Michigan CJIS compliance for law enforcement agencies

Unlike states that layer materially stricter requirements on top of the federal baseline, the Michigan Addendum mainly exists to clarify how the FBI's CJIS Security Policy applies to Michigan agencies - resolving ambiguity rather than adding a separate stringent standard. What matters just as much for compliance planning is who checks your work: MSP's CJIS Compliance Unit conducts LEIN/NCIC audits of every direct-access criminal justice agency on a three-year cycle, reviewing physical and technical security, administrative policy, and records practices together.

The bulk of what that audit checks - access control, authentication, audit logging, incident response, and the rest of CJIS v6.0's 20 policy areas - is the same work every CJIS-connected agency in the country does. ComplianceLattice tracks that full federal baseline today, which is most of what a LEIN/NCIC auditor will actually review.

A three-year audit cycle is long enough that compliance posture can drift significantly between visits from MSP's auditors - the agencies that fare best treat the interval as continuous maintenance, not a countdown that starts the year before the next audit is due. If your agency is working through the Michigan Addendum requirements now, reach out - alpha tester feedback directly shapes what we build first.