CJIS security becomes considerably more difficult when every system shares the same unrestricted network.

Trestle designs and manages network segmentation intended to separate systems according to security, operational and access requirements.

Segmentation may include dedicated networks for:

• CJIS systems

• Police workstations

• Servers and infrastructure

• Administrative systems

• Municipal users

• Wireless clients

• Guest wireless

• Cameras and physical-security devices

• Printers and other peripherals

• Voice systems

• Building-management and IoT devices

• Vendor-managed systems

• Network management

• Backup infrastructure

Firewalls, VLANs, routing policies and access-control mechanisms can then regulate communication between those environments.

This reduces unnecessary pathways into sensitive systems and helps limit the impact of a compromised endpoint.

The goal is straightforward:

Only authorized systems should be able to communicate with protected resources, using only the access they require.

CJIS alignment

SC-7 Boundary Protection • AC-3 Access Enforcement • AC-4 Information Flow Enforcement • AC-6 Least Privilege

Remote access creates a pathway from outside the agency directly into trusted infrastructure.

That pathway requires deliberate security controls.

Trestle manages supported remote-access and site-to-site VPN environments with attention to:

• Authorized remote-access methods

• Encryption

• Authentication

• Multi-factor authentication integration

• User and administrative access

• VPN address assignment

• Network access restrictions

• Session visibility

• Security logging

• Vendor access

• Site-to-site connectivity

• Configuration maintenance

• Software and firmware lifecycle

Remote connectivity can also be segmented so that users and third parties receive access only to the resources required for their role.

CJIS alignment

AC-17 Remote Access • IA-2 Identification & Authentication • SC-8 Transmission Confidentiality and Integrity • SC-13 Cryptographic Protection • SC-7 Boundary Protection

Switches form the internal transport layer connecting agency workstations, servers, wireless systems, cameras, phones and other infrastructure.

Trestle manages supported switching environments throughout their lifecycle, including:

• VLAN configuration

• Trunk and access-port management

• Network segmentation

• Inter-switch connectivity

• Redundant switching

• Link aggregation

• Spanning-tree configuration

• Port-security controls

• DHCP-related protections where supported

• Management-interface security

• SNMP and monitoring configuration

• Firmware maintenance

• Configuration backup

• Performance monitoring

• Hardware lifecycle planning

• Troubleshooting

This provides both operational reliability and the underlying enforcement mechanisms required for a segmented security architecture.

CJIS alignment

SC-7 • AC-4 • CM-2 • CM-3 • CM-6 • CM-8 • SI-4

Wireless networks extend the agency's security boundary beyond physical network cabling.

Trestle manages supported wireless infrastructure with separate consideration for agency, municipal, device and guest access.

Services can include:

• Wireless network and SSID configuration

• Secure authentication

• Encryption configuration

• VLAN and security-zone assignment

• Guest-network isolation

• Access-point management

• Controller and cloud-management configuration

• Firmware lifecycle

• Administrative-access controls

• RF and performance troubleshooting

• Security-event monitoring

• Configuration backup and documentation

Wireless access can be segmented according to function so that connecting to an SSID does not automatically provide unrestricted access to internal systems.

CJIS alignment

AC-18 Wireless Access • AC-4 Information Flow Enforcement • SC-7 Boundary Protection • IA-2 Identification & Authentication • CM-6 Configuration Settings

Network infrastructure itself is a privileged environment.

Compromise of a firewall, core switch, VPN gateway or wireless-management platform can provide an attacker with extraordinary visibility and control.

CJIS alignment

AC-2 Account Management • AC-6 Least Privilege • IA-2 Identification & Authentication • AU-2 Event Logging • AU-6 Audit Review • CM-3 Configuration Change Control

Trestle works to restrict and protect network-device administration using appropriate controls such as:

• Named administrative accounts

• Least-privilege access

• Restricted management networks

• Secure management protocols

• MFA where supported

• Removal or restriction of unnecessary services

• Administrative session logging

• Failed-login monitoring

• Configuration-change monitoring

• Controlled remote administration

• Credential-management practices

Administrative activity can then feed Trestle's monitoring and logging services to provide historical evidence of access and changes.

A secure network isn't defined only by its original design.

Its security posture changes every time someone modifies:

• A firewall rule

• A VLAN

• A VPN

• An administrative account

• A routing policy

• A wireless network

• An access-control list

• A security service

• A management setting

Trestle maintains supported infrastructure through a controlled configuration-management process.

Services can include:

• Standardized device configuration

• Baseline configuration

• Change documentation

• Configuration review

• Automated or scheduled configuration backup

• Historical configuration retention

• Change detection

• Post-change validation

• Configuration restoration

• Documentation updates

This helps agencies demonstrate not merely what the network looks like today, but that important changes are actively managed.

