ORLANDO — With an October 2027 Criminal Justice Information Services (CJIS) compliance deadline approaching, police agencies face a challenge that extends beyond implementing multifactor authentication: ensuring that every officer, dispatcher and employee who accesses criminal justice information can do so securely without disrupting daily operations.
Recent research from Imprivata and Lexipol illustrates the gap between recognizing the importance of CJIS compliance and achieving it. Although 79% of surveyed public safety professionals consider compliance a top or high cybersecurity priority, only 32% report that their agencies are fully compliant. Just 38% say multifactor authentication (MFA) has been fully implemented across all applicable users and devices.
At IACP 2026, Imprivata highlighted how its Enterprise Access Management (EAM) solution can help agencies address those gaps through passwordless authentication, single sign-on, support for existing applications and stronger visibility into system access.
Nick Stohlman, vice president of CJIS program strategy at Imprivata, said agencies should approach compliance as an ongoing operational responsibility rather than a project undertaken before an audit.
“Compliance isn’t some. It’s all,” Stohlman said, emphasizing that implementing stronger authentication in one division does not address the requirements across an entire department.
Closing authentication gaps across the agency
One of the most common challenges Stohlman encounters is agencies that have implemented MFA for patrol officers but have not extended the same protection to other personnel who access criminal justice information.
An evidence technician working at a shared desktop, a dispatcher managing multiple applications and a patrol officer using a mobile data terminal all have different workflows. Applying consistent authentication controls requires understanding how each group accesses information.
Stohlman recommends that agencies begin by assigning responsibility for CJIS compliance and assembling a team representing different divisions. That team should document existing access procedures, identify gaps and prioritize improvements.
“The teams should ask, ‘What are we doing today, not just for patrol, but for every aspect of our department?’” he said. “Every different division within an agency may have a different workflow.”
Imprivata EAM is designed to support those different environments by providing multifactor authentication and passwordless access across workstations, mobile devices and applications.
Rather than requiring every employee to follow an identical login process, agencies can implement authentication methods suited to their operational needs while maintaining centralized controls.
Faster access for officers and dispatchers
For personnel who repeatedly access critical systems throughout a shift, authentication can become an operational obstacle.
A dispatcher, for example, may need to sign into computer-aided dispatch, mapping, records management and other applications. Each system may require separate credentials, creating repeated interruptions and opportunities for forgotten passwords.
Imprivata EAM addresses that challenge through single sign-on, allowing users to authenticate and then access multiple authorized applications without repeatedly entering credentials.
Stohlman described a patrol officer beginning a shift by tapping an assigned access card against a reader connected to the officer’s laptop. The officer then enters a PIN as an additional authentication factor.
The system verifies the officer’s identity and provides access to the applications associated with that user’s permissions.
For shared workstations, badge-based authentication also allows personnel to switch users while maintaining individual accountability.
The objective is to make secure access faster without requiring officers or dispatchers to manage numerous application passwords.
Stohlman said delays can become particularly problematic when officers need information during an active call or when a forgotten password triggers an account lockout.
If the problem occurs overnight, resolving it may require contacting an IT employee who is not on duty.
“Sometimes when you have speed, you give up security,” Stohlman said. “Imprivata’s job is to make sure you don’t.”
Reducing password workarounds
Repeated login requirements can also encourage behaviors that undermine security.
Stohlman said he has encountered police departments where passwords were written on whiteboards or shared among employees to simplify access.
Those practices can make it difficult to establish which individual accessed a system and create opportunities for unauthorized use.
EAM reduces reliance on manually entered passwords by managing application credentials and supporting single sign-on.
In Stohlman’s patrol example, the officer authenticates with an assigned card and PIN rather than entering individual passwords for every application. Credential management can occur behind the scenes, reducing the need for officers to remember or handle those passwords.
The system also supports self-service capabilities that can reduce password-related help desk requests and the operational disruption associated with account lockouts.
For agencies evaluating authentication technology, the practical consideration is whether stronger security can be implemented without encouraging employees to find ways around it.
Supporting legacy systems without replacing them
Aging infrastructure presents another obstacle. Among survey respondents whose agencies were not fully compliant, 47% identified legacy systems and aging technology as barriers.
Many departments operate a mixture of newer cloud-based applications and older systems that remain necessary for accessing historical records or supporting daily operations.
Replacing those systems can require significant funding, lengthy implementation projects and complicated data migrations.
Stohlman described agencies that continue maintaining older CAD or records management platforms because historical information could not easily be transferred to replacement systems.
Imprivata EAM is designed to provide single sign-on across both modern and legacy applications, including systems that were not originally built to support contemporary authentication methods.
The software can manage the different login procedures required by those applications and supply the appropriate credentials after a user authenticates.
That approach allows agencies to strengthen access controls without making wholesale replacement of existing technology a prerequisite.
For departments facing limited IT budgets and competing modernization priorities, the ability to improve authentication across current systems can provide a more practical path toward compliance.
Building accountability beyond the next audit
Although the October 2027 deadline is driving attention to CJIS requirements, Stohlman cautioned against treating compliance as a one-time achievement.
“The key focus shouldn’t be, ‘I’m going to pass our audit or get ready to pass an audit,’“ he said. “Passing your audit should be an everyday practice.”
That means agencies need to consider not only whether users can authenticate securely, but also how access is managed, documented and reviewed over time.
Identity-based access controls and auditing capabilities can help departments establish which users accessed particular systems and when, supporting individual accountability and audit preparation.
Stohlman also discussed Imprivata’s developing CJIS Intelligence offering, which is intended to extend visibility beyond initial authentication by identifying potentially inappropriate activity by authorized users.
For example, an agency could investigate patterns suggesting that an employee is repeatedly accessing information unrelated to assigned duties.
The distinction is important: ensuring that someone has permission to enter a system does not necessarily establish that every action taken within that system is appropriate.
Stohlman said agencies should consider access management as part of a broader security strategy that evolves alongside new technologies, including cloud applications and artificial intelligence.
He recommends establishing clear ownership of compliance, assessing the needs of each division, addressing gaps in priority order and regularly reinforcing secure practices through training.
For agencies preparing for October 2027, the objective is not simply to meet the next deadline. It is to establish authentication and access practices that remain effective as personnel, technology and security requirements change.
As Stohlman put it, “There’s a starting point, but in compliance, there’s never an ending point.”
Learn more: Imprivata Enterprise Access Management
