Trust
Trust
Regulatory Stack, Community Stack

The Research CIO's Regulatory Stack
Your R1 CIO is triaging three federal compliance clocks at once: NSPM-33 training tracking live at NIH since May, CMMC Level 2 assessments five months out with no university exemption, and a budget environment where court victories against indirect cost caps didn't restore the planning capacity lost fighting them. This is the pressure map. The companion piece covers the community conversations she's carrying alongside it.

The Research CIO's Community Stack
The companion piece maps the regulatory clocks your R1 CIO is managing. This one maps the community rooms she's in and the conversations she carries out of them. She's processing ACAMP federation friction debates, REN-ISAC's live MISP threat-sharing deployment, and an identity proofing conversation with no single clean standard. Reference these correctly and you signal fluency. Miss them and the regulatory knowledge from the companion piece lands without context.
Quoting "July 2026" Tells a Research CIO You Haven't Done the Work

NSPM-33 is a matrix of agency-specific deadlines, and every research CIO with significant federal funding has been tracking it for over a year. NIH's RSP certification obligation is already live. NSF's centralized process is still being finalized. DOE and DoD haven't published RSP certification dates at all. Quote "July 2026" as a single universal date in a Tier 1 meeting and you've told the room you read a summary instead of the source documents. One question fixes this. Start with their funding portfolio.
Quoting "July 2026" Tells a Research CIO You Haven't Done the Work
NSPM-33 is a matrix of agency-specific deadlines, and every research CIO with significant federal funding has been tracking it for over a year. NIH's RSP certification obligation is already live. NSF's centralized process is still being finalized. DOE and DoD haven't published RSP certification dates at all. Quote "July 2026" as a single universal date in a Tier 1 meeting and you've told the room you read a summary instead of the source documents. One question fixes this. Start with their funding portfolio.

Identity Proofing Sidebar

NIH's January 2027 CADR identity proofing deadline is already consuming cycles at campus IAM teams across the R1 landscape. InCommon is an approved NIH RAS broker, and over half of federation members have active NIH researchers. Eleven institutions finished the inaugural Identity Proofing Accelerator cohort this spring. The fall cohort is recruiting now.
Internet2's Ann West frames identity proofing as "a business problem that touches admissions, HR, the registrar, financial aid, and research administration all at once." Borrow that framing. It tells the CIO you see governance, not a config task.
