CJIS (Section 5.3 and related guidance) requires agencies to implement a formal, documented incident response capability.

1. Preparation

Agencies must establish:

• A documented incident response plan
• Defined roles (e.g., CJIS Systems Officer, LASO)
• Training and awareness programs

Preparation ensures personnel know exactly how to respond before an incident occurs.

2. Detection and Analysis

Organizations must be able to:

• Identify potential incidents (e.g., alerts, anomalies)
• Analyze whether CJI is impacted
• Determine scope and severity

CJIS expects agencies to maintain monitoring and logging capabilities to support detection.

3. Containment

Once an incident is confirmed, agencies must:

• Isolate affected systems
• Prevent further exposure of CJI
• Limit lateral movement

Example (CJIS context):
If a CJIS-connected workstation is infected with malware, it must be immediately removed from CJNet or network access.

4. Eradication

After containment:

• Remove malware or unauthorized access
• Patch vulnerabilities
• Eliminate root cause

This step ensures the threat is fully neutralized.

5. Recovery

Systems must be:

• Restored to normal operation
• Verified as secure before reconnecting to CJIS systems

CJIS emphasizes that systems must not return to service until risk is mitigated.

6. Reporting and Notification (Florida-Specific)

In Florida, CJIS incident response includes mandatory reporting to FDLE:

• Agencies must notify the FDLE CJIS Information Security Officer (ISO)

Additionally, agencies must:

• Document the incident
• Track response actions
• Maintain records for audit purposes

Additional CJIS Requirements Often Overlooked

Mobile Device Incidents

CJIS explicitly requires procedures for:

• Lost or stolen devices
• Compromised mobile endpoints
• Incidents occurring outside the United States

Physical + Electronic Incidents

Your plan must address both:

• Cyber incidents (e.g., ransomware)
• Physical incidents (e.g., stolen paper records or laptops)

CJIS treats both as equally critical.