Georgia Southern receives perfect score on cybersecurity audit, gains access to increased research opportunities from the Department of Defense

Georgia Southern University researchers can now compete for federal funding, including Department of War (DoW) funding that requires strict cybersecurity protections, after the University’s Talon Secure virtual environment earned Cybersecurity Maturity Model Certification Level 2 certification.

With Talon Secure certified, Georgia Southern faculty can pursue larger DoW grants, support current DoW-funded projects and join defense companies as research partners or subcontractors. 

Inside Talon Secure, researchers can store and work with government information that is unclassified but still must be safeguarded, such as technical data tied to defense programs. The certification confirms the system meets federal requirements for protecting that information.

“Protecting sensitive research isn’t a box we check, it’s a standard we hold ourselves to every day,” said Georgia Southern Vice President for Research and Innovation David Weindorf, Ph.D. “This certification opens the door for our faculty to compete for consequential defense research, and it tells our federal partners they can bring that work to Georgia Southern with confidence.”

Talon Secure was reviewed by a Certified Third-Party Assessor Organization and earned a perfect score, with no deficiencies in any of the 14 security categories tested. Several Georgia Southern departments collaborated to prepare for the audit, including the Office of Research Integrity, Research Security and Export Controls (RSEC) and Information Technology Services.

Janny Crespo-Grow, Ph.D., director of RSEC, said the assessor described Georgia Southern’s performance as “the standard for what we should see in our assessments.” Crespo-Grow, part of the Office of Research Integrity, specifically credited Chief Information Security Officer Nic Carroll and his team, who “took point” in preparation.

Carroll highlighted the cross-divisional collaboration behind the audit.

“Preparing for the audit meant bringing together people from the Office of Research and Innovation, IT, information security and compliance to answer one honest question: ‘Does what we actually do every day match what our written procedures say we do?’” he said.

He added assessors tested 110 security controls against 320 assessment objectives. 

“The assessment confirmed our protections are followed in practice, not just written down, and that is what gives our researchers an environment they can trust,” Carroll explained.