Our police department touches FDLE and CJIS systems. Can you support that?

Criminal justice information is its own compliance world. The FBI CJIS Security Policy governs it, and in Florida the Department of Law Enforcement is the CJIS Systems Agency, so FDLE sets and audits how it applies to your agency.

What that means for any IT vendor with access to criminal justice information:

• A signed CJIS Security Addendum between the agency and the vendor.
• Personnel screening for vendor staff with access, including fingerprint based background checks, and security awareness training on the CJIS schedule.
• Specific technical controls, including advanced authentication, encryption meeting the policy's standards, physical security of the areas where terminals sit, and audit logging kept for the required period.

Practically, the division we usually recommend is this. We handle the agency's general network, the workstations that never touch criminal justice information, email, backup, the phones, and the boundary between the general network and the criminal justice segment, which is where the real risk concentrates. Where criminal justice information is in scope we work inside the addendum and alongside your local agency security officer and FDLE rather than around them.

The straight answer on fit. If your department is looking for a vendor whose whole practice is law enforcement, and who sits through CJIS audits every week, that is a reasonable thing to want and we will tell you so rather than talk you out of it. What we are good at is being the town's IT provider who does not create a problem on the police side, and who will be honest about where our edge is. For a small department attached to a small city, that is usually the right shape. For a larger agency, it may not be.

If you are not sure where your own line is, start by asking your local agency security officer which systems are actually in scope. It is frequently fewer than people assume, and the answer changes the whole conversation.