A law enforcement GIS can begin with basemaps and parcel layers, then expand to include computer-aided dispatch (CAD), records management system (RMS), license plate reader (LPR), and other operational data. That changes the security questions an agency must answer. When Criminal Justice Information (CJI) enters the environment, applicable CJIS Security Policy requirements follow the data.
Cloud hosting can reduce infrastructure work and make disconnected information easier to use, but a provider’s security claims are not enough. Agencies need to establish where CJI resides, who can access it, and how responsibility is divided among IT, GIS, and vendors.
The FBI modernized the CJIS Security Policy in Version 6.0 in December 2024 and released Version 6.1 in June 2026. Existing and Priority 1 controls are already auditable and sanctionable; Priority 2, 3, and 4 modernized controls remain in a transition period through September 30, 2027. This guide focuses on the decisions facing state and local agencies.
What Are CJIS-Compliant GIS Cloud Services?
A CJIS-compliant GIS cloud service is a cloud-hosted mapping and analysis environment designed to meet applicable CJIS Security Policy requirements when it handles CJI. CJIS is not a single product certification issued by the FBI. Oversight occurs through each state’s CJIS Systems Agency (CSA) and CJIS Systems Officer (CSO).
The scope of a review includes more than the cloud region. An agency must consider the mapping platform, applications, connections to CAD and RMS, administrators, and users who view operational information. Moving a workload does not transfer every security obligation to the provider. State-specific guidance also matters: the Texas Department of Public Safety, for example, maintains CJIS documents alongside the federal policy.
Providers should explain the controls they maintain, which agreements apply, and how their responsibilities fit with the agency’s obligations. Important requirements include:
- FIPS 140-validated cryptographic modules for applicable protection of CJI in transit and at rest.
- Multi-factor authentication meeting Authenticator Assurance Level 2 (AAL2) where required.
- Personnel screening or acceptable technical safeguards, plus appropriate security addenda and agreements.
- Audit logging, incident reporting, and defined responsibilities for system administration.
Does Your GIS Data Count as CJI?
Basemaps, streets, parcels, and zoning layers are generally public or administrative data. GIS environments require closer scrutiny when they display or process CAD/RMS incidents, LPR hits, warrant information, or offender records. The classification depends on the information handled and applicable agency requirements.
GIS data type | Example and treatment |
Basemaps and reference layers | Street centerlines, parcels, zoning: generally not CJI. |
Public crime dashboards | Anonymized, aggregated incident data released for residents: generally not CJI. |
CAD/RMS incident layers | Live calls for service mapped by address: assess and protect applicable CJI. |
LPR hit layers | Plate reads connected with a location and time: assess and protect applicable CJI. |
Offender, parole, or probation layers | Restricted individual and address data: assess and protect applicable CJI. |
Warrant or BOLO layers | Active warrant and alert information: assess and protect applicable CJI. |
Crime analysis units and real-time crime centers often combine CAD, RMS, AVL, and LPR data. Identify sources containing CJI before moving workloads to the cloud. Keep restricted operational layers separate from public-facing services such as GeoShield Communities, which supports anonymized public crime mapping for residents.
Classify what a map actually exposes, not only the source system. An incident layer may include an address, case details, and linked records that change who should be permitted to view it. Before migration, trace how each source is ingested, joined with location information, displayed, retained, and shared. Confirm which maps remain internal and who authorizes any public-facing version. This makes the security review specific to the work analysts perform.
Why Agencies Consider Cloud-Hosted GIS
Cloud hosting can reduce server administration, hardware refreshes, and capacity planning. That matters to agencies managing staffing pressures. In the IACP’s 2024 recruitment and retention survey, responding agencies reported staffing at approximately 91% of authorized levels. GIS and IT teams may already be supporting multiple critical systems.
On-premises GIS | Cloud-hosted GIS |
Capacity planned around local servers | Capacity can scale with subscribed services. |
Agency manages hardware refreshes | Cloud provider manages underlying infrastructure. |
Redundancy requires agency planning | Redundancy and failover depend on deployment architecture. |
Agency schedules Esri upgrades | Version management depends on the service agreement. |
The operational value can be greater than the infrastructure savings. Analysts who now export and merge CAD, RMS, and LPR data can spend more time examining patterns when those sources are available through connected GIS workflows.
Cloud delivery does not remove the need to plan availability, failover, system upgrades, and secure remote access. Agencies should distinguish the infrastructure the provider maintains from the GIS applications, data connections, and operating procedures their own teams still manage. The value of a hosted service is determined by that complete arrangement, not the hosting label.
