Question DOCU-05

Can the systems that hold the institution's data be compliant with NIST SP 800-171 and/or CMMC Level 2 standards?

Standard Guidance

EDUCAUSE provides no guidance here

Describe any plans to provide NIST SP 800-171 or CMMC Level 2 services.

if you have a third-party hosting provider, please provide how you comply with 800-171 where your third party uses a shared responsibility mode.

For institutions that collaborate with the United States government, FISMA compliance may be required.

Follow-up inquiries for FISMA compliance will be institution/implementation specific.

[Add expert insights and best practices]

[Add practical steps for SME SaaS vendors]

[Add common questions related to this HECVAT item]

[Add links to relevant articles or tools]