Please report any level of incident, no matter how small. The appropriate information security office will evaluate the report and provide a full investigation if appropriate.
New: Cybersecurity Maturity Model Certification Level 1 Standard
Last modified
August 17, 2026 - 1:27pm
Post date
August 17, 2026 - 8:50am
New: Cybersecurity Maturity Model Certification Level 1 Standard
To support the University's ability to pursue and perform Department of War (DoW) contracts that require Cybersecurity Maturity Model Certification (CMMC) Level 1 compliance, the University has established a new Cybersecurity Maturity Model Certification (CMMC) Level 1 Standard.
The most important takeaway is that this standard does not introduce any new technical requirements or changes to existing IT security practices. Rather, it documents and formalizes the safeguards and processes necessary to meet the requirements for CMMC Level 1 self-assessments under 48 CFR § 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.
This standard is not broadly applicable across the University. It only applies to departments, projects, and individuals that work on contracts requiring CMMC Level 1 compliance and that process, store, or transmit Federal Contract Information (FCI). Units that do not handle FCI under a contract requiring CMMC Level 1 are not affected by this standard.
The standard was developed collaboratively by Information Technology Services (ITS), Health Information Technology (HIT), and the Office of the Vice President for Research (OVPR) to ensure the University is prepared to meet contractual cybersecurity requirements as opportunities arise. While the University is not currently performing contracts that require CMMC Level 1 compliance, it anticipates pursuing such opportunities in the future. Establishing this standard now positions the University to compete for and perform this work when needed.
Additional information regarding the University's CMMC program, requirements, guidance, and available resources is available through the Office of Research Security's Cybersecurity Maturity Model Certification (CMMC) website.
If you have questions about how this standard may apply to your department or research activities, please contact UVA Office of Research Security: mailto: [email protected].