Five CJIS Requirements That Matter in the Cloud
CJIS Security Policy v6.0 reorganized the requirements around NIST SP 800-53 Rev. 5. Five areas are particularly relevant when cloud GIS processes CJI.
1. Encryption in transit, at rest, and during use
CJI requires appropriate FIPS 140-validated protection during transmission and storage. Agencies should also ask how sensitive information is protected while processed, including what cloud administrators and other privileged personnel can access.
A useful review covers user connections, interfaces between systems, stored records, and any temporary processing locations. Determine who controls encryption keys and which parts of the environment can expose CJI in readable form. The answers affect both the architecture and the responsibilities documented with the provider.
2. Multi-factor authentication
Applicable access to CJI requires MFA at AAL2, whether the user is in the office or connecting remotely. The design must account for analysts, officers, and supervisors accessing the same operational data from different locations.
During evaluation, ask how access is granted and removed, what changes when a user moves between roles, and how administrative privileges are limited. A sign-on feature alone does not explain the full access-control process.
3. Personnel access and compensating controls
Personnel with unescorted access to systems containing CJI have historically been subject to fingerprint-based background checks. Policy v5.9.1 introduced technical alternatives in certain situations, including controls using agency-managed encryption keys. The CSA determines which arrangements are acceptable.
4. Security agreements and management control
Applicable contractors and cloud providers may need a CJIS Security Addendum. Management control agreements can clarify which aspects of the environment the agency operates and which the provider administers. Review these obligations for the actual deployment.
5. Auditability, incidents, and supplier risk
The environment needs appropriate access logs and a defined incident-reporting process. Agencies should assess risks from the cloud provider and other vendors, including new integrations that expand access to operational data.
Make the handoff explicit: which organization monitors logs, investigates a suspected incident, coordinates notification, and retains evidence for an audit? Such decisions become more important as new sources or contractors join an operational GIS environment.
Moving GIS to the cloud without losing control of CJI? Schedule a GeoShield technical briefing to review your environment and CJIS needs.
How CJIS, FedRAMP, and Government Cloud Differ
These terms are related, but not interchangeable. FedRAMP assesses cloud services against a federal security baseline built on NIST SP 800-53. Government cloud regions, including Azure Government, provide public-sector hosting controls. The CJIS Security Policy sets requirements for protecting CJI, with state-level oversight and contractual obligations.
FedRAMP Moderate authorization and government cloud hosting can provide a strong starting point, but neither independently makes a GIS application CJIS compliant. Agencies still need to review identity controls, the GIS platform, connected systems, personnel access, agreements, and state-specific requirements.
The practical comparison is between evidence and obligation. A FedRAMP assessment demonstrates reviewed controls for a particular cloud service; the agency must still determine how its configured GIS application and integrations satisfy applicable CJIS requirements. Ask which evidence applies to the specific service in use, which controls the agency must implement, and what the state CSA expects.
Separate GIS Hosting From Law Enforcement Integration
Moving ArcGIS to the cloud and connecting operational data are different decisions. Agencies may retain an existing Esri environment while adding a platform that brings CAD, RMS, LPR, video, and other data into shared workflows. Others may need to change their GIS hosting arrangement as well.
Map the path from source systems to GIS layers, dashboards, and authorized users. Identify who manages the GIS, interfaces, permissions, software updates, and any public-facing outputs before selecting the service model.
An agency that already operates ArcGIS Enterprise may be evaluating integration rather than a complete cloud migration. Another may require managed hosting and data integration together. Treat these as separate requirements in the procurement process. Otherwise, a provider can appear to solve the hosting problem while leaving analysts with the same manual transfers between operational systems.
Questions to Ask a GIS Cloud Provider
Include agency IT, GIS leadership, CJIS security personnel, and operational users in the evaluation. Ask providers to demonstrate the relevant configuration, not just describe general capabilities.
Ask the provider | Why it matters |
Will you sign the CJIS Security Addendum required in our state? | Clarifies contractual and state requirements. |
Who can access CJI, and how are authentication and audits managed? | Establishes accountability for access and monitoring. |
How does the platform integrate with existing Esri systems? | Tests whether current ArcGIS investments can remain in place. |
Can it connect CAD, RMS, LPR, video, and other sources? | Tests actual analytical workflows, not only hosting. |
Can you demonstrate an agency deployment with similar needs? | Provides evidence of operational experience. |
Use the same scenario in each vendor demonstration: a CAD event arrives, relevant RMS or LPR information is available to authorized users, and the result is shown on a map. Ask where the data is processed, which source remains authoritative, who can see each layer, and how access would be investigated after an incident.
