Which CJIS Requirements Are Sanctionable Today

Published September 14, 2026 · Updated October 13, 2026

Most agencies preparing for CJIS are tracking one date. There are two, they run on different schedules, and confusing them produces a predictable failure: an agency arrives at its audit having prepared for a deadline that was never the one it was being measured against.

The first clock is already running

Section 1.4 of CJIS Security Policy v6.1 is three paragraphs long and it sets the enforcement boundary for the entire document.

Beginning October 1, 2024, two categories of requirement became the sanctionable set. Requirements that existed prior to modernization, meaning the version 5.9 baseline, and requirements marked [Priority 1].

That date has passed. An agency audited tomorrow is audited against those requirements now, not in 2027.

Section 1.4 also states that non-modernized sections carry no markings, are considered existing requirements, and continue to be auditable and sanctionable. Absence of a priority marking is not absence of obligation.

The second clock ends September 30, 2027

The same section places all [Priority 2], [Priority 3], and [Priority 4] modernized requirements into what the policy calls zero-cycle status. The zero cycle begins October 1, 2024 and ends September 30, 2027.

Note the end date. Guidance circulating in the vendor market gives October 1, 2027, which is the day sanctionability begins rather than the day the cycle closes. The difference is immaterial in practice and material in a room where someone is checking your citations.

What this means in specific terms

Two Priority 1 controls, both sanctionable now:

AC-2 Account Management carries [Existing] [Priority 1]. It requires the agency to define and document the types of accounts allowed and specifically prohibited, assign account managers, and require conditions for group and role membership, among other requirements.

CA-7 Continuous Monitoring carries [Priority 1]. It requires a system-level continuous monitoring strategy and its implementation.

Both were sanctionable on October 1, 2024.

The part almost nobody has worked through

CA-7 does not stop at requiring a strategy. It names 20 specific system-level metrics that the strategy must monitor. Among them:

AC-2(g) Account Management
AC-17(1) Remote Access, Monitoring and Control
AT-4(a) Training Records
CM-3(f) Configuration Change Control
MA-3(a) Maintenance Tool
PE-14(b) Environmental Controls
SA-9(c) External System Services
SI-4 System Monitoring

Now check the priority markings on the underlying controls. MA-3 Maintenance Tools is marked [Priority 4]. PE-14 Environmental Controls is [Priority 2]. Both sit in the zero cycle until September 30, 2027.

So the situation is this. CA-7 is sanctionable today and requires monitoring of metrics drawn from controls that are not themselves sanctionable until 2027.

The obligation to monitor arrives before the obligation to fully implement. An agency that reads only the priority column on MA-3 and defers it entirely has missed that CA-7 already reaches into it.

This is a reading, not a settled position. The policy text supports it. Whether a given CSA's audit instrument reflects it is a separate question, and the right one to ask your CSA directly rather than assume.

A second case worth checking

AT-4 Training Records carries [Existing] [Priority 4]. Two markings pulling in opposite directions.

Section 1.4 makes existing requirements sanctionable and places Priority 4 modernized requirements in the zero cycle. AT-4 is marked as both. The more defensible reading is that the [Existing] marking governs, because the requirement to document training activity and retain records for three years predates modernization. It is not a new obligation waiting on a cycle.

AT-4's own discussion text supports this. It states that three-year retention accounts for a triennial audit cycle. That is the requirement describing itself as already aligned to the audit rhythm.

Where a requirement carries both markings, assume the existing obligation applies now and confirm with your CSA.

The clock that actually schedules your audit

Neither of the two above determines when you are audited. That is set separately.

Appendix D.1 of the policy, the CJIS User Agreement, states at item 5 that each CSA, Interface Agency, or State Identification Bureau is responsible for completing a triennial audit of all agencies with access to CJIS Division systems through their systems. Each authorized CSA, IA, or SIB user is in turn subject to a triennial audit by the CJIS Division.

Triennial means rolling. Your agency's position in that cycle depends on when it was last audited, not on a national date. Some agencies will be assessed in 2026, some in 2028. Both are assessed against whatever the sanctionable set is on the day they are assessed.

If you know your agency's last audit year, the Compliance Clock will place you in the triennial cycle and show which sanctionable set applies on your next assessment.

There is a third audit obligation that catches agencies out. SA-9 External System Services requires that agencies, at minimum, triennially audit all external service providers with access to the information system. That is the agency auditing its vendors, on its own initiative. It is not something the CSA does for you, and a fifteen-officer department with three cloud vendors owns three of these.

Reconciling this with what your CSA tells you

Some state CSAs currently advise that v6.1 is not yet the basis for audits and that agencies should use it for gap assessment while continuing to operate against 5.9.5. Texas DPS publishes guidance to this effect.

That is not in conflict with anything above, and your CSA is authoritative for your agency. The reconciliation is:

The sanctionable requirement set under §1.4 has included existing and Priority 1 requirements since October 1, 2024.
The audit instrument a particular CSA uses may still be built on the 5.9.5 structure.
Requirements marked [Existing] are, by definition, requirements that were in 5.9. They appear in both.

The overlap is where an agency is exposed regardless of which document its CSA is holding. That is the set to work on first.

Ask your CSA one question: which policy version is your current audit instrument built on, and when do you expect to move to 6.1. The answer changes your sequencing and nothing else in this article changes with it.

What to do with this

Three steps, in order.

Separate your requirement list into existing and Priority 1 on one side, Priority 2 through 4 on the other. The first list is your exposure today.

Read CA-7's metric list against your Priority 2 through 4 controls and find where monitoring obligations reach into deferred implementation.

Establish your position in the triennial cycle by asking your CSA, and calendar your own SA-9 vendor audits separately, because nobody else will.