Security 2024

CJIS-Compliant MFA Implementation

Building MFA infrastructure that satisfies FBI auditors without annoying users

100% User Coverage
7 Policy Segments
100% CJIS Compliant

The Problem

A local government with sworn law enforcement needed MFA that would pass an FBI CJIS audit. Officers accessing NCIC and state criminal databases needed bulletproof authentication. The rest of staff just needed reasonable security without the friction.

  • Law enforcement accessing NCIC, III, and state criminal databases
  • Mixed population: sworn officers, administrative staff, external vendors
  • Existing Active Directory with zero MFA integration
  • Multiple access points: workstations, servers, VPN, webmail
  • CJIS audit scheduled: compliance documentation required

CJIS Section 5.6.2.2 compliance for CJI access. No unnecessary friction for everyone else.

Deployment Overview

Full Org

All users synced from Active Directory with automated group membership

7 Policies

Role-based segmentation separating CJIS, general, and vendor access requirements

6 Applications

Endpoint, server, Windows login, internal VPN, vendor VPN, and webmail protected

On-Prem Proxy

Authentication proxy connected to AD for real-time user validation

Architecture Overview

Diagram: Cisco Duo authentication architecture showing cloud service, authentication proxy, Active Directory integration, and protected applications CISCO DUO AUTHENTICATION ARCHITECTURE Duo Cloud Service Authentication Engine Policy enforcement & logging SSO Endpoint SAML/OIDC apps Auth Proxy On-premises Active Directory All users synced CJIS Systems Endpoint/Server Windows Login Internal VPN Employee access Vendor VPN Contractor access Microsoft OWA Webmail

Policy Hierarchy

Diagram: Duo policy hierarchy showing Global Policy at top with CJIS, VPN, and General Apps policies below Global Policy 7 rules • All applications CJIS Users 6 rules • Strict VPN Policies 4 rules each General Apps 2 rules • Standard Endpoint MFA Server MFA Internal VPN Vendor VPN Microsoft OWA

CJIS Compliance Mapping

5.6.2.2 - Advanced Authentication

Requirement: All users with unescorted access to CJI shall use AA

Implementation: CJIS Users policy applied to all law enforcement applications

Status: ✓ Compliant

5.6.2.2.1 - Two-Factor Minimum

Requirement: Must use at least two of: know, have, are

Implementation: Password (know) + Push/FIDO2/Biometric (have/are)

Status: ✓ Compliant

5.5.6 - Remote Access

Requirement: Remote access to CJI shall employ AA

Implementation: VPN policies require Duo for all remote connections

Status: ✓ Compliant

5.4.1.1 - Audit Logging

Requirement: Log all authentication events including success/failure

Implementation: Duo authentication logs retained with full detail

Status: ✓ Compliant

5.6.3.2 - Session Lock

Requirement: Session lock after period of inactivity

Implementation: Re-authentication policy configured per CJIS timeout

Status: ✓ Compliant

Offline Access

Requirement: Field operations require disconnected authentication

Implementation: Offline Access enabled for law enforcement devices

Status: ✓ Supported

CJIS Policy Controls

Offline Access

Law enforcement can authenticate offline during field operations

Hardware Tokens

FIDO2/WebAuthn security keys accepted as CJIS-compliant second factor

Biometric Auth

Windows Hello, Touch ID, Face ID permitted as second factor for "something you are"

Duo Push

Mobile app push notifications for real-time authentication approval

Session Controls

Re-authentication required after configurable inactivity timeout

Vendor Isolation

Separate policy and VPN segment for third-party contractor access

Results

Metric Achievement
CJIS Audit Readiness ✓ Compliant (all 5 sections)
User Coverage All users (100%)
Policy Segmentation 7 role-based policies
Directory Sync Automated sync cycle
Vendor Access Control Isolated policy + VPN
Protected Applications 6 critical systems

Technologies

Cisco Duo MFA/SSO Active Directory CJIS Compliance Zero Trust Identity Governance FIDO2/WebAuthn SAML VPN Security Technical Documentation

Lessons Learned

Segment from day one

Role-based policy architecture prevents painful retrofits when compliance requirements differ across user populations.

Compliance isn't theater

CJIS requirements are prescriptive but reasonable. Proper implementation actually improves security, not just checkbox status.

Plan for disconnected

Law enforcement field operations can't depend on network connectivity. Offline authentication isn't optional.

Documentation is audit prep

Clear policy-to-compliance mapping turns audit prep from days of scrambling into hours of review.