CJIS Security Addendum & Contractor Compliance Agreement
Document Reference: AUC-SEC-CJIS-001
Version: 3.1.0
Effective Date: October 24, 2026
Last Updated: October 24, 2026
Classification: Legal / Law Enforcement Sector Compliance
Regulatory Baselines: FBI Criminal Justice Information Services (CJIS) Security Policy Version 6.1 (June 25, 2026) | Title 28 CFR Part 20 | FBI CJIS Security Addendum (Standard Form CJIS-001c)
Executive Summary (ISO 24495-1 Plain-Language Overview)
[!IMPORTANT] Legal Precedence Notice: This plain-language summary is provided solely for reader convenience and agency compliance audit navigation pursuant to ISO 24495-1:2023. It does not replace or supersede operative FBI CJIS Security Policy standards or binding addendum terms. In the event of any conflict, governing federal regulations and operative contractual provisions strictly control.
- Purpose & Authority: Incorporates the uniform FBI CJIS Security Addendum (Form CJIS-001c) governing private contractor access to Criminal Justice Information (CJI) under FBI CJIS Security Policy v6.1.
- Strict Enclave Boundary: CJI is never processed in commercial multi-tenant environments; workloads reside exclusively in isolated sovereign government cloud enclaves.
- Personnel Vetting: Personnel with logical or administrative access to unencrypted CJI undergo mandatory state and national fingerprint-based background checks and biennial security training.
- Zero Model Ingestion: CJI is strictly barred from foundation model training; prompts and outputs are ephemeral and purged immediately post-inference.
- Rapid Incident SLA: Notification to the agency Information Security Officer (ISO) and State CSA within four (4) hours of discovering any security incident or unauthorized access event involving CJI.
High-Intent Law Enforcement FAQ (AEO Direct Answers)
Can law enforcement and public safety agencies process Criminal Justice Information (CJI) on Auctoric?
Yes. Subject to prior agency execution of this Addendum, FBI fingerprint vetting, and activation of a dedicated government sovereign cloud enclave conforming to FBI CJIS Security Policy v6.1 Area 5.
Are CJI prompts or records ever ingested into foundation AI models for training?
No. Under Section 2.4, CJI is strictly prohibited from being ingested into public, shared, or foundational models. All CJI model inference occurs in volatile memory enclaves and is purged immediately upon completion.
What is Auctoric’s reporting timeline for security incidents involving CJI?
Under Section 2.5, Auctoric will notify the agency Information Security Officer (ISO) and designated State CJIS Systems Agency (CSA) contact within four (4) hours of discovering an unauthorized access event, data breach, or security incident involving CJI.
[!IMPORTANT] Workload Activation Notice: Processing or storing Criminal Justice Information (CJI) on the Auctoric platform is strictly subject to prior agency execution of this Addendum, completion of State CJIS Systems Agency (CSA) fingerprint-based background vetting, and formal activation of an approved sovereign cloud boundary (e.g., dedicated sovereign government cloud enclaves conforming to CJIS Security Policy Area 5). Workloads involving CJI are not permitted on commercial multi-tenant endpoints.
1. Scope, Purpose, and Governing Standards
This CJIS Security Addendum & Contractor Compliance Agreement (“Agreement”) is entered into by and between the Contracting Law Enforcement Agency or Criminal Justice Agency (“CJA”) and Auctoric, LLC (“Contractor” or “Auctoric”).
This Agreement incorporates the mandatory provisions of the FBI CJIS Security Addendum (Standard Form CJIS-001c) and establishes the technical and administrative safeguards required under FBI CJIS Security Policy Version 6.1 for private contractors administering, processing, or supporting systems conveying Criminal Justice Information (“CJI”).
2. Incorporating the Uniform FBI CJIS Security Addendum (Form CJIS-001c)
2.1 Contractor Personnel Background Screening & Training
- Fingerprint-Based Record Check: Prior to being granted unescorted logical or physical access to infrastructure handling unencrypted CJI, all Auctoric personnel must undergo a state and national fingerprint-based background check through the appropriate State CSA.
- Felony Disqualification: Any individual with a felony conviction is strictly barred from access to systems conveying CJI.
- Security Awareness Training: Auctoric personnel with administrative access to CJIS-designated infrastructure must complete biennial CJIS Security Awareness Training within thirty (30) days of assignment.
2.2 Sovereign Data Boundary & Physical/Logical Protection
- Dedicated Cloud Enclaves: All CJI processed or stored within Auctoric systems resides exclusively within dedicated government sovereign cloud boundaries conforming to CJIS Area 5.9.2 requirements.
- Logical Segregation: Virtual machines, container namespaces, and vector databases containing CJI are logically and cryptographically partitioned from commercial multi-tenant infrastructure.
- Personnel Geographic Restrictions: Access to unencrypted CJI is restricted to screened personnel in accordance with CJIS Security Policy v6.1 Area 5.10 (Advisory Policy Board country standards, including the United States and Canada).
2.3 Cryptographic Standards (CJIS Area 5.10)
- Data in Transit: All network traffic conveying CJI across public or shared networks is encrypted using cryptographic modules conforming to FIPS standards with a minimum of TLS 1.3 or IPsec (AES-256).
- Data at Rest: All disk volumes, database records, and vector embeddings containing CJI are encrypted at rest using AES-256 with customer-controlled or dedicated KMS keys.
2.4 Handling CJI in Artificial Intelligence & Large Language Models
- Absolute Prohibition on Public Model Training: CJI shall NEVER be ingested into public, shared, or multi-tenant foundational AI models for training, calibration, or evaluation.
- Ephemeral Processing: Prompt inputs and model completions containing CJI are processed in volatile memory enclaves and purged immediately post-inference, unless the CJA explicitly configures encrypted retention in an authorized CJIS-compliant repository.
- Immutable Audit Trail (CJIS Area 5.4): Every transaction, inference call, automated agent tool execution, and administrative access event touching CJI is recorded with tamper-resistant audit logs retained for a minimum of one (1) year.
2.5 Security Incident Discovery and Reporting
- Escalation Protocol: Auctoric will notify the CJA Information Security Officer (ISO) and the designated State CSA contact within four (4) hours of discovering an unauthorized access event, data breach, or security incident involving CJI.
- Audit Co-operation: Auctoric agrees to permit triennial CJIS compliance audits conducted by the State CSA and the FBI CJIS Audit Unit (CAU).
3. Form of Execution & Agency Signatures
(This standard form agreement is incorporated into and executed via agency-specific Order Forms or bilateral electronic signature.)
| For Criminal Justice Agency (CJA) | For Auctoric, LLC (Contractor) |
|---|---|
| Agency Name: [Authorized Law Enforcement Agency] | Company Name: Auctoric, LLC |
| Execution: Executed via Agency Order Form / Electronic Sign | Execution: Executed via Agency Order Form / Electronic Sign |
| Authorized Role: [Chief of Police / Sheriff / Director] | Authorized Role: Office of the CISO / General Counsel |
| Effective Date: October 24, 2026 | Effective Date: October 24, 2026 |
4. Contractor Employee Acknowledgment (Standard Form CJIS-001c Attachment)
Auctoric maintains digital records of individual employee acknowledgments administered and verified prior to logical enclave provisioning.
- Policy Standard: FBI CJIS Security Policy Version 6.1 (Standard Form CJIS-001c)
- Record Keeping: Managed via Auctoric Compliance Management System with annual re-certification.