Define an oversight role on your project team to ensure the compliance and security requirements you own are maintained throughout the lifecycle of the project. This should be given to people with leadership roles within the project. Create a partnership with your IT, Regulator and Security offices. 

This will help reduce work related to compliance and security activities by allowing for effective communication with trusted parties.

Regulatory Oversight

Your institution regulatory office should be reviewing the following:

• Publication Approvals

• Restrictions on Participants

• Dissemination Limits

• Jurisdiction Review (EAR v. ITAR)

• Technology Review

• Foreign Sponsors

Researcher's Roles In Cybersecurity

Protection

• Protect People’s Privacy

• Protect Research Data

• Protect Systems, Update Software

Detection

• Look for Insider Threat

• Look for Malicious System activity using Antivirus

• Use Approved Networks

Mitigation

• Reduce incidents by using the defined processes

• Report IT security incidents promptly

• Reduce risk by keeping systems up to date

Institution's Role in Cybersecurity

Protection

• Security Awareness Program

• Data Security Plans

• Automated System Updates

Detection

• Have an Insider Threat Program

• Alert on Malicious Activity

• Centralized Event Logging

Mitigation

• Annual Regulatory Review

• Incident Response Policy and Procedures

• Track Risk



When working with Controlled Unclassified Information (CUI), you will be introduced to new terms, definitions and categories. The National Archives provides the information needed to learn the new concepts. Learning common terms will help you communicate to your regulatory office.

Identifying and Marking CUI

The DoD office or agency is responsible for identifying CUI. 



Look for DFARS clause 52.204.7012 in your contracts or Grants. If included, determine if you are receiving or generating CUI. It is possible you won’t receive, generate or access CUI. This could be Fundamental Research.



If you create CUI think about your responsibility for identifying and marking CUI when applicable.

Work with your Security Office to perform a security risk assessment for new and existing projects.

Prioritize your risk and document the process.

Review Risk Assessments at least yearly to ensure the reports stay current.

Manage risk, this includes accepted, unaccepted and risk with a temporary mitigation in place.

Cybersecurity Baseline for FCI

Federal Contract Information (FCI) has special cybersecurity requirements defined in FAR 52.204-21.

Review required safeguards to ensure the are performed. The requirements are basic cybersecurity protections. If your data is meant to be private and protected the safeguards should already be performed for your research programs.

You should have documented procedures to ensure the security controls are performed. Work with your IT department if you have managed systems.

Technology Control Plan (TCP) for Export Control (ITAR,EAR,OFAC)

A TCP is a plan to provide clear guidelines and controls deemed necessary to safeguard controlled technical data, information or equipment that is subject to export control regulations. Your institution should have a process for creating and or reviewing TCPs. Contact your regulatory office for more details.

There are several different export control regulations, but the 3 most likely to impact university activity are those of the State Department (ITAR), the Commerce Department (EAR), and the Treasury Department (OFAC). The following activities could be in scope:

• Performing Controlled or Proprietary Research

• Performing Research Outside the United States

• Traveling Outside the United States

• Presenting at Conferences Outside the United States

• Hosting International Visitors

• Shipping Equipment, Software or Technical Information Internationally

• Engaging in international Collaborations or Partnerships

• Paying someone in another country for items or services

• Advising Students from Countries subject to U.S. comprehensive sanctions

Technology Control Baseline

A Technology Control Plan should address:

• Authorized personnel

• Dissemination and publication rules (including how to handled student theses that may result from the controlled research)

• Physical security

• Information technology security

• Plans should be signed, by at least the Principal Investigator and the projects team. It is good to have Department Heads and representatives from your regulatory offices to sign as well.

To keep the TCP current, amend the document for:

• Significant changes to the scope or project plan

• Personnel additions or deletions

• IT hardware additions or deletions

• IT storage or software changes

• Physical location (office or lab additions or change)

• Significant changes to the physical security

• Change to student thesis/dissertation committee or new plan of study submission.

Cybersecurity Baseline for CUI

The publication and supplemental material can be found at the 800-171 Re.2 publication.

800-171 Rev.2 provides the security requirements for protecting CUI when the information resides on nonfederal systems. All requirements in 800-171 Rev.2 must be addressed.

A system security plan (SSP) must be created and maintained. Review the plan at least yearly. Update the plan when changes arise to the protections or infrastructure. Use a change management process to help monitor changes and to record risk.

Exceptions or deficiencies to the security requirements are managed using a plans of action. This document helps you manage risk, don’t use it as a supplement to implementing controls

Self attest to compliance. 800-171A provides assessment procedures and a methodology for conducting assessments of the CUI security.

To meet compliance you will need to work with your institution, start with your security and policy offices along with your regulatory offices.

System Security Plan (SSP) for CUI

The goals for a System Security Plan:

• Record system categorization

• Define owners for the data, system and security.

• Provide a genal description and purpose for the system.

• Describe the environment

  • Hardware components

  • Software components

  • Maintenance Options

• Status of the required security controls.

  • Implemented

  • Planned to be implemented

  • Variance to the original control

• Diagrams:

  • System Boundaries

  • System Interconnections

  • Key Devices

  • Network Boundaries

  • Data Flow

Additional Plans to Consider

Have a plan to deal with publication restrictions or to track approvals.

Have a plan to deal with potential shipping restrictions.

If you have CUI specified there could be additional handling controls outlined by an agencies that differ from those for CUI Basic.

Configuration Management

Create or adopt a change management process, meet regularly and record and track changes to:

• Information Systems

• Installed software

• Process Workflows

• User Permissions

• Data Sharing

Adjust the System Security Plan as needed.

Test the security and compliance controls prior to go live.

Create a security report outlining any findings.

Adjust any findings or determine if its safe to operate. Add the remaining findings to risk assessment or adjust the Security Plan.

Continue to work with all stakeholders to mature your practices and processes by identifying gaps and documenting gaps.

Ensure you strengthen the governance program by review the gaps and ensure you document the final response for future reference.

Staying Compliant

Systems, environments, and priorities will change, and this is important to provide appropriate growth. It is not up to one person to ensure compliance; all stakeholder are part of the process.

If you don’t have a strong governance model and buy in form senior leaders, staying compliant could be a struggle.