When comparing law enforcement technology categories, GeoShield’s comparison guide explains how different systems support agency workflows.
Best Practices for Maintaining Compliance
CJIS compliance continues after migration. Build the following activities into routine operations:
- Track policy changes and the implementation expectations of your state CSO.
- Review permissions, remove inactive accounts, and maintain required security awareness training.
- Assess each new CAD, RMS, or LPR integration for changes in CJI exposure and vendor access.
- Test incident-response procedures and revisit agreements when vendors, modules, or users change.
When an integration changes, review not only whether the feed still works, but also whether new fields or joined records alter who can see the layer. A change that looks routine to IT can affect an analyst’s map and the agency’s disclosure obligations. Record the decision and owner.
Schedule these checks rather than relying on an annual scramble before an audit. Security posture changes whenever permissions, interfaces, service versions, or personnel change. Agencies should keep the records needed to explain who approved those changes and how the protection of CJI was maintained.
How GeoShield Supports Law Enforcement GIS Operations
GeoShield’s Law Enforcement Operations Platform brings GIS and operational data into a secure environment hosted on Microsoft Azure Government Cloud. Its native ArcGIS integration works with existing Esri systems, allowing agencies to add law enforcement capabilities without replacing their GIS investment.
The GeoShield Real-Time Dashboard connects CAD, RMS, AVL, LPR, video, and other sources in a map-based view. GeoShield’s ArcGIS Pro Add-In supports analysts working within familiar Esri tools. The platform includes CJIS-compliant architecture, Microsoft 365 single sign-on, and an Ethical and Responsible AI Framework. GeoShield does not sell agency data.
The platform draws on law enforcement experience, including an advisory board with Chief Brandon Gillespie of the Modesto Police Department and former Ogden Police Department Chief Eric Young. The Ogden Police Department also uses GeoShield for Real-Time Crime Center operations.
Agencies can integrate GeoShield with an existing ArcGIS environment or use its CJIS-compliant managed ArcGIS option on Microsoft Azure Government Cloud. These deployment options help agencies address GIS hosting, law enforcement data integration, or both, depending on their existing Esri infrastructure and operational workflows.
For agencies evaluating cloud GIS, GeoShield can help review current systems, CJI touchpoints, and integration requirements. Schedule a technical briefing to discuss the existing environment and the agency’s operational and CJIS needs.
Frequently Asked Questions
1. Is all GIS data considered CJI under the CJIS Security Policy?
No. Basemaps, parcel data, and public boundary layers generally are not CJI. CAD/RMS incidents, LPR hits, warrants, and offender-related layers warrant closer review because they may contain CJI. Assess each layer and any joined records before determining who may access the map or whether information can be released publicly.
2. Can law enforcement agencies use commercial cloud platforms, not just GovCloud, for CJIS data?
Yes, under current policy. Since CJIS Security Policy v5.9.1, agencies can use commercial cloud regions if the provider implements compensating technical controls, such as customer-managed encryption keys, in place of full personnel background screening. Government cloud regions can help address personnel-screening requirements, depending on provider controls and approval by the state CJIS Systems Agency.
3. What's the difference between FedRAMP and CJIS compliance?
FedRAMP is a centralized federal authorization run by the GSA for cloud services used by federal agencies, built on the NIST SP 800-53 control catalog. CJIS is enforced state by state by each state’s CJIS Systems Officer through a signed Security Addendum, not a central certification. FedRAMP Moderate authorization signals a strong overlapping baseline, but it doesn’t replace the addendum and state sign-off.
4. Does moving GIS to the cloud always require a CJIS Security Addendum?
If the cloud provider or its personnel can access CJI in any form, even encrypted, a CJIS Security Addendum is required between the agency and that vendor.
5. How often is CJIS compliance audited?
Typically on a triennial cycle, by the FBI CJIS Division or the delegated state CJIS Systems Agency. Agencies are expected to maintain compliance continuously between audits, not treat it as a one-time project.
6. What happens if a cloud GIS platform isn't CJIS compliant?
Non-compliance can cost the agency its own access to CJIS-connected systems, including NCIC and III, not just the vendor. That’s why the agency’s audit exposure, not the vendor’s marketing claims, should drive provider selection.