Tier 1 Portrait: R1 and Large State Systems

Call-prep reference. Pull before any first meeting with an R1 or flagship state system account.

Recognition Cues

You're in Tier 1 if the institution carries Carnegie R1 or R2 classification and federal research expenditures above $50M annually. Large state systems — the University of California campuses, Big Ten flagships, land-grant research universities — qualify regardless of individual campus classification when the system office controls identity infrastructure decisions across multiple campuses.

Specific signals to confirm before the call:

• Active InCommon participant with a named federation contact in the InCommon registry, often a dedicated federation engineer or a senior identity architect who owns the Shibboleth deployment
• Federal research portfolio with at least one active CMMC-scoped contract or an NSF/NIH grant carrying explicit data security requirements
• Dedicated research computing infrastructure: HPC clusters, NSF ACCESS allocations, national lab partnerships, or DOE facility access that requires federated authentication
• Multi-college AD/LDAP environment where central IT runs the enterprise directory but individual colleges — Engineering, Medicine, Law — maintain their own OUs or shadow directories
• HECVAT 4.1.5 in active use, with a named information security office contact managing vendor assessments

What Hurts Right Now

The NSPM-33 July 2026 certification deadline is the live forcing function. Institutions receiving federal research funding must certify their research security programs — covering foreign talent recruitment controls, research data protection, and access governance — by July 2026. The certification requirement maps directly to identity infrastructure: who has access to what research data, under what conditions, with what audit trail.

Most R1s cannot answer that question cleanly today. An EDUCAUSE pulse survey from Q1 2026 found fewer than 35% of R1 institutions had completed a formal gap assessment mapping their identity governance posture to NSPM-33 requirements. The gap is not ignorance. Campus security teams understand the requirement. The gap is infrastructure: Shibboleth federations built to release attributes to library databases and learning management systems were not designed to produce the access audit logs NSPM-33 certification requires.

Three pain points are live simultaneously, and they compound.

Federally funded research certification gaps. The VP for Research's office is running a certification readiness process and discovering that central IT cannot produce a reliable roster of who has access to controlled research environments. Service accounts provisioned for research projects two or three years ago are still active. Visiting scholars from foreign institutions have eduPersonAffiliation attributes that were never updated when their appointments ended. The identity record and the research access record are not the same record, and the July deadline is forcing that gap into the open.

Shibboleth federation complexity at scale. The institution's InCommon federation footprint has grown to 80–120 service providers, many with custom attribute release policies negotiated individually over years. The metadata refresh process is manual or semi-automated. Adding a new SP — a research data repository that needs to verify CMMC compliance status, for instance — requires a ticket, a review, and a wait. At R1 scale this is not a minor inconvenience. It is a bottleneck actively slowing research computing access provisioning at the moment when speed matters most.

Decentralized AD/LDAP sprawl. The College of Engineering runs its own LDAP for research computing. The medical school has an AD domain that predates the central enterprise directory. The research computing cluster authenticates against a third directory stood up for an NSF grant and never decommissioned. Central IT knows these exist but does not have authoritative control over them. When the VP for Research asks "who has access to our ITAR-controlled research data," the honest answer from central IT is: we can tell you about the users in our directory.

These three problems are not independent. The Shibboleth federation cannot enforce access controls it doesn't know about, and it can't know about access in directories it doesn't govern. NSPM-33 certification requires a coherent answer to a question the current infrastructure was never built to answer.

Who's in the Room

The VP for Research is your most urgent champion, not the CISO. This is the most common misread at Tier 1. The CISO cares about NSPM-33. The VP for Research has to sign the certification, and the stakes are different: if the institution cannot certify, the consequence is the loss of federal research funding, not a security finding on a risk register. At an R1 with $200M in annual federal research expenditures, that is an existential threat to the research enterprise.

The VP for Research has budget authority, institutional urgency, and a July 2026 deadline that is not moving. They are also, in most cases, not a technologist, which means they need a trusted technical partner who can translate the identity infrastructure problem into certification readiness terms. Start there.

The committee structure at Tier 1 typically looks like this:

VP for Research — Certification accountability, research mission owner, budget authority for research security investments. Often the economic buyer for identity investments that can be framed as research security infrastructure. Currently under active pressure from federal program officers and their institution's research security officer. Call them first.

Central CIO — Infrastructure owner, InCommon federation operator, Shibboleth deployment owner. Technical authority. Will be asked to implement whatever the VP for Research decides to fund. May be a champion or a skeptic depending on whether they read the engagement as support or displacement of their team's work. Treat them as a co-architect, not a gatekeeper.

CISO — Compliance framing, risk register owner, HECVAT process owner. Typically a strong technical champion but not the economic buyer. Will be in the room for any vendor evaluation and will have detailed questions about federation architecture. Has strong opinions about Shibboleth.

