State and local agencies that handle criminal justice information operate under the FBI CJIS Security Policy, and that policy does not pause for a relocation. Records systems, dispatch infrastructure, and anything else that stores or processes CJI carry the same obligations in a hallway, on a loading dock, and inside a trailer as they do in the server room.
What changes during a move is the number of people involved. Crews, drivers, electricians, and colocation staff who have never been part of the agency's security program suddenly have hands on equipment that holds regulated data. Most of the planning for a CJIS move is about deciding, in advance, which of those people may touch what, and proving afterward that the rules were followed.
Who Sets the CJIS Requirements for a Move?
The FBI's CJIS Security Policy sets the national baseline. Each state has a CJIS Systems Agency responsible for administering it, and that agency may add requirements on top of the federal policy. Within the agency, the Local Agency Security Officer is typically the day-to-day point of contact for security questions.
Involve both early. State requirements for contractor vetting, in particular, vary, and some states expect vendors to be fingerprinted and approved through their own process regardless of any clearance obtained elsewhere. A moving vendor who has worked CJIS jobs in one state has not necessarily met the requirements in yours.
The policy also changes. The FBI has been reorganizing it in recent years to align more closely with the NIST SP 800-53 control structure, and section numbering has shifted between versions. Work from the current version your CSA recognizes rather than a checklist someone built against an older one.
Who Can Handle CJI-Bearing Equipment During a Move?
Only people who have passed the agency's screening, or who work under escort. Anyone with unescorted access to unencrypted CJI, or to the physically secure locations where it is processed, must pass a fingerprint-based criminal history record check before access is granted. Private contractors in that position also sign the CJIS Security Addendum and complete security awareness training appropriate to their role.
For a move, that leaves two options for every person on the crew. Either they complete the screening and training and are approved through the agency before the move begins, or they work under escort by authorized agency personnel at all times.
Escort is workable for small moves and short windows. It scales poorly. An escort has to be present for every minute a non-screened person is near CJI-bearing equipment, including breaks, loading, and any delay at the dock. On a move with multiple crews working in parallel, the agency can run out of available escorts long before it runs out of equipment.
Fingerprinting takes time to process. Build it into the schedule weeks ahead, and confirm approvals in writing before the crew roster is final. Crew vetting and site access is usually the longest lead-time item on a CJIS move, and it is the one most often discovered late.
How Must CJI Media Be Protected in Transit?
The policy requires agencies to protect and control digital and physical media containing CJI during transport outside controlled areas, and to restrict that transport to authorized personnel. In practice, that means equipment carrying unencrypted CJI travels with screened or escorted people and stays under continuous control until it reaches another controlled area.
Encryption changes the picture significantly. CJI encrypted with FIPS-validated cryptography (modules listed by NIST's Cryptographic Module Validation Program) that meets the policy's requirements is treated differently from unencrypted data, and for data in transit or at rest outside a physically secure location, encryption is often the control that makes the rest achievable. Confirm with your CSA how encryption affects handling requirements for your specific equipment, and confirm the encryption is actually enabled on every drive, not assumed. Encryption and custody practices for drives in transit work best when both are verified before loading.
Where data is not encrypted, the physical controls carry the weight. Dedicated vehicles, sealed containers with recorded seal numbers, no unattended stops, and a documented handoff at every transfer. An agency move is a reasonable case for a secure transit escort staffed by personnel who have already cleared the agency's screening.
Physical Security at Both Ends
The origin and destination both have to qualify as physically secure locations for as long as CJI is present. The policy expects defined perimeters, controlled access, visitor control, and access authorizations maintained for the people permitted inside.
Moves strain every one of those. Loading doors stay open for hours. Temporary staff need badges. The destination may be a colocation cage that is secure for the provider's purposes but has not yet been assessed against your agency's requirements.
Get the destination reviewed and approved before any equipment arrives. Establish the visitor and escort log for both sites and keep it running for the full duration of the data center move, including the unglamorous hours of staging and cleanup. Where equipment is staged overnight, it stays inside a secure area, not in a trailer in the lot.
Sanitize What Doesn't Come Back
Relocations often retire equipment. Media that stored CJI and is not being reinstalled has to be sanitized or destroyed before it leaves agency control, and the policy expects that work to be carried out or witnessed by authorized personnel. Software sanitization to NIST SP 800-88 is performed by a licensed contractor or your IT team.
Keep records for every retired device: serial numbers, the method used, the date, and who performed and witnessed it. That record is what an audit will ask for, and the state's periodic compliance audits do ask.
What Documentation Will a CJIS Auditor Want?
CJIS audits are document-driven. Plan the move so it produces the records as it runs.
Keep the approved personnel roster with screening dates, the signed Security Addenda, escort logs, visitor logs for both sites, custody forms for every container, seal records, encryption confirmation for transported media, and sanitization records for retired devices. Tie them together with a short move summary that lists what moved, when, and under whose control.
Share the draft plan with your LASO before the move is scheduled, not after. Questions raised at the planning stage cost a meeting. The same questions raised during an audit cost a finding.