Last Updated on September 21, 2026 by Satyendra
Organizations handling Criminal Justice Information (CJI) are required to implement applicable audit and accountability controls, but having audit logging enabled does not by itself ensure that the resulting records are sufficient for investigation or compliance. The real problem arises when an auditor asks who changed the folder permissions, when, and whether they were supposed to have access.
CJIS does not reward the volume of events you collect. It expects you to establish who performed an activity, what happened, when, which systems or data were affected, and whether it was authorized. That requires logging, monitoring, protection, review, and retention to work together. This article reflects CJIS Security Policy v6.1, dated June 25, 2026. The policy incorporates security controls and related concepts aligned with NIST SP 800-53.
- Know what CJIS activity you need to log.
- Understand what makes an audit record useful, not just available.
- Learn how to protect, monitor, and retain CJIS audit logs.
- Identify common audit logging gaps that can weaken compliance.
- See how centralized auditing can simplify investigations and audit readiness.
What Does CJIS Require for Audit Logging?
CJIS audit and accountability requirements are designed to make relevant system activity traceable, reviewable, and available for investigation. Organizations are required to:
- Establish Accountability: Ensure applicable auditable activities can be associated with the responsible user, account, or other relevant identity.
- Generate Audit Records: Record the system events and activities that have been identified as requiring auditing.
- Capture Sufficient Details: Include enough information in each audit record to understand what happened, when, where, and who acted.
- Protect Audit Records: Prevent unauthorized users from accessing, changing, or deleting audit logs.
- Review Activity: Regularly examine audit logs to identify suspicious, unauthorized, or inappropriate activity.
- Support Investigations: Make audit records available for review, analysis, and investigation.
- Document Event Selection: Identify the auditable event types applicable to the system and document the organization’s audit-event selection and related procedures.
Logging vs. Monitoring vs. Auditing
| Description | Why It Matters | Question It Answers |
|---|---|---|
| Logging | Capturing events as they occur | Did the system record it? |
| Monitoring | Continuously observing events and activity for conditions that may require attention | Is something happening I should worry about? |
| Auditing | Reviewing and analyzing records to determine what occurred and support accountability, investigation, and compliance | Can I prove what happened, and judge whether it should have? |
Having logs does not necessarily mean having visibility. Critical events may be missed due to incomplete logging, short retention periods, or disconnected data sources. Without centralized monitoring and meaningful analysis, teams may struggle to identify what actually happened.
What Activity Should You Log for CJIS Compliance?
The following activity categories provide a practical framework for determining what should be logged and monitored:
- Authentication and Login Activity: Authentication logs provide the foundation for accountability by recording when users attempt to access systems containing CJI. Monitor successful and failed authentication attempts, logouts, account lockouts, and applicable remote-access or authentication activity. These records help determine who accessed or attempted to access a system, when the activity occurred, and whether the authentication attempt succeeded or failed.
- User and Account Management Activity: Organizations should monitor changes to user accounts throughout their lifecycle, including account creation, deletion, enablement, disablement, password resets, and modifications to account attributes or authentication changes. These events help maintain accountability for who has access to CJI-containing systems. Pay particular attention to privileged and administrative accounts, as well as service and other accounts relevant to the environment.
- Privileged Access and Administrative Activity: Privileged accounts can make changes that significantly affect systems, security controls, and access to CJI. Log privileged logins, administrative actions, privilege assignments, privilege escalations, and changes made using administrative accounts or privileged groups. The purpose is not simply to record an administrator logged in, but to maintain visibility into what privileged actions were performed and when. This helps organizations investigate unauthorized changes and apply greater scrutiny to activities that could affect CJI or critical systems.
- Group, Role, and Permission Changes: Track changes that alter who can access systems, applications, files, or repositories containing CJI. This includes group membership changes, role assignments, permission modifications, access-control changes, and additions or removals from privileged groups. These logs create a historical record of how access changed over time and who performed or initiated the change, where that information is available.
- CJI and Sensitive Data Access: Where supported by the system and applicable to the environment, organizations should maintain visibility into access to CJI and sensitive repositories. Depending on the system and available audit capabilities, relevant activity may include file and folder access, creation, modification, deletion, copying or movement, and permission changes. Monitoring this activity helps organizations determine who interacted with sensitive information and what actions they performed. Particular attention should be given to unusual access patterns, bulk activity, or access to sensitive repositories by users who do not normally interact with that data.
- Security and Configuration Changes: Changes to security and system configuration can directly affect an organization’s ability to protect CJI. Monitor changes to audit policies, security policies, Group Policy, logging configurations, system settings, security controls, and relevant network configurations. Maintaining these records helps establish who changed a security setting, what changed, and when the change occurred.
- Audit System Activity: The audit system itself must be treated as a security-sensitive information component. Monitor events involving audit-policy changes, logging being disabled, audit logs being cleared, retention settings being changed, and attempts to modify or interfere with audit records. This provides visibility into activity that could weaken or compromise the organization’s audit trail.
