Two different rules
28 CFR Part 23 is a federal regulation about criminal intelligence systems. It applies to systems operated with certain Department of Justice grant funding, and many fusion centers adopt its principles in their privacy policies regardless of funding. It governs what may be collected, who it may be shared with, how long it may be kept, and how it must be protected.
The FBI CJIS Security Policy sets the security controls required wherever criminal justice information is accessed, stored, or transmitted: authentication, audit, encryption, incident response, personnel screening, and more.
A reviewer typically needs both answered: Part 23 for how information is handled, CJIS for how the system is secured.
What RAID is, for the purposes of review
RAID is a dissemination platform. Analysts publish finished products, such as bulletins, situational awareness reports, and officer-safety notices, to vetted communities of partners. It is not a criminal intelligence database where suspects and associates are entered and queried.
That matters because many of Part 23's rules, such as the reasonable-suspicion standard for entering information, apply to how your analysts create content. RAID cannot judge whether a product meets that standard. It can make sure a product goes only to the right people, record who received it, and protect it in transit and at rest.
28 CFR Part 23 principles and how RAID supports them
| Principle | What RAID does | What stays with your agency |
|---|---|---|
| Need to know and right to know | Products go only to the communities an analyst targets. Members are vetted and approved by your administrators, and there is no open self-signup. | Deciding who belongs in each community and which communities a product should reach. |
| Record of dissemination | Each product records who it was delivered to, who opened it, and when. Referrals to outside agencies are logged. | Documenting the reason for any release outside the system, where your policy requires it. |
| Reasonable suspicion and content limits | Products carry classification and handling markings chosen by the author. | Analyst training and supervisory review of product content before publication. |
| Review and purge | Administrators can remove products. Audit records are archived to append-only storage and kept at least a year. | Your review schedule for products and the decision to retain or remove them. |
| Security safeguards | Dedicated Azure Government environment, MFA and passkeys, lockout, session timeout, encryption, recipient watermarking, and a full audit trail. | Physical security of the devices your users read on, and your own access policies. |
CJIS Security Policy in a cloud deployment
For cloud software, CJIS compliance is shared. Some controls come from the cloud platform, some are enforced by the application, and some are organizational and can only be met by your agency.
Inherited from Azure Government
Physical protection of data centers, platform encryption at rest, and the infrastructure controls Microsoft maintains for Azure Government, which Microsoft operates with CJIS commitments to state CJIS Systems Agencies.
Enforced by RAID
- Advanced authentication: TOTP multi-factor authentication, FIDO2 passkeys, and Microsoft single sign-on with MFA enforcement.
- Session and lockout controls: lockout after repeated failed sign-in or MFA attempts, and automatic sign-out after inactivity.
- Auditing and accountability: sign-ins, failures, role and membership changes, the user lifecycle, configuration changes, and security incidents, each with timestamp, user, and source IP. Archived to append-only storage, with a one-year minimum.
- Incident detection and alerting: lockouts, role changes, disabled accounts, forwarded personal links, and capture attempts are logged and emailed to your security contacts.
- Account management: agency-controlled onboarding, optional automatic disabling of dormant accounts, and a login banner and system use agreement whose acceptance is recorded.
- Isolation: each agency has its own database, storage, and key vault. There is no shared data store between customers.
Your agency's responsibility
Information exchange agreements, security awareness training, personnel screening, the written incident response plan, and formal audits. RAID supports these with records and settings, but no software can meet them for you.
Questions reviewers usually ask
Where is the data stored?
In your agency's own environment in Azure Government, Microsoft's US-sovereign cloud for government customers. See RAID security.
Can another agency on RAID see our products?
No. Each agency runs on dedicated infrastructure. Partners outside your agency see products only if your administrators add them to a community.
Can we get the control mapping before a demonstration?
Yes. Email sales@raidplatform.io and we will send the CJIS control mapping, architecture overview, and network allowlist.