Confirm agency authority
Identify the policy owner and obtain the handling conditions for the intended use.
CJIS · Criminal justice information
CJIS file exchange planning for agencies and contractors
Before moving criminal justice information, ask the responsible agency to confirm the approved workflow and applicable policy. Use fictional case material to assess the proposed route.
Inspect each handoff
Map sender, recipient, service provider and the systems that may hold a copy.
Record the review decision
Keep unresolved personnel, location and configuration questions with the agency reviewer.
Start with the agency’s approval process
Ask which approvals and evidence are required before demonstrating or using the proposed service.
What information is involved?
Establish the data classification, permitted purpose and restrictions on onward disclosure. Identify whether the package contains CJI or other protected information.
Who can authorize the route?
Identify the agency contacts responsible for approving the exchange and evaluating its security requirements. Record unresolved questions before testing with real information.
Where does responsibility sit?
Map the sender, service provider, administrators and recipient environment. Include third parties that may support or access the service.
Assess the full exchange environment
Include people, endpoints and retained copies alongside encryption and recipient verification.
Personnel and access
Confirm identities, assigned privileges and relevant personnel requirements with the agency.
Service safeguards
Request evidence about the protections and configuration relevant to the proposed deployment.
Activity and incidents
Agree which records are available and how suspected incidents reach the responsible team.
Retention and disposal
Determine how copies, return of information and removal are managed under approved procedures.
Build the approval packet before the demonstration.
Give the agency reviewer a precise description of the proposed exchange. A product name or an encryption statement leaves too much unresolved. The packet should explain the people, information and environments involved in the intended use.
Describe the information
Use a fictional case file to explain the activity and the information it would involve.
Draw the service boundary
Identify the endpoints, providers and support roles that could handle the proposed transfer.
Record the decision route
Document the approving agency contact, its conditions and any missing evidence.
Test an exception as well as a successful delivery.
Once the agency has agreed the scope of an evaluation, use synthetic information to explore ordinary mistakes and changes. The purpose is to identify questions for review, not to infer authorization from a successful demonstration.
- The intended recipient changes
- Discuss how a recipient is verified and how a mistaken or outdated access decision would be corrected.
- A support request is raised
- Ask who may access relevant information during troubleshooting and which agency procedures apply.
- The exchange ends
- Review return, retention and removal expectations, including copies in recipient environments and relevant activity records.
Prepare for the conversation
- Agency requirements
- Bring the applicable policy and any agency-specific conditions.
- A synthetic package
- Describe the intended information without including live CJI.
- The approval owner
- Identify who can assess the service evidence and authorize the proposed route.
Bring the requirements. Leave out the case data.
Walk through a synthetic exchange with MX. Capture the questions your agency needs answered about the service, configuration and responsibilities before making a decision.
Explore your controlled exchangeQuestions for
your review.
Is MX represented here as CJIS approved?
No. This page is guidance for evaluating a proposed exchange. Obtain the evidence and approvals required by the responsible agency before using a service for CJI.
Does encryption alone establish CJIS compliance?
No. Evaluate the relevant policy requirements and the complete operating environment, including personnel, access, procedures and provider responsibilities.
Can we use real case information in a demonstration?
Use synthetic information until the route and service have been assessed and authorized for the intended use.
Will every agency have the same implementation requirements?
Do not assume so. Confirm the applicable policy, agreements and agency-specific requirements with the responsible authority.