Compliant Software Doesn't Make You Compliant

CJIS, Laserfiche Cloud, and the responsibilities that remain with your agency

A persistent misconception in government technology procurement: If a software platform supports a particular compliance framework, buying it makes your organization compliant.

It doesn't.

Software can provide the security controls, audit capabilities, encryption, and records management functionality necessary to meet regulatory requirements. But those capabilities are only part of the equation. Compliance also depends on how the system is implemented, how the organization manages information, and whether it has established and follows appropriate policies and procedures.

For law enforcement agencies considering cloud-based enterprise content management (ECM), this distinction matters most when dealing with the FBI's Criminal Justice Information Services (CJIS) Security Policy.

Understanding CJIS Compliance

The CJIS Security Policy establishes minimum security requirements for protecting Criminal Justice Information (CJI). It addresses a broad range of administrative, technical, and operational controls, including access management, auditing, encryption, incident response, personnel security, and information handling.

While the FBI sets the overarching policy, each state's CJIS Systems Agency (CSA) administers and enforces requirements within its jurisdiction.

This means an agency considering storing CJI in a cloud environment needs to understand not only federal requirements but also its state CSA's applicable processes and expectations.

The process may involve security assessments, documentation, service provider agreements, and demonstrating that appropriate controls are in place.

These responsibilities do not disappear because the agency purchases software designed to support CJIS requirements.

What Laserfiche Enterprise Security Provides

Laserfiche Cloud Enterprise Security provides enhanced security capabilities to support organizations that manage sensitive and regulated information.

These include advanced auditing and monitoring, enhanced encryption using FIPS 140-3 cryptographic modules, and additional administrative security controls.

These capabilities are valuable. They provide technical mechanisms agencies can use to address applicable security requirements and strengthen the protection of sensitive information.

But having those capabilities available does not mean an agency has implemented every required control.

Consider auditing. A platform may provide detailed records of user activity, access attempts, and administrative actions. However, the agency still needs to decide which events to monitor, configure applicable audit settings, establish review procedures, and respond appropriately when it identifies suspicious activity.

The technology makes those activities possible. The agency must ensure they actually happen.

Records Retention: A Practical Example

Records retention illustrates the distinction particularly well.

Laserfiche provides records management functionality that can help organizations apply retention schedules, manage disposition processes, and document records-related activities.

But Laserfiche cannot determine which retention requirements apply to every record maintained by a police department.

That responsibility belongs to the agency.

A police department must identify the laws, regulations, directives, and policies governing its records. It must establish appropriate retention schedules, classify records, and implement procedures to manage them throughout their lifecycle.

Only then can the technology be configured to support those requirements.

An automated retention process is only as compliant as the policies and schedules behind it. Automating an incorrect retention schedule doesn't correct the underlying problem. It simply makes the mistake more efficient.

Compliance Is a Shared Responsibility, Not an Outsourced Obligation

Cloud computing introduces another important consideration: the division of responsibilities between the software provider and the agency.

The cloud provider is responsible for the security controls and services it has agreed to deliver. The agency remains accountable for ensuring that its use of the system meets applicable CJIS requirements.

The FBI's CJIS guidance recognizes this division of responsibilities. The provider implements some security controls, the agency implements others, and some require coordinated action.

Agencies must understand where those responsibilities intersect.

For example, a cloud provider may supply encryption, security monitoring capabilities, and infrastructure protections. The agency may still need to establish user access policies, manage personnel authorizations, document security procedures, and coordinate required agreements and assessments.

The presence of a security feature does not establish that the corresponding organizational requirement has been satisfied.

Preparing for a CJIS-Aligned Cloud Implementation

Agencies evaluating Laserfiche Cloud or planning to move criminal justice information to a cloud environment should begin preparation well before implementation.

That means understanding which information will be stored, which CJIS requirements apply, and what the agency must demonstrate to its state CJIS authority.

It also means examining existing information governance practices. Are retention schedules current? Are access policies documented? Does the agency know who is responsible for reviewing audit activity? Are security and incident response procedures established?

These questions are not simply technical implementation details. They reflect organizational decisions that determine how the agency must configure and manage the technology.

Agencies with mature records management and information governance practices may find this process more straightforward. Agencies still developing those practices may need to address policy and procedural gaps before they can consider implementation complete.

In either case, the objective is the same: ensuring that technology, policies, procedures, and responsibilities work together.

The Right Technology Is the Beginning, Not the Finish Line

At Complete Paperless Solutions, we work with municipal agencies to implement Laserfiche environments that support their operational, records management, and information governance requirements.

That work involves more than enabling software features. It requires understanding how an agency manages information, identifying the processes the technology needs to support, and configuring the system to reflect those requirements.

When criminal justice information is involved, agencies must also coordinate with the appropriate authorities and qualified security and compliance professionals to determine whether their implementations meet applicable CJIS requirements.

Laserfiche Enterprise Security can provide important capabilities for protecting sensitive information. Proper implementation helps agencies put those capabilities to work.

But the fundamental principle remains unchanged:

Compliant software doesn't make your organization compliant. What you do with that software matters.