Your IT company can remote into the records machine. Georgia wants their fingerprints — every two years.

September 21 was the last day a FIPS 140-2 validated module could be used for a new system. After that date, NIST moves FIPS 140-2 validation certificates to the Historical List; FIPS 140-3 is the standard now (NIST Cryptographic Module Validation Program).

If you run a police department, a sheriff’s office, a magistrate or probate court, or a 911 center, that date matters to you for a reason that has nothing to do with buying encryption. It matters because the CJIS Security Policy requires validated cryptography for criminal justice information — and the people most likely to know whether yours is validated do not work for you. They work for your IT provider.

If your IT vendor’s technicians can reach criminal justice information — physically or virtually — Georgia has rules about those people, and the rules are checkable in an afternoon. There are two separate questions, and agencies routinely assume one answers the other. It does not.

Question one: are their people authorized?

Georgia runs a CJIS Vendor Compliance Program through GCIC, and the Bureau is explicit about who it covers: vendors whose personnel need “unescorted physical or virtual access to criminal justice information (CJI).” Computer system maintenance is the first example the state lists. That is your IT provider.

What the state requires of them:

• A designated vendor Coordinator, and an executed CJA/G-NCJA and Vendor CJIS Network & Data Agreement, before anything else proceeds.
• Fingerprints submitted through the Georgia Applicant Processing Service for state and national checks, for each employee who will have CJI access. GCIC states these “must be completed every 2 years.” It is a recurring clock, not a one-time hurdle.
• Security awareness training “completed yearly.”
• A signed FBI Security Addendum, plus a signed acknowledgment that the employee received the Addendum and the CJIS Security Policy.

Read the Addendum itself and two clauses stand out for anyone holding a contract signed years ago. The contractor must maintain a security program consistent with the CJIS Security Policy “in effect when the contract is executed and all subsequent versions.” And the FBI reserves the right to perform a final audit of the contractor’s systems after termination, and to suspend or terminate access and telecommunications links.

Those signed acknowledgments are retained for audit. The audit is yours, which means the paperwork belongs in your file cabinet, not theirs.

Question two: are their tools validated? Georgia’s program does not answer that.

This is the trap, and GCIC says it plainly on the same page: the vendor program “does not certify that the vendor’s technical services, products or solutions are compliant” with FBI standards, and it grants no licensure or marketing privileges.

So a provider can be in perfect standing on the people side — fingerprints current, training done, Addendum signed — and still reach your records machine over a tool whose cryptographic module no longer holds a current validation. Being in the program and being technically compliant are different claims, and a vendor who answers the second by citing the first has not answered it.

The September 21 sunset sharpens this. A certificate that went Historical can no longer carry a new procurement decision. If you are renewing a backup platform, a remote support tool, or an RMS contract this fiscal year, validation status is a question you ask before you sign.

Where the clock actually is

CJIS Security Policy v6.0 restructured the document around NIST SP 800-53 control families. The National Association of Counties calls it “the most significant modernization of CJIS requirements in more than a decade,” with compliance required by October 1, 2027, and agencies now obliged to “demonstrate, not just assert, that controls are implemented, reviewed regularly, and adjusted based on risk.”

Two things get lost in the 2027 headline. First, the current policy is version 6.1, dated June 25, 2026, posted at the FBI’s CJIS Security Policy Resource Center along with the Requirements Companion Document. Second, 2027 does not defer everything. Published compliance analyses place existing and Priority 1 requirements — multi-factor authentication, account management, remote access, boundary protection, vulnerability scanning — as already enforceable since October 1, 2024, with only the Priority 2 through 4 requirements sitting in the zero-cycle window that closes September 30, 2027. Verify the tier your specific control falls into against the Requirements Companion Document rather than against a blog post, including this one.

And in Georgia there is a nearer date than any of those: your next audit. Under Georgia Rule 140-2-.07, “GCIC auditors shall audit these agencies triennially as required by NCIC operating policy.” Agency heads get “at least 15 days advance notice” of an on-site audit, and receive a written report identifying areas of compliance and non-compliance. In cases of continued non-compliance, the Director recommends sanctions to the Council.

