Industry · Higher EducationResearch universities · academic medical centers · systems

One program for every campus mandate.

A research university answers to federal research sponsors, the Department of Education, HHS, card networks, and its own vendors at once. Compyl maps one control library across research security programs, NIST SP 800-171 for NIH and federal research data, the GLBA Safeguards Rule, FERPA, HIPAA for the academic medical center, PCI DSS, and vendor risk, so a decentralized campus runs one connected program.

Request a demo See research security →

Research security readyAcademic medical centers125+ integrations

Your regulatory year · research universityLive evidence status · every control checked hourly

JanFebMarAprMayJunJulAugSepOctNovDec

JanFERPA records access reviewRegistrarCurrent

MarGLBA Safeguards auditFinancial aid · FSA auditEvidence current

MayResearch security certificationNSPM-33 · CHIPS Act · 800-17184% · POA&M

JulHIPAA risk analysisAcademic medical centerReviewed

SepVendor risk reviewsEdTech and research vendorsScheduled

Oct – NovCabinet and board risk reportFAIR-basedDrafted

Always on · NIH controlled-access data attestations, PCI DSS, breach notification (state laws, GDPR), and vendor monitoringContinuous monitoring, not an office-by-office scramble

The challenge

Why GRC is harder at a research university

Research security, student aid, student records, a health system, and hundreds of vendors, each owned by a different office, with federal funding on the line.

Research security and grant conditions

Institutions averaging more than $50 million a year in federal research funding must stand up a research security program, several agencies already require research security training certification, and NIH controlled-access data requires a NIST SP 800-171 attestation.

An academic medical center inside the university

Hospitals, clinics, and clinical research bring HIPAA into a university that is usually a hybrid entity, so health care components and the rest of campus must be governed together but kept distinct.

Decentralized colleges, labs, and vendors

Colleges, labs, central and distributed IT, the registrar, and financial aid each hold sensitive data and buy their own software, which makes consistent controls and vendor reviews hard to prove.

Who you answer to

Every mandate that governs the research campus

Federal research sponsors, student-aid rules, health privacy, card networks, and vendor reviews, on one control library. Each tile shows who enforces it, what it asks, and the shared control Compyl evidences once.

Research security program

Research

NSPM-33 · CHIPS Act · federal sponsors

Certify a program covering cybersecurity, foreign travel security, research security training, and export control training.

Shared controlCyber protocols · training records

Training required now · program dates pending

NIST SP 800-171

Research

NIH · federal sponsors

Protect controlled-access and controlled unclassified research data. NIH requires an attestation for controlled-access data.

Shared control110 requirements · POA&M

NIH attestation since Jan 2025

GLBA Safeguards

Federal

Department of Education · FTC

Information security program for federal student-aid data, checked in the annual compliance audit.

Shared controlRisk assessment · MFA · encryption

Annual audit

HIPAA · academic medicine

Federal

HHS · OCR

Academic medical centers, clinics, clinical research, and student health, usually under a hybrid entity designation.

Shared controlRisk analysis · access · audit logs

Security Rule update pending

FERPA

Federal

Department of Education

Privacy of student education records and who may access them.

Shared controlAccess control · access reviews

Annual notification

Vendor oversight

Vendors

GLBA · HIPAA · FERPA

EdTech, cloud, and research vendors that touch student, financial-aid, patient, or research data.

Shared controlVendor risk · due diligence

At purchase and renewal

Export controls

Research

Commerce (EAR) · State (ITAR)

Controlled technology, foreign collaborators, and international travel in sponsored research.

Shared controlAccess control · training · travel

Per project

PCI DSS v4.0.1

Card networks

PCI SSC

Tuition, bookstore, athletics, parking, and donation payments.

Shared controlMFA · encryption · logging

Annual SAQ

ADA Title II

Federal

Department of Justice

Web and digital accessibility for public universities' sites, apps, and course content.

Shared controlPolicy · testing · remediation

Large entities Apr 26, 2027

State breach laws

State

State attorneys general

Notification duties for student, patient, employee, and donor data.

Shared controlIncident response · notification

Varies by state

GDPR

Privacy

EU supervisory authorities

International students, research collaborations, and study-abroad programs.

Shared controlArt. 32 security · Art. 30 records

72-hour breach clock

NIST CSF 2.0

Framework

NIST

The reference model for campus cyber programs and board reporting.

