The base models for agencies using the NJICS is the APX 6000 (my friend in my amateur radio club is the project leader for the NJDOT ITS teams, and showed it to me a few months ago).
The APX line have what's called a MACE processor that's built right into the main board by default (Motorola Advanced Crypto Engine). The latest radios have the ability right out of the box now.
My 7000 has 4 formats active (ADP, DES-XL, DES-OFB, & AES), and I have personally seen a 7000 with 5 (the previous 4 + AES-GCS, where even the OTAR handshake request is encrypted). I don't own a KVL, so those features are kind of worthless to me!