As research data increasingly moves into digital environments, protecting sensitive information has become a vital part of the research enterprise. The UC Office of Research (OoR) recently achieved Cybersecurity Maturity Model Certification (CMMC) Level 2 status, a significant accomplishment that strengthens the university’s ability to compete for and perform sponsored research from the Department of Defense (DoD).

The certification reflects months of coordinated effort across the OoR and Digital Technology Services (DTS) and positions UC to meet emerging federal security requirements for cybersecurity- and defense-related research projects.

What is CMMC?

The Cybersecurity Maturity Model Certification, or CMMC, is a framework developed by the DoD to ensure that organizations handling sensitive defense information maintain appropriate cybersecurity practices.

CMMC is structured in levels. Level 1 requires organizations to conduct a self-assessment of basic cybersecurity safeguards. Level 2, which UC has achieved, requires organizations to implement and demonstrate compliance with a comprehensive set of security controls designed to protect Controlled Unclassified Information (CUI). Level 3 introduces an even more rigorous set of protections and assessment requirements.

“This certification ensures that UC researchers can continue pursuing ambitious, high-impact work. As federal agencies place greater emphasis on cybersecurity, we have built the infrastructure and expertise needed to support our faculty and remain competitive for important research opportunities in the years ahead, particularly as we continue to grow our research related to national security and defense.”

– Loren Wold, Vice President for Research

For universities and research institutions, CMMC is becoming increasingly important because the DoD is set to include CMMC requirements in research contracts. Organizations that do not hold the required certification level may be ineligible to receive certain awards.

“CUI” refers to sensitive information that is not classified but still requires protection. Whether a project contains CUI is determined by the specific DoD contract and reviewed in partnership with the OoR’s Restricted Research team.

A major institutional effort

Achieving CMMC Level 2 was neither quick nor simple.

The certification process required extensive collaboration between the OoR’s Restricted Research office and DTS. Teams worked through a lengthy assessment process that required documenting how security controls were implemented, maintained and monitored across the certified research environment.

In total, more than 1,200 documents were submitted for auditor review. Assessors examined not only the technical safeguards in place, but also the documentation supporting each control, policies governing system use and evidence demonstrating that required cybersecurity practices were being followed consistently.

The effort involved detailed discussions about every aspect of the environment, including how data are protected, how access is managed and how compliance is verified. The review process demanded proof that each required control was functioning as intended.

“This achievement reflects an extraordinary collaborative effort across our institution,” said Vice President for Research Loren Wold. “The Restricted Research team worked closely with our partners in Digital Technology Services through a complex and rigorous certification process that demanded careful documentation, technical expertise and sustained attention to detail. Their dedication ensured that UC is prepared to meet the highest standards for protecting sensitive research data.”

Much of the work focused on cybersecurity protections for research data stored and accessed in cloud-based environments. While the certification also includes physical security requirements, such as controlling access to dedicated research spaces, the primary emphasis is safeguarding sensitive information from cyber threats.

The process required substantial investments of time, expertise and financial resources, making the achievement a noteworthy and celebratory milestone for the university.

What it means for UC research

The immediate impact of CMMC Level 2 certification is that UC is now prepared to pursue DoD opportunities that require this level of cybersecurity compliance.

While many contracts have not yet incorporated CMMC requirements, federal agencies are expected to make certification a requirement for an increasing number of defense-related awards. By achieving certification now, UC is positioned ahead of that transition and can continue competing for research projects involving sensitive information.

The certification also demonstrates UC’s commitment to responsible stewardship of research data. Researchers can be confident that approved environments exist for projects that require enhanced cybersecurity protections.

“This certification ensures that UC researchers can continue pursuing ambitious, high-impact work,” said Wold. “As federal agencies place greater emphasis on cybersecurity, we have built the infrastructure and expertise needed to support our faculty and remain competitive for important research opportunities in the years ahead, particularly as we continue to grow our research related to national security and defense.”

Faculty members developing proposals that include CMMC requirements or involve CUI are encouraged to engage the OoR early in the process. The Restricted Research team can help investigators determine whether special protections are needed and guide them through available compliance resources.

As federal expectations around cybersecurity continue to evolve, CMMC Level 2 certification provides a strong foundation for future research growth. More importantly, it ensures that UC researchers remain competitive for opportunities that advance discovery, support national priorities and strengthen the university’s research portfolio.