Provost/CFO — Approves capital expenditure above a threshold (varies by institution; typically $500K–$1M for multi-year contracts at state universities). Rarely in early-stage conversations. Becomes relevant when the deal requires a budget exception or a multi-year commitment that exceeds the CIO's signing authority.

One structural note: at some R1s the CISO reports to the CIO; at others, directly to the Provost or CFO. At large state systems, the system office CIO may have authority over campus-level identity decisions, or may not. Verify the reporting structure before the first call. EDUCAUSE's published governance research and peer institution job postings are the fastest way to map this without asking directly.

The buying decision at Tier 1 is a committee decision. Shared governance is the actual mechanism by which resource allocation decisions get made at research universities, not a phrase for institutional caution. A champion in one office cannot close a deal without alignment across the others. Plan for it from the first meeting.

Sound Like You Belong

Use the vocabulary of the community, not the vocabulary of enterprise security. The signal that you've been in this space is not knowing what SAML is. It's knowing what eduPersonAffiliation means in the context of a research computing federation and why an incorrect value in that attribute can lock a postdoc out of an NSF ACCESS allocation during a grant deadline week.

Vocabulary that signals fluency:

InCommon — Reference it as the federation operator, not a membership organization or a vendor. Internet2 operates it. R1s treat InCommon participation as infrastructure, not a service subscription, and their federation relationships with peer institutions are not easily migrated.

eduPersonAffiliation — The attribute that governs access to federated services. "Member," "staff," and "affiliate" mean different things in different institutional contexts, and the affiliate category is where NSPM-33 compliance problems concentrate: visiting scholars, emeritus faculty, research collaborators from partner institutions.

Research computing federation — The specific context of federated access to HPC resources, national lab systems, and NSF ACCESS. Not the same as the enterprise federation, even when they share an IdP. Conflating them signals you haven't been in an R1 research computing environment.

CMMC — Cybersecurity Maturity Model Certification, effective November 2025 for DoD contractors. Relevant at R1s with defense research portfolios. CMMC Level 2 requires MFA and access control documentation that maps directly to the identity governance gaps NSPM-33 is also surfacing. When both requirements are live simultaneously, the identity infrastructure problem becomes urgent for two separate federal audiences.

REN-ISAC — The threat intelligence community for research and education networks. Mentioning it signals you understand that R1 security teams operate in a peer community with shared threat intelligence, not in isolation from their counterparts at Michigan or Georgia Tech.

HECVAT 4.1.5 — The current version of the vendor assessment toolkit as of early 2025. If you're being evaluated as a vendor, you'll fill one out. The data protection domain questions in 4.1.5 have expanded to cover access control and identity governance in ways that earlier versions did not. Get the version number right.

Reference EDUCAUSE and Internet2 by name as community governance bodies, not as conferences or trade associations. Treating them as optional is a tell.

Trust-Killers

Say any of these in the first three minutes and the call is effectively over.

"We can replace Shibboleth." Don't. Shibboleth is the institution's InCommon federation infrastructure, and the community that built and maintains it is represented in the room. The right frame is extension and coexistence. Institutions that have run Shibboleth for fifteen years have federation relationships, custom attribute release policies, and SP integrations that cannot be migrated in a quarter. Acknowledge the investment. Explain what you add to it.

"This is really a CISO conversation." Routing the conversation to the CISO before you've established urgency with the VP for Research signals that you're running a security-tool sale, not a research certification play. The CISO will evaluate you on technical merit. The VP for Research will evaluate you on whether you can help them certify by July 2026. Lead with the deadline, not the security architecture.

Quoting a community college case study. Tier 1 buyers know the difference between their environment and a 3,000-student institution with a single AD domain. If your reference customer doesn't have a research computing federation, a multi-college AD sprawl problem, and an InCommon footprint above 50 SPs, don't lead with them. The implicit message is that you don't understand the scale of the problem you're being asked to solve.

Treating shared governance as a procurement obstacle. Asking "who's the decision-maker here?" in a way that implies you're looking for one person to close signals that you've never sold into a research university. The committee is the decision-maker. Framing it as an obstacle tells everyone in the room you're going to be difficult to work with for the next 18 months.

Underestimating the deal cycle. Tier 1 deals run 12–24 months from first meeting to signed contract. Procurement at state institutions has specific windows. Budget cycles are annual. Shared governance requires alignment across offices that do not always agree on priorities. The stall conditions are predictable: a CIO or VP for Research transition mid-cycle, a competing capital budget priority triggered by a major research grant, or a Shibboleth community champion who surfaces an open-source alternative at the wrong moment. None of these are surprises if you've planned for them. All of them are fatal if you haven't.

The July 2026 deadline creates urgency. It does not compress the institutional decision-making process, and walking in expecting otherwise is its own kind of trust-killer.