Policy Alerts

New: Cybersecurity Maturity Model Certification Level 1 Standard 

To support the University's ability to pursue and perform Department of War (DoW) contracts that require Cybersecurity Maturity Model Certification (CMMC) Level 1 compliance, the University has established a new Cybersecurity Maturity Model Certification (CMMC) Level 1 Standard.

The most important takeaway is that this standard does not introduce any new technical requirements or changes to existing IT security practices. Rather, it documents and formalizes the safeguards and processes necessary to meet the requirements for CMMC Level 1 self-assessments under 48 CFR § 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.
 

This standard is not broadly applicable across the University. It only applies to departments, projects, and individuals that work on contracts requiring CMMC Level 1 compliance and that process, store, or transmit Federal Contract Information (FCI). Units that do not handle FCI under a contract requiring CMMC Level 1 are not affected by this standard.

The standard was developed collaboratively by Information Technology Services (ITS), Health Information Technology (HIT), and the Office of the Vice President for Research (OVPR) to ensure the University is prepared to meet contractual cybersecurity requirements as opportunities arise. While the University is not currently performing contracts that require CMMC Level 1 compliance, it anticipates pursuing such opportunities in the future. Establishing this standard now positions the University to compete for and perform this work when needed.

Additional information regarding the University's CMMC program, requirements, guidance, and available resources is available through the Office of Research Security's Cybersecurity Maturity Model Certification (CMMC) website.
 

If you have questions about how this standard may apply to your department or research activities, please contact UVA Office of Research Security: mailto: [email protected].

The Security of Connected Devices Standard has been updated 

InfoSec collaborated with the Security Advisory Committee to review the requirements for Microsoft Defender on devices owned by Wise and the Academic Division and address the concerns that were identified. 

These revisions to the standard are intended solely to provide clarification, do not introduce any new technical requirements, and do not change current practice.

Specifically:

• Sections 2.a and 2.b have been revised to more clearly define the responsibilities of device owners and school, department, and unit IT personnel/administrators.
• The revised language in section 2.a excludes mobile operating systems from the antimalware requirements and is now consistent with the antimalware requirement for devices owned by Wise and the Academic Division in section 2.b.

Reviewing the revised standard is recommended.

Effective April 9, 2026: The Security of Connected Devices Standard has been slightly revised to clarify that the requirement in section 2.b. for non-server electronic devices owned by the Academic Division or Wise to install and run Microsoft Defender for Endpoint (MDE) applies only to devices utilizing operating systems supported by ITS's MDE service

The Security of Connected Devices Standard has been updated to require Microsoft Defender for Endpoint Plan 2 (MDE) as of July 1, 2026, for all non-server electronic devices utilizing an operating system supported by Microsoft Defender for Endpoint. Additionally, the standard was amended by reorganizing the document to clarify the requirements for University-owned devices. This reorganization does not add additional technical requirements to the standard. 

The current centrally-configured Qualys Vulnerability scanning and reporting frequencies have been added to provide documentation for audit and regulatory requirements. This does not change current practice or require anything new of distributed units
 

Reviewing carefully the revised standard is highly recommended.

CHANGED

Existing Item - 2.a: 

1. Security Requirements for All Connected Devices

   All electronic devices connecting to the University's network must meet the following security requirements:

changed to: 

1. Security Requirements for All Connected Devices

   All electronic devices that connect to the University's network or that access, collect, generate, process, or transmit University data must meet the following security requirements:

Existing Item - 2.b: 

2.b) Additional Security Requirements For Any Device Accessing, Collecting, Displaying, Generating, Processing, Storing, Or Transmitting University Data 

Computers owned by the Academic Division of the University, an employee of the Academic Division, sponsored account of the University, or student worker that access, collect, generate, process, or transmits University data must comply with the requirements described in this section. The Medical Center, University-Associated Organizations, and student owned computers not accessing University Academic data are excluded from the requirements described in this section.

changed to: 

2.b) Additional Security Requirements For Devices Owned by the Academic Division or Wise

All electronic devices owned by the Academic Division or Wise must comply with the requirements described in this section.

