What changed in CJIS Security Policy 6.1, and what Texas agencies need to know.

Prepare against v6.1. Demonstrate current audit readiness against the version Texas says it is auditing.

As of September 17, 2026, Texas DPS states that all Texas CJIS audits through March 31, 2027 are conducted against FBI CJIS Security Policy version 5.9.5. FBI CJIS Security Policy version 6.1 was released June 25, 2026. DPS says agencies should begin gap assessments for that modernized policy. It is not the current Texas audit baseline.

5.9.5 = what Texas is auditing today

6.1 = what the agency should be comparing and preparing against

This guide covers what materially changed in v6.1, which of those changes a small Texas agency should evaluate, and how to identify gaps without abandoning the current audit standard. Evidence preparation under the policy Texas is auditing today belongs in the separate audit-readiness guide.

For demonstrating the security program Texas is auditing today, read Texas CJIS Audit Readiness.

Texas CJIS 6.1 status at a glance

Status reviewed September 17, 2026 against the Texas DPS CJIS Policy Components & Documents page.

Why the modernized policy looks different

v6.1 is the current published form of the modernized CJIS Security Policy. The FBI completed that modernization in v6.0 on December 27, 2024, and v6.1 incorporates calendar-year 2025 corrections, omissions, and additions. Texas DPS describes v6.1 as a significant modernization aligned with NIST SP 800-53 Rev. 5 and tells agencies to use it for gap assessment.

The useful takeaway is structural. v5.9.5 still mixes older numbered policy areas with modernized control families. v6.1 presents the security program as control families. A simple old-section-number-to-new-section-number comparison is usually not enough.

The FBI’s Requirements Companion and List of Priorities distinguish controls carried forward from earlier policy from phased modernized controls. Those federal implementation priorities can help an agency sequence its gap assessment, but they are not the same thing as Texas’s current audit baseline. Texas DPS currently says Texas audits through March 31, 2027 use v5.9.5.

Three kinds of change

A control that appears under a new number, or in a more NIST-like family, is not automatically a new obligation. Before treating something as extra work, decide which of these it is.

• New obligation — a material duty that was not present in the relevant prior baseline.
• Changed obligation — an existing responsibility with different scope, specificity, frequency, implementation, or evidence expectation.
• Reorganized or clarified obligation — substantially the same security responsibility expressed in the modernized control structure.

An Existing marking or an asterisk on the List of Priorities can help. A missing asterisk does not, by itself, mean the duty first appeared in v6.1. Many authentication, logging, incident-response, and access-control requirements already appear in v5.9.5. Compare the current implementation with the applicable v6.1 language.

What actually changed for a small agency

Texas DPS says v6.1 introduces updated controls in access control, identification and authentication, incident response, and cloud computing environments. Those families already exist in v5.9.5. The comparison below keeps the families that are structurally new or substantially expanded, then the families agencies often misread as brand-new obligations.

Assessment, authorization, and monitoring

v6.1 organizes Assessment, Authorization, and Monitoring as its own CA family. v5.9.5 does not present that family. CA-3 Information Exchange is marked as existing. Other CA controls—including CA-2 control assessments and CA-7 continuous monitoring—are modernized additions. That does not mean Texas agencies have never been audited. It does mean a future v6.1 review may ask whether the agency assesses its own controls, tracks open remedial actions, and monitors control effectiveness between DPS visits—not only whether it can survive the current audit.

Do not assume every CA control requires a purchased GRC tool. The first check is whether anyone owns internal assessment, whether open gaps are written down, and whether monitoring happens as work rather than as a reaction to the auditor.

Acquisition and supply chain

v5.9.5 includes SA-22 for unsupported system components. v6.1 expands System and Services Acquisition into a full SA family. SA-9 External System Services is marked Existing: management-control agreements, the CJIS Security Addendum, and contractor access rules were already part of the baseline. The change is that acquisition, external-service oversight, and related documentation are now easier to see as their own controls.

Supply Chain Risk Management (SR) appears as a control family in v6.1 and does not appear as a family in v5.9.5. That is the clearest structural addition. It does not mean vendor responsibility suddenly began in 2026. It does mean the agency should be able to identify suppliers and components that affect CJI systems, who reviews them, how a supplier incident is reported, and how components are disposed of. Buying a product, outsourcing IT, or hearing that a vendor is “CJIS compliant” still does not transfer the agency’s CJIS responsibilities to the vendor.

Authentication

Do not treat multi-factor authentication as a v6.1 invention. v5.9.5 already includes IA-2(1) MFA for privileged accounts and IA-2(2) MFA for non-privileged accounts. In v6.1, IA-2 remains marked Existing. v6.0 also clarified authenticator refresh and banned-password-list language inside IA-5; those refinements carry into v6.1. Older “advanced authentication” wording from v5.9.5 Policy Area 13 should not be carried forward as the current concept.

The gap-assessment question is whether every path to CJI matches the current authentication language: privileged and non-privileged MFA, remote access, authenticator types including memorized secrets, service or non-person accounts, and vendor support paths. Check the environment. Do not buy a new authenticator product because the family was renumbered.

Logging and monitoring

The AU family already exists in v5.9.5, including AU-6 weekly review and analysis of system audit records. v6.1 does not make logging a new idea. Compare current capture, protection, retention, review, alerting, and correlation—including vendor-held logs—with the applicable v6.1 requirements.

Configuration, vulnerability, and patch management

Configuration management, vulnerability monitoring, and flaw remediation already appear in v5.9.5 (CM, RA-5, SI-2, SA-22). v6.1 keeps those duties in the modernized families and makes the path from discovery to remediation easier to locate. Inventory who patches what, what the configuration baseline is, how vulnerabilities are identified, how exceptions are approved, what evidence exists, and which systems are vendor-managed. The useful question is whether the agency can show how a vulnerability or configuration change moves from discovery to remediation.

