CJIS endpoint controls (+ Illinois LEADS)

The CJIS Security Policy requires technical controls that limit access to Criminal Justice Information (CJI) and reduce risk on agency endpoints. Illinois LEADS adopts CJIS as a baseline and adds state-specific provisions. Codeproof provides centralized MDM and security configuration for iOS, Android, Windows, and macOS to help you deploy consistent controls at scale.

Download CJIS/LEADS checklist (PDF)

What CJIS expects on endpoints

Access control: Unique user authentication, session lock, and least privilege on devices and apps that handle CJI.

Encryption: Protect data at rest and data in transit with approved algorithms and trusted certificates.

Configuration management: Standardized baselines, change control, and detection of unauthorized settings or software.

Audit and accountability: Activity logging and retention for access, configuration, and administrative actions.

Incident response: Remote lock and wipe for lost or stolen devices, and procedures for containment and evidence.

Your agency remains responsible for overall CJIS compliance. Codeproof provides endpoint controls and evidence to support your program.

Illinois LEADS (CJIS-aligned)

LEADS (Law Enforcement Agencies Data System) is administered by the Illinois State Police and requires adherence to the FBI CJIS Security Policy, plus Illinois-specific provisions. Codeproof’s CJIS-aligned endpoint controls—encryption, MFA, app governance, mobile device security, and audit evidence—also support LEADS participants.

  • Advanced/Multi-Factor Authentication: Enforce strong authentication for remote/mobile access to CJI.
  • Encryption in transit & at rest: Use approved algorithms; deploy certificates and trusted roots at scale.
  • Mobile device security (CJIS Policy Area 13): Jailbreak/root detection, OS posture, and BYOD containers with selective wipe.
  • App governance: Allowlists/denylists, managed configs, data sharing restrictions, per-app VPN.
  • Audit evidence: Export device inventory, baseline configs, activity logs, and remediation history.

How Codeproof helps

  • Encryption and auth: Enforce FileVault and BitLocker policies, device encryption on mobile, passcodes, auto-lock, and idle timeout.
  • Integrity posture: Detect jailbroken or rooted devices and block access for noncompliant endpoints.
  • App governance: Allow or deny lists, kiosk mode for single app or multi app use, and silent app updates where supported.
  • Secure connectivity: Deploy Wi-Fi, per app VPN, and certificate trust stores at scale.
  • Patch posture: Track OS and app versions and restrict access for unpatched devices where policy requires.
  • Remote actions: Lock, selective wipe, full wipe, and optional location where allowed by agency policy.
  • Evidence for audits: Device inventory, configuration history, activity logs, and exportable reports.

Related: Windows MDM · macOS MDM · Android MDM · iOS MDM

CJIS & LEADS FAQs

What is CJIS?
CJIS (Criminal Justice Information Services) refers to the FBI’s CJIS Security Policy—a set of requirements for protecting Criminal Justice Information (CJI) across agencies and their vendors.
What is Illinois LEADS, and how does it relate to CJIS?
LEADS (Law Enforcement Agencies Data System) is the Illinois state implementation of CJIS. Agencies must meet the CJIS Security Policy along with any state-specific LEADS provisions administered by the Illinois State Police.
Does Codeproof help us align with CJIS and LEADS?
Yes. Codeproof enforces device safeguards—encryption, access control, audit logging, and remote actions—that support CJIS and LEADS endpoint requirements. Policy alignment still requires agency procedures and training.
Is MFA required for LEADS/CJIS?
Advanced authentication (e.g., MFA) is required in several scenarios, especially for remote or mobile access to CJI. Pair device posture enforcement with your identity provider to meet these requirements.
How do we protect CJI on mobile devices?
Require passcodes and encryption, restrict data sharing to approved apps, disable risky features (where supported), and use remote lock/wipe with activity logs for incident evidence.
How do we handle lost or stolen officer devices?
Trigger Lost Mode or remote lock, revoke certificates/keys, and wipe corporate data. Use inventory and logs to document timelines and actions.
Can cameras, Bluetooth, or sharing be restricted in secure areas?
Yes—use policy to block camera, screen capture, AirDrop/Nearby Share, and unmanaged sharing in designated profiles or locations (where the OS supports it).

Maximize employee productivity through Codeproof