Any system that touches criminal justice information falls under the Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Security Policy. Its audit section is one of the most specific in any security standard. It lists the events to log, how often to review them, how fast to react when logging breaks and how long to keep the records. It also changed shape recently. Version 6.0 rewrote the policy in the format of NIST SP 800-53, so many checklists still quote section numbers that no longer exist. This guide walks through the logging controls in the current version, 6.1, and how to meet them.
The short answer: The CJIS Security Policy (version 6.1, June 25, 2026) requires you to log all successful and unsuccessful logons, attempts to access, create, write, delete or change permissions on accounts, files and other resources, password changes, every action by privileged accounts, and any attempt to access, change or destroy the audit log itself (control AU-2). Each record must show what happened, when, where, the source, the outcome and who was involved (AU-3). Logs must be reviewed at least weekly (AU-6), administrators must be alerted within one hour when logging fails (AU-5), and records must be kept for at least one year, then until they are no longer needed (AU-11). The policy never names a SIEM (security information and event management system), but its newer controls ask for automated review and correlation across log stores, which is what a SIEM does.
Who must follow the CJIS logging rules
The policy applies to every entity with access to criminal justice information (CJI), and to every entity that runs systems used to process, store or transmit it (section 1.2). That covers:
- Criminal justice agencies, such as police, sheriffs, courts, prosecutors and corrections.
- Noncriminal justice agencies with authorized access, such as agencies that run fingerprint-based background checks.
- Private contractors that support them, such as dispatch, records management and information technology (IT) providers. Each signs the CJIS Security Addendum (control SA-9 and Appendix H).
Each state has a CJIS Systems Agency (CSA) that manages access to FBI systems and appoints a CJIS Systems Officer (CSO). The CSA “may impose more stringent or additional protection measures” (section 3.2.1), so treat this guide as the floor and check your state’s policy. Audits run on a three-year cycle: each CSA audits its agencies every three years, and the FBI audits each CSA every three years (Appendix D.1).
The audit controls in CJIS Security Policy 6.1
Version 6.0 (December 27, 2024) finished moving the policy to the control format of the National Institute of Standards and Technology (NIST) SP 800-53. Version 6.1 (June 25, 2026) added the changes approved in 2025. The logging rules sit in the Audit and Accountability (AU) family.
Each control carries a marking. Requirements that already existed in version 5.9 are marked “Existing”; new or rewritten ones carry a priority from 1 to 4. Since October 1, 2024, existing and Priority 1 requirements are the ones an audit can sanction. Priority 2 to 4 requirements sit in a “zero-cycle” until September 30, 2027 (section 1.4). Most logging controls are marked Existing, so auditors can already hold you to them.
| Control | What it requires (summary) | Marking |
|---|---|---|
| AU-2 Event logging | Log the event types listed below, justify the list, review it every year | Priority 2; the same events were required in 5.9 |
| AU-3 Content | Type of event, time, place, source, outcome and identity in each record | Existing |
| AU-3(1) Additional content | Session duration, addresses, object or file name, bytes sent and received; for Interstate Identification Index (III) logs, the operator, receiving agency, requestor and secondary recipient | Existing |
| AU-4 Storage | Enough log storage to meet the retention rule | Priority 2 |
| AU-5 Logging failures | Alert audit staff and administrators within one hour, restart logging, verify it works | Existing |
| AU-6 Review | Review weekly for inappropriate or unusual activity, report findings, review more when risk rises | Existing |
| AU-6(1) and AU-6(3) | Automate review and reporting; correlate records across log stores | Priority 2 |
| AU-8 Time stamps | Time to hundredths of a second, in Coordinated Universal Time (UTC) or with the offset | Existing |
| AU-9 Protection | Protect logs and logging tools from unauthorized access, change and deletion; alert when it happens | Existing |
| AU-11 Retention | At least one year, then until no longer needed | Existing |
The five CJIS logging deadlines
From the CJIS Security Policy, version 6.1
- Logging fails1 hourto alert audit staff and administrators. AU-5
- Incident suspected1 hourat most to report it to your incident response team. IR-6
- Log reviewWeeklyat minimum, with findings reported. AU-6
- Event listYearlyreview of the event types you log. AU-2
- Retention1 yearminimum, then until no longer needed. AU-11
What to log: CJIS event types mapped to real sources
AU-2 lists the events in plain terms, but your systems record them under their own names and numbers. The table maps each event type to the Windows event IDs and Linux sources that capture it. Windows records many of these only after you turn on the matching advanced audit policy, so check your Group Policy first.
