SDSC Sherlock FedRAMP release 2026-09-21 (web)
Citation
Kimberly Mann Bruch, San Diego Supercomputer Center (SDSC). “UC San Diego’s Sherlock Secure Cloud Advances Trusted Computing for Higher Education and Defense Research.” News release, Sept. 21, 2026. https://www.sdsc.edu/news/2026/PR20260921-FedRAMP.html. Read 2026-11-09.
Bottom line
- SDSC’s Sherlock Secure Cloud has FedRAMP Moderate equivalency and Cybersecurity Maturity Model Certification (CMMC) Level 2 certification. The release says UC San Diego is the only known higher education institution with both.
- Sherlock offers a shared-services model: partner institutions inherit most CMMC controls from its assessed cloud enclave instead of building their own.
Background
SDSC published this release on its news site. Sherlock is run by the Stack Science Division at SDSC. The release quotes its director. It describes the shared-services model, the split of duties with partner institutions, and the uses that Sherlock serves. It names three groups of users: higher education, research organizations and members of the Defense Industrial Base (DIB).
Key claims
- “The San Diego Supercomputer Center’s (SDSC) Sherlock Secure Cloud has achieved FedRAMP Moderate equivalency, making the University of California San Diego the only known higher education institution to pair that achievement with Cybersecurity Maturity Model Certification (CMMC) Level 2 certification.” (first paragraph)
- “Under Sherlock’s shared-services model, partnering institutions can inherit the vast majority of required CMMC controls from Sherlock’s assessed cloud enclave.” (A New Model for Higher Education CMMC Compliance)
- “Partnering organizations will remain responsible for institution-specific requirements, such as applicable personnel security and cybersecurity awareness training” (A New Model for Higher Education CMMC Compliance)
- “For many institutions, the annual cost of participating in Sherlock’s shared-services model may be comparable to the cost of adding only a limited number of staff” (Lowering the Barrier to CMMC Compliance)
- “Sherlock’s evolution from an internal UC San Diego capability to a national service provider reflects SDSC’s broader mission” (Extending UC San Diego’s Investment to the National Research Community)
- “The combination of secure cloud services and advanced research computing creates opportunities for organizations to conduct secure AI, machine learning, scientific computing and data-intensive research involving federally sensitive information.” (From Secure Research to Secure AI)
Evidence and method
An institutional news release. It states the two certifications and describes the service model. It lists six potential uses, among them federally funded research with Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). The cost claim compares the annual fee to the cost of “a limited number of staff”. It gives no figure.
Limits
The release gives no price, no capacity and no count of partner institutions. It does not say who assessed the FedRAMP Moderate equivalency or what “equivalency” means. The claim that UC San Diego is the only institution with both is “To our knowledge”, in the director’s words. SDSC Sherlock compliance (web) lists the same two items under Sherlock’s Government Services.