Question DOCU-05

Can the systems that hold the institution's data be compliant with NIST SP 800-171 and/or CMMC Level 2 standards?

Standard Guidance

A HECVAT Full is recommended if this level of full NIST SP 800-171 compliance is required for the application.

Describe any plans to provide NIST SP 800-171 or CMMC Level 3 services.

Indicate level, Supplier Performance Risk System (SPRS) Score or certification information.

For institutions that collaborate with the United States government, FISMA compliance may be required.

Follow-up inquiries for FISMA compliance will be institution/implementation specific.

[Add expert insights and best practices]

[Add practical steps for SME SaaS vendors]

[Add common questions related to this HECVAT item]

[Add links to relevant articles or tools]