Edit: y’all are great for dragging someone who came here for help because they clearly have no idea what they’re talking about and for downvoting everyone who actually gave decent advice. I wasn’t looking for a payday, this is my first time working with secure data, so I don’t know what is or isn’t okay and any obligation I might have to report.

Throwaway for obvious reasons.

I was just fired from a state university on Monday and I haven’t received any guidance on how/where to surrender my CUI endpoints. My last day is supposed to be today and still crickets. I work from home but am within driving distance of the university.

I have two CUI machines. One is a ThinClient where I connect to the remote CUI endpoint server. The other is a MacBook where the MacBook itself was the CUI endpoint, instead of a remote server. For both machines, I would use my regular home Ethernet or WiFi, respectively, without being required to connect to a VPN. Edit: I forgot that everyone on my team used to share the same server on the ThinClient until we were separated into different servers about a month or two ago.

The thing about the MacBook is that it’s been collecting dust in my house for about 8 months now. We had a CUI (compliance officer?) who issued the MacBooks to the team I was on, but he threw up his hands and refused to implement the new CUI requirements this year, he didn’t collect our MacBooks, and nobody replaced him. We have a CMMC department, but they manage the ThinClients and not the MacBooks. I don’t know, it’s a whole thing and I haven’t been privy to the conversations between the CUI liaison on my team and CMMC and the MacBook guy. So the guidance from my team leaders has been to secure the MacBook and let it collect dust until we receive guidance on how to surrender them.

So, do I have a whistleblower case and, if so, should I whistleblow?

TLDR; a terminated employee hasn’t received any instructions on how/where to surrender their CUI endpoints and compliance has been questionable long before this point.