Protecting Sensitive Police Department Data with Phishing-Resistant Multi-Factor Authentication
When a southeastern U.S. police department received notice that state auditors would arrive within the week to conduct a 360-question CJIS compliance review, most departments would have scrambled. This one didn’t—because their identity infrastructure was already built for exactly this moment.
They passed the audit in approximately five hours. Shortly after, they passed an FBI CJIS audit in the same timeframe.
The full case study explains the RSA solution they deployed and what the audit results revealed about their security posture.
Download the case study now or read on for the key concepts and common questions that frame the story.
The case study covers:
- The specific CJIS compliance challenge the department faced—and why their previous approach left them exposed
- How RSA’s iShield Key 2 Series was deployed across officers and administrators, replacing passwords with hardware-enforced authentication
- Why auditors were able to verify compliance in hours rather than days—and what documentation made the difference
- How the same deployment satisfied both state and FBI CJIS audit requirements without additional preparation
- What the outcome means for other law enforcement agencies navigating CJIS advanced authentication requirements
The case study references several technical standards central to how law enforcement agencies are required to protect criminal justice data. These definitions provide the context behind the compliance requirements the department met—and that any agency accessing FBI systems must address.
Criminal Justice Information (CJI)
Criminal Justice Information refers to the sensitive data managed and protected under CJIS Security Policy, including biometric data, identity history, biographic data, property data, and case and incident history. Access to CJI is tightly regulated by the FBI and requires strict authentication controls at every access point. Any agency—federal, state, or local—that stores, processes, or transmits CJI must demonstrate compliance with CJIS standards during regular audits. Unauthorized access to CJI systems can compromise ongoing investigations and result in suspension of an agency’s access to critical law enforcement databases.
CJIS Security Policy
The CJIS Security Policy is a document issued by the FBI’s Criminal Justice Information Services Division that establishes minimum security requirements for agencies accessing FBI criminal justice data systems. It covers 13 policy areas including access control, auditing, configuration management, and—critically—advanced authentication. The policy is updated regularly and requires agencies to evolve their security posture as threats change. Failure to comply can result in suspension of access to systems like the National Crime Information Center (NCIC), cutting off agencies from data essential to daily law enforcement operations.
Phishing-Resistant Multi-Factor Authentication (MFA)
Phishing-resistant MFA is a category of authentication that uses cryptographic mechanisms to prevent credentials from being captured or replayed by attackers. Unlike traditional MFA methods that rely on shared secrets—such as a code sent via SMS or generated by an authenticator app—phishing-resistant MFA binds authentication to a specific physical device and a specific registered application. This makes it technically impossible for an attacker to redirect the authentication response, even if a user is tricked into visiting a fraudulent website. For law enforcement agencies accessing CJI outside physically secure locations, phishing-resistant MFA is now the required standard under CJIS Security Policy.
FIDO2 and Passkeys
FIDO2 is an open authentication standard developed by the FIDO Alliance that enables passwordless and phishing-resistant login using public-key cryptography. When a user registers a FIDO2 device, a unique cryptographic key pair is generated—the private key never leaves the device, while the public key is registered with the application or service. For law enforcement, hardware-bound FIDO2 keys provide the highest assurance level because the private key cannot be extracted, copied, or used on any other device—ensuring authentication remains tied to a specific, accountable individual.
FIPS 140-3 Level 3
FIPS 140-3 is a U.S. federal standard published by NIST that defines security requirements for cryptographic modules. Level 3 requires physical tamper-resistance mechanisms, identity-based authentication for accessing the cryptographic module, and additional environmental protections against physical attack. A FIPS 140-3 Level 3 certified hardware authenticator—such as the RSA iShield Key 2 Series—provides assurance that cryptographic operations and key storage meet rigorous federal requirements, and its presence significantly accelerates CJIS audit review by giving auditors immediate, verifiable evidence of security control quality.
CJIS stands for Criminal Justice Information Services, a division of the FBI that sets security policies governing access to sensitive criminal justice data—including fingerprints, criminal histories, and warrant information. Any law enforcement agency that accesses this data must comply with CJIS Security Policy requirements covering identity management, access control, and encryption. Non-compliance can result in loss of access to critical FBI databases, including the National Crime Information Center (NCIC).
CJIS Security Policy requires advanced authentication for any user accessing criminal justice information from outside a physically secure location. Phishing-resistant MFA—such as FIDO2 hardware security keys—satisfies this requirement using cryptographic authentication that cannot be intercepted, replicated, or socially engineered, ensuring that even a compromised password cannot grant unauthorized access to CJI systems.
The RSA iShield Key 2 Series is a hardware security key providing FIDO2 passwordless authentication certified to FIPS 140-3 Level 3—the federal standard required for the most sensitive government data. Officers and administrators use the physical key to authenticate access to criminal justice systems; because it generates a unique cryptographic response for each login, it cannot be phished, cloned, or used by unauthorized individuals even if a password is compromised.
A standard CJIS audit involving 360 security questions typically requires a full week of personnel time. By deploying RSA’s identity management platform and iShield Key 2 Series, one southeastern U.S. police department completed its state audit in approximately five hours—a reduction of over 80%—and passed its subsequent FBI CJIS audit in the same condensed timeframe.
Traditional MFA methods—SMS one-time passwords, authenticator apps—rely on shared secrets that can be intercepted through phishing, SIM swapping, or man-in-the-middle attacks. Phishing-resistant MFA uses public-key cryptography tied to a specific registered device, making it technically impossible to replay or redirect credentials to a fraudulent site. For law enforcement agencies, this distinction separates MFA that meets CJIS requirements from MFA that does not.
Yes. The RSA iShield Key 2 Series supports cloud-based management, allowing small or mid-sized departments to provision, monitor, and revoke authenticators without on-premises infrastructure. The RSA platform provides centralized visibility across all authentication events, so departments that previously spent days assembling audit evidence can now produce it in hours.
Included