October 2026
PDF Article
Protecting the Information Entrusted to Us
October is Cybersecurity Awareness Month, an annual r eminder that protecting information is everyone’s responsibility. For public safety records professionals, however, cybersecurity is more than an IT issue. Records personnel routinely handle some of an agency’s most sensitive information: criminal history information, incident and investigative reports, personally identifiable information (PII), fingerprints and other biometrics, juvenile records, body-worn camera footage, photographs, and other data that could cause significant harm if improperly accessed or disclosed.
The FBI’s CJIS Security Policy (CJIS SECPOL) establishes security requirements for agencies that access, process, store, or transmit Criminal Justice Information (CJI). The current CJIS SECPOL, Version 6.1, emphasizes safeguards involving access control, identification and authentication, least privilege, media protection, and other controls designed to prevent unauthorized access to CJI. In addition to the FBI’s guidance, the Cybersecurity Information Security Agency, CISA, is the federal agency under the Department of Homeland Security responsible for protecting national cyber and physical critical infrastructure. Their Secure Our World guidance emphasizes four core cybersecurity practices: recognizing and reporting phishing, using strong passwords, enabling multifactor authentication, and keeping software updated.
Access Should Be Based on Need, Not Convenience
One of the most important cybersecurity concepts is least privilege: employees should have access only to the information and system functions necessary to perform their assigned duties. CJIS guidance specifically incorporates least privilege into its security framework.
Records managers should periodically ask, “does this employee still need this level of access?” In addition to reviewing access as part of on-boarding and off-boarding procedures, transfers, promotions, and temporary assignments should also trigger a review of permissions. Administrative privileges should be especially restricted.
Strengthen the Front Door
Passwords remain important, but passwords alone are increasingly insufficient. Both CJIS SECPOL and CISA recommend strong, unique passwords and use of multifactor authentication (MFA), particularly for accounts involving sensitive information, remote access, and administrative privileges.
Never share or reuse passwords, and don’t store passwords on paper, in spreadsheets, or in unsecured
electronic files. There’s a reason why the FBI refers to passwords as “memorized secrets!”
MFA provides another layer of defense. Even when a password is compromised, the additional authentication
factor can help prevent unauthorized access.
Think Before You Click
Records employees receive emails from prosecutors, officers, courts, attorneys, citizens, vendors, and countless other sources—making the records unit an attractive target for phishing.
Unexpected links, attachments, password-reset requests, invoices, file-sharing notifications, or messages creating an artificial sense of urgency should receive extra scrutiny. CISA recommends verifying suspicious communications and reporting phishing attempts rather than interacting with them.
Removable Media Is Still a Risk
USB drives, external hard drives, memory cards, CDs, and other removable media can introduce malware or create opportunities for sensitive information to leave agency control. The CJIS Security Policy specifically addresses protection of electronic and physical media and requires agencies to restrict access to authorized individuals and appropriately protect stored CJI.
Use only agency-approved media and follow agency procedures for encryption, transportation, storage, sanitization, and destruction.
Records Security Is Cybersecurity
Cybersecurity does not belong exclusively to IT. Every time a records professional opens an attachment, exports a report, downloads video, creates a user account, copies information to removable media, or provides someone access to a system, a cybersecurity decision is being made.
This October, take a few minutes to review your access permissions, strengthen your passwords, enable MFA where required, recognize phishing attempts, secure removable media, and reconsider how sensitive records are stored and shared.
The goal is simple: the right information, accessible to the right people, for the right reasons—and protected from everyone else.
Cybersecurity Checklist
Ten quick checks for protecting public safety records and Criminal Justice Information.
Find us on Google Maps