Azure Government or Azure Commercial for CJIS 6.0: Choosing Your Compliance Path
Since 2014, United States criminal justice agencies have trusted Microsoft Azure Government to manage Criminal Justice Information (CJI). Built exclusively for regulated government data, it provides datacenters with physical, network, and logical isolation and is operated by CJIS-screened U.S. persons—the "gold standard" for compliance. However, we understand that flexibility is critical for modern agencies. As first announced with the release of CJIS Security Policy (CJISSECPOL) v5.9.1, agencies have the option to utilize Azure Commercial for CJIS workloads by leveraging advanced technical controls in place of traditional personnel screening. With the release of CJIS Security Policy 6.0, this hybrid landscape has evolved. The new policy moves beyond simple access control toward a "Zero Trust" framework which minimizes implicit trust, verifies all requests, and requires continuous monitoring. What’s New in CJIS 6.0? The 6.0 update (released late 2024) is a modernization overhaul. Key changes include: Phishing-Resistant MFA: Strict requirements for FIDO2 or certificate-based authentication for all privileged access. Continuous Monitoring: A shift from point-in-time audits to real-time threat detection and automated logging. Supply Chain Risk Management: Enhanced vetting of third-party software and vendors. The Choice: Azure Government or Azure Commercial: Criminal Justice Agencies can still choose between our two distinct offerings, but the "How" of compliance differs: Azure Government: The path of personnel screening. Microsoft executes CJIS Management Agreements with state CJIS Systems Agencies that include their screening of Microsoft personnel. This offers the broadest feature set with the simplest compliance burden. Azure Commercial: The path of technical controls. Because Azure Commercial support staff are not CJIS-screened, compliance relies on an agency implementing Customer Managed Keys (CMK) encryption. This way, Microsoft cannot access unencrypted criminal justice information, effectively removing Microsoft staff from the scope of trust. Our Commitment Whether you choose the physically secure location of Azure Government or the global scale of Azure Commercial, Microsoft provides the tools—Entra ID, Azure Key Vault, and Microsoft Sentinel—to meet the rigorous demands of CJIS 6.0. Step-by-Step Walkthrough for CJIS 6.0 in Azure Commercial Managing CJI in Azure Commercial requires you to bridge the gap between "standard commercial security" and "CJIS compliance" using your own configurations. Because Microsoft Commercial staff are not CJIS-screened, you must ensure they can never see unencrypted data. Phase 1: Foundation & Residency Step 1: Restrict Data Residency CJIS 6.0 mandates that CJI must not leave the United States. Action: Deploy all Azure resources (compute, storage, disks, networking, monitoring, logging, backups, etc.) exclusively in US regions (e.g., East US, West US, Central US). Policy: Use Azure Policy to deny the creation of resources in non-US regions to prevent accidental drift. o Documentation: Tutorial: Manage tag governance with Azure Policy (See the concept of "Allowed Locations" built-in policy). o Documentation: Azure Policy built-in definitions and assignment (Allowed locations) o Documentation: Details of the "Allowed locations" policy definition. Phase 2: The "Technical Control" (Encryption) This is the most critical step for Azure Commercial. Step 2: Implement Customer Managed Keys (CMK) To meet CJIS requirements in Azure Commercial, which is operated by Microsoft personnel who aren’t CJIS-screened, you must use encryption where you hold the keys, and Microsoft has no access. Action: Provision Azure Key Vault (Premium) or Managed HSM for FIPS 140-2 Level 2/3 compliance. o Documentation: About Azure Key Vault Premium and HSMs. o Documentation: Secure your Azure Managed HSM deployment. Action: Generate your encryption keys within your HSM or import them from on-premises. o Documentation: How to generate and transfer HSM-protected keys (BYOK). Action: Configure Disk Encryption Sets and Storage Account Encryption to use these keys. Do not use the default "Microsoft Managed Key" setting. o Documentation: Server-side encryption of Azure Disk Storage (CMK). o Documentation: Configure customer-managed keys for Azure