SDSC Sherlock compliance (web)
Citation
San Diego Supercomputer Center (SDSC), Sherlock Cloud Services. “Delivering bespoke, cloud-based solutions.” Services page, date not stated. https://sherlock.sdsc.edu/compliance. Read 2026-11-09.
Bottom line
- Sherlock has three regulated-data services: Cloud Services (HIPAA, FISMA, CUI, FERPA), Government Services (CMMC Level 2, “FedRAMP Moderate Equivalency”) and Data Services (HIPAA, FISMA, FERPA).
- Each service runs on named clouds. Every service includes the same system, security, compliance and personnel services.
Background
Sherlock is “Part of the SDSC Community” and “A UC San Diego Organization” (page footer). The address is /compliance, but the page is the services overview. It compares the three services by compliance standards, cloud support, use cases and users. SDSC Sherlock Cloud services (web) describes the first service in full.
Key claims
- Cloud Services: “HIPAA, FISMA, CUI, FERPA”; cloud support “AWS, Microsoft Azure, Google Cloud Platform, SDSC Datacenter”. (Cloud Services)
- Government Services: “CMMC Level 2, FedRAMP Moderate Equivalency”; cloud support “Microsoft Azure Government Cloud, Office 365 GCC High”. (Government Services)
- Government Services is for “Department of Defense (DoD) research projects, Interactions with government agencies, Secure data transfer, Contractual guarantees for storing data in US and limiting access to screened US persons.” (Government Services)
- Data Services runs on AWS and is for “Support for AI & ML researcher workloads, Analytics, reporting, and other institution critical data needs, Starting small and scaling as needed with low startup costs.” (Data Services)
- “Every Sherlock Solution Includes a Set of Common Services” (Features)
- Compliance and audit services include “SOC 2 Type 2, CMMC, FISMA”, “3rd party audits” and “Governance, risk & compliance (GRC)”. (Compliance & Audit Services)
- “Our solutions are staffed with and supported with vetted U.S. persons compliant with regulatory requirements” (Personnel Services)
Evidence and method
A service overview of about 600 words. It lists standards, clouds and service features. It gives no prices, customer counts or audit reports.
Limits
The page does not define “FedRAMP Moderate Equivalency” or say who assessed it. It gives no prices, GPU capacity or service levels.