Police and justice agencies face stricter login and audit rules

Police and justice agencies that handle Criminal Justice Information, the sensitive records tied to law enforcement work, are being pushed to tighten login, account and logging controls under version 6.1 of the CJIS security rules. A guide published on BleepingComputer on October 20, 2026 lists five priorities. It is sponsored content written by Specops Software, a company that sells tools in this area.

Stronger logins

The rules require multi-factor login, which means a second proof of identity on top of a password. It applies to both admin and regular accounts, whether staff connect locally, over the network or from a distance. The guide says the hard part is making sure no account slips through, especially older applications and admin accounts. It suggests phishing-resistant options such as FIDO2 security keys, which are physical keys, and clear steps for issuing, replacing and removing them.

Accounts and passwords

• Keep a full list of user, admin, service and temporary accounts.
• Review accounts and privileges at least once a year.
• Remove temporary and emergency accounts within 72 hours.
• Disable accounts idle for 90 days within one week.

On passwords, the rule sets an eight-character minimum. It is a Priority 1 control, which the guide says has been sanctionable since October 2024. The guide also advises longer, unique passphrases and approved password managers. One wrinkle: the rule still calls for a yearly password change, so agencies should check with their CJIS Systems Agency.

Logs and audits

Audit logs are the records that show who did what, when, and with what result. Collecting them is not enough. Agencies need to capture the right events, review them regularly and protect them from tampering. The guide says a central log tool, often called a SIEM, can make odd activity easier to spot.

Agencies are audited at least once every three years. They are expected to stay compliant in between, so the guide recommends keeping evidence organized all year instead of scrambling before an audit.

What to keep in mind

The guide is written by a vendor, so its product pitches should be read as marketing. It mentions a free, read-only scan of Active Directory, the system many organizations use to manage logins, that checks password policy against CJIS requirements. It also cites a Verizon report finding stolen credentials in 44.7% of breaches. The article does not say what sanctions apply when an agency falls short.