CICI: RDP: Supporting Controlled Unclassified Information with a Campus Awareness and Risk Management Framework

保护受控制的非机密信息(CUI)是13356号行政命令的要求，今天是国防和航空航天等部门的研究所必需的。对研究的监管要求将会增加，CUI的法规涵盖了农业、金融、法律记录和商业信息等类别。当与HIPAA和欧盟GDPR等大学已经看到的现有法规相结合时，一个定义明确和一致的使用受监管数据的框架对高等教育机构至关重要。该项目描述了一个经济高效的生态系统(Reed+)，用于管理符合园区环境合规性要求的受控数据。Reed+框架集成了NIST SP 800-171和其他相关的NIST出版物作为框架的基础。该框架可作为校园IT部门与安全法规和最佳实践保持一致的标准，并为受控研究项目办公室、人类受试者办公室和出口管制办公室的受控研究创建单一流程，并便于将受控研究轻松映射到CI资源。该框架使研究人员能够更快地获得新资助的项目，并在研究资金方面更具竞争力。使用学生开发的培训材料和指导，研究人员、管理员和校园IT现在能够更清楚地了解以前影响研究项目的复杂数据安全法规。通过该项目开发的生态系统可以与政府机构以及国防、航空航天和生命科学领域的行业合作伙伴建立新的合作伙伴关系。在提供网络基础设施和安全意识方面的经验和最佳实践通过会议、期刊和工作坊被记录下来，并与更广泛的CI和校园社区共享。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Protecting Controlled Unclassified Information (CUI) is mandated by the executive order 13356, and today is required for research in sectors such as defense and aerospace. Regulatory requirements for research will increase, with CUI regulations covering categories including Agriculture, Financial, Legal Records, and Business information. When combined with existing regulations already seen by universities, such as HIPAA, and the European Union's GDPR, a well-defined and consistent framework for working with regulated data is critical for institutions of higher education. This project describes a cost-effective ecosystem (REED+) to manage regulated data that meets the compliance requirements found in a campus environment. The REED+ framework integrates NIST SP 800-171 and other related NIST publications as the foundation of the framework. This framework serves as a standard for campus IT to align with security regulations and best practices, and create a single process for intake, contracting, and facilitate easy mapping of controlled research to CI resources for the sponsored programs office, human subjects office, and export control office. The framework allows researchers to experience faster intake of new funded projects and be more competitive for research dollars. Using student-developed training materials and instruction, researchers, administrators, and campus IT are now able to more clearly understand previously complicated data security regulations affecting research projects. The ecosystem developed from this project enables new partnerships with government agencies, and industry partners from the defense, aerospace, and life science sectors. Experiences and best practices in providing cyberinfrastructure and security awareness developed from this collaboration are documented and shared with the broader CI and campus community through conferences, journals and workshop.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.