| CJIS event type (AU-2) | Windows events | Linux and other systems |
|---|---|---|
| Logon attempts, successful and failed | 4624 and 4625; on domain controllers 4768, 4771 and 4776 | auth.log or secure for SSH, console and sudo; administrator logins on firewalls and virtual private network (VPN) gateways |
| Permission use on user accounts | 4720 created, 4722 enabled, 4725 disabled, 4726 deleted, 4738 changed; 4728, 4732 and 4756 for group membership | useradd, usermod and groupmod entries; auditd watches on /etc/passwd and /etc/group |
| Permission use on files and folders | 4663 object access (needs object access auditing and an audit list on the folder); 4670 permissions changed | auditd watch rules on the directories that hold CJI |
| Password changes | 4723 user changed a password; 4724 administrator reset one | passwd entries in the authentication log |
| Actions by privileged accounts | 4672 special privileges assigned at logon; 4688 process creation with command line | sudo records; database audit logs for administrator accounts |
| Access to, change or destruction of the audit log | 1102 Security log cleared; 104 another log cleared; 4719 audit policy changed | auditd watches on /var/log/audit and its configuration |
One source is easy to forget: the applications that query FBI systems. Records management, computer-aided dispatch and message switch software log the National Crime Information Center (NCIC) and III transactions, and AU-3(1) says the III portion must identify the operator, the receiving agency, the requestor and the secondary recipient. Only the application knows those values, so its logs must reach your central store too.
What a CJIS audit record must contain
Illustration: one failed Windows logon, as a SIEM shows it after parsing
- When, to hundredths of a second, in UTC or with the offset (AU-3b, AU-8)
- What type of event occurred (AU-3a)
- Where it occurred (AU-3c)
- The source of the event (AU-3d)
- The outcome, success or failure (AU-3e)
- The identity of the person or account involved (AU-3f)
How often to review CJIS logs
AU-6 requires you to review and analyze audit records weekly for inappropriate or unusual activity, report findings to the people responsible for audit and security, and review more often when the risk changes. The 5.9 wording was nearly the same: “at a minimum once a week.”
Weekly is the minimum, not the goal. A brute-force attack or a stolen password does its damage in hours. A workable pattern has two layers:
- Real-time alerts for high-risk events: repeated failed logons followed by a success, a cleared Security log, a privileged logon from an unusual place.
- A documented weekly review of everything else: who reviewed, what they found and what they did. Auditors ask for that record, not just the logs.
Two newer controls point the same way. AU-6(1) asks you to integrate review, analysis and reporting with automated mechanisms, and AU-6(3) to correlate records across different repositories. Both are Priority 2, in the zero-cycle until September 30, 2027. Agencies that still review logs one server at a time should plan for them now.
How long to keep CJIS logs
AU-11 says to retain audit records “for a minimum of one (1) year or until it is determined they are no longer needed for administrative, legal, audit, or other operational purposes.” Read it as two rules: never less than one year, and longer while a case, a records request or an audit still needs them. AU-4 adds that you must allocate enough storage to meet it.
Version 5.9 also had section 5.4.7, a one-year log of all NCIC and III transactions. Version 6.1 has no separate rule: the III content sits in AU-3(1), and AU-11 covers retention for all records.
Because audits come every three years, many agencies keep logs longer than a year so an auditor can sample across the cycle. That is a policy choice, not a CJIS rule. Other rules may apply to the same systems; the New York financial regulator, for example, requires three years for audit trails, as our guide to NYDFS logging requirements explains. Our SIEM sizing calculator estimates the storage for any period.
How the CJIS audit rules changed
Key dates from the FBI's own policy documents
- June 2020Version 5.9Audit rules in section 5.4, the numbering many checklists still use
- October 1, 2024Sanction set fixedExisting and Priority 1 requirements can be sanctioned
- December 27, 2024Version 6.0Move to the NIST SP 800-53 control format completed
- June 25, 2026Version 6.1Changes approved in 2025 added
- September 30, 2027Zero-cycle endsFor Priority 2 to 4 requirements such as AU-6(1) and AU-6(3)
Protecting logs and catching logging failures
Logs only count as evidence if nobody could have changed them. AU-9 requires you to protect audit information and logging tools from unauthorized access, change and deletion, and to alert audit, security and system staff when someone tries. AU-9(4) limits who can manage logging to a small set of privileged users. In practice, send logs off the host within seconds, keep server administrators from being the only people who can change logging, and alert on events 1102, 104 and 4719.
AU-5 covers logging that simply stops: a full disk, a crashed agent or a firewall that lost its syslog target. The policy requires an alert within one hour, a restart, and a check that systems log properly again. Watch for sources that go silent and treat silence as an alert.
AU-8 requires time stamps from system clocks, in UTC or with an offset. Version 5.9 asked for a yearly clock sync; version 6.1 drops that sentence. Sync every system to one time source anyway, because the correlation AU-6(3) asks for fails when clocks disagree.