- Security and Incident-Related Events: Audit records should support investigations of potential security incidents. Depending on the applicable system and audit-event configuration, this may include suspicious authentication attempts, unauthorized access, privilege changes, abnormal data access, security-control changes, and activity associated with potentially compromised accounts. The objective is to connect individual events into a useful investigation trail.
What Information Should a CJIS Audit Record Contain?
An effective CJIS audit record should provide sufficient information to understand the event, including the event type, date and time, user or account, source or originating component, affected system or resource, and whether the activity succeeded or failed. Additional information may be required depending on the type of event and the applicable audit requirements. Depending on the event, additional information may include the affected object or resource, changes to permissions or privileges, and other details needed to reconstruct and investigate the activity.
A simple way to evaluate audit records is by asking the following question: Can the record tell you who did what, when, where, and what was affected?
Why Does Context Matter?
A raw event may not provide enough context by itself to determine what changed, what access rights were involved, whether sensitive data was affected, or whether the activity was expected. CJIS auditing uses the information contained in events to link event data with identities, access rights, and security context to facilitate investigations and ensure compliance.
How Should CJIS Audit Logs Be Protected, Reviewed, and Monitored?
It is necessary to ensure that audit logs are protected from unauthorized access and manipulation and checked regularly for suspicious activity. It is recommended to use alerts and monitoring tools so that risks can be detected promptly and investigations can be carried out properly.
1. Protect Audit Records
- Prevent Unauthorized Modifications: Restrict who can modify audit logs and protect records from unauthorized changes.
- Restrict Access to Logs: Use least-privilege access controls to ensure only authorized personnel can view or manage audit records.
- Protect Logs from Deletion: Prevent unauthorized deletion or clearing of logs and maintain them according to applicable retention requirements.
- Maintain Integrity: Ensure audit records remain accurate, complete, and trustworthy so they can support investigations and compliance reviews.
- Secure Log Repositories: Store audit records in appropriately secured repositories with suitable access, retention, and integrity controls.
2. Review Audit Activity
Audit records should be reviewed and analyzed regularly rather than simply stored. Attention should be focused on events showing unauthorized access to the system, misuse of authorized access privileges, as well as changes in security control measures.
- Privileged Activity: Review administrative actions, especially unexpected changes to accounts, groups, permissions, or configurations.
- Authentication Anomalies: Monitor repeated failed logins and unusual authentication activity that could indicate attempted unauthorized access.
- Permission Changes: Review changes that increase or alter access to systems, files, or CJI.
- Security-Policy Changes: Monitor changes to security and access policies that could weaken existing protection.
- Access to Sensitive Information: Review access to CJI to identify unusual or unauthorized data activity.
- Audit Mechanism Changes: Monitor changes to logging and audit settings that could reduce visibility into security activity
3. Use Alerts for High-Risk Activity
Automated alerts can help security teams identify and respond to potentially significant security events. The specific alert conditions should be defined according to the organization’s environment, risk, and applicable CJIS requirements.
- Privilege Escalation: Alert when users unexpectedly gain elevated or administrative privileges.
- Privileged Group Changes: Monitor additions to privileged groups that could provide unauthorized elevated access.
- Authentication Failures: Alert on repeated or unusual authentication failures that may indicate credential attacks.
- Unusual CJI Access: Identify unexpected or abnormal access to Criminal Justice Information (CJI).
- Audit Policy Changes: Alert when audit policies or logging configurations are modified unexpectedly.
- Audit Logs Cleared: Generate alerts when logs are cleared or deleted, as this can remove evidence of security activity.
- Significant Permission Changes: Alert on major permission changes affecting sensitive systems or resources.
4. Centralize Visibility
Aggregate audit information from relevant systems into a centralized view to make monitoring and investigation easier. This can be particularly useful This can be particularly useful for organizations operating across cloud, on-premises, and hybrid environments.
How Long Should You Retain CJIS Audit Logs?
Audit logs must be retained according to the minimum requirements established by the CJIS Security Policy, as well as any stricter state, agency, contractual, legal, or organizational requirements.
Understand the CJIS Retention Requirement
The CJIS Security Policy establishes baseline requirements for retaining audit records.
- CJIS minimum: Organizations should retain audit records for the period required by the applicable CJIS requirement and by any longer state, agency, contractual, legal, or organizational requirements.
- Agency/state requirements: State CJIS authorities or individual agencies may impose additional or longer retention requirements.
- Organizational requirements: Retention may need to extend beyond one year to support investigations, legal requests, audits, law-enforcement actions, or internal record-retention policies.
In practice, organizations should define a documented retention period that meets the applicable CJIS audit-record retention requirement while also accounting for applicable state, agency, legal, and operational requirements. This avoids treating the CJIS minimum as a universal maximum or assuming that one year is sufficient in every environment.
Factors That May Require Longer Retention
Organizations should consider extending retention when required by:
- State or local requirements that impose longer record-retention periods.
- Agency policies governing criminal justice information and security records.
- Contractual obligations that specify audit-log retention periods.
- Investigation requirements, where historical activity may be needed to establish what happened.
- Other regulatory requirements that apply to the same systems or data.
- Incident response and forensic needs, particularly when investigations may require access to older audit records.
