Cybersecurity Maturity Model Certification Level 1 Standard

Date: 7/7/2026                                                      
Governing Policy: IRM-003: Data Protection of University Information                            
Applies To: Academic Division, the Medical Center, and the College at Wise                             

Table of Contents

1. Purpose and Background
2. Scope
3. Annual Self-Assessment and Affirmation
4. Definitions
5. Control Statements
6. Exceptions
7. Cross Reference Table
8. Related Links

1. Purpose and Background

The University of Virginia is strongly committed to safeguarding Federal Contract Information (FCI) as required in FAR Clause 52.204-21. In order to guide University data users in achieving this objective, the University has developed this standard to highlight the basic safeguarding requirements presented in DFARS 252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements. 

This standard does not supplant federal and state laws and regulations, legal requirements, or contractual obligations for protecting data. 

This standard is consistent with the data handling requirements in IRM-002: Acceptable Use of the University’s Information Technology Resources, IRM-003: Data Protection of University Information, and IRM-004: Information Security of University Technology Resources and the associated standards and procedures. 

2. Scope

This standard applies to all University organizational units, faculty, staff, students, contingent workers, and contractors who process, store, or transmit FCI (including through cloud and collaboration platforms) in performance of contracts requiring compliance with DFARS 252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements.

This standard presents the twenty-three control statements the University has identified for complying with Cybersecurity Maturity Model Certification Level 1 (CMMC-L1) self-assessment requirements. 

3. Annual Self-Assessment and Affirmation

The University shall conduct annual CMMC-L1 self-assessments to determine the effectiveness of implemented security controls and ensure compliance with applicable requirements. Assessment results shall be documented, and identified deficiencies shall be tracked and remediated in a timely manner in accordance with organizational risk management practices. The University shall maintain a current affirmation of compliance in the Department of War Supplier Performance Risk System (SPRS).

4. Definitions

Authorized Users List: Users authorized to access FCI on in-scope systems identified on an approved System Security Plan and uniquely identified and authenticated as required by the Authentication Standard.

Authorized Processes List: Processes, services, or tasks authorized to run on in-scope systems identified on an approved System Security Plan that act on behalf of authorized users under designated accounts with defined roles.

Authorized Device List: University-owned devices conforming to the requirements of the Security of Connected Devices Standard that are authorized for FCI access to in-scope systems.

Authorized Publisher List: Individuals expressly authorized by contract or the project System Security Plan (SSP), to post or process information about an FCI contract.  Authorized publishers must complete annual training related to sensitive data protection. 

Physical Access Device List: Physical access devices (e.g., keys, badges, key cards) that limit access to media, systems, equipment, or operating environments containing FCI.

5. Control Statements

C-1.    Authorized users are identified. 

a)    Authorized users are positively identified and documented through the Authorized User List.  
b)    Authorized users are positively identified within in-scope systems via a unique identifier (e.g., User ID). 
c)    A review is performed annually to confirm that only authorized users have access to in-scope systems.

C-2.    Processes acting on behalf of authorized users are identified.

a)    Processes acting on behalf of users are uniquely identifiable and documented through the Authorized Processes List.
b)    Processes acting on behalf of users are uniquely identified within in-scope systems and executed under designated accounts with defined roles.
c)    A review is performed annually to confirm that only authorized processes acting on behalf of authorized users have access to in-scope systems.

C-3.    Devices (and other systems) authorized to connect to the in-scope system are identified.  

a)    Devices with access to in-scope systems are tracked in the Authorized Device List. Only University-owned authorized devices are permitted to be included in the Authorized Device List. 
b)    Identifying information about devices connecting to in-scope systems (e.g., device name, hostname, MAC address, IP Address) is logged.
c)    A review is performed annually to confirm that only authorized devices have access to in-scope systems.

C-4.    System access is limited to authorized users.

a)    In-scope system authentication and authorization services are configured to limit access only to authorized individuals. 
b)    A review is performed annually to confirm that only authorized users have access to in-scope systems. 

C-5.    In-scope system access is limited to authorized devices via policy, user education, and technical controls as applicable to the system.

C-6.    Transactions and functions for authorized users are defined in the in-scope system with roles and permissions. 

C-7.    FCI (internal) and non-FCI (external) boundaries are identified in the environment description. Data flow and network diagrams are created and maintained.

C-8.    External connections are regulated by firewall rules. Changes to these rules are reviewed and approved before implementation.