Fifteen days is not enough time to get a technician fingerprinted.

What to do, in order

1. Map where CJI actually lives and who can reach it. Not only the GCIC terminal. The network segment it sits on, the backup that copies it, the storage holding evidentiary video, the records-management vendor’s cloud tenant, and every standing remote-access account into any of it.
2. Ask your provider for three documents, in writing. The executed GCIC vendor agreement; the fingerprint clearance status of every named technician who touches your systems, with the date of the last submission, because the clock is two years; and this year’s security awareness training completion.
3. Confirm you hold the signed Security Addendum acknowledgments. Your file, not theirs. If nobody can find them, that is a finding waiting to be written down by someone else.
4. Get a named list and a departure clause. Which individuals are cleared, and a written commitment to notify you within one business day when one of them leaves. Rapid account disabling is one of the things the modernized policy tightened.
5. Ask for the FIPS certificate number of the cryptographic module in whatever tool they use to remote into CJI systems, and for the backup encryption. “We use AES-256” is not an answer to that question. A certificate number you can look up in the CMVP search is.
6. Ask for the date and scope of the last vulnerability scan of the segment carrying CJI, and how often it runs. Compare the cadence to the Requirements Companion Document for your tier.
7. Fix it at renewal. Attach the Security Addendum to the contract, and include a clause binding the vendor to the CJIS Security Policy as amended rather than the version current on the signature date. The Addendum already says this. Your contract should say it too.

If a provider cannot produce items two through four within a week, you have learned something useful, and you learned it on a calm day rather than fifteen days before an audit or in the middle of an incident. Vicksburg, Mississippi announced on October 2 that ransomware had disrupted city systems, with utility payments affected and emergency services reportedly unaffected (The Record). Questions about who had access to what get asked eventually. The only variable is whether the file is ready.

This is not only a police problem. If your city has a municipal court, if your county runs magistrate or probate terminals, if your 911 center shares a network closet with city hall, the CJI boundary is wider than the one workstation everyone pictures — and the provider who administers that network is inside it whether anyone has said so or not.

If you want someone to run this with you

Southern Technology Partners works with cities, counties, utilities, sheriff’s offices, police and fire departments, EMS, 911 centers, schools and libraries, and small businesses within about a hundred miles of Hazlehurst — managed IT, cybersecurity and compliance, cloud and VoIP, structured cabling, CCTV and access control, and fire and alarm systems. We have moved a South Georgia county’s entire E-911 operation to a new building in a single day without dropping coverage.

If you are already under contract with somebody else, run the list above on them first. That is the honest advice. If you want a second set of eyes on what comes back — or you ask for the three documents and get silence — call us. Ask us for the same documents on any work we would do for you, and hold us to the same standard.

Southern Technology Partners LLC

15 Latimer St., Hazlehurst, GA 31539

(912) 209-4804·southerntechpartners.net

Sources

1. NIST, Cryptographic Module Validation Program — FIPS 140-2 certificates move to the Historical List after September 21, 2026.
2. Georgia Bureau of Investigation, CJIS Vendor Compliance Program — vendor coordinator, GAPS fingerprinting every two years, annual security awareness training, Security Addendum, and the limits of the program.
3. FBI CJIS Division, CJIS Security Policy Resource Center — CJIS Security Policy v6.1, June 25, 2026, and the Requirements Companion Document.
4. FBI CJIS Security Addendum (Appendix H), copy hosted by the Michigan State Police — contractor security program obligations, retention of signed acknowledgments, FBI audit and termination rights.
5. National Association of Counties, New FBI CJIS Security Rule Requirements — October 1, 2027 compliance date and the shift to demonstrated controls.
6. Ga. Comp. R. & Regs. R. 140-2-.07, Audit Procedures — triennial GCIC audits, 15-day notice, written findings, sanctions for continued non-compliance.
7. The Record, Vicksburg, Mississippi city government hit by ransomware, October 2026.