Rachel German
IT Security Analyst 3,
University of California San Diego
Building a Sustainable CMMC Program: Lessons from UC San Diego’s Five-Year Journey
Wednesday, April 29, 2026 | 9:00AM–9:45AM PT | Pacific Ballroom A, Second Floor
Session Type:
Breakout Session
Delivery Format:
Presentation/Panel
UCSD recognized early that building a Cybersecurity Maturity Model Certification (CMMC) program would require a multi-year, institution-wide commitment. Beginning over five years ago, the university laid the groundwork for a sustainable CMMC program, culminating in successful CMMC Level 2 certification in November 2025. This session shares UCSD’s end-to-end journey and focuses on how higher education institutions can design, build, and sustain an effective CMMC program. The session highlights UCSD’s collaborative model, bringing together the Office of Information Assurance, Sherlock, Export Control, Sponsored Projects Office, and Research Compliance Office. Attendees will learn how assembling a cross-functional team that blends compliance expertise, technical capability, and an understanding of academic research is essential to long-term success.We will discuss the program’s evolution, including uncertainty as CMMC requirements matured, lessons learned, resource planning, and strategies for maintaining momentum. Participants will gain practical guidance on structuring teams, defining roles, and establishing communication practices that support both compliance and research productivity. The session concludes by demonstrating how thoughtful program design enables seamless researcher support across the full project life cycle.
Presenters
-
-
Lillian Maestas
CMMC Operations Manager, University of California San Diego -
Leslie Morsek
Regulated Research Cybersecurity Lead, University of California San Diego -
Daniel Quach
Director, IT Risk and Compliance, University of California San Diego -
Arlene Yetnikoff
CISO, University of California San Diego