Make Sure Retained Logs Remain Safe
Retaining logs involves more than keeping data for a longer period of time. Retained logs must be accessible and usable as audit evidence if an audit or similar compliance review is conducted. The organization needs to ensure that the logs remain:
- Integrity: Logs should remain tamper-resistant and trustworthy
- Accessibility: Authorized teams should be able to retrieve logs when needed.
- Searchability: Security and audit teams should be able to quickly find relevant events.
- Appropriate Access Restriction: Log data should be protected from unauthorized access or modification.
- Sufficient Context: Logs should provide the details needed to understand what happened, who performed the action, when it occurred, and what was affected.
Simply retaining huge volumes of raw logs does not automatically create strong audit evidence. If logs cannot be reliably accessed, searched, interpreted, or connected to the activity they represent, their value during investigations and audits is significantly reduced. Thus, effective log retention means keeping audit evidence usable and trustworthy rather than simply accumulating logs.
Common CJIS Audit Logging Gaps
To meet applicable CJIS Security Policy requirements, organizations need more than simply having audit logging enabled. Common gaps that can weaken audit visibility and readiness include:
- Logging is Enabled but Nobody Reviews it: Logs may be collected but rarely reviewed, allowing suspicious activity or policy violations to go unnoticed.
- Critical Events Are Not Being Captured: Important activities, such as logging into systems, failed logins, and accessing files, permissions, or configurations, may remain untracked and undetected.
- Privileged Activity is Treated Like Normal User Activity: Actions performed using privileged or administrative accounts warrant particular scrutiny because those accounts can make changes that affect security controls, access, and system configuration.
- Audit Logs Can Be Deleted or Modified: If logs can be deleted or modified by unauthorized users, their usefulness as evidence is greatly diminished.
- Hybrid Systems Create Monitoring Blind Spots: Audit data distributed across cloud services, on-premises systems, and other environments can create visibility and correlation challenges.
- Logs Lack User and Permission Context: A log showing an event is less useful if it does not clearly identify the user, resource, action, permissions, and other relevant context.
- Retention Settings Are Inconsistent: Different systems may retain logs for different periods, potentially leaving gaps when historical evidence is required.
- Teams Cannot Produce Evidence Quickly During an Audit: Manually searching multiple systems and compiling records can delay audits and investigations.
Audit readiness is not measured by how many logs you collect, but by whether those logs can demonstrate what happened and support timely investigation.
How Lepide Helps With CJIS Auditing and Log Visibility
Lepide helps organizations improve CJIS audit readiness by providing centralized visibility into user activity, identities, permissions, and access to sensitive data.
- Monitor User and Administrative Activity: Track relevant user and administrative activities across supported environments.
- Track Identity, Group and Permission Changes: Monitor changes to Active Directory, Microsoft Entra ID, group memberships, permissions, and privileged access across supported environments.
- Monitor Sensitive Data Access: Correlate user activity with sensitive-data and permission context to help investigate potentially risky access.
- Detect High-Risk Changes: Use alerts and contextual information to identify privilege escalation, major permission changes, and unusual activity.
- Simplify Audit Investigations: Provide centralized activity records and context to help investigators determine who performed an action, what changed, and when it occurred, reducing manual log analysis.
- Support Hybrid Visibility: Provide centralized visibility into relevant activities across supported cloud and on-premises environments.
- Simplify Audit Evidence and Reporting: Use historical activity records and reports to answer auditor questions and demonstrate relevant security controls.
Lepide helps organizations support CJIS auditing and evidence requirements by improving visibility, monitoring, and reporting. It does not automatically make an organization CJIS compliant.
Conclusion
The conditions necessary for a CJIS audit can be summarized in four basic principles : capture the right activity, deliberately and document it, protect the audit trail so records stay trustworthy, review and investigate meaningful events, prioritizing them by risk, prioritized by risk, and retain usable evidence for the required period of time as defined by the CJIS Security Policy.
When these principles are implemented effectively, organizations can respond to auditor and investigator questions with a clearer record of what happened, who performed the activity, when it occurred, and what systems or data were affected, without relying solely on fragmented logs from multiple systems.
See how Lepide centralizes audit visibility, adds identity and sensitive-data context to raw events, and produces audit-ready reporting on demand. Schedule a demo to see how Lepide can support your CJIS audit readiness.
Frequently Asked Questions
Yes, organizations must maintain a log of the activities of privileged accounts, as required by the CJIS Security Policy. The CJIS Security Policy includes controls addressing privileged functions and security-relevant audit activity. Organizations should ensure that applicable privileged activity is logged and reviewable so inappropriate or unauthorized use can be identified and investigated.
No. Windows event logs can provide important audit information, but collecting Windows events alone does not necessarily address all applicable CJIS audit and accountability requirements. Organizations must identify applicable auditable events, generate sufficient audit records, protect those records, review and analyze them, and retain them for the required period.
Organizations should establish centralized and consistent audit logging across on-premises systems, cloud services, applications, and other systems that process or access CJI. The CJIS Security Policy requires applicable audit records to be generated and protected so they can support accountability, review, analysis, and investigation.