Shared controlShared across every mandate above

Six functions

Research security

Certify your research security program with evidence, not binders

Under NSPM-33, the CHIPS and Science Act, and the 2024 OSTP guidelines, research universities above the $50 million federal funding threshold must run a research security program, and DOE, NSF, USDA, NIH, and NASA already require research security training certification. Compyl turns the four program elements into owned controls with live evidence, and maps the cybersecurity element to NIST SP 800-171 so one set of research controls also supports NIH controlled-access data attestations.

Cybersecurity, foreign travel, research security training, and export control training tracked as controls
Agency-by-agency requirements and dates tracked as each agency finalizes its policy
NIST SP 800-171 mapped and evidenced for research enclaves and NIH data, with a POA&M tracked to closure
Training completions and travel records pulled in as evidence

Research security requirements and dates by agency →

Research security programNSPM-33 · CHIPS Act

Cybersecurity800-171 mapped

Foreign travelRegistry linked

Training91% complete

Export controlTraining due

Training certification · NSF, NIH, DOECovered personnel tracked · owner: research security officer

Current

NIH controlled-access data800-171 attestation · genomics enclave

Attested

Research enclave · 800-17118 of 110 requirements open · POA&M tracked

In progress

One control library for every sponsorEvidence Health 94

Academic medical centers

Govern the university and its health system together

Most universities with a medical center are HIPAA hybrid entities: the hospital, clinics, and clinical research are health care components, and the rest of campus is not. Compyl keeps those boundaries clear while running one program, so the HIPAA risk analysis, access reviews, and business associate agreements for the medical center sit alongside GLBA, FERPA, and research controls.

Health care components scoped as their own program on the shared control library
HIPAA Security Rule risk analysis kept current, not rebuilt each year
Business associates and clinical research vendors assessed and tracked
Ready for the HIPAA Security Rule update, now projected for 2027

Hybrid entity coverageUniversity + academic medical center

Hospital and clinics · HIPAACovered

Clinical research · HIPAACovered

Student health · HIPAACovered

Rest of campus · FERPA, GLBACovered

HIPAA risk analysis · medical centerUpdated after EHR migration · 12 risks re-scored

Current

Business associate agreements214 vendors · 6 renewals due this quarter

Tracked

Clinical research data access reviewInvestigators and coordinators · quarterly

Complete

Health care components kept distinct, one program overallHybrid entity

Vendor risk

Review every campus vendor in one place

Campuses buy software college by college. Compyl gives procurement and security one place to assess EdTech, cloud, and research vendors, collect their security documentation, track exceptions, and re-review at renewal, with the results tied to the controls and programs they affect.

Security questionnaires and SOC 2 reports kept with each vendor record
Vendor tiering by the data they touch: student records, financial aid, PHI, research data
Exceptions and remediation tracked to an owner and a date
GLBA service provider oversight and HIPAA business associate terms tracked alongside the review

Campus vendor reviewsTiered by data · FAIR

Learning management systemStudent records · SOC 2 report on file

Medium

Cloud research enclaveControlled-access research data · 800-171 evidence on file

Critical

SIS / ERP vendorStudent and financial-aid records · monitored continuously

Medium

EdTech SaaSCourse content only · annual review

Low

Loss exposure$2.2M → $0.9M

Top scenarioEnclave breach

Risk in dollars for cabinet and board reportingFAIR-based

One control library

Map one control library across every campus program

Define controls once and cross-map them to research security, NIST SP 800-171, GLBA, FERPA, HIPAA, and PCI DSS, so evidence collected once proves compliance for every office and every sponsor.

No duplicate work across departments, sponsors, or mandates
Each new program reuses controls you already have
Every artifact mapped to every requirement it satisfies
Coverage visible per program, not buried in spreadsheets

One control library · every campus programCross-mapped automatically

Encryption and access controlsPulled automatically from Okta / SIS / AWS

6programs

Research securityCybersecurity element

Satisfied

NIST SP 800-1713.1 / 3.5 · research

Satisfied

GLBA Safeguards§314.4 · financial aid

Satisfied

HIPAA§164.312 · medical center

Satisfied

FERPAEducation records

Satisfied

PCI DSS v4.0.1Req 8.4 · tuition

Also covered

Each new program reuses controls you already haveNo duplicate work

One campus

Unify a decentralized campus

Bring research administration, the medical center, the registrar, financial aid, and distributed IT into one control library and evidence base, so the institution proves compliance consistently instead of office by office.

