CICI: RDP: Supporting Controlled Unclassified Information with a Campus Awareness and Risk Management Framework

保护受控非机密信息（CUI）是第13356号行政命令规定的，如今国防和航空航天等领域的研究也需要保护。对研究的监管要求将会增加，CUI法规涵盖的类别包括农业、财务、法律的记录和业务信息。当与大学已经看到的现有法规（如HIPAA和欧盟的GDPR）相结合时，一个定义明确且一致的数据处理框架对高等教育机构至关重要。该项目描述了一个具有成本效益的生态系统（REED+），用于管理符合校园环境中法规遵从性要求的受监管数据。 REED+框架将NIST SP 800-171和其他相关NIST出版物整合为框架的基础。该框架作为校园IT的标准，以符合安全法规和最佳实践，并创建一个单一的流程，用于接收，签约，并促进受控研究到赞助项目办公室，人类受试者办公室和出口管制办公室的CI资源的轻松映射。该框架使研究人员能够更快地获得新的资助项目，并在研究资金方面更具竞争力。使用学生开发的培训材料和指导，研究人员，管理员和校园IT现在能够更清楚地了解以前影响研究项目的复杂数据安全法规。从该项目开发的生态系统可以与政府机构以及国防，航空航天和生命科学领域的行业合作伙伴建立新的合作伙伴关系。在提供网络基础设施和安全意识方面的经验和最佳实践通过会议、期刊和研讨会与更广泛的CI和校园社区分享。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Protecting Controlled Unclassified Information (CUI) is mandated by the executive order 13356, and today is required for research in sectors such as defense and aerospace. Regulatory requirements for research will increase, with CUI regulations covering categories including Agriculture, Financial, Legal Records, and Business information. When combined with existing regulations already seen by universities, such as HIPAA, and the European Union's GDPR, a well-defined and consistent framework for working with regulated data is critical for institutions of higher education. This project describes a cost-effective ecosystem (REED+) to manage regulated data that meets the compliance requirements found in a campus environment. The REED+ framework integrates NIST SP 800-171 and other related NIST publications as the foundation of the framework. This framework serves as a standard for campus IT to align with security regulations and best practices, and create a single process for intake, contracting, and facilitate easy mapping of controlled research to CI resources for the sponsored programs office, human subjects office, and export control office. The framework allows researchers to experience faster intake of new funded projects and be more competitive for research dollars. Using student-developed training materials and instruction, researchers, administrators, and campus IT are now able to more clearly understand previously complicated data security regulations affecting research projects. The ecosystem developed from this project enables new partnerships with government agencies, and industry partners from the defense, aerospace, and life science sectors. Experiences and best practices in providing cyberinfrastructure and security awareness developed from this collaboration are documented and shared with the broader CI and campus community through conferences, journals and workshop.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.