Microsoft’s own CJIS page says the FBI doesn’t offer certification of Microsoft’s compliance with CJIS requirements, and that surprises more police IT teams than it should. If you’re evaluating Microsoft 365 CJIS compliance, what exists instead is alignment with the CJIS Security Policy, backed by signed agreements. Microsoft attests to its ability to meet FBI requirements in its agreements with states and customers, and contractors who process criminal justice information sign the CJIS Security Addendum. If you’ve worked with HIPAA, the pattern will look familiar. Nobody hands you a HIPAA certificate either, and the proof lives in paper like a business associate agreement. Version 6.1 of the policy is dated June 25, 2026, and the clock is already running on the controls that matter most. Here’s what that means for GCC and GCC High, where phishing-resistant sign-in fits, and a plan a small department can finish before the grace period ends.
What does CJIS alignment actually mean?
I use the term CJIS aligned to mean that a vendor says it can meet the CJIS requirements and the CJIS Security Policy and backs that up with the required agreements. It isn’t an official FBI label. Microsoft’s wording is that it assessed its government cloud operations and will attest in its agreements to its ability to meet FBI requirements, and that attestation lives in agreements with a state’s CJIS authority and with customers.
The HIPAA comparison is my shorthand and it isn’t a perfect match. A business associate agreement is a contract between you and a vendor, while the CJIS Security Addendum is a standard document your state and its contractors sign. They do the same kind of job, which is to put a vendor’s promises in writing so you can point to them. So when a vendor tells you they’re CJIS certified, ask which agreement backs that up. A badge on a website is a bumper sticker, and your auditor won’t accept a bumper sticker.
What changed in CJIS Security Policy 6.1?
Version 6.1 is dated June 25, 2026 and refines the modernized policy the FBI completed in December 2024 (version 6.0). The part that matters most to IT teams is the priority structure, because it decides which controls an auditor can hold against you today and which ones can wait.
Priority 1 requirements are sanctionable now, and multi-factor authentication for privileged and non-privileged accounts is on that list. The modernized Priority 2 through 4 requirements sit in a zero-cycle window. Think of it like a building inspection where the fire exits are already enforced and the signage gets a pass until next year. Nobody wants to explain a missing exit sign to the fire marshal once the window closes.
When does the CJIS grace period end?
The policy says the zero-cycle begins October 1, 2024 and ends September 30, 2027. Industry summaries describe it as a window where auditors can note gaps in Priority 2 through 4 requirements without sanctioning them, and those gaps are expected to become sanctionable afterward.
Your state sets the audit calendar, so ask your CJIS Systems Agency (CSA) which version your next audit uses. Texas DPS, for example, says its audits through March 31, 2027 use version 5.9.5 and that agencies should begin gap assessments now to prepare for future audit cycles. That one phone call can save you a lot of guessing.
Is Microsoft 365 GCC CJIS compliant?
Microsoft says it has assessed the operational policies and procedures of its government clouds, including Office 365 U.S. Government, and attests in its agreements to its ability to meet FBI requirements for in-scope services. Office 365 GCC appears in Microsoft’s CJIS applicability table. GCC High is not listed there.
| Topic | GCC | GCC High |
| Appears in Microsoft’s CJIS applicability table | Yes | Not listed, and the page does not say how it is treated |
| Personnel screening for staff who can access customer content | Includes state-adjudicated CJIS screening in states that joined Microsoft’s CJIS program | No CJIS specific row on the GCC High and DoD page, which lists a fingerprint check against FBI databases |
| Customer support covered by CJIS data handling assurances | No, support is outside the accreditation boundary | No, the GCC High and DoD page says the same |
The last row is the one that catches people. Microsoft’s service descriptions for both GCC and GCC High say customer support sits outside the accreditation boundary and doesn’t come with CJIS data handling or compliance assurances. My recommendation is a simple house rule. Keep criminal justice information out of support tickets, screenshots, and chat sessions with any vendor that hasn’t signed your state’s CJIS paperwork.
Microsoft’s page also explains that private contractors who process CJI sign the CJIS Security Addendum, and that Microsoft signs it in states that have a CJIS Information Agreement in place. Your CSA is the place to request your state’s agreement. If your department runs GCC High, ask your Microsoft account team and your CSA how your state treats it, because Microsoft’s CJIS page doesn’t list it in the applicability table or say how it is treated.
Where does phishing-resistant MFA fit?