One connected program across every college and department
Surface gaps before an audit, a sponsor review, or a certification
Department owners see only their controls and tasks
Drift becomes a tracked task with an owner and a deadline

Program coverageContinuous monitoring across departments

Research · security programIn progress · 84%

Medical center · HIPAACovered

Financial aid · GLBACovered

Registrar · FERPACovered

FERPA · records access reviewSIS · 2,300 staff accounts reviewed · 41 revoked

Current

GLBA · financial-aid data encryptionAWS KMS · checked hourly

Current

800-171 · research enclave MFAEnforced for all enclave users

Current

Gaps surface before an audit or sponsor reviewEvidence Health 97

Collect once, satisfy every regulator

One piece of evidence. Every program it satisfies.

Compyl maps each control and its evidence across every program and framework that requires it, so a single artifact, pulled automatically from your stack, counts for every office and sponsor at once.

One control library mapped to 70+ frameworks and every campus program
Collect evidence once and reuse it across audits, sponsor reviews, and certifications
See instantly how GLBA work translates to HIPAA or 800-171
Add the next program without starting over

One controlMFA enforced on all usersPulled automatically from Okta and the SIS · scored 97 by Evidence Health1 piece of evidence

Satisfies at once

NIST SP 800-1713.5.3 Multifactor authentication

Satisfied

GLBA Safeguards§314.4(c) Access controls · MFA

Satisfied

HIPAA§164.312(d) Person or entity authentication

Satisfied

PCI DSS v4.0.1Req 8.4 Multi-factor authentication

Satisfied

+ 70 more frameworks cross-mapped automatically

Coverage

Frameworks that govern higher education

All cross-mapped to one control library. Explore each, or see the full library of 70+.

Research security (NSPM-33)NIST SP 800-171GLBA Safeguards RuleFERPAHIPAA PCI DSS NIST CSF GDPR 70+ frameworks

Guides

Best GRC platforms for higher education Research security deadlines GLBA for higher education

NIST SP 800-53 Vendor Risk Management Trust Center

Recognized by users on G2 · Rated a leader by the teams who use it G2 Momentum Leader, Summer 2026

Campus programs on one control library

125+

Native integrations feeding evidence automatically

Real-time

Evidence collection, no manual screenshots

Year-round

Audit and certification readiness instead of an office-by-office scramble

“It has brought a sense of relief to my life because, for the first time, we have a real solution in place that is proactively keeping us protected.”

JSJon SeniorCTO · via G2

Why Compyl for higher education

Built for the way campus GRC actually works

Plenty of tools store a policy. Compyl runs the whole program, controls, evidence, risk, and vendors, across every office, sponsor, and mandate you answer to.

One source of truth

Controls, evidence, risk, and vendors in one connected system, across research, the medical center, and the rest of campus.

Continuous, not point-in-time

Evidence refreshes automatically and is scored for health, so you are ready for audits and certifications every day of the year.

125+ integrations

SIS, identity, cloud, and research platforms feed evidence automatically.

Your own environment

A dedicated, single-tenant environment for each customer, so sensitive research and health data stays separate.

Risk in dollars

FAIR-based quantification turns campus, clinical, and research risk into numbers the cabinet and board can act on.

What does compliance for higher education require?

Research universities carry the broadest compliance load in higher education: a research security program under NSPM-33, the CHIPS and Science Act, and the OSTP guidelines for institutions averaging more than $50 million a year in federal research funding, including research security training certification, NIST SP 800-171 for NIH controlled-access data and other protected research data, the GLBA Safeguards Rule for financial-aid data (enforced by the Department of Education), FERPA for student records, HIPAA for academic medical centers and clinical research, PCI DSS for payments, and oversight of the vendors that touch campus data. Add export controls, ADA Title II accessibility, state breach laws, and GDPR for international research. Compyl maps one control library across every program from a single, connected platform.

Obligations

What does each program expect you to prove?

The recurring obligations behind campus compliance, with the program that sets each one.

