Third-party risk operations // CJISSECPOL v6.1
CJIS Vantage runs prospective partners through an evidence-backed questionnaire mapped to CJIS Security Policy 6.1, the CIS Critical Security Controls v8, and the CJIS vendor and cloud plan requirements — then turns their answers into a defensible risk picture.
171 cyber, privacy and governance controls plus 43 CJISSECPOL v6.1 shared-responsibility attestations across 27 domains, plus the 38-question CJISSECPOL v6.0 Cloud Plan.
Every question carries its CIS Control and CJIS / NIST 800-53 reference so findings map straight to policy sections.
Ownership, headcount, dedicated security FTEs, CISO reporting line, privacy officer, MSSP reliance and policy inventory.
SOC 2 Type II, ISO 27001, FedRAMP, StateRAMP / GovRAMP, CMMC, HITRUST and PCI with scope and expiry tracking.
Invite a vendor contact by email; they create an account and see only their own assessment. Submissions lock on send-back.
Priority-weighted scoring (High 3 / Medium 2 / Low 1) rolls into domain grades, radar posture and a Low–Critical rating.