The policy’s control list names multi-factor authentication for privileged accounts and for non-privileged accounts as Priority 1. In Microsoft Entra, the built-in phishing-resistant strength accepts FIDO2 security keys, Windows Hello for Business, or a platform credential, and certificate-based authentication. Microsoft Authenticator phone sign-in counts as passwordless, but it isn’t in that group.
Whether your CSA expects phishing-resistant methods or accepts any approved second factor is a conversation to have with them. I’d still pick the stronger option for admins and anyone who touches records systems, since that’s where a stolen session hurts the most. Microsoft’s Entra availability page for US Government lists passwordless sign-in and certificate-based authentication as available, but it doesn’t list authentication strengths. Confirm that feature in your own cloud before you build a Conditional Access policy around it.
What should a police department do before September 30, 2027?
Start with the paperwork, then the people, then the tools. A department with one IT person and a managed provider doesn’t need a big program, just a short list done in a sensible order. The first step is a phone call.
| Step | What to do | Why it comes first |
| 1 | Ask your CSA which policy version your next audit uses and when it happens | The answer sets your real deadline |
| 2 | Confirm whether you are on GCC or GCC High and get your Microsoft CJIS agreement in writing | Your tenant type and state agreement decide what you can rely on |
| 3 | Map where CJI lives in Exchange, Teams, SharePoint and OneDrive | You can’t protect or audit what you haven’t found |
| 4 | Turn on MFA for every admin and every non-privileged account on systems in CJIS scope, using phishing-resistant methods where your CSA allows | Priority 1 controls are sanctionable now |
| 5 | Write the support ticket rule and train the help desk | Support sits outside the CJIS assurances |
| 6 | Run a gap assessment against 6.1 and sort the findings by priority | Priority 2 through 4 gaps still need a plan before September 30, 2027 |
Where does nuHarbor fit?
We run Microsoft security for clients, and our Microsoft security managed services page lays out four stages. Assess starts with a Defender Health Check and a Purview Quick Start. Optimize tunes detections and policies. Manage covers Defender managed detection and response and managed Purview. Detect and Respond adds Sentinel MXDR and 24/7 security operations.
For a CJIS project, Assess is the natural starting point, because any gap assessment needs an honest picture of what’s configured and what’s turned off. I’d rather find a missing conditional access policy in November than have a state auditor find it in a later cycle. We share the work with you. You keep the decisions about your data and your CSA relationship, and we help carry the monitoring and the tuning. You can see how the pieces fit on the nuHarbor Microsoft security managed services page.
Frequently asked questions
Does the FBI certify Microsoft’s CJIS compliance? No. Microsoft’s CJIS page says the FBI doesn’t offer certification of Microsoft’s compliance. Microsoft attests to its ability to meet FBI requirements in its agreements with state CJIS authorities and with customers, and your CSA can tell you how those agreements apply to your department.
Is GCC High covered for CJIS? Microsoft’s CJIS page doesn’t list GCC High in its applicability table. Its GCC High service description also says support is outside the accreditation boundary and doesn’t provide CJIS data handling assurances. Ask your Microsoft account team and your CSA how your state treats GCC High.
Is multi-factor authentication required under CJIS 6.1? The policy lists multi-factor authentication for privileged and non-privileged accounts as Priority 1, which means it’s sanctionable.
Which Entra sign-in methods count as phishing-resistant? Microsoft’s built-in phishing-resistant strength includes FIDO2 security keys, Windows Hello for Business, or a platform credential, and certificate-based authentication.
Is my state auditing against 6.1 yet? That depends on the state. Texas DPS says its audits through March 31, 2027 use version 5.9.5 and that agencies should start gap assessments now. Your CSA can tell you the schedule for your agency.
Sources
FBI, Criminal Justice Information Services (CJIS) Security Policy, version 6.1, June 25, 2026
Texas Department of Public Safety, CJIS Policy Components and Documents
Microsoft Learn, Criminal Justice Information Services (CJIS) Security Policy
Microsoft Learn, Office 365 GCC, Service Descriptions
Microsoft Learn, Office 365 GCC High and DoD, Service Descriptions
Microsoft Learn, Conditional Access authentication strengths
Microsoft Learn, Microsoft Entra feature availability in Azure for US Government
ITNS, CJIS Security Policy 6.1: What Changes by Sept. 2027
nuHarbor, Microsoft security managed services
About the author
Justin is the founder and CEO of nuHarbor, where he continues to advance modern integrated cybersecurity services. He has over 20 years of cybersecurity experience, much of it earned while leading security efforts for multinational corporations, most recently serving as global CISO at Keurig Green Mountain Coffee. Justin serves multiple local organizations in the public interest, including his board membership at Champlain College.
