Security coverage shaped around your institution’s boundary

Scope

Education-record privacy for covered educational agencies and institutions. Confirm the Department of Education funding basis, whether records in this system are education records, and the disclosure context.

How it relates to other obligations

A vendor may act as a school official only when the regulatory criteria and the institution’s direct-control requirements are met. Do not infer scope from the institution name alone.

Evidence to consider

• Education-record inventory and system/data-flow boundary
• Access, disclosure, and redisclosure procedures
• School-official criteria and applicable vendor agreements

Scope

Determine whether the institution’s covered financial activity and customer information are in scope. Federal Student Aid guidance addresses Title IV institutions and student financial-aid information.

How it relates to other obligations

The FTC rule is regulatory. Title IV Program Participation Agreement and service-provider terms are separate contractual or program obligations; they are not the same source of duty.

Evidence to consider

• Financial-aid/customer information inventory and data-flow boundary
• Written information-security program and risk assessment
• Service-provider inventory, contracts, oversight, and incident procedures

Scope

Applies to covered entities and business associates handling electronic protected health information. Confirm role, transactions, ePHI flows, and system boundary.

How it relates to other obligations

Student health-clinic records governed by FERPA are generally outside HIPAA. A university may separately operate a covered health provider or act as a business associate for another covered entity. HHS says the 2024 Security Rule proposal remains proposed and the current Security Rule remains in effect.

Evidence to consider

• Covered-entity/business-associate role analysis and ePHI inventory
• Risk analysis, safeguard implementation, and incident records
• Business-associate agreements and subcontractor relationships where applicable

Scope

Relevant through applicable HIPAA provisions, including business-associate responsibilities and breach notification. It follows the institution’s HIPAA role, ePHI, and relationships.

How it relates to other obligations

Read alongside the current HIPAA regulations. HITECH is a law, not a standalone security control framework or certification.

Evidence to consider

• HIPAA role and ePHI boundary analysis
• Business-associate agreements and downstream relationships
• Breach assessment, notification, and response records where applicable

Scope

A broad risk-management framework for organizations of any size or sector. Its six functions are Govern, Identify, Protect, Detect, Respond, and Recover.

How it relates to other obligations

Adoption is an institutional choice unless a separate contract, policy, or other obligation incorporates outcomes or controls from it.

Evidence to consider

• Selected CSF profile, outcomes, and boundary
• Risk register and governance decisions mapped to chosen outcomes
• Evidence references and documented gaps for selected outcomes

Scope

Requirements cover nonfederal system components that process, store, or transmit CUI, or provide protection for those components. An applicable agreement selects whether and which revision applies.

How it relates to other obligations

Use Rev. 3 only when the contract or other agreement incorporates it. Some contracts may still identify Rev. 2 or transition terms. As of 2026-10-10, DoD identifies Rev. 2 as the CMMC Level 2 baseline during a paused Phase II rollout. CUI by itself does not make this publication universally binding.

Evidence to consider

• Award clauses, CUI markings, and the exact incorporated revision
• CUI data-flow inventory and system boundary
• Contract-required system security plan, assessment results, and remediation records

Scope

Applies to covered contractor information systems at the level required by the relevant DoD solicitation or contract. As of 2026-10-10, DoD says Phase II implementation is suspended; confirm the current clause, rollout terms, scope, and assessment route for each award.

How it relates to other obligations

Some contract levels require an independent C3PAO or government assessment. KeepGrade supports readiness and evidence organization; it does not issue CMMC certification or replace a required assessor.

Evidence to consider

• DoD solicitation/contract clauses and required CMMC level
• FCI/CUI asset inventory and CMMC assessment boundary
• Current SPRS status and required C3PAO or government assessment records

Scope

A standardized questionnaire used by higher-education institutions for vendor risk assessment. It is not an institutional security framework, law, or certification.

How it relates to other obligations

Use the current questionnaire when a university or customer requests it for a vendor relationship. EDUCAUSE permits specified institutional and vendor use, but third-party risk platforms need an explicit license to integrate it. This catalog tracks metadata only and does not host or reproduce questionnaire content.

Evidence to consider

• University/customer request and vendor relationship
• Current questionnaire obtained from EDUCAUSE and response owner
• Reviewed evidence references, exceptions, and follow-up items