The document is a formal letter dated September 1, 2020, from four major academic organizations—EDUCAUSE, the Council on Governmental Relations (COGR), the Association of American Universities (AAU), and the Association of Public and Land-grant Universities (APLU)—addressed to Ellen M. Lord, Under Secretary of Defense for Acquisition and Sustainment. The letter expresses concerns regarding the Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program and its implications for university-based fundamental research, particularly in light of financial constraints exacerbated by the COVID-19 pandemic. The authors highlight issues such as the potential misapplication of CMMC requirements to fundamental research, the lack of clear guidance on certification levels for subcontractors, and the risk of unnecessarily burdensome security obligations being extended to academic research projects that do not handle controlled unclassified information (CUI). They emphasize that fundamental research, by its open and collaborative nature, should ideally be excluded from the CMMC program and request a formal dialogue with DOD officials to clarify definitions, procedures, and possible exemptions.
Furthermore, the letter includes an attachment outlining specific questions from the university research community, such as how DOD will distinguish between general academic interest and advanced persistent threats, the processes for obtaining waivers to certification levels, and the criteria for applying CMMC requirements to specific awards. The letter ultimately requests the establishment of a cooperative process to ensure that information security practices advance national defense interests without unduly hindering academic research or imposing inappropriate compliance burdens on universities. The signatory organizations underscore their collective commitment to information security and their willingness to collaborate with the DOD to ensure that federal security frameworks are both effective and appropriately scoped for academic research contexts.