Old CJIS section numbers and where they went
| Version 5.9 section | Topic | Version 6.1 control |
|---|---|---|
| 5.4.1.1 | Events to log | AU-2 |
| 5.4.1.1.1 | Content of each record | AU-3 and AU-3(1) |
| 5.4.2 | Response to audit failures | AU-5, now with a one-hour alert |
| 5.4.3 | Review at least weekly | AU-6 |
| 5.4.4 | Time stamps and yearly clock sync | AU-8, now to hundredths of a second |
| 5.4.5 | Protection of audit information | AU-9 |
| 5.4.6 | Retention of at least one year | AU-11 |
| 5.4.7 | One-year log of NCIC and III transactions | AU-3(1) for content, AU-11 for retention |
Do you need a SIEM for CJIS?
The policy names no product, and a very small agency could review a few systems by hand each week. Most cannot. Logs left on the server an attacker controls are easy to erase (AU-9), noticing within an hour that a source went silent takes automated monitoring (AU-5), and AU-6(3) asks for correlation across log stores, which is the definition of a SIEM.
Where the SIEM runs matters too. Audit logs can hold CJI themselves, such as the query details of an NCIC or III transaction, so the system that stores them may need the same protection as any system with CJI. Ask your CSO how your state treats them before you send them to an outside service. Many agencies keep them on systems they control; our guide to self-hosted SIEM covers what that takes.
How UTMStack fits
We build UTMStack, so weigh our view accordingly. Here is what it does for CJIS logging, and where it stops.
- Runs on your own hardware. UTMStack installs on your own server running Ubuntu 24.04 or a Red Hat compatible Linux in 15 to 30 minutes, and the installer has an air-gapped mode for networks without internet access. See install options.
- Free agents for Windows and Linux. The Community edition includes both, which cover most AU-2 sources. The macOS agent is part of the paid editions.
- Detection as logs arrive. More than 600 detection rules mapped to MITRE ATT&CK are checked as each log arrives, before it is stored. Windows rules include brute force, repeated failures followed by a success, pass the hash and Kerberoasting, and two rules watch the logs themselves: one when the Security log is cleared, one when another log is cleared or auditing is switched off from the command line. See threat detection.
- Retention. Up to five years, with older logs in cold storage that stays searchable without a restore. See log management.
- Response and records. Alerts become incidents with a history of who did what, and response flows can disable an account, block an address or isolate a host.
- What it does not do. There is no CJIS compliance report; the compliance module covers nine other frameworks, such as NIST SP 800-171. There are no built-in rules for new accounts, privileged group changes or audit policy changes (event 4719), so write those as custom rules. The data sources page marks a source as offline when it stops reporting, but it does not page anyone, so pair it with monitoring that alerts within the hour AU-5 requires. UTMStack also has no file integrity monitoring.
- About hosting. UTMStack Cloud runs a dedicated instance per customer on OVHcloud, including a United States region. We do not claim it meets CJIS requirements for systems that hold CJI. For logs that may contain CJI, self-hosting is the safer path, and the decision belongs to your CSO.
UTMStack is priced per device, never by log volume, so logging every source AU-2 asks for does not raise the bill. Ask for a quote or see pricing. For the Windows side in depth, see Active Directory SIEM use cases and Windows event log analysis.
Frequently asked questions
How long does CJIS require logs to be kept? At least one year, then until the records are no longer needed for administrative, legal, audit or other operational purposes (AU-11). Your CSA or state law may require more.
How often must CJIS logs be reviewed? At least weekly, with findings reported to the people responsible for audit and security, and more often when the risk rises (AU-6).
Does CJIS require a SIEM? Not by name. But AU-6(1) asks for automated review, AU-6(3) for correlation across log stores, and AU-5 for an alert within one hour when logging fails. Most agencies use a SIEM to meet them.
What events does CJIS require you to log? All successful and unsuccessful logon attempts; attempts to use access, create, write, delete or change permissions on accounts, files, directories and other resources; password changes; all actions by privileged accounts; and attempts to access, modify or destroy the audit log (AU-2).
Are the new CJIS logging requirements enforced yet? Most are. Controls marked Existing, including AU-3, AU-5, AU-6, AU-8, AU-9 and AU-11, can be sanctioned since October 1, 2024. Newer Priority 2 to 4 items, such as automated review and correlation, are in a zero-cycle until September 30, 2027.
Sources
- FBI, Criminal Justice Information Services (CJIS) Security Policy, version 6.1 (June 25, 2026): section 1.4, AU-2 to AU-11, IR-6, SA-9, Appendix D.1
- FBI, CJIS Security Policy, version 5.9 (June 1, 2020): section 5.4, for the older numbering
- NIST, SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, the catalog the CJIS policy now follows
- Microsoft, Advanced security audit policy settings, for the Windows events in each category
