# CJIS Compliance **Criminal Justice Information Services compliance** — the FBI-managed framework that governs how state and local LE agencies (and their vendors) handle CJIS-classified data: NCIC, III (Interstate Identification Index), N-DEx, and related. Encompasses personnel security, access controls, encryption, auditing, training, and breach reporting requirements. Flock Safety asserts CJIS compliance as a baseline; the Conway-Flock onboarding included a verification step before any NCIC-derived hot list was activated. ## How it appears in the corpus - Per [[AR - Conway PD - Welcome to Flock! (3) - Flock Kickoff Slide Deck]] Page 15: "CJIS Compliance — In order to add any hotlist sources to your account NCIC, Amber Alert) we need to legally verify that you are CJIS compliant per CJIS guidelines. Live display of law enforcement issued ID card · Verified via Zoom · Agency ORI number · Agency address · Badge number or other identification number · Customer Name and Title." - Per [[Flock Cameras Apr 2026 City Council QA Thread]] (Gena Hatch reply to Burningham, 2026-04-20): "[Flock] operate[s] in a manner consistent with CJIS requirements and regularly work[s] with agencies on audits and related compliance items." ## Stakeholders - **FBI CJIS Division** — sets the security policy and conducts audits. - **CJIS Systems Agency** in each state — for Arkansas this is the Arkansas State Police, which operates ACIC. - **Local agency** — must maintain compliance to access CJIS data and to operate in a CJIS-data environment. - **Vendor (Flock)** — asserts compliance; subject to CJIS audit requirements as a contractor processing CJIS data on the agency's behalf. ## Notes - Flock's CJIS-compliance assertion in the corpus is not externally verified within the wiki. The most recent published CJIS Security Policy version (as of writing, 5.9.x family or successor) is the anchor for any deliverable that wants to evaluate the assertion against the actual requirements. This remains a matter for external research. - The Zoom-verification step ("Live display of law enforcement issued ID card · Verified via Zoom") for activating NCIC hot lists on a Flock instance is operationally interesting: the gating mechanism for CJIS-data access on the Flock platform is a video call with a Customer Success Manager. This is the actual practice at the agency-onboarding interface. - CJIS compliance does not impose substantive restrictions on cross-jurisdictional data sharing within the Flock platform (network sharing, custom hot list sharing, federal-prefix sharing) beyond personnel-vetting and access-control requirements. The data-sharing posture documented in [[Federal LE Data-Sharing Pipeline]] is **not** prohibited by CJIS compliance; CJIS compliance is necessary but not sufficient for satisfying broader policy or oversight concerns.