Federal Contract Information (FCI) means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as that on public Web sites) or simple transactional information, such as that necessary to process payments.

Controlled Unclassified Information (CUI) means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.  CUI excludes classified information.

Covered Defense Information (CDI) means unclassified controlled technical information or other information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoW in support of the performance of the contract; or collected developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

Controlled Technical Information (CTI) means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. The term does not include information that is lawfully publicly available without restrictions. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

The Department of War (DoW) will specify the required CMMC level in the solicitation and the resulting contract. 

Beginning in October, 2016 and continuing in November, 2020, the DoW issued three new Defense Federal Acquisition Regulation (DFARS) clauses implementing what would become CMMC requirements to support the issuance of the  acquisition activities piloting the CMMC Model. These DFARS clauses to support an interim cybersecurity program will remain in place now that the CMMC Model is fully implemented as of November 10, 2025. The related DFARS clauses and brief descriptions thereof are provided below:

• DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting
  • Effective October, 2016.
  • Safeguard DoW CUI that resides on or is transiting through a contractor/subcontractor internal information system or network by implementing NIST SP 800-171.
• DFARS 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements
  • Effective November, 2020.
  • Implement DFARS clause 252.204-7012 and have at least a NIST SP 800-171 self-assessment (Basic) that is reported to the DoW.
• DFARS 252.204-7020 NIST SP 800-171 DoD Assessment Requirements
  • Effective November, 2020.
  • These are the same requirements listed in DFARS 252.204-7019, but expanded descriptions are provided for the processes around the conduct and reporting of Medium and High assessments by the DoW.

• DFARS 252.204-7021 Cybersecurity Maturity Model Certification Requirements 

  • Effective November, 2025
  • This requires the Contractor to have a current (i.e. not older that 3 years) CMMC certificate at the CMMC level required by the contract and maintain the CMMC certificate at the required level for the duration of the contract.

   

Only solicitations resulting in a contract funding mechanism are subject to CMMC requirements.  Grants and Cooperative Agreements are excluded from the requirements.

CMMC Level 1

1. Early Awareness at Proposal Stage - The Department of War (DOW) will specify in the solicitation what level of CMMC is required in the contract. AS SOON AS the reviewer of the solicitation becomes aware that an awarded contract will be subject to CMMC requirements, the Research Administrator must initiate an Ancillary Review in ResearchUVA, following the "Cybersecurity Maturity Model Certification (CMMC) Level 1" guidance in the Ancillary Review Matrix located at https://osp.research.virginia.edu/media/1111. This will notify the CMMC Liaison who will reach out with next steps to allow the Principal Investigator (PI) and project team to prepare for CMMC compliance if a contract is awarded.  

   Note: While the proposal will be submitted prior to completion of the SSP described below, UVA may not be able to accept the award if a compliant solution is not possible.

2. Draft Contract - If the proposal is successful and a draft DOW contract or DOW flow-through contract with CMMC terms is received, a contract negotiator from the Office of Sponsored Programs will notify the PI as part of the contract negotiation process.  The PI will then reach back out to the CMMC Liaison to finalize the System Security Plan.
3. Completion of a System Security Plan (SSP) - If the proposal is successful and a draft contract with CMMC terms is received, a contract negotiator from the Office of Sponsored Programs will notify the PI and the CMMC Liaison immediately. The CMMC Liaison will supply the SSP template and supplemental documentation to the PI for completion. The PI, with the assistance of unit/School technologists, must review the requirements, align the information security assets and utilities with the goals of the project, and complete the SSP to document how the project will comply with CMMC requirements. The CMMC Liaison is available to assist in the completion of the SSP and identifying centrally available resources that can be utilized for the project and are pre-approved.
4. Submission and Assessment - Once complete, the completed SSP must be submitted to [email protected]. The Assessment Team (Office of Research Security, Information Security, UVA Health Information and Technology, Research Computing) will review the SSP and contact the school/unit technologists and/or PI for clarification as needed.    
5. Compliance Decision - The Assessment Team will review the SSP and make a determination as to the project team's ability to meet the 15 CMMC cybersecurity requirements.  Submission of the proposal does not guarantee UVA's being able to accept the award. During the contract negotiation process, if a compliant solution to meet ALL 15 CMMC Level 1 requirements cannot be implemented, OSP will notify the PI and the Assessment Team that UVA cannot accept the award.

* This process applies to both University and UVA Health investigators.

CMMC Level 2

UVA does not have a CMMC Level 2 environment at this time. We are exploring options to achieve CMMC Level 2 compliance by, in part, building out the Ivy CUI environment; however, at this time, we cannot provide a specific timeline for self-attestation or a third-party certification of compliance.

CMMC Level 3

At this time, UVA does not anticipate pursuing CMMC Level 3 certification. Researchers wishing to participate in programs requiring CMMC Level 3 certification are advised to seek out government, industry or university partners who have attained or plan to attain appropriate certifications. While vendor-provided or project-specific solutions may be an option, significant lead time and resources will be required to develop those options. 

Marie Dorroh

Project Manager, Research Data Security

[email protected]

(434)-924-1025

Public Information

Proposals (UVA information, still sensitive)

The contract itself (insofar as it isn’t a ‘deliverable’ or ‘service’ UVA is providing to the Gov’t.)

Fundamental Research Results (care must be taken here to distinguish these from FCI when negotiating the contract)

Information not provided under the Contract, but related to the Contract (unless specifically denoted as FCI by the feds in the contract)