C-9.    External connections to the protected, in-scope network segments are limited to authorized in-scope systems and enforced through an Information Technology Services (ITS), Health Information and Technology (HIT), or Vendor managed firewall that enforces firewall policies for both inbound and outbound connections.
Access to/from comprehensively embargoed countries is blocked and file transfers with external systems are verified and controlled.

C-10.     Individuals authorized to post or process information on publicly accessible systems about an FCI contract are identified in an "Authorized Publisher" list.  Data related to FCI contracts is published in accordance with the terms and conditions of the relevant contract only after publication has been approved by an Authorized Publisher. Any Individuals with access to FCI data on the project must complete annual training related to sensitive data protection.  Instances of inappropriate FCI data discovered to be posted publicly are reported and investigated accordingly.

C-11.    The identity of each authorized user or process acting on behalf of an authorized user is authenticated by the in-scope system before allowing access.

C-12.    System access is limited to authorized devices via policy, user education, and technical controls as applicable to the system. Authorized users will only access in-scope systems from authorized devices once those devices have been authorized.

C-13.    System media containing FCI are sanitized or destroyed in accordance with the Electronic Data Removal Standard and the Electronic Data Removal Procedures.

C-14.    Individuals authorized to physically access media, systems, equipment, or operating environments containing FCI are defined in the Authorized User List.  Physical access to in-scope systems, equipment, and operating environments is limited to designated areas.

C-15.    Visitors are escorted and monitored at all times in operating environments containing FCI.

C-16.    Ingress and egress of Authorized Users and visitors to operating environments containing FCI is tracked via badge readers, manual sign in/sign out sheets, or electronic sign in/sign out systems.

C-17.    Physical access devices (e.g., keys, badges, key cards) that limit access to media, systems, equipment, or operating environments containing FCI are uniquely identified in a Physical Access Device List. The Authorized User each physical access device is assigned to is tracked. Authorized Users do not share physical access devices with other Authorized Users or visitors.

C-18.    Communications are monitored at the external in-scope system boundary.

a)    Communications are monitored, controlled, and protected at the boundary between University networks and the public internet with Firewalls, Intrusion Detection Systems, Reputation blocklists, VPN gateways, encryption, or other security safeguards.
b)    Communications are monitored, controlled, and protected at key internal boundaries such as the boundary between FCI and non-FCI environments with one or more Firewalls, VPN gateways, Virtual Desktop Instances, encryption, and/or other security controls.
c)    Key security related logs are forwarded to a Security Information and Event Management System where they are correlated and analyzed. Alerts of anomalous activity are investigated.

C-19.    The protected, in-scope network segments do not host publicly accessible system components. Any publicly accessible systems are hosted in network segments that are physically or logically separated from the internal FCI environment.

C-20.    Information security flaws are identified, reported, and remediated in a timely manner for in-scope systems.  Information security flaw remediation is addressed in accordance with the Security of Connected Devices Standard.

C-21.    All Authorized devices are identified in the Authorized Device List and required to have an active antivirus tool. Antimalware software is implemented within the University’s M365 tenant protecting email, Teams, SharePoint, and OneDrive.

C-22.    Malicious code protection mechanisms are updated in real-time.

C-23.    Malicious code scans are performed with the defined frequency.

a)    Malicious code protection performs continuous real-time protection. Files from external sources are scanned in real-time when downloaded, opened, or executed.
b)    Where supported, automated minimum weekly scans are performed. Sampling is utilized to limit the volume of files scanned each week. The minimum weekly sample size is 2 TB.
c)    Any required exceptions are justified and authorized.
 

6. Exceptions

If you think you need to request an exception to these requirements, please refer to the Exceptions Process.

7. Cross Reference Table

This table cross-references the control statements defined above with the security requirement assessment objectives in the CMMC Assessment Guide Level 1^*.

8. Related Links

• IRM-002: Acceptable Use of the University’s Information Technology Resources
• IRM-003: Data Protection of University Information
• IRM-004: Information Security of University Technology Resources
• Authentication Standard
• Electronic Data Removal Standard
• Electronic Data Removal Procedure
• Security of Connected Devices Standard 
• University Data Protection Standard
• 52.204-21 Basic Safeguarding of Covered Contractor Information Systems
• Office of Research Security: Cybersecurity Maturity Model Certification (CMMC)

Approved By, Date: Chief Information Officer, 7/7/26

Next Scheduled Review: 7/7/29