CICI: UCSS: Building a Community of Practice for Supporting Regulated Research

每日新闻清楚地表明，数据、个人和知识产权的安全和隐私受到越来越大的威胁。美国国防部修改了DFARS条款，要求在2017年分类并标记为CUI的数据必须遵循NIST 800-171。该计划的下一个演变被称为网络安全成熟度模型认证CMMC。其他机构，例如教育部，已经表示他们正在考虑遵循类似的路径来保护数据。虽然这些要求提高了各机构与承包商和受赠方之间数据处理的一致性，但却让学术机构自己想办法以符合其研究和教育使命的成本效益高的方式满足这些要求。大多数机构、代理商和公司都使用一次性的合同语言来解决数据安全和保护问题。监管研究实践社区（RRCoP）建立了一个能够相互帮助的网络，在学术机构实施负担得起但有效的网络安全和合规计划。尽管网络安全有一个明确而统一的目标，即保护数据，但单一的解决方案并不适合所有的学术机构。通过这个项目，RRCoP实现了1）开发网络安全培训资源，共享经过验证的和多样化的最佳实践。2)建立领导力培训和发展计划，加速分布式大学资源的可用性3）通过与行业和政府实体的战略伙伴关系发展代表性。RRCoP通过制定社区战略路线图、定期讨论和研讨会以及处理受监管研究项目的一般和特定资源库来支持该社区，从而降低了处理新法规的机构的准入门槛。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The daily news clearly shows the increasing threat to safety and privacy of data, personal as well as intellectual property. The Department of Defense modified the DFARS clause to mandate that NIST 800-171 be followed for data classified and marked as CUI in 2017. The next evolution of this program is called Cybersecurity Maturity Model Certification CMMC. Other agencies, for example, Department of Education, have indicated that they are considering following a similar path to safeguard data. While these requirements improve the consistency of data handling between agencies and contractors and grantees, it leaves academic institutions to figure out how to meet such requirements in a cost-effective way that fits the research and education mission of the institution. Most institutions, agencies, and companies act in isolation with one-off contract language to address data security and safeguarding concerns. The Regulated Research Community of Practice (RRCoP) builds a network of people able to help each other in implementing an affordable but effective cybersecurity and compliance program at academic institutions. Even though cybersecurity has a clear and uniform goal of protecting data, a onesize solution does not fit all academic institutions.Through this project, RRCoP accomplishes 1) Developing cybersecurity training resources that share validated and diverse best-practices. 2) Establishing a leadership training and development program accelerating availability of distributed university resources 3) Developing representation through strategic partnerships with industry and government entities. By supporting this community with development of a community strategic roadmap, regular discussions and workshops, and a repository of generalized and specific resources for handling regulated research programs RRCoP lowers the barrier to entry for institutions handling new regulations.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.