Personnel and training

Personnel security and training already existed. v6.1 restates them in the modernized PS and AT families. Compare contractor and cloud-personnel screening, and whether access actually ends when a role ends. Ordinary employee-lifecycle evidence belongs in the audit-readiness guide.

Incident response

Incident response was already modernized in v5.9.5, including training, testing, handling, reporting, and supply-chain coordination. v6.1 keeps that IR family. Compare the current plan with the v6.1 IR controls: does it contain what the modernized family expects, are roles and contact paths current, have testing expectations been met, and do vendors participate where they hold or can reach CJI? Do not rebuild the entire incident-response lifecycle on this page. Current Texas reporting and evidence questions belong in Audit Readiness.

Mobile, remote, and cloud environments

Inspect the actual environment: authorized remote access, authentication, local CJI storage, lost-device and revocation procedures, vendor remote support, and who owns each hosted-service duty. v6.1 reorganizes these responsibilities across the modernized control families and drops the older Policy Area 13 / advanced-authentication map. Cloud shared-responsibility distinctions continue; they are easier to find, not newly invented.

Policies and documentation

Most v6.1 families include a policy-and-procedures control. That is not an instruction to create a separate Word document for every family. Distinguish a required documented policy or process from one practical way of organizing files. Review existing policies against the applicable v6.1 areas. Update the area that no longer matches. DPS sample templates remain starting points, not finished agency policy.

For how to organize current-audit evidence, read Texas CJIS Audit Readiness.

Texas DPS sample agreements and policy templates

Separate agency work from vendor work

Some v6.1 comparisons are configuration or product work. Others are agency process, assignment, training, or contract work. Do not retrain officers for a control-number change. Do not assume a vendor software update completes the agency’s transition.

How to run a gap assessment now

DPS has not published the following as a mandated order of operations. It is a practical method for using v6.1 while Texas still audits v5.9.5.

SCOPE
Systems, users, vendors, locations, current documentation
       ↓
COMPARE
Current implementation against applicable v6.1 controls
       ↓
ASSIGN
An owner for each identified gap
       ↓
REMEDIATE
Policy, process, configuration, contract, training, or technology
       ↓
EVIDENCE
Retain proof the new practice operates
       ↓
VERIFY
Reassess and confirm the gap actually closed

A gap may close through configuration, documentation, assignment of responsibility, a workflow change, training, vendor evidence, contractual clarification, or a technical control. Do not frame modernization as a shopping list. Conversely, do not treat a rewritten policy as the close of a technical gap.

What not to do

• Do not abandon current v5.9.5 audit readiness while preparing for v6.1.
• Do not assume every renumbered control is a new requirement.
• Do not assume a policy rewrite alone closes a technical or operational gap.
• Do not buy technology before identifying the actual control gap.
• Do not assume the vendor owns the entire requirement.
• Do not wait until Texas changes its audit baseline to begin comparison work.

Those items are Thin Line practical recommendations unless a cited source requires the same action.

Compare now. Keep today’s evidence intact.

A Texas agency should finish this page knowing which policy Texas is auditing today, why v6.1 matters now, what materially changed, and who owns each gap. Current evidence still has to stand up under v5.9.5.

Do we know what Texas is auditing today, where v6.1 actually differs, and who owns each gap?

Texas CJIS 6.1 gap-assessment tools

Use these to organize comparison work. They do not replace the official policy, the Requirements Companion, or guidance from the Texas CJIS Security Office. They do not store answers, assign a score, or determine CJIS compliance.

Start here

• Current v5.9.5 readiness is understood, and that work has not been paused
• Current v6.1 policy and Requirements Companion have been obtained
• Texas DPS v6.1 / audit-baseline guidance has been reviewed
• Someone owns the gap assessment
• Current systems, devices, users, locations, and vendors are inventoried
• Existing policies have been compared with applicable v6.1 areas
• Authentication requirements have been compared
• Logging and audit-review requirements have been compared
• Vulnerability and configuration requirements have been compared
• Personnel and training requirements have been compared
• Incident-response requirements have been compared
• Vendor, cloud, and supply-chain responsibilities have been compared
• Assessment, authorization, and monitoring expectations have been compared
• Each identified gap has an owner and an action
• Evidence of remediation is being retained
• Current Texas DPS implementation and audit guidance is being monitored

Gap-assessment table

An agency organizational tool, not an official DPS form. Fill Current agency practice, Gap?, Action, and Owner from the actual environment. Do not invent a compliance score.

Material change quick reference

Only material, source-supported differences appear here. Type of change describes the presentation or scope relative to the v5.9.5 baseline Texas is auditing—not whether the underlying security idea first appeared in v6.1.

Questions to ask vendors and IT providers

Prefer “Show us” over “Are you CJIS 6.1 compliant?”

1. Show us your comparison of our current product/version with applicable v6.1 controls.
2. Which requirements are already implemented, and which remain in development or testing?
3. Which items depend on further Texas DPS implementation or audit-baseline guidance?
4. Show us current MFA, authenticator, and remote-access behavior on every CJI path you provide.
5. Show us logging, retention, and how we can review or receive audit records you hold.
6. Show us how vulnerabilities and configuration changes move from discovery to remediation on systems you manage.
7. Show us the agency, provider, and shared duties for any hosted or cloud service.
8. What Security Addendum, screening, incident-notification, and contract-end evidence can you produce?
9. What agency action is required, and what will you deliver if Texas later audits against v6.1?

For current-audit evidence, read Texas CJIS Audit Readiness.