Storage. o Documentation: Services that support customer-managed keys (CMKs) Step 3: Client-Side Encryption (For SaaS/PaaS) For data processing, encryption should happen before data reaches Azure. Action: Ensure applications encrypt CJI at the application layer before writing to databases (SQL Azure, Cosmos DB). This ensures that even a database admin with platform access sees only ciphertext. Step 3b (optional): Protecting CJI While In Use (Confidential Compute) CJIS Security Policy 6.0 requires that Criminal Justice Information be protected while at rest, in transit, and in use. In Azure Commercial, once CJI is decrypted for processing by an application, traditional encryption controls (including CMK) no longer protect the data from platform-level access risks such as memory inspection, diagnostics, or hypervisor operations. To address this risk, agencies may implement Azure Confidential Computing, which uses hardware-backed Trusted Execution Environments (TEEs) to cryptographically isolate data in memory and prevent access by cloud provider personnel—even at the infrastructure layer. o Documentation: Always Encrypted for Azure SQL Database. o Documentation: Client-side encryption for Azure Cosmos DB. o Documentation: Confidential Computing o Documentation: Confidential Compute Offerings Phase 3: Identity & Access (CJIS 6.0 Focus) Step 4: Phishing-Resistant MFA CJIS 6.0 raises the bar for Multi-Factor Authentication (MFA). SMS and simple push notifications may no longer suffice for privileged roles. Action: Deploy Microsoft Entra ID (formerly Azure AD). o Documentation: What is Microsoft Entra ID?. Action: Enforce FIDO2 security keys (like YubiKeys) or Certificate-Based Authentication (CBA) for all users accessing CJI. o Documentation: Enable passkeys (FIDO2) for your organization. o Documentation: How to configure Certificate-Based Authentication in Entra ID. Phase 4: Continuous Monitoring Step 5: Unified Audit Logging You must retain audit logs for at least one year (or longer depending on state rules) and review them weekly. Action: Enable Diagnostic Settings on all CJIS resources to stream logs to an Azure Log Analytics Workspace. o Documentation: Create diagnostic settings in Azure Monitor. Action: Deploy Microsoft Sentinel on top of Log Analytics. o Documentation: Quickstart: Onboard Microsoft Sentinel. Action: Configure Sentinel analytic rules to detect anomalies (e.g., "Mass download of CJI," "Access from foreign IP"). o Documentation: Detect threats out-of-the-box with Sentinel analytics rules. Phase 5: Endpoint & Mobile Step 6: Mobile Device Management (MDM) If CJI is accessed on mobile devices (MDTs, tablets), CJIS 6.0 requires remote wipe and encryption capability. Action: Enroll devices in Microsoft Intune. o Documentation: Enroll Windows devices in Intune. o Documentation: Enroll iOS/iPadOS devices in Intune. Action: Create a Compliance Policy requiring BitLocker/FileVault encryption and complex PINs. o Documentation: Create a compliance policy in Microsoft Intune. o Documentation: Manage BitLocker policy for Windows devices with Intune. Action: Configure "App Protection Policies" to ensure CJI cannot be copied/pasted into unmanaged apps (like personal email). o Documentation: App protection policies overview. Phase 6: Personnel & Documentation Step 7: Update your SEIP/SSP Since you are using Azure Commercial, your System Security Plan (SSP) must explicitly state that you are using encryption as the compensating control for the lack of vendor personnel screening. Action: Document the CMK architecture in your CJIS audit packet. Action: Ensure your agency's "CJI Administrators" (who manage the Azure keys) have met the policy’s personnel screening requirements o Documentation: Microsoft CJIS Audit Scope & Personnel Screening (Reference).A CISO's Guide to Securing AI - Securing AI for Federal, DIB, and DoW Entities
Artificial Intelligence (AI) is rapidly reshaping federal missions, defense operations, and critical infrastructure. From intelligence analysis to logistics and cyber defense, AI’s transformative power is undeniable. Yet, with great power comes great responsibility and risk.History of Microsoft Cloud Offerings leading to the US Sovereign Cloud - July 2025 Update
