CJIS mandates multi-factor authentication for county systems amid new cyber security measures

During the Rockwall County Commissioners Court Workshop Meeting on June 16, 2025, significant discussions centered around enhancing cybersecurity measures and compliance with new regulations affecting the county's access to criminal justice information.

One of the key topics was the need for regular penetration testing, or "pen tests," to identify vulnerabilities in the county's network. The county previously conducted a pen test in 2024 but expressed dissatisfaction with the thoroughness of the results. A proposal for a new pen test in 2026 from a different vendor was discussed, with the intention of establishing a routine testing schedule every other year to bolster security.

Another major focus was the implementation of multifactor authentication (MFA) in response to updated Criminal Justice Information Services (CJIS) requirements. The county is now required to adopt MFA annually, rather than every three years, due to its classification alongside urban areas like Dallas. Currently, MFA is only in place for remote access and certain applications, but the county needs to expand this to all system logins, particularly for Windows.

Two potential systems for MFA were evaluated: Imprivata and Cisco Duo. Imprivata offers a comprehensive solution with features like badge login and fast user switching, which could be particularly beneficial for shared computers in the Sheriff's office. However, it comes with a higher upfront cost. Cisco Duo, while more basic, is cloud-hosted and integrates with existing login processes, making it a more cost-effective option. The annual costs for implementing these systems for the entire county were estimated at approximately $42,000 for Imprivata and $24,000 for Cisco Duo.

The discussion highlighted the urgency of adopting these security measures, as the county must comply with CJIS regulations and protect sensitive information from potential cyber threats. The commissioners acknowledged the importance of these upgrades, particularly for departments that handle sensitive data, such as the Sheriff's office and the District Attorney's office.

As the county moves forward, the decisions made in this meeting will play a crucial role in enhancing cybersecurity and ensuring compliance with state regulations, ultimately safeguarding the community's information and resources.