Multi-Factor Authentication for Criminal Justice Information Systems: Implementation Considerations for Protecting Criminal Justice Information

Published

September 3, 2025

Author(s)

William Fisher, Jason Ajmo, Sudhindra Umarji, Spike Dog, Mark Russell, Karen Scarfone

Abstract

Most recent cybersecurity breaches have involved compromised credentials. Migrating from single-factor to multi-factor authentication (MFA) reduces the risk of compromised credentials and unauthorized access. Both criminal and noncriminal justice agencies need to access criminal justice information (CJI); to reduce the risk of unauthorized access, the Criminal Justice Information Services (CJIS) Security Policy now requires the use of MFA when accessing CJI. This document provides practical guidance to agencies that are implementing MFA, reflecting on lessons learned from agencies around the country and from CJI-related technology vendors.

Citation

NIST Interagency/Internal Report (NISTIR) - 8523

Report Number

8523

NIST Pub Series

NIST Interagency/Internal Report (NISTIR)

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.IR.8523

Local Download

Keywords

authentication, credentials, criminal justice information (CJI), identity, identity federation, law enforcement, multi-factor authentication (MFA), single sign-on (SSO)

Citation

Fisher, W. , Ajmo, J. , Umarji, S. , Dog, S. , Russell, M. and Scarfone, K. (2025), Multi-Factor Authentication for Criminal Justice Information Systems: Implementation Considerations for Protecting Criminal Justice Information, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.IR.8523, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=960104 (Accessed September 11, 2025)