Federal Cybersecurity Policy

EDUCAUSE Comments: Updated Concerns About Proposed CIRCIA Regulations

Thu, 31 Jul 2025 20:06:53 Z

EDUCAUSE sent a letter to the acting director of CISA in June 2025 that highlights the concerns that we raised about the proposed CIRCIA regulations in 2024 and discusses how Trump administration directives reinforce our conclusion that higher education institutions should not be considered covered entities under the final rules, whenever they are released.

EDUCAUSE Comments: Proposed CUI Rules for Federal Contracting

Wed, 19 Mar 2025 13:21:51 Z

On March 17, 2025, EDUCAUSE, COGR, the American Council on Education (ACE), the Association of American Universities (AAU), and the Association of Public and Land-grant Universities (APLU) submitted comments in response to proposed regulations for incorporating controlled unclassified information (CUI) marking, handling, and security requirements into federal contracting rules and processes.

EDUCAUSE Comments: Incorporating CMMC Requirements Into DOD Contracting Regulations

Fri, 06 Dec 2024 15:12:55 Z

On October 15, 2024, EDUCAUSE submitted comments to the U.S. Department of Defense (DOD) regarding its proposed changes to the department’s contracting regulations (i.e., the Defense Federal Acquisition Regulation Supplement, or DFARS) to incorporate Cybersecurity Maturity Model Certification (CMMC) requirements into the defense contracting process.

2024 EDUCAUSE Horizon Report | Cybersecurity and Privacy Edition

Tue, 24 Sep 2024 16:46:52 Z

The 2024 EDUCAUSE Horizon Report profiles key trends and emerging technologies and practices shaping the future of cybersecurity and privacy, and envisions a number of scenarios and implications for that future.

EDUCAUSE Comments: CMMC 2.0 Regulations

Wed, 28 Feb 2024 21:04:48 Z

EDUCAUSE joined COGR, AAU, APLU, and ACE in submitting comments to the U.S. Department of Defense (DoD) on February 26, 2024, regarding the DoD’s second-round of proposed regulations to implement its Cybersecurity Maturity Model Certification (CMMC) Program.

EDUCAUSE Comments: FAR Cyber Incident Reporting

Mon, 19 Feb 2024 17:29:33 Z

On February 2, 2024, EDUCAUSE was joined by COGR and the Association of American Universities (AAU) in submitting comments on proposed changes to the Federal Acquisition Regulation (FAR) that could impose cyber incident reporting and software bill of materials (SBOM) development/maintenance obligations on all federal contractors, including colleges and universities.

EDUCAUSE Comments: NIST SP 800-171, Revision 3

Mon, 19 Feb 2024 17:06:01 Z

EDUCAUSE submitted comments to the National Institute of Standards and Technology (NIST) on January 26, 2024, regarding the near-final draft of the NIST Special Publication (SP) 800-171 cybersecurity guidelines for controlled unclassified information (CUI) held in non-federal information systems (such as those of colleges and universities).

Columbia University Administrative Policy Library: Computing and Technology

Tue, 22 Dec 2015 17:36:26 Z

Columbia University: Administrative Policy Library Computing and Technology website

EDUCAUSE Comments: Possible NSF Development of a Research Security and Integrity Information Sharing and Analysis Organization (RSI-ISAO)

Fri, 30 Jun 2023 14:17:03 Z

EDUCAUSE provided a response to the National Science Foundation (NSF) on June 27, 2023, regarding its request for comments on the possible development of a research security and integrity information sharing and analysis organization (RSI-ISAO).

EDUCAUSE Comments: NIST Research Cybersecurity Resource Development

Fri, 30 Jun 2023 13:57:19 Z

On June 27, 2023, EDUCAUSE submitted a cover letter and comments to the National Institute of Standards and Technology (NIST) in response to its request for input on the resources that it could develop to support research cybersecurity at colleges and universities.

EDUCAUSE Comments: Draft Cybersecurity Provisions for Research Security Programs

Wed, 14 Jun 2023 22:16:58 Z

EDUCAUSE submitted comments to the White House Office of Science and Technology Policy (OSTP) on June 5, 2023, concerning the draft requirements for research security programs under National Security Presidential Memorandum 33 (NSPM-33).

NIST SP 800-171 Overview

Wed, 14 Sep 2022 16:00:01 Z

This overview provides a review of the timeline that introduced NIST SP 800-171 "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations" as a compliance framework, an overview of the control families for the 110 controls and a discussion of the impacts and concerns for higher education.

NIST SP 800-171 Toolkit

Wed, 14 Sep 2022 16:00:01 Z

In this toolkit, you will find an overview of NIST SP 800-171 and its implications for higher education, questions to ask during project planning, 7 Things You Should Know About CMMC to use when speaking with stakeholders and leadership, and a customizable control evaluation.

7 Things You Should Know About Cybersecurity Maturity Model Certification (CMMC)

Thu, 15 Sep 2022 16:31:19 Z

The Cybersecurity Maturity Model Certification (CMMC) is a set of policies and practices that address the protection of federal Controlled Unclassified Information (CUI) data through administrative, physical, and technical controls.

NIST SP 800-171 Compliance Template

Fri, 30 Sep 2016 16:20:41 Z

Higher education institutions continue to refine their understanding of the impact of NIST Special Publication 800-171 on their IT systems and the data they receive from the federal government. This compliance template will help institutions map the NIST SP 800-171 requirements to other common security standards used in higher education, and provides suggested responses to controls listed in NIST SP 800-171.

EDUCAUSE Comments: FTC Safeguards Rule Proposed Reporting Requirement

Mon, 14 Feb 2022 23:39:55 Z

EDUCAUSE joined the American Council on Education (ACE) and eleven other higher education associations in submitting comments to the Federal Trade Commission (FTC) regarding its proposal to add a reporting requirement to the FTC Safeguards Rule.

2021 EDUCAUSE Horizon Report® | Information Security Edition

Wed, 05 Jul 2023 16:33:24 Z

The 2021 EDUCAUSE Horizon Report profiles key trends and emerging technologies and practices shaping the future of information security, and envisions a number of scenarios and implications for that future.

EDUCAUSE Comments: DOD Interim Rule on CMMC and 800-171 Assessment

Tue, 08 Dec 2020 19:46:33 Z

EDUCAUSE joined others in commenting on the U.S. Department of Defense (DOD) interim rule that seeks to formally incorporate the Cybersecurity Maturity Model Certification (CMMC) Framework and the DOD assessment methodology and requirements for NIST SP 800-171 compliance by defense contractors into the DOD contracting regulations.

EDUCAUSE Comments: Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements

Mon, 01 Jul 2024 19:51:43 Z

On July 1, 2024, EDUCAUSE joined with the American Association of Collegiate Registrars and Admissions Officers (AACRAO), the Association of American Universities (AAU), the Association of Governing Boards of Universities and Colleges (AGB), the Association of Public and Land-grant Universities (APLU), and the National Association of Independent Colleges and Universities (NAICU) to submit comments regarding the reporting requirements proposed by the Cybersecurity and Infrastructure Security Agency (CISA) under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA).

EDUCAUSE Comments: FSA Strategic Plan, 2020-24 (Draft)

Mon, 26 Oct 2020 15:52:42 Z

The Office of Federal Student Aid (FSA) at the U.S. Department of Education (ED) recently invited public comments on its draft strategic plan for 2020 through 2024. EDUCAUSE encouraged FSA to rewrite the relevant sections of its plan to focus on current and potential collaboration between the agency and higher education information security leaders on clarifying and publicly documenting compliance guidance as well as bolstering the dissemination of jointly sourced effective information security practices.