# CJIS Compliance **Criminal Justice Information Services compliance** — the FBI-managed framework that governs how state and local LE agencies (and their vendors) handle CJIS-classified data: NCIC, III (Interstate Identification Index), N-DEx, and related. Encompasses personnel security, access controls, encryption, auditing, training, and breach reporting requirements. Flock Safety asserts CJIS compliance as a baseline; the Conway-Flock onboarding included a verification step before any NCIC-derived hot list was activated. ## How it appears in the corpus - Per [[AR - Conway PD - Welcome to Flock! (3) - Flock Kickoff Slide Deck]] Page 15: "CJIS Compliance — In order to add any hotlist sources to your account NCIC, Amber Alert) we need to legally verify that you are CJIS compliant per CJIS guidelines. Live display of law enforcement issued ID card · Verified via Zoom · Agency ORI number · Agency address · Badge number or other identification number · Customer Name and Title." - Per [[Flock Cameras Apr 2026 City Council QA Thread]] (Gena Hatch reply to Burningham, 2026-04-20): "[Flock] operate[s] in a manner consistent with CJIS requirements and regularly work[s] with agencies on audits and related compliance items." - ACIN's executive overview calls its connected RMS environment "CJIS-compliant" and names AWS GovCloud, MFA, role-based access, logging, and encryption ([[ACIN Executive Overview 2026-05-15]], pp. 1-2). Its FAQ uses the narrower formulation that ACIN is "designed to align" with the FBI CJIS Security Policy ([[ACIN FAQ 2026-05-15]], p. 2). The first batch includes no policy mapping, certification, assessment, configuration export, or audit with which to test either formulation. ## Stakeholders - **FBI CJIS Division** — sets the security policy and conducts audits. - **CJIS Systems Agency** in each state — for Arkansas this is the Arkansas State Police, which operates ACIC. - **Local agency** — must maintain compliance to access CJIS data and to operate in a CJIS-data environment. - **Vendor (Flock)** — asserts compliance; subject to CJIS audit requirements as a contractor processing CJIS data on the agency's behalf. ## Notes - Flock's CJIS-compliance assertion in the corpus is not externally verified within the wiki. The most recent published CJIS Security Policy version (as of writing, 5.9.x family or successor) is the anchor for any deliverable that wants to evaluate the assertion against the actual requirements. This remains a matter for external research. - ACIN's CJIS language is likewise a self-description. The public materials identify controls but do not show which policy version, control responsibilities, participating-agency agreements, assessments, or exceptions govern the network. - The Zoom-verification step ("Live display of law enforcement issued ID card · Verified via Zoom") for activating NCIC hot lists on a Flock instance is operationally interesting: the gating mechanism for CJIS-data access on the Flock platform is a video call with a Customer Success Manager. This is the actual practice at the agency-onboarding interface. - CJIS compliance does not impose substantive restrictions on cross-jurisdictional data sharing within the Flock platform (network sharing, custom hot list sharing, federal-prefix sharing) beyond personnel-vetting and access-control requirements. The data-sharing posture documented in [[Federal LE Data-Sharing Pipeline]] is **not** prohibited by CJIS compliance; CJIS compliance is necessary but not sufficient for satisfying broader policy or oversight concerns.