Will Higher Education Institutions Face Enhanced Cybersecurity Requirements?

U.S. colleges and universities watched closely this summer when the DOJ, in a novel move, scrutinized the cybersecurity compliance of a research lab at an academic institution.

The lab at the Georgia Institute of Technology held contracts with the DOD, and the DOJ alleged in a lawsuit that the lab failed to apply required information security controls to DOD data in its possession. As a result, institutions of higher education should consider paying close attention to a proposed Department of Education rule that, if finalized, may soon require universities and colleges to protect personal data and other categories of Controlled Unclassified Information (CUI) according to the same standards required by the DOD.