CMMC is going to impact higher education universities, federally funded research and development centers, and university-affiliated research centers; specifically the research institutions that are maintaining government research contracts. If you’re not pursuing federal government or DoD research contracts, then you’re likely not going to be impacted, at least initially. As far as the resources that have been made available, the universities have basically been left to their own devices to navigate federal compliance mandates. The only data that’s out there is provided by either the Undersecretary of Defense for Acquisition and Sustainment through Katie Arrington’s office, or potentially through the CMMC Accreditation Body. Now, you have a large amount of people out there talking about unofficial takes on CMMC and information about CMMC compliance. Many companies are attempting to provide the adequate information via webinars and online events, but obviously, they can’t speak for the government. They are basically interpreting what the government is telling everyone and providing guidance to customers based on that interpretation.
One datapoint that’s a fairly safe assumption is universities that do any sort of work with the DoD will need to be CMMC Level 3 because their role in the DIB is largely data driven and often addressing sensitive technical subject matters.