CJIS alignment

CM-2 Baseline Configuration • CM-3 Configuration Change Control • CM-5 Access Restrictions for Change • CM-6 Configuration Settings

Network devices are software platforms and must be maintained accordingly.

Firewalls, switches, wireless controllers and access points can contain vulnerabilities that affect the security of the entire environment.

Trestle tracks supported infrastructure for:

• Current firmware/software versions

• Vendor security advisories

• Critical vulnerabilities

• Recommended releases

• End-of-support status

• End-of-life hardware

• Required upgrades

• Security fixes

• Compatibility concerns

Updates are evaluated against operational requirements and performed through coordinated maintenance rather than unmanaged or reactive upgrades.

When infrastructure reaches the end of vendor support, Trestle can help agencies plan replacement before unsupported equipment becomes an operational or compliance problem.

CJIS alignment

SI-2 Flaw Remediation • RA-5 Vulnerability Monitoring and Scanning • CM-6 Configuration Settings • CM-8 System Component Inventory

You Cannot Secure What You Don't Know Exists.

Trestle maintains visibility into supported network infrastructure and its role within the agency environment.

Inventory information can include:

• Device name

• Manufacturer and model

• Serial number

• Management IP address

• Physical location

• Device function

• Software or firmware version

• Security zone

• Support status

• Monitoring status

• Logging status

• Configuration-backup status

Operational inventory can be reconciled against monitoring, vulnerability assessment and existing municipal records to identify discrepancies.

This can reveal:

• Unknown devices

• Unsupported equipment

• Missing monitoring

• Missing logging

• Inconsistent firmware

• Infrastructure absent from formal inventories

• Equipment that should have been retired

CJIS alignment

CM-8 System Component Inventory • CA-7 Continuous Monitoring • RA-5 Vulnerability Monitoring

Managed infrastructure should not depend upon someone noticing that something stopped working.

Trestle integrates supported devices with inSight Monitoring to provide continuous visibility into network health, performance and security conditions.

Monitoring can include:

• Device availability

• Interface status

• Bandwidth utilization

• CPU and memory

• VPN status

• High-availability status

• Environmental conditions

• Power supplies and hardware components

• Packet loss and latency

• Authentication failures

• Administrative logins

• Security events

• Configuration changes

• IPS activity

• Service failures

The result is a network that is not simply configured and left in place.

Its operational state is continuously observed.

CJIS alignment

SI-4 System Monitoring • CA-7 Continuous Monitoring • AU-6 Audit Record Review and Analysis

Firewalls, switches, VPN gateways and wireless systems produce important evidence about activity occurring throughout the network.

Managed Network can integrate directly with inSight Logging to centralize and retain supported network audit records.

Relevant events can include:

• Administrative logins

• Failed authentication

• VPN connections

• Firewall activity

• Configuration changes

• IPS/IDS events

• Access-control activity

• System events

• Security-policy changes

Centralized retention protects historical evidence from being dependent solely on limited local device storage.

CJIS alignment

AU-2 Event Logging • AU-3 Content of Audit Records • AU-6 Audit Review • AU-9 Protection of Audit Information • AU-11 Audit Record Retention

A network-device failure should not require rebuilding critical security infrastructure from memory.

Trestle maintains recurring configuration backups for supported infrastructure where technically practical.

Backup capabilities can include:

• Scheduled configuration collection

• Historical configuration versions

• Secure centralized storage

• Change comparison

• Rapid configuration retrieval

• Restoration assistance

• Replacement-device recovery

Configuration history also provides useful evidence when investigating unexpected or unauthorized changes.

CJIS alignment

CM-2 Baseline Configuration • CM-3 Configuration Change Control • CP-related contingency and recovery requirements

Managed infrastructure is included in the agency's broader security lifecycle.

inSight Vulnerability Management can assess supported network infrastructure for conditions such as:

• Vulnerable firmware

• Exposed management services

• Weak protocols

• Outdated encryption

• Known security vulnerabilities

• Unexpected open services

• Unsupported software

• Internet exposure

Findings can then be prioritized, remediated and rescanned.

This creates a closed loop:

DISCOVER → ASSESS → REMEDIATE → VERIFY

rather than allowing a vulnerability scanner to produce findings that remain unresolved.

An Auditable Network Should Also Be an Understandable Network.

Trestle maintains documentation appropriate to the managed environment, which can include:

• Logical network diagrams

• Network addressing

• VLANs and security zones

• Device inventories

• Firewall and VPN relationships

• WAN connectivity

• Wireless infrastructure

• Management networks

• Monitoring coverage

• Logging coverage

• Configuration-backup status

• Software and firmware information

Documentation supports day-to-day administration, incident response, troubleshooting, lifecycle planning and CJIS assessment activities.

