Law enforcement agencies increasingly rely on digital evidence to investigate crimes, establish timelines, and support legal proceedings. Body-worn camera recordings, surveillance footage, mobile devices, digital photographs, and computer files can all contain valuable information.
However, collecting and storing digital evidence also creates significant security responsibilities. Criminal Justice Information (CJI) must be protected against unauthorized access, alteration, disclosure, and loss. The Criminal Justice Information Services (CJIS) Security Policy establishes minimum security requirements for organizations that access, process, store, or transmit CJI.
The FBI's CJIS Security Policy was updated to Version 6.1 on June 25, 2026. Its requirements cover areas including access control, authentication, audit and accountability, incident response, media protection, system security, and supply chain risk management.
This checklist provides a practical starting point for agencies reviewing their digital evidence workflows. It should be used alongside the current CJIS Security Policy, applicable state requirements, and guidance from the relevant CJIS Systems Agency.
1. Define what constitutes criminal justice information
The first step is identifying which digital evidence falls within the scope of CJIS compliance requirements. CJI can include information obtained from or processed through criminal justice systems, and the precise classification depends on the data and how it is handled.
Digital evidence may include:
Video recordings connected to an investigation
Images and photographs
Criminal history information
Reports containing personally identifiable information
Extracted mobile device data
Digital communications
Audio recordings and interview files
Information stored in investigative platforms
Not every file held by a law enforcement agency will necessarily qualify as CJI. Agencies should establish clear classification procedures and consult their CJIS security personnel when the status of information is uncertain.
A classification process helps determine which security controls, access restrictions, retention rules, and sharing procedures should apply.
Protect sensitive criminal justice information with AI-powered video redaction.
2. Restrict access to authorized personnel
CJIS compliance depends on limiting access to information systems and data to authorized individuals. Employees should receive access based on their job responsibilities and legitimate need to know.
Agencies should review whether each user can access only the systems and files necessary for their role. Investigators, evidence technicians, supervisors, contractors, and administrative staff may require different permission levels.
A practical access control checklist includes:
Assigning individual user accounts
Applying role-based permissions
Removing access when employment ends
Reviewing privileges regularly
Restricting administrative access
Monitoring access to sensitive evidence
Preventing unauthorized sharing or downloads
The FBI's CJIS guidance emphasizes access control, identification and authentication, and least-privilege principles as important safeguards for protecting CJI.
Shared accounts can make investigations into unauthorized activity more difficult because actions cannot easily be attributed to a specific person. Individual authentication and appropriate logging help agencies maintain accountability.
3. Apply strong authentication
Passwords alone may not provide sufficient protection for systems containing sensitive criminal justice information. Agencies should establish authentication requirements that reflect the current CJIS Security Policy and the systems being used.
Multi-factor authentication can provide an additional layer of protection by requiring users to verify their identity through more than one factor. This can help reduce the impact of compromised passwords, particularly when personnel access evidence remotely.
Authentication policies should address:
Password strength and management
Multi-factor authentication requirements
Account lockout and session controls
Remote access
Privileged accounts
Authentication of users and connected systems
Agencies should ensure that security controls are applied consistently across evidence management platforms, cloud services, mobile devices, and other systems that process CJI.
4. Encrypt evidence in transit and at rest
Digital evidence may be vulnerable when transferred between systems or stored outside a physically secure location. Encryption helps protect information by making it unreadable to people who do not possess the appropriate means of decryption.
CJIS requirements address encryption for CJI in transit and at rest, subject to the policy's specific conditions and exceptions. The FBI's CJIS resource materials also recommend examining how encryption is implemented when agencies use cloud environments.
Agencies should confirm:
Whether evidence is encrypted during transmission
Whether stored files are encrypted
Which encryption standards apply
Who manages encryption keys
How keys are protected and accessed
Whether vendors meet relevant requirements
Encryption should not be considered a substitute for access control. A person with access to encryption keys may be able to decrypt sensitive information, so key management and authorization remain important.
5. Secure physical and digital media
Digital evidence can be stored on hard drives, memory cards, mobile devices, removable media, and cloud-based systems. Each storage method creates different risks.
Physical media should be stored in controlled areas, with access restricted to authorized personnel. When media is transported, agencies should use procedures designed to prevent loss, theft, damage, or unauthorized access.
Digital media management should also address how files are copied, backed up, archived, and destroyed. Agencies should know where evidence is stored and which personnel or vendors can access it.
The CJIS Security Policy includes media protection requirements relating to the storage, access, transport, and destruction of information.
A documented media handling process can help agencies avoid common problems, such as misplaced memory cards, untracked external drives, and evidence remaining on retired equipment.
6. Maintain audit logs and accountability
Audit logging helps agencies monitor activity across systems containing CJI. Logs can provide information about access attempts, file handling, administrative actions, and potential security incidents.
An effective logging process should establish which events must be recorded, how long logs are retained, and who is responsible for reviewing them. Logs should be protected against unauthorized modification and made available for appropriate investigations or audits.
For digital evidence, useful records may include:
User access and download activity
Evidence uploads and transfers
Changes to permissions
Administrative actions
File deletion or modification
Security alerts and failed access attempts
Logging should be proportionate to the system and its risk profile. Agencies should also ensure that monitoring does not create additional unnecessary exposure of sensitive information.
7. Protect evidence during collection and processing
Digital evidence should be collected using documented procedures that preserve its integrity and support later examination. Investigators should record the source of the material, collection method, date and time, and any relevant technical circumstances.
