Safeguarding sensitive information: HiPerGator earns CMMC Level 2
The University of Florida’s high performance supercomputing cluster, HiPerGator-RV, achieved the Cybersecurity Maturity Model Certification (CMMC) Level 2. UF joins less than 1,100 organizations nationwide that have earned the Level 2 certification.
This milestone confirms that UF’s secure computing environment meets critical cybersecurity standards created by the U.S. Department of War (DoW). CMMC aligns cybersecurity requirements with data sensitivity into three levels. Level 2, known as “Advanced,” allows handling Controlled Unclassified Information (CUI). While CUI data is not classified, it must be kept secure from unauthorized access. Examples of CUI include Personally Identifiable Information (PII), defense technical data, satellite technology, and financial or medical records under federal contracts.
HiPerGator-RV is a protected computing environment designed for UF researchers handling and storing regulated data types. In addition to CMMC Level 2, HiPerGator-RV also supports projects requiring compliance with National Institute of Standards and Technology (NIST) 800-171 and NIST 800-53 standards.
For researchers leveraging HiPerGator-RV, UF Information Technology Research Computing provides training, support and consulting to make complex scientific and technical workflows run as efficiently as possible within the constraints of the rigorous CMMC Level 2 compliance framework. UFIT RC staff configure virtual machines with the software needed to carry out the research.
Approximately 30 research groups, including faculty from the College of Pharmacy and the Herbert Wertheim College of Engineering, use HiPerGator-RV.
The CMMC enables UF researchers to collaborate on federally funded research, expands future research opportunities and affirms the university’s commitment to protecting sensitive federal information.
Completed by third-party auditors, HiPerGator-RV’s successful CMMC Level 2 assessment required implementing 110 controls and meeting 320 assessment objectives, a disciplined documentation process maintained by UF Information Technology staff, employee training in basic cybersecurity and a comprehensive incident response and disaster recovery plan.
“Going through the CMMC assessment process is like taking a test,” said Erik Deumens, Senior Director of UFIT Research Computing. “You have to be ready to answer all 320 questions with evidence that the organization is doing the right thing for all controls.”
UF was one of the first academic institutions in the world to receive HITRUST® (Health Information Trust Alliance) certification in 2023 for HiPerGator and it was renewed again to HITRUST®11.3 in 2025. HITRUST® is a robust security control framework that maps to dozens of compliance reviews and regulations, including those outlined by the NIST, the International Organization for Standardization (ISO), the Health Insurance Portability and Accountability Act (HIPAA) and the European Union’s General Data Protection Regulation (GDPR).
HiPerGator’s security assessments help manage and reduce risk exposure and brings a competitive advantage to UF’s research landscape.
As of fiscal year 2025, UF conducted a record $1.33 billion in research, transforming state industries through artificial intelligence, advancing medical breakthroughs and drug discovery, and improving Florida’s cyber resilience to increasing digital threats.