Southwest Research Institute Achieves Independent CMMC Level 2 Cybersecurity Certification

Southwest Research Institute, the San Antonio-based applied research organization that works across automotive, aerospace, defense, and medical technology sectors, has completed Cybersecurity Maturity Model Certification at Level 2 - the first tier that requires an independent, third-party assessment rather than a self-attestation. The certification covers the Institute's Intelligent Systems Division and Mechanical Engineering Division.

The achievement positions SwRI as an early adopter of CMMC compliance during a period when the federal government is still implementing mandatory requirements for defense contractors. Companies working on federal contracts that involve controlled unclassified information will eventually be required to hold CMMC certification at the appropriate level; many are still working toward that goal.

What CMMC Certification Requires

The Cybersecurity Maturity Model Certification program was created by the U.S. Department of Defense to establish a consistent framework for verifying that contractors adequately protect sensitive government information. The program draws its technical requirements from the National Institute of Standards and Technology's Special Publication 800-171, which addresses security for controlled unclassified information in non-federal systems.

Level 2 certification requires satisfying 110 distinct security requirements spanning 14 domains: access controls, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.

The key distinguishing feature of Level 2 is that organizations cannot self-certify. An independently authorized Third-Party Assessment Organization (C3PAO) must conduct the audit and verify compliance. SwRI engaged that process and received certification valid for three years, with annual affirmations of ongoing compliance required in the interim.

What SwRI's Leadership Said

"Our leadership has made a significant investment into CMMC," said Stephan Polinsky, SwRI's chief information security officer. "SwRI is working to integrate these practices into business lifecycles to ensure consistent adherence to secure procedures across the organization for years to come."

Dr. Steve Dellenback, vice president of the Intelligent Systems Division, emphasized the value of the independent verification component. "This independent assessment demonstrates a commitment to the rigor of the process. We are proud to be an early adopter and to have achieved the Level 2 certification."

Dr. Barron Bichon, vice president of the Mechanical Engineering Division, framed the certification in terms of client benefit: "Adhering to the CMMC program increases our cybersecurity capabilities, allowing us to better protect our clients' data. And over time, the entire Institute and our clients will benefit through a culture that promotes maturing processes."

Context for the Defense Research Sector

SwRI performs research and development for government and commercial clients across transportation, energy, defense, space, and health sciences. Work involving government-classified or sensitive defense-related information requires demonstrable information security protections, and CMMC Level 2 addresses the middle tier of that requirement framework - organizations handling sensitive but unclassified defense information rather than classified material, which falls under a separate security regime.

The CMMC program has undergone several revisions since its introduction, and the timeline for mandatory compliance has been adjusted multiple times as the Department of Defense refined implementation details. The current version, CMMC 2.0, reduced the original five-tier structure to three levels and relaxed some requirements relative to the earlier draft. SwRI's certification under the current framework suggests the organization has positioned itself ahead of the compliance curve for federal contractors in its sector.

The three-year certification period and annual compliance affirmations reflect the program's recognition that cybersecurity is not a one-time achievement but an ongoing organizational practice.