behavior Auditing for file reads, writes, deletes, renames, and permission changes per dataset, and the system log. |
| AU-3 Content of Audit Records | Sanctionable now | Records carry the event type, a UTC timestamp from an NTP-synchronized clock, the user and role, the client IP address, the protocol, the full file path, and the outcome. |
| AU-6 Audit Record Review, Analysis, and Reporting | Sanctionable now | Hub audit views and user behavior reports support review, and Active Defense analyzes file activity continuously and responds in real time. |
| AU-9 Protection of Audit Information | Sanctionable now | Audit records are reachable only through authorized management roles, and a read-only role can be mapped to an audit-review group. All three streams forward to your SIEM over TLS-protected syslog in RFC 5424 or CEF format. |
| AU-11 Audit Record Retention | Sanctionable now | Local audit retention is set by time and capacity, and records can also be kept on a replication partner BrickStor and in your SIEM for long-term retention. |
| System and Communications Protection | ||
| SC-8 Transmission Confidentiality and Integrity | Sanctionable now | Management traffic runs over TLS 1.2 or 1.3 and SSH v2, replication over TLS, SMB with SMB3 encryption, and NFSv4 with Kerberos (krb5p). |
| SC-12 Cryptographic Key Establishment and Management | Sanctionable now | Per-dataset keys with rotation, managed by the built-in key manager (with key replication to a peer system for backup) or by your own KMIP-compliant key server. |
| SC-13 / SC-28 Cryptographic Protection and Protection of Information at Rest | Sanctionable now | AES-256 per-dataset encryption. BrickStor SP 23.9 and later uses a FIPS 140-3 Level 1 validated software cryptographic module (CMVP certificate #5423), and RackTop appliances shipped since 2022 with FIPS drives use FIPS 140-3 Level 2 validated self-encrypting drives. That is two independent layers, both at the 256-bit strength v6.1 requires. |
| Contingency Planning | ||
| CP-9 System Backup | Zero cycle to Sept 30, 2027 | Policy-driven immutable snapshots, replication over TLS to a second BrickStor with encryption keys forwarded so encrypted datasets can be recovered there, and ImmutaVault isolated copies that survive administrative compromise. |
| CP-10 System Recovery and Reconstitution | Zero cycle to Sept 30, 2027 | Highly available controllers ride through a single component failure, the operating system is read-only, and Intelligent Bulk Remediation restores only the files an attack touched. |
| System and Information Integrity | ||
| SI-3 / SI-4 Malicious Code Protection and System Monitoring | Sanctionable now | Active Defense watches file activity for ransomware, mass deletion, data theft, and unusual access, opens an incident in real time, and can block the user or client. All activity streams forward to your SIEM. |
| SI-7 Software, Firmware, and Information Integrity | Sanctionable now | Signed software packages, boot-time verification, a read-only operating system image, and self-healing checksums on every block of stored data. |
| Incident Response | ||
| IR-4 Incident Handling | Sanctionable now | Active Defense response actions (block the user, block the client, hold snapshots, notify) and an incident record for each event in the Hub console. |
| IR-6 Incident Reporting | Zero cycle to Sept 30, 2027 | Incidents can be pushed automatically to Teams, Slack, PagerDuty, your SIEM, or email through webhooks and mail, which supports the automated reporting enhancement. |
Sanctionable now means the requirement is tagged Existing or Priority 1 in CJIS Security Policy v6.1 (June 25, 2026). Source: the FBI CJIS Security Policy v6.1 and the RackTop NIST SP 800-53 Rev. 5 crosswalk for BrickStor SP.
What your agency still owns
- MFA for officers and staff at workstation and directory sign-in.
- Weekly audit review, and forwarding audit records to your SIEM.
- Local password policy, and changing factory and BMC default credentials.
- Turning on dataset encryption at creation and enrolling the self-encrypting drives. The drive layer applies to RackTop appliances, not SAN gateway or virtual deployments.
- Reporting suspected incidents within one hour to your CSO and the FBI CJIS ISO.
- Confirming vendor agreements with your CJIS Systems Agency.
No product is "CJIS certified"
The FBI does not certify or endorse products against the CJIS Security Policy, and there is no national CJIS certification for technology. Compliance is assessed at the agency by its CJIS Systems Agency. Judge a storage platform on the controls it supports and the evidence it produces for the auditor.
Ask RackTop for the full NIST SP 800-53 crosswalk and a walkthrough of this mapping against your environment.