Real Example: When “CJIS Compliant” Wasn't Actually CJIS Compliant
One municipality came to Dazzee IT believing its environment was CJIS compliant. The city's previous IT provider had told city leaders that the necessary requirements were being met.
When Dazzee IT took over and performed a comprehensive assessment, we found something very different.
The environment was not CJIS compliant.
Even more concerning, we discovered that the city's general office and law-enforcement networks were co-mingled rather than properly separated. This created a potential path where a threat actor who compromised a general office user's workstation could potentially gain access to systems containing sensitive criminal justice information.
That wasn't simply an IT configuration problem. It created the potential for criminal justice data exposure as well as serious legal and financial consequences for the municipality.
Our team identified the gaps, worked with the city to address the network architecture and security issues, and helped move the environment toward the appropriate CJIS security requirements.
The lesson for other municipalities is important:
Don't assume you're CJIS compliant simply because an IT provider says you are.
Ask how that conclusion was reached. A qualified provider should be able to assess the environment, document deficiencies, explain the risks in language city leadership can understand, and provide a specific remediation plan.
For municipalities with law-enforcement operations, an independent cybersecurity and CJIS assessment can uncover risks that may otherwise remain hidden until an audit or a cyberattack exposes them.