What the justice lane involves
- Before any tooling decision, we build an obligations matrix that maps every information type in your contract to its imposing instrument, requirement set, and verification mechanism.
- The CUI program implements NIST SP 800-171 for the CUI your contract designates, including law-enforcement-sensitive categories with tighter dissemination rules.
- Privacy-protected and litigation-sensitive material gets access, minimization, and retention controls that are enforced in configuration.
- Incident detection, response, and the contract-specific reporting duties of justice-sector work are engineered into the Defender and monitoring stack.
- Where systems touch criminal-justice information, we implement the CJIS Security Policy as its own regime, with its own requirements, agreements, and audit expectations. It is coordinated with the CUI program and kept separate from it.
We never present CJIS as a flavor of 800-171, or 800-171 as covering CJIS. Contractors who blur the two build programs that satisfy neither auditor. The regimes do share much of their engineering (access control, auditing, encryption), so one implementation can serve both when the mapping is honest.
Questions contractors ask us
Is CJIS just 'NIST 800-171 for the FBI'?
No. Treating it that way is how contractors fail audits. The FBI's CJIS Security Policy is a separate security regime for criminal-justice information, with its own requirements, audit process, and agreements. Its controls have been moving toward NIST alignment, but if your work touches CJI you comply with CJIS on its own terms, in addition to any CUI obligations your contract carries.
What information types show up in DOJ/FBI contract work?
Often several at once: CUI categories (including law-enforcement-sensitive information), privacy-protected records, grand-jury or litigation material governed by court rules, and, where systems touch criminal-justice information, CJI under CJIS. Each type has its own handling and access requirements, and the program has to keep them apart.
How do we know what actually applies to our contract?
By reading it: the clauses, the security addenda, and any incorporated policies or agreements. DOJ components differ, and requirements are contract-specific. Our first deliverable in this lane is always an obligations matrix: information type → imposing instrument → requirement set → verification mechanism.
Have the obligations matrix in hand before the audit.
Tell us the component, the contract type, and the information you handle, and a practitioner will map the regimes that apply. Or email rj@indirectit.com directly.