What the justice lane involves
- Obligations matrix first — every information type in your contract mapped to its imposing instrument, requirement set, and verification mechanism, before any tooling decisions.
- CUI program — NIST SP 800-171 implementation for the CUI your contract designates, including law-enforcement-sensitive categories with tighter dissemination rules.
- Privacy and records handling — access, minimization, and retention controls for privacy-protected and litigation-sensitive material, enforced in configuration.
- Incident response — detection, response, and the contract-specific reporting obligations justice-sector work carries, engineered into the Defender/monitoring stack rather than left as a binder procedure.
- CJIS, where applicable — where systems touch criminal-justice information, the CJIS Security Policy implemented as the distinct regime it is: its requirements, its agreements, its audit expectations — coordinated with, never conflated with, the CUI program.
A line we hold: we do not present CJIS as a flavor of 800-171, and we do not present 800-171 as covering CJIS. Contractors who blur that distinction build programs that satisfy neither auditor. The two regimes share engineering DNA — access control, auditing, encryption — which is exactly why one disciplined implementation can serve both when the mapping is honest.
Questions contractors ask us
Is CJIS just 'NIST 800-171 for the FBI'?
No — and treating it that way is how contractors fail audits. The FBI's CJIS Security Policy is a distinct security regime governing criminal-justice information, with its own requirements, audit process, and agreements. It has been modernizing toward NIST-aligned controls, but if your work touches CJI, you comply with CJIS as CJIS — alongside, not instead of, any CUI obligations your contract carries.
What information types show up in DOJ/FBI contract work?
Frequently several at once: CUI categories (including law-enforcement-sensitive information), privacy-protected records, grand-jury or litigation material with court-driven rules, and — where systems touch criminal-justice information — CJI under CJIS. Each type carries its own handling and access requirements; the program has to keep them straight by design.
How do we know what actually applies to our contract?
By reading it — the clauses, the security addenda, and any incorporated policies or agreements. DOJ components differ, and requirements are contract-specific. Our first deliverable in this lane is always an obligations matrix: information type → imposing instrument → requirement set → verification mechanism.
Get the obligations matrix before the audit does.
Tell us the component, the contract type, and the information you touch — a practitioner will map the regimes that actually apply. Or email rj@indirectit.com directly.