Existing Item - 2.bii: 

Non-server electronic devices utilizing an operating system supported by Microsoft Defender for Endpoint should install Microsoft Defender for Endpoint Plan 2. See Microsoft Defender for Endpoints (MDE).

changed to: 

All non-server electronic devices utilizing an operating system supported by Microsoft Defender for Endpoint must install and run Microsoft Defender for Endpoint Plan 2 by July 1, 2026. See Microsoft Defender for Endpoints (MDE).

Existing Item - 2.c: 

c) Additional Security Requirements for Email Services 

It is highly recommended that the central IT email services be used for any University related email.  Email services providers must follow the requirements above when providing email services for University faculty, staff, and/or students.  In addition, email services providers (e.g., servers):

changed to: 

c) Additional Security Requirements for Email Services

It is highly recommended that central ITS or Medical Center email services be used for any University related email. Other email services providers must follow the requirements above when providing email services for University faculty, staff, and/or students. In addition, email services providers (e.g., servers):

Existing Items : 

2.d, 2.e, and 2.f

Renumbered: 

2.e, 2.f, 2.g respectfully

REORGANIZED and CHANGED

Existing Item - 2.b.iii: 

2.b.iii Organizations not employing the ITS Academic M365 tenant’s MDC or MDE

• Forward MDS and MDE logs to the Enterprise Logging Service (Splunk).
• Implement security configuration settings at the same or higher level than the ITS tenant
• Provide ITS Information Security personnel full access to the tenant security portal

Renamed and moved to:: 

Section 2.d) Additional Security Requirements for M365 Tenants              

It is highly recommended that organizations use the ITS Academic or Medical Center M365 tenants for a secure, integrated M365 platform. Organizations not employing these tenants’ Microsoft Defender for Servers (MDS) or Microsoft Defender for Endpoints (MDE) must:

• Forward MDS and MDE logs to the Enterprise Logging Service (Splunk).

• Implement security configuration settings at the same or higher level than the ITS tenant

• Provide ITS Information Security personnel with full access to the tenant security portal2.b) Additional Security Requirements For Devices Owned by the Academic Division or Wise

ADDED

Under 2.b.i) Vulnerability Management

ITS must configure the Qualys Cloud Agent to:

• Initiate scans at least daily
• Communicate scan results to responsible parties at least weekly

The Security of Connected Devices Standard was changed.

A requirement to encrypt the disk(s) of any servers containing HSD that cannot meet the physical security requirements already in effect is added. A similar disk encryption requirement is recommended for servers containing sensitive data.

Reviewing carefully the revised standard is highly recommended.

CHANGED

In the Shared Devices (E.G. Servers, Network Attached Storage, Disk Arrays) table, the requirements for Recovery and Physical Security are changed:

Existing Item - Highly Sensitive Data: 

Servers must be located in locked server racks in data centers managed by ITS or Health IT, or in a departmental machine room that is physically restricted, has a double-locked door, with card access and access logging.

changed to: 

Servers must be located in locked server racks in data centers managed by ITS or Health IT, or in a departmental machine room that is physically restricted. Departmental machines rooms must be located within a secure building with access to the machine room controlled via a card-based authentication system that logs all access. For servers not meeting these requirements, the entire disk or all user-writable local disk volumes must be encrypted, according to encryption methods recommended by the:

- University Information Security Office for academic users, or,

- Health Information and Technology Security Office for UVA Health System users.

Existing Item - Sensitive Data: 

Same as for highly sensitive data if the personal data of multiple individuals are involved, e.g. student names and grades for a class. Otherwise, recommended but not required that servers be located in locked server racks in ITS or Health IT data centers if space is available.

If located outside of a data center, the room must be physically restricted (locked when unattended).  Recommended, but not required to have a double-locked door, with card access and access logging.

changed to: 

Same requirement as for highly sensitive data if the personal data of multiple individuals are involved, e.g. student names and grades for a class. Otherwise, it is recommended but not required that servers be located in locked server racks in data centers managed by ITS or Health IT, or in a departmental machine room that is physically restricted .