When a network or security event occurs, municipal agencies need more than an automated alert.

Trestle provides hands-on engineering support for supported network infrastructure.

Response can include:

• Connectivity failures

• Firewall and VPN incidents

• Security events

• Hardware failures

• Configuration problems

• ISP and WAN outages

• Wireless issues

• Suspected unauthorized access

• Vulnerability remediation

• Failed upgrades

• Network performance degradation

Trestle engineers can use monitoring telemetry, centralized logs, configuration history and network documentation together to diagnose and remediate incidents.

The same team responsible for understanding the environment is available when that environment requires action.

CJIS Control Coverage

I'd make this another prominent visual table, consistent with the new pages:

CJIS 6.1 AreaExample ControlManaged Network CapabilityBoundary ProtectionSC-7Firewalls, security zones, segmentation and access controlInformation FlowAC-4VLANs, firewall policy and network access restrictionsRemote AccessAC-17Secure VPN and remote-access managementWireless AccessAC-18Managed wireless security and segmentationLeast PrivilegeAC-6Restricted network administrative accessIdentification & AuthenticationIA-2Administrative authentication and MFA integrationBaseline ConfigurationCM-2Standardized network-device configurationsConfiguration Change ControlCM-3Managed and documented network changesConfiguration SettingsCM-6Secure device configurationSystem InventoryCM-8Network infrastructure inventoryFlaw RemediationSI-2Firmware and security-update lifecycleVulnerability MonitoringRA-5Integration with inSight Vulnerability ManagementSystem MonitoringSI-4Continuous network/security monitoringEvent LoggingAU-2Network security and administrative event collectionContinuous MonitoringCA-7Ongoing infrastructure oversight

I'd keep the wording "supports" / "CJIS alignment", rather than implying that management of a firewall automatically satisfies an entire control. The precise applicability depends on the agency environment and implementation.

One Network. Multiple Security Controls.

This is where I'd tie the portfolio together visually.

Managed Network

Operate and secure the infrastructure.

Firewalls • Switching • Wireless • VPN • Segmentation • Configuration • Firmware

inSight Monitoring

Know whether it is operating correctly.

Availability • Performance • Security Conditions • Configuration Changes

inSight Logging

Preserve the evidence.

Administrative Activity • Authentication • Security Events • Configuration History

inSight Vulnerability Management

Find weaknesses.

Vulnerabilities • Exposure • Obsolete Software • Remediation • Verification

inSight Security Monitoring

Identify suspicious activity.

Detection • Analysis • Investigation • Escalation

CJIS Compliance Oversight

Connect everything to the compliance program.

Controls • Evidence • Findings • Remediation • Reporting

The Network Is Part of Your CJIS Security Program

A firewall isn't compliant because it was installed five years ago.

A VLAN isn't secure because someone once documented it.

A switch isn't protected because it is located inside the police department.

CJIS-aligned network security requires infrastructure to remain:

Properly configured.

Appropriately segmented.

Securely administered.

Patched and supported.

Continuously monitored.

Centrally logged.

Regularly assessed.

Documented and recoverable.

Trestle Networks Managed Network brings those activities together as an ongoing engineering and security service designed for municipal law enforcement environments.

Don't Just Manage the Network.

Make the Network Part of Your CJIS Security Program.

Contact Trestle Networks to discuss Managed Network services for your agency.

Specific CJIS control applicability depends upon agency systems, CJI scope, technology, policies and applicable CJIS Systems Agency requirements. Trestle services support implementation and operation of applicable security controls but do not independently constitute or guarantee CJIS compliance.

One positioning change I'd make

I would not rename this "CJIS Managed Network."

Keeping Managed Network is useful because it describes the actual service and leaves you room to sell it outside law enforcement. Instead, use the subtitle:

CJIS-Aligned Network Infrastructure Management

That is consistent with the direction you've taken with inSight Vulnerability Management and the other pages without implying some special FBI-certified network service.

More importantly, I'd remove or substantially deemphasize some of the generic MSP language on the current page—particularly phrases like "best-in-class application security, UTM and IDP" and generic warnings about revenue/reputation. . They sound like the older Trestle positioning. The redesigned site is becoming much more differentiated: Trestle understands the actual infrastructure controls underneath CJIS compliance and can operate them.

There's also an opportunity for the hero graphic on this page to be especially strong. I'd show a simplified municipal/police network with Internet → Firewall/VPN → Security Zones → Switching → Police/CJI Systems, with small callouts for SC-7, AC-4, AC-17, AC-18, CM-3, SI-2, SI-4. That would immediately communicate why "Managed Network" belongs in the CJIS-Centric Services menu rather than looking like a leftover generic MSP service.

1/2