Overview

Minimum IT Safeguards is a series of initiatives designed to ensure compliance, close gaps, and reinforce the security of IT systems and data across the university.

The federal cybersecurity regulations have increased in number and requirements to protect data received or generated on behalf of the government. The Department of Defense (DoD) finalized a new compliance verification program called Cybersecurity Maturity Model Certification (CMMC) to protect federal information and data. Additionally, in response to increasing concerns of foreign government interference and exploitation of federally funded research, the U. S. government issued National Security Presidential Memorandum 33 (NSPM-33) and the National Science and Technology Council issued Guidance for Implementing NSPM-33 for research institutions to establish research security programs. Following CMMC-Level 1 and NSPM-33 guidance, UCF must apply specific basic safeguarding protocols and procedures to its research activities.

Implementation Timeline

• Phase 1, Spring 2025: Units conducting defense-related research
• Phase 2, Summer – Fall 2025: Units with any federal agreements
• Phase 3, Spring 2026 – Summer 2026: All remaining units

Overview of Assessment and Implementation

The basic federal cybersecurity requirements align with UCF IT policies and standards and should already be implemented. Where gaps exist, respective IT teams will coordinate changes to devices and processes through implementation.

The following implementations are designed to help meet the assessment requirements.

Implementations	Assessment
Updated 502 IT Account Standards Delegated Device Behavior Changes Disabling Idle Devices	Controls are implemented to restrict what user accounts can access, based on defined procedures; for example, NID accounts are not used for local administrator accounts.
Microsoft Defender for Endpoints Installation and Configuration Vulnerability Management and Dashboard	System and information integrity are maintained. Systems (operating system, software and applications) are patched. Antivirus/malware protections are installed with real-time system scanning.
Annual Information Security Training via Workday and KnowBe4	All employees take security awareness training.

Assessment and Attestation Impact

The assessment will support an institutional attestation by UCF into the Supplier Performance Risk System (SPRS), as required by DoD. Without an entry in SPRS representing compliant environments, UCF researchers cannot respond to defense solicitations and receive new DoD awards.