What to Ask Before You Buy Police Hiring Software

You have been told to find a system and come back with a recommendation. The demos will all look the same. These are the questions that separate them, and most of them never make it into the solicitation.

• Published applicant-tracking solicitations ask for generic HR features. The same governments’ police software solicitations ask about criminal justice data safeguards, retention settings and data exportability. The gap is the buying mistake.
• Three requirements carry legal weight: whether the system touches criminal justice information, how long each record type must be kept, and an accessibility deadline that now has a date on it.
• The operational question is simpler than any of them: can it time-stamp your own process?

What public bodies actually ask for

We read five published solicitations end to end: four for applicant tracking or HR systems — a Southwestern university system, two Texas municipalities and a mid-Atlantic transit body — and one issued by a Southeastern police department for operational software.^1,2,3,4,5 Here is what they required.

The hiring solicitations are not sloppy. One of them is rigorous: 99.9% uptime, SAML or CAS single sign-on, an annual SOC 2 report, background checks on vendor staff, services “performed within the borders of the United States,” a mandatory accessibility conformance report, and a one-hour response clock on priority-one incidents.¹ It is a good enterprise HR document. The words CJIS, polygraph, background investigation and multi-factor do not appear in it.

Meanwhile the police department buying operational software asked proposers to “describe hosting, encryption, security controls, and CJIS-related safeguards,” to “support configurable retention settings,” and to “describe customer ownership and exportability of agency data.”⁵ The same governments know how to ask. They just do not ask on the hiring side.

First question: does it touch criminal justice information?

This one decides how much of the rest matters. If criminal history record information from an applicant’s background investigation will live in the system, the vendor is inside the FBI’s CJIS regime. If it will not, say so in writing and move on.

Inside that regime, the vendor signs the CJIS Security Addendum. Its terms are short and specific: the contractor “will maintain a security program consistent with federal and state laws, regulations, and standards” (§3.01); security violations are reported to the CJIS Systems Officer and the Director of the FBI (§4.01); the FBI may “suspend or terminate access and services, including telecommunications links” and on termination “the Contractor’s records containing CHRI must be deleted or returned” (§4.03); and “the FBI is authorized to perform a final audit of the Contractor’s systems after termination” (§5.01).⁶

Personnel screening runs the same way for a vendor’s staff as for yours: a state-of-residency check and a national fingerprint-based check before access is granted, with a felony conviction disqualifying.⁷ The current policy, version 6.1, is restructured onto the NIST 800-53 control families, so a vendor who understands those families can answer precisely and one who does not will change the subject.⁸

Retention is not one number

A hiring system holds several record types with different clocks, and “we keep everything forever” is a liability, not a feature.

• One Pacific Northwest state’s schedule for local government keeps recruitment records — announcements, screening records for all applicants, and applications from unsuccessful candidates — for 3 years after the position is filled, while the application of the person hired becomes work history retained 6 years after separation.⁹
• A Southwestern state’s licensing rule requires an agency to keep the records it maintains on a licensed officer “for a minimum of five years after the licensee’s separation date.”¹⁰
• One West Coast state requires employers to preserve “any and all applications, personnel, membership, or employment referral records and files for a minimum period of four years.”¹¹
• The federal floor is one year from the record or the personnel action, whichever is later — and once a charge is filed, every record relevant to it must be preserved until final disposition.¹²

So the requirement is not “retention.” It is retention configurable per record type, plus a litigation hold that suspends deletion for a defined applicant pool and can be proven to have held, plus an export you can redact and release inside your public-records response window.

Accessibility now has a date on it

The Department of Justice’s 2024 rule under Title II of the ADA sets a technical standard — WCAG 2.1 Level AA — for web content and mobile apps that a state or local government provides, including content third parties provide on its behalf. An April 2026 interim final rule extended the compliance dates by one year without changing the standard: April 26, 2027 for public entities serving 50,000 or more people, and April 26, 2028 for smaller entities and special districts.¹³

Your applicant-facing portal is content provided on your behalf. Ask for a current accessibility conformance report against WCAG 2.1 AA specifically — a report claiming WCAG 2.0 AA answers the older federal procurement question, not this one — and ask who tested it and how. Federal buying guidance tells public buyers to require testing evidence, to evaluate conformance claims with a repeatable methodology rather than taking the document at face value, and to re-test after each updated version.¹⁴ Put that last one in the contract; software changes after you sign.

Can it measure your own process?

This is where general-purpose systems quietly fail, and two public audits show exactly how.

A large Southwestern city’s auditor examined its police department’s recruiting in April 2025. The department ran applicants through a commercial applicant tracking system, and the auditor found: “Staff in the Recruiting Unit are entering data into their tracking system inconsistently. While some information is automatically populated into the system when an application is submitted, details about the applicant’s movement through the hiring process are manually entered.” The consequence is the number worth remembering: 5,940 applicants — 70% of everyone who applied between February 2020 and July 2024 — had no recorded date for the written exam.¹⁵

A Southeastern city’s internal audit, November 2025, found the same shape of problem in a different system: “limited documentation of activities during the evaluation and interview stage,” requisitions “not consistently closed…after positions are filled,” and “inconsistent understanding of data entry and reporting practices,” with staff uncertain how fields were defined. Its own target was 85 days from posting to start; actual performance ran past it every year measured.¹⁶

Neither finding is really about software quality. Both are about a system that treats stage movement as something a human types in later. If your process cannot say how long a candidate waited between passing the interview and sitting the polygraph, you cannot fix the wait, and you will not know which stage is costing you people.

The list