Whenever possible, the original evidence should be preserved while examination takes place on an appropriate working copy. This is particularly important for video files, where format conversion, compression, or editing can affect quality and metadata.
A reliable workflow should include:
Identifying the relevant evidence source
Securing the device, account, or recording
Collecting the material using an appropriate method
Recording technical and contextual details
Preserving the original file
Documenting any subsequent processing
Agencies should also establish when specialist forensic personnel are required. Some devices and systems may require dedicated tools or expertise to avoid altering the source information.
8. Redact sensitive video before disclosure
Digital evidence may contain information that is not relevant to the investigation or should not be shared with every recipient. Video recordings can show unrelated individuals, license plates, addresses, children, and other sensitive details.
Before sharing footage with prosecutors, courts, attorneys, partner agencies, or members of the public, agencies should assess whether redaction is appropriate. The decision should take account of the disclosure purpose, legal authority, privacy risks, and evidentiary requirements.
Pimloc's public safety video redaction software, Secure Redact, supports automated detection and tracking of sensitive content in video. This can assist law enforcement teams in preparing redacted copies while retaining relevant visual context. Human review remains essential to identify missed detections and confirm that redaction has not removed information required for the investigation.
The original evidence should be preserved separately, and agencies should document the redaction process, including what was obscured and who reviewed the final file.
9. Establish incident response procedures
Agencies need a documented plan for responding to suspected security incidents involving CJI. Potential incidents may include unauthorized access, lost devices, malware, accidental disclosure, or compromised accounts.
An incident response plan should identify responsibilities for reporting, investigation, containment, recovery, and communication. Staff should know how to escalate concerns and whom to contact when sensitive information may have been exposed.
The plan should also address third-party providers. When evidence is stored or processed by a vendor, agencies should understand how the supplier detects incidents, communicates with customers, preserves relevant logs, and supports investigation and recovery.
Testing incident response procedures can reveal gaps before a serious event occurs. Agencies should use the results of exercises and real incidents to update controls and improve training.
10. Review vendors and cloud services
Many law enforcement agencies use external providers for evidence storage, digital investigations, video management, and secure sharing. These arrangements require careful assessment because vendors may access or process CJI on the agency's behalf.
The FBI's CJIS cloud guidance recommends examining encryption, incident response, contractor requirements, audit access, logging, and media protection when evaluating cloud service providers.
Before approving a supplier, agencies should determine:
Which services will process or store CJI
Where the information will be hosted
How access is controlled
Whether encryption requirements are met
How security incidents are reported
Whether required audits can be supported
How information is returned or destroyed
Whether subcontractors are involved
Contracts should clearly define the supplier's responsibilities and the agency's oversight rights. A vendor's general security claims should not replace a detailed assessment against the requirements applicable to the specific deployment.
11. Train personnel and conduct regular reviews
CJIS compliance is an ongoing responsibility. Technology, threats, staffing arrangements, and policy requirements can change, so agencies should provide regular training and review their procedures.
Training should be tailored to personnel responsibilities. General users may need guidance on secure passwords, phishing, information handling, and incident reporting, while administrators and security personnel may require more advanced instruction.
Agencies should also conduct periodic reviews of:
User accounts and access privileges
Encryption and authentication controls
Audit logs
Evidence storage locations
Vendor arrangements
Incident response procedures
Staff training records
Media retention and destruction
The FBI's CJIS materials identify security awareness training, personnel security, and audit-related controls as important parts of protecting CJI.
A practical CJIS compliance review
CJIS compliance involves more than securing a single evidence management system. Agencies must consider the complete information lifecycle, from collection and storage through examination, sharing, retention, and destruction.
A practical review should confirm that the agency:
Classifies relevant criminal justice information
Restricts access to authorized personnel
Uses appropriate authentication controls
Encrypts information when required
Protects physical and digital media
Maintains audit logs
Documents collection and processing methods
Reviews video for sensitive information
Uses secure disclosure procedures
Maintains an incident response plan
Evaluates vendors and cloud services
Provides ongoing staff training
This checklist is a starting point rather than a substitute for a formal CJIS assessment. Agencies should verify requirements against the current policy and consult their CJIS security authority when interpreting specific controls.
Frequently asked questions
-
Not necessarily. The applicable requirements depend on whether the information qualifies as CJI and how it is accessed, processed, stored, or transmitted. Agencies should establish a clear classification process.
-
Encryption requirements depend on factors such as whether information is in transit or at rest, where it is stored, and whether a policy exception applies. Agencies should consult the current CJIS Security Policy for the relevant conditions.
-
Description text goes here
-
Cloud services may be used when the arrangement meets applicable CJIS requirements and agency policies. Agencies should evaluate encryption, access controls, incident response, auditing, vendor responsibilities, and data location.
-
Redaction should generally be performed on a working copy, while the original evidence is preserved securely. This helps retain the source material for future examination or legal proceedings.
-
AI redaction tools can support privacy and disclosure workflows, but using them does not automatically establish CJIS compliance. Agencies must assess the complete system, including security controls, data handling, access, hosting, and vendor responsibilities.
-
Agencies should follow the review requirements in the current CJIS Security Policy and their internal procedures. Reviews should also occur when personnel change roles, leave the organization, or no longer require access.
-
Personnel should follow the agency's incident response procedures immediately, report the concern to the appropriate security personnel, and take steps to contain and investigate the incident. Notification and documentation requirements will depend on the circumstances.
-
No. Compliance involves people, processes, technology, training, contracts, and oversight. A software product may support specific controls, but agencies remain responsible for assessing and maintaining their broader compliance obligations.