CJIS Compliance
Criminal justice information security, built into APB360 for years — not bolted on.
A CJIS-Compliant System
APB360 has operated as a CJIS-compliant system for years. Law enforcement agencies trust APB360 with records about their officers, their firearms and duty equipment, and the custody of that equipment. We protect that information to the standard the criminal justice community expects.
The FBI’s Criminal Justice Information Services (CJIS) Division publishes the CJIS Security Policy. It sets the minimum security requirements for any agency, and any vendor working for an agency, that accesses, stores or transmits criminal justice information (CJI). It covers how systems are secured and also who can reach the data, how they prove who they are, and what record is kept of what they did.
How APB360 Protects Your Data
Encrypted in Transit
APB360 is served over HTTPS only, using TLS 1.2 or newer. Older, weaker protocols are refused, and browsers are told never to connect without encryption.
Access by Role
Every user signs in with their own account, and what they can see and do depends on their role. Each agency sees only its own data.
A Complete Audit Trail
Custody changes, inspections, qualifications and approvals are recorded with who did what and when, so the record holds up when it is examined.
Sessions That Expire
Signed-in sessions time out, so an unattended device does not stay logged in indefinitely.
Infrastructure & Security Partner since 2024
Our Infrastructure Partner: Overwatch Technology
Since 2024, Overwatch Technology has been APB360’s partner in keeping our infrastructure sound and secure. Overwatch is a managed IT and cybersecurity provider, and their team works alongside ours on:
- Infrastructure management — keeping the systems APB360 runs on maintained, monitored and current
- Cybersecurity — protecting those systems against the threats that target public safety organizations
- Cloud services — the hosting environment that APB360 is delivered from
Security is not a one-time project. Having a dedicated security partner means our infrastructure is continually reviewed by people whose job is to look for weaknesses before anyone else does.
CJIS Compliance Is a Shared Responsibility
There is no federal CJIS “certification” for software. Compliance is assessed through each state’s CJIS Systems Agency (CSA) and the agency’s own audits. It depends on both the vendor’s systems and how the agency uses them. Your agency’s part includes:
- Giving each person their own account, and removing access promptly when someone leaves
- Assigning roles so people see only what their job requires
- Securing the devices your staff use to sign in
- Including APB360 in your agency’s security reviews and audits
If your agency’s Information Security Officer or CSA has questions about APB360 as part of a vendor review, we are glad to work through them with you.