Compliance & Governance

The Campus Cloud uses a shared responsibility model. The Landing Zone provides a compliance baseline; you are responsible for the controls that depend on your specific workloads and processes.

The Campus Cloud is designed to align with two key standards:

• UC Policy IS-3 — University of California information security policy. All Campus Cloud accounts must comply.
• NIST 800-171 — federal standard for protecting Controlled Unclassified Information (CUI). Required to receive federal research funding involving sensitive data.

Compliance Built Into Every Account

Every Campus Cloud account gets a baseline set of controls at creation:

• Audit logging of all API calls and console actions
• Detection controls for common misconfigurations (unencrypted storage, public access, missing MFA)
• Security monitoring via provider-native tools (Security Hub, Defender for Cloud, Security Command Center)
• Guardrails that prevent high-risk actions (deploying outside allowed regions, disabling audit logging, using root credentials)

These controls cover part of the NIST 800-171 requirements, but not all of them. You are responsible for the remaining controls that depend on your specific workloads and processes.

New and Imported Accounts Have NIST 800-171 Controls

New Campus Cloud accounts, and existing accounts imported into the Campus Cloud, will have full guardrails and NIST 800-171 controls applied on all three providers. You don’t need to request it — follow the standard procurement process.

On top of the baseline above, these accounts get additional controls:

• Additional detective controls check encryption, access, and network configuration
• Additional preventive controls block non-compliant configurations
• Regular automated compliance reports are available on request

If your research involves Controlled Unclassified Information (CUI) — such as federally funded research with export controls, or data subject to ITAR, HIPAA, or similar frameworks — these controls are a starting point. You are still responsible for the controls that depend on your workload.

Needing a Different Compliance Level

If you need a different compliance level — for example, a NIST 800-171 control gets in the way of your work, or your project has other requirements — contact the Cloud Team before you request or change your account. Email info@cloud.ucsb.edu or open a ServiceNow ticket and explain what you’re trying to do. The Cloud Team will work with you on options, and will bring in ITS Information Security if needed.

Migrating an Existing Account to NIST 800-171 Controls

If you already have a Campus Cloud account that doesn’t have the NIST 800-171 controls, you can migrate your account to the group of accounts that does — an Organizational Unit (OU) on AWS, a management group on Azure, or a folder on GCP. The Cloud Team can help with this process.

Email info@cloud.ucsb.edu to discuss your options, or open a ServiceNow ticket if you are ready to proceed.

Compliance Tracking Tool

The Cloud Team has developed a NIST 800-171 Controls Evaluation Spreadsheet that maps each NIST requirement to controls available in the Campus Cloud. It documents what the Campus Cloud Landing Zone provides, what local controls you own, and provides progress tracking with color-coded dashboards.

To request a copy: info@cloud.ucsb.edu

Cross-Provider Security Monitoring

Each provider’s security monitoring tools send findings to consolidated views:

• AWS: Security Hub aggregates GuardDuty, Config, and other findings.
• Azure: Microsoft Defender for Cloud provides the unified security posture.
• GCP: Security Command Center provides organization-wide findings.

In addition, Wiz is available for cross-provider security posture scanning. Contact the Cloud Team for details.

Account Compliance Requirements

Regardless of account type, every Campus Cloud account must:

1. Have administrative passwords secured and MFA enabled
2. Have valid alternate contacts (billing, security, operations)
3. Apply data classification tags to resources
4. Use the account only for UCSB business purposes in accordance with UC IS-3

For provider-specific controls, see: AWS Guardrails · Azure Guardrails · GCP Guardrails