If the servers are located outside of a data center managed by ITS or Health IT, the departmental machine room must be physically restricted (locked when unattended).  It is also recommended, but not required that:

- The room is located within a secure building with access to the room controlled via a card-based authentication system that logs all access, or

- The entire disk or all user-writable local disk volumes is encrypted, according to encryption methods recommended by the:

- University Information Security Office for academic users, or,

- Health Information and Technology Security Office for UVA Health System users

Effective August 18, 2025: As part of the scheduled three-year review cycle, the Electronic Data Removal Standard and Electronic Data Removal Procedures have undergone non-substantive updates. These revisions serve to clarify existing use cases, refresh the list of approved secure data deletion methods, and promote the use of whole disk encryption as the preferred method for data protection and disposal.

No changes have been made to the core requirements or intent of the standard and procedures.

Effective August 18, 2025, the Copyrights of Digital Materials and Software Standard and Procedures underwent non-substantive updates as part of their scheduled three-year review. These updates include the adoption of a standardized template to clearly indicate the effective date, revision and review dates, and the applicable division for the standard and procedures.

The Security of Connected Devices Standard was extensively changed.

Reviewing carefully the revised standard is highly recommended.

CHANGED

Under 2 b) Additional Security Requirements For Any Device Accessing, Collecting, Displaying, Generating, Processing, Storing, Or Transmitting University Data

Existing item: 

The Health System 

changed to: 

The Medical Center

Existing item: 

Computers owned by the Academic Division of the University, an employee of the Academic Division or sponsored account of the University  

changed to: 

Computers owned by the Academic Division of the University, an employee of the Academic Division, sponsored account of the University, or student worker  

Existing item: 

student owned computers are excluded 

changed to: 

student owned computers not accessing University Academic data are excluded

ADDED 

Under 2 b)  Security Requirements For Any Device Accessing, Collecting, Displaying, Generating, Processing, Storing, Or Transmitting University Data

• Antimalware and Microsoft Defender
  • All electronic devices capable of installing and running Endpoint Detection and Response (EDR) real-time antimalware protection must do so.
  • All servers utilizing a Microsoft Windows Operating System must install and run Microsoft Defender for Cloud Plan 1 or Plan 2 by January 1, 2025. See  Microsoft Defender for Servers.
  • All servers utilizing a Linux Operating System must install and run Microsoft Defender for Cloud Plan 1 or Plan 2 by July 1, 2025. See Microsoft Defender for Servers.
  • Non-server electronic devices utilizing an operating system supported by Microsoft Defender for Endpoint should install Microsoft Defender for Endpoint Plan 2. See Microsoft Defender for Endpoints (MDE).
• Organizations not employing the ITS Academic M365 tenant’s MDC or MDE must:
  • Forward logs MDS and MDE logs to the Enterprise Logging Service (Splunk)
  • Implement security configuration settings at the same or higher level than the ITS tenant
  • Provide ITS Information Security personnel full access to the tenant security portal

Under 2 c) Additional Security Requirements for Email Services

• All email service providers sending or receiving email with a virginia.edu domain or sub-domain must:
  • request Domain-based Message Authentication, Reporting and Conformance (DMARC) keys via the ITS Service Catalog request 
  • AND have EITHER 
    • a DMARC p=reject policy 
    • OR 
    • a Sender Policy Framework (SPF) record configured to hard fail

Effective: July 23, 2024 

On July 23, 2024 the Electronically Stored Information Release Standard had non-substantive changes to update the links for submitting Electronically Stored Information request to Records and Information Management (RIM) office. 

The Standard was reviewed and the Next Scheduled Review date set to 7/23/2027.

Effective: November 29, 2023 the Vendor Security Review Standard webpage had non-substantive changes to update the UVA Wise Reviewers Sign off to be UVA Wise Director of Information Technology & CSO.