Microsoft has evolved our cloud service offerings to include the US Sovereign Cloud with Azure Government, Microsoft 365 Government (GCC High) and DoD. This article puts the history in perspective of how we ended up with multiple clouds, as opposed to one instance with many data enclaves.Understanding Compliance Between Commercial, Government and DoD Offerings - September 2023 Update
Understanding compliance between Commercial, Government and DoD offerings: There remains much confusion as to what service supports what standards best. If you have DFARS, ITAR, FedRAMP, CJIS, IRS and other regulatory requirements and you are trying to understand what service is the best fit for your organization then you should read this article.Microsoft Ignite session: AI for the Public Sector with Microsoft 365 Copilot GCC available Nov 19
In today's rapidly evolving digital landscape, the public sector stands at the forefront of innovation, driven by the transformative power of AI. Microsoft 365 Copilot GCC (Government Community Cloud) is set to revolutionize how public sector organizations operate, offering new capabilities that will enhance human capabilities, streamline workflows, and support compliance with stringent security standards. AI for the Public Sector with Microsoft 365 Copilot GCC - OD803 Our Ignite On Demand session delves into the myriad ways Microsoft 365 Copilot GCC can empower your public sector organizations, from automating routine tasks to providing actionable insights that drive mission-critical decisions. We invite you to watch this session and discover how you can harness the power of AI to elevate your organization's capabilities. Microsoft Ignite | November 18-22, 2024 | ignite.microsoft.com The '101 on Microsoft Ignite 2024' What: Microsoft Ignite to learn more | Full Session scheduler Where: Hybrid | Chicago, IL (sold out) and Global Digital (online; free to register) When: November 18-22, 2024 Primary X handle & official hashtag: #MSIgnite (join in) AND follow @MicrosoftTeams, @SharePoint, @OneDrive, and @Events_MSFT The Ignite presentation highlights several key areas where Microsoft 365 Copilot GCC can make a significant impact for public sector strategists. We explore the role of AI in the public sector, emphasizing how AI can alleviate the burden of digital debt by automating repetitive tasks and optimizing workflows. The session also showcases the features of Microsoft 365 Copilot GCC such as Microsoft 365 Copilot Business Chat and AI-driven insights in applications embedded in apps you use everyday Word, Excel, PowerPoint, Teams and Outlook. Additionally, the presentation underscores the importance of responsible AI practices and data privacy, detailing Microsoft's commitment to security and compliance within the GCC environment. To start building your AI skills today and prepare your organization for the future, we encourage you to explore the following resources: Microsoft 365 Copilot GCC Blog: aka.ms/M365CopilotGCCBlog Microsoft 365 Copilot GCC High/DOD Blog: aka.ms/MS365CopilotGCCHighBlog Microsoft 365 Copilot – Readiness and Adoption Guide for Public Sector Roadmap ID # 415097 - Microsoft 365 Copilot GCC general availability -- the product referenced in this blog. Service description will be updated prior to general availability here Roadmap ID # 464984 - Microsoft Copilot general availability for GCC -- more information will be shared on this product closer to launch. Current information for WW/Ent environment on differences between these two products can be referenced here. Additionally, you can learn more about the roadmap for government AI adoption and specific Copilot scenarios for the US government. By leveraging these resources, you can ensure your organization is well-equipped to navigate the AI-driven future and deliver exceptional public services. The Roadmap for Government AI Adoption US Gov specific Copilot Scenarios content Other Microsoft 365 Copilot resources (environment agnostic): 3 short explainer videos: Microsoft 365 Copilot data security and privacy commitments Microsoft 365 - How Microsoft 365 Delivers Trustworthy AI (2024-01) Data, Privacy, and Security for Microsoft 365 Copilot Secure by default with Microsoft Purview and protect against oversharing Microsoft Purview data security and compliance protections for Microsoft Copilot Apply principles of Zero Trust to Microsoft 365 Copilot Learn about retention for Microsoft 365 Copilot This blog was written with support from Microsoft 365 Copilot, my AI assistant for work.
