CJIS storage for police and sheriff's offices

Local accounts and Active Directory or LDAP accounts, with the full create, enable, modify, disable, and remove lifecycle. A directory account disabled in AD loses access at its next authentication, and every administrative change is recorded in the Hub audit log.

Your agency: Run the periodic account review. Rosters of administrators, role mappings, and dataset permissions can be pulled on demand.

File and directory permissions are enforced on every SMB and NFS access, for local and directory identities. BrickStor SP also enforces attribute-based (ABAC) labels set by an external policy engine, so access to a case can depend on more than group membership.

Three management roles (Hub Admin, Storage Admin, and a read-only Hub User) keep storage administration separate from data access, and non-administrators cannot reach management interfaces.

Every management path (the Hub web console over TLS, SSH, the REST API, and the BMC) requires authentication. Data-plane access can be restricted per dataset by host.

Every user is uniquely identified through local or directory accounts, and every file action is tied to that identity. Hub sign-in for administrators supports passkeys (FIDO2) and time-based one-time codes.

Your agency: CJIS requires MFA for privileged and non-privileged accounts. File-share users authenticate through your directory, so their MFA is enforced at workstation and directory sign-in. Front SSH with an MFA jump host.

Directory accounts inherit your AD password policy. Local accounts support complexity, lifetime, and reuse rules, and local passwords are stored as SHA-512 hashes.

Your agency: Set the local password policy and change factory and BMC default credentials before production. The system ships without local password values.

Three audit streams: the Hub audit log for every administrative action (including CLI service actions), User Behavior Auditing for file reads, writes, deletes, renames, and permission changes per dataset, and the system log.

Records carry the event type, a UTC timestamp from an NTP-synchronized clock, the user and role, the client IP address, the protocol, the full file path, and the outcome.

Hub audit views and user behavior reports support review, and Active Defense analyzes file activity continuously and responds in real time.

Your agency: CJIS v6.1 requires review and analysis at least weekly. Assign the reviewer and keep the record of each review.

Audit records are reachable only through authorized management roles, and a read-only role can be mapped to an audit-review group. All three streams forward to your SIEM over TLS-protected syslog in RFC 5424 or CEF format.

Your agency: Forward audit records to your SIEM. The SIEM copy, outside the reach of any storage administrator, is the control an auditor should be shown.

Local audit retention is set by time and capacity, and records can also be kept on a replication partner BrickStor and in your SIEM for long-term retention.

Your agency: CJIS requires at least one year. Set retention to cover that, plus any longer hold for FOIA requests, subpoenas, or litigation.

Management traffic runs over TLS 1.2 or 1.3 and SSH v2, replication over TLS, SMB with SMB3 encryption, and NFSv4 with Kerberos (krb5p).

Per-dataset keys with rotation, managed by the built-in key manager (with key replication to a peer system for backup) or by your own KMIP-compliant key server.

AES-256 per-dataset encryption. BrickStor SP 23.9 and later uses a FIPS 140-3 Level 1 validated software cryptographic module (CMVP certificate #5423), and RackTop appliances shipped since 2022 with FIPS drives use FIPS 140-3 Level 2 validated self-encrypting drives. That is two independent layers, both at the 256-bit strength v6.1 requires.

Your agency: Turn on dataset encryption when each dataset is created, and enroll the self-encrypting drives. The drive layer applies to RackTop appliances, not SAN gateway or virtual deployments.

Policy-driven immutable snapshots, replication over TLS to a second BrickStor with encryption keys forwarded so encrypted datasets can be recovered there, and ImmutaVault isolated copies that survive administrative compromise.

Highly available controllers ride through a single component failure, the operating system is read-only, and Intelligent Bulk Remediation restores only the files an attack touched.

Active Defense watches file activity for ransomware, mass deletion, data theft, and unusual access, opens an incident in real time, and can block the user or client. All activity streams forward to your SIEM.

Signed software packages, boot-time verification, a read-only operating system image, and self-healing checksums on every block of stored data.

Active Defense response actions (block the user, block the client, hold snapshots, notify) and an incident record for each event in the Hub console.

Incidents can be pushed automatically to Teams, Slack, PagerDuty, your SIEM, or email through webhooks and mail, which supports the automated reporting enhancement.

Your agency: CJIS v6.1 asks personnel to report suspected incidents within one hour of discovery, and to report onward to your CSO and the FBI CJIS ISO. Wire the alerts into that process.