Obligation	Program	Cadence	With Compyl
Certify research security training and run a research security program	NSPM-33 · CHIPS and Science Act · OSTP guidelines	Training: in effect at DOE, NSF, USDA, NIH, NASA; program: as each agency finalizes its policy	Four program elements tracked as controls with evidence
Attest to NIST SP 800-171 for controlled-access data	NIH	With each data access request, since Jan 25, 2025	110 requirements mapped, POA&M tracked
Protect federal student-aid data	GLBA Safeguards Rule (FSA)	Continuous, checked in the annual audit	Program, risk assessment, and controls evidenced
Safeguard patient and clinical research data	HIPAA (hybrid entity)	Continuous, with a current risk analysis	Health care components scoped, risk analysis current
Control access to education records	FERPA	Continuous, with annual notification	Access reviews and records-access evidence
Oversee vendors that touch campus data	GLBA §314.4(f) · HIPAA business associates · FERPA	At purchase and renewal	Vendors tiered, reviewed, and tracked
Validate payment controls	PCI DSS v4.0.1	Annual SAQ	Requirements mapped to live evidence
Notify after a breach	Dept of Education · HHS · state laws · GDPR	Varies by regulator; 72 hours under GDPR	Incident workflow with the notification record

Higher Education FAQ

Higher education questions, answered

What compliance do research universities need?

Research universities need a research security program, including research security training certification, if they average more than $50 million a year in federal research funding, NIST SP 800-171 for NIH controlled-access data and other protected research data, the GLBA Safeguards Rule for financial-aid data, FERPA for student records, HIPAA for academic medical centers and clinical research, PCI DSS for payments, and oversight of the vendors that touch campus data, plus export controls, state breach laws, and GDPR for international research. Compyl maps one control library across all of them.

What is a research security program, and when must universities certify?

NSPM-33 and the July 2024 OSTP guidelines require institutions averaging more than $50 million a year in federal research funding to run a research security program covering cybersecurity, foreign travel security, research security training, and export control training. Research security training certification is already in effect at DOE, NSF, USDA, NIH, and NASA. Full program certification starts once each agency finalizes its policy, and as of November 2026 none has. Compyl tracks each element as controls with evidence so the program is ready when the dates land.

Does NIH require NIST SP 800-171 for research data?

Yes, for controlled-access data. Since January 25, 2025, approved users of NIH controlled-access data must attest that their institution's systems meet NIST SP 800-171. Compyl maps and continuously evidences the 800-171 requirements for the systems and enclaves that hold that data.

Does Compyl support NIST SP 800-171 for federally funded research?

Yes. Compyl helps you stand up, map, and continuously evidence the NIST SP 800-171 requirements a research enclave needs, with a POA&M tracked to closure. DoD-funded projects that handle controlled unclassified information carry separate CMMC contract terms, which build on the same 800-171 controls.

How does Compyl help academic medical centers?

Most universities with a medical center are HIPAA hybrid entities. Compyl scopes the hospital, clinics, and clinical research as health care components on the shared control library, keeps the HIPAA Security Rule risk analysis current, and tracks business associate agreements and clinical research vendors, alongside GLBA, FERPA, and research controls for the rest of campus.

How does Compyl handle campus vendor risk?

Compyl gives procurement and security one place to assess the EdTech, cloud, and research vendors that touch campus data. Vendors are tiered by the data they handle, security questionnaires and SOC 2 reports stay with each vendor record, exceptions are tracked to closure, and re-reviews are scheduled at renewal, which supports GLBA service provider oversight and HIPAA business associate requirements.

How does Compyl help with the GLBA Safeguards Rule for financial aid?

The Department of Education requires institutions handling federal student-aid data to meet the GLBA Safeguards Rule and checks it in the annual compliance audit. Compyl maps your controls to each Safeguards requirement and continuously collects the evidence, so financial-aid data protection is provable on demand rather than assembled before a review.

Can one control library cover a whole decentralized campus?

Yes. Compyl brings research administration, the medical center, the registrar, financial aid, and distributed IT into one control library and evidence base. Because research security, 800-171, GLBA, HIPAA, and FERPA share many underlying controls, evidence collected once satisfies multiple mandates across the institution.

GRC your way

See Compyl mapped to your campus programs

One control library for research security, the medical center, and every campus mandate, with continuous evidence and your experts in control.

Request a demo All industries →

Last reviewed November 2026 by the Compyl GRC team