Cybersecurity
CJIS v6.1 raises encryption and scanning requirements
Specops Software’s sponsored explainer said the FBI’s CJIS Security Policy v6.1 tightened encryption and vulnerability-scanning rules, while leaving password and MFA requirements largely unchanged and keeping local audit timing in place.
- The FBI’s CJIS Security Policy v6.1 was published on 25 June 2026, after version 6.0 had been released on 27 December 2024.
- Version 6.1 raised the encryption strength for SC-13 and SC-28 to at least 256-bit and changed vulnerability scanning from quarterly to at least monthly.
- The policy kept phased audit and sanction dates, with Priority 1 controls sanctionable since 1 October 2024 and Priority 2, 3 and 4 controls in zero-cycle status until 30 September 2027.
- Michigan State Police said MFA was among its top audit findings at an October 2025 CJIS Board meeting, and Texas was still auditing against v5.9.5 through 31 March 2027.
- Specops Software used the article to promote its own password, MFA and device-trust products.
The article said the FBI’s CJIS Security Policy had moved through a major revision with version 6.0 on 27 December 2024 and version 6.1 on 25 June 2026. It said the newer version corrected, added and refined parts of the modernised policy, but did not change the overall direction.
The most specific technical changes were in encryption and vulnerability management. Under SC-13 and SC-28, the required strength rose to at least 256-bit, and scanning frequency moved from quarterly to at least monthly.
The article also said the publication of version 6.1 did not mean every agency would switch to one new audit baseline at once. It said Priority 1 controls had been sanctionable since 1 October 2024, while Priority 2, 3 and 4 controls remained in zero-cycle status until 30 September 2027, and it gave Texas as an example of a state still auditing against version 5.9.5 until 31 March 2027.
For password and MFA controls, the article said the requirements had not materially changed between versions 6.0 and 6.1. It said Identification and Authentication still required unique user identification, MFA for privileged and non-privileged accounts, and checks against lists of common or compromised passwords.
The piece then moved into promotion for Specops Software products. It said Password Auditor, Password Policy, Secure Access and Device Trust could help with the cited requirements, and it ended by inviting readers to book a demo.
Named in this story
Companies
- Verizon
- Was cited for a breach report statistic on stolen credentials.
- Specops Software
- Wrote and sponsored the article and promoted its products.
Organisations
- State CJIS Systems Agencies
- May set implementation and assessment guidance.
Governments and agencies
- FBI
- Issued the CJIS Security Policy update.
- CJIS Security Policy
- Was updated to version 6.1.
- NIST SP 800-53
- Was the framework CJIS was said to align with.
- Michigan State Police
- Listed MFA among its top audit findings.
Products and systems
- Specops Password Auditor
- Scans Active Directory for password-policy gaps and compromised passwords.
- Specops Password Policy
- Enforces password rules and checks passwords against compromised credentials.
- Specops Secure Access
- Adds MFA to Windows authentication.
- Specops Device Trust
- Was presented as a complement to the policy direction.
- Active Directory
- Was the directory scanned by Specops Password Auditor.
Places
- Texas
- Was cited as still auditing against v5.9.5 until 31 March 2027.
How the source tells it
The source read like a sponsored compliance explainer: mostly measured, but with recurring vendor promotion and some pressure to act before audits.
- reassurance It said the overall direction had not changed and that password and MFA requirements were largely unchanged.
- urgency It urged attention to the updates before audits and tied them to more frequent enforcement and assessment.
- vendor boosterism It repeatedly shifted into product promotion and ended by inviting readers to book a demo.