If you have CUI and/or subsets, such as ITAR or EAR content, as a part of the DoD research contracts or grants currently in your portfolio or future pipeline, then you’re institution will need to meet CMMC Level 3. This is the reason so many large universities have already been working towards compliance with DFARS 7012.
The University of Tennessee Space Institute (UTSI) in Tullahoma is very close to our headquarters and they, for example, recently announced a half a million dollar contract award to help further develop hypersonic technology for the Air Force and other applications. UTSI was one of eight institutions selected for this particular contract, and all eight of these organizations will need to meet CMMC Level 3. This is one example of many.
Another thing worth pointing out is the data residency and access requirements in DFARS 7012 associated with CUI. These requirements necessitate organizations to use FedRAMP Moderate accredited cloud systems, and specific CUI types prohibit system access to foreign nationals, including faculty and students.