22 Texas municipalities were hit in a coordinated ransomware wave in Q4 2025. FBI CJIS v6.0 auditing went live October 2025 — full compliance deadline October 1, 2027. CoreRecon delivers SOC-grade monitoring, 30-minute response SLA, and CJIS-mapped controls at $89–$129/endpoint. No enterprise contracts. No minimums.
Local governments are the most-attacked sector in Texas — 38% of all 2025 ransomware incidents. Limited IT staff, underfunded security budgets, and CJIS-linked systems make municipalities the highest-value, lowest-resistance targets in the state.
FBI CJIS v6.0 auditing is live. Every Texas municipality with NCIC or criminal justice system access is in scope. Here's exactly how CoreRecon maps to each policy area — and which tier covers it.
| # | CJIS Policy Area | Auditors Look For | Common Gaps | CoreRecon Coverage |
|---|---|---|---|---|
| 1 | Information Exchange | Encrypted CJI transmission, written MOUs, authorization protocols | Unencrypted email for CJI data, missing vendor MOUs | Sentinel Encrypted handling, MOU automation, access controls |
| 2 | Security Awareness Training | Annual training completion, records on file, contractor coverage | No documentation, incomplete refreshers, contractor gaps | Sentinel Annual programs, documentation, automated reminders |
| 3 | Incident Response | Documented IR plan, 24/7 capability, TX DPS reporting | No formal IR plan, undocumented response times, no DPS reporting | Command 24/7 SOC, 30-min SLA, TX DPS coordination |
| 4 | Auditing & Accountability | 90-day log retention, user-level accountability, monthly review | Insufficient retention, no user audit trails, logs not reviewed | Sentinel Automated retention, activity tracking, monthly reports |
| 5 | Access Control | RBAC, least-privilege, background checks before CJIS access | Overly broad permissions, no formal roles, background check gaps | Sentinel RBAC, least-privilege enforcement, background tracking |
| 6 | Identification & Authentication | Unique user IDs, MFA for remote access, password standards | Shared accounts, no MFA for remote CJIS, weak passwords | Sentinel Unique ID enforcement, MFA deployment, password policy |
| 7 | Configuration Management | Baseline configs, change management process, approval workflow | No baseline docs, ad-hoc changes, no CMDB | Fortress CMDB, change approval workflow, baseline documentation |
| 8 | Media Protection | Encrypted media, physical destruction certs, media logs | Unencrypted USBs, no destruction certs, media not tracked | Sentinel Media encryption, chain-of-custody, certified destruction |
| 9 | Physical Protection | Controlled access, visitor logs, CJI isolated in locked areas | No badge controls, incomplete visitor logs, open workstations | Sentinel Physical assessment, badge access, workstation standards |
| 10 | Systems & Communications | Firewall configs, intrusion detection, VPN for remote CJI | No IDS/IPS, undocumented firewall rules, remote access without VPN | Fortress Firewall mgmt, IDS/IPS, VPN enforcement, perimeter security |
| 11 | Formal Audits | Annual self-assessments, corrective action plans, evidence packages | No self-assessment, findings not tracked, no audit-ready docs | Command Annual CJIS audits, corrective action planning, evidence packages |
| 12 | Personnel Security | Reinvestigation every 5 years, termination checklists, 24-hr revocation | No reinvestigation schedule, access not revoked on exit | Sentinel Reinvestigation tracking, termination checklists, auto-revocation |
| 13 | Mobile Devices | MDM with encryption, remote wipe, mobile device policy, GPS | No MDM, personal devices on CJI, no remote wipe | Fortress MDM, encryption, remote wipe, GPS tracking |
Enterprise MSSPs weren't designed for city halls with 3-person IT teams and tight budgets. We were. Every plan covers CJIS requirements. Every engagement starts with your assessment — not a six-month sales cycle.
13 questions across all CJIS policy areas. Find your gaps before FBI auditors do. Oct 2027 deadline is closer than it looks.
Enterprise MSSPs can cover municipalities — but they're not built for it. Here's how we compare on the three things that matter most for city government.
| Dimension | CoreRecon | Cybriant | Trustwave |
|---|---|---|---|
| CJIS v6.0 Mapped Coverage | All 13 policy areas, documented per tier. Audit-ready evidence packages at Command tier. | General SIEM coverage; CJIS mapping not published. Customer must map independently. | Compliance modules available at enterprise pricing; CJIS specifics not disclosed. |
| Pricing for Small Cities | $89–$129/endpoint. No minimums. Month-to-month. Published publicly. | Quoted per engagement. No published pricing for sub-500 endpoint environments. | Enterprise contracts starting at 6-figure annual commitment. Not designed for <500 endpoints. |
| Texas-Specific SOC & SLA | 30-minute SLA. Texas threat intel built-in. TX DIR & TX DPS CJIS protocol-aware team. | National SOC. 4-hour response target for Tier 1 events. No TX-specific protocols published. | Global SOC centers. Response SLAs vary by tier. No Texas-specific expertise documented. |
Most municipal breaches aren't discovered until ransomware detonates. The average dwell time in Texas government networks is 7 days — meaning attackers had full access before anyone knew. Our free assessment maps your exposure, benchmarks against CJIS v6.0, and hands you a prioritized remediation plan. No credit card. No commitment.
Request your free assessment →Delivered within 14 days • No credit card • SDVOSB-certified team
See a sample report — redacted 12-page PDF, real findings.
Need a SOW for your city manager or council? Build your Scope of Work PDF →
CJIS Appendix G requires vendor outsourcing controls. Score your vendor risk against CJIS App G requirements →
CyberArmyofRussia compromised water HMI systems in four Texas Panhandle towns. Many Texas water districts sit under municipal IT. AWIA Section 2013 requires a cyber-inclusive Risk & Resilience Assessment. CoreRecon covers both stacks.