To protect the research enterprise, establish institutional oversight, and comply with federal laws and regulations pertaining to the management of Controlled Unclassified Information (CUI).
This policy applies to members of the campus community (including faculty, academic staff, civil service staff, students, postdoctoral appointees, visiting scholars, and visiting scientists) who receive, store, or otherwise manage CUI as part of their research activities.
This policy applies to research projects in which any or all of the following conditions apply:
(1) data or information is marked by the federal government as “Controlled Unclassified Information”
(2) data or information management requirements include adherence to NIST 800-171 standards (see NIST Special Publication 800-171 ) or the Cybersecurity Maturity Model Certification (CMMC)
(3) the grant or contract includes terms and conditions that require adherence to NIST 800-171 standards (see NIST Special Publication 800-171 ) or the Cybersecurity Maturity Model Certification (CMMC)
Office of the Chief Information Officer and Office of the Vice Chancellor for Research and Innovation
All members of the campus community who have a role in receiving, storing, or otherwise processing CUI for research purposes must:
Controlled Unclassified Information: Data or information used in a research project that are subject to federal regulatory requirements for CUI (32 CFR Part 2002, Controlled Unclassified Information; also see NIST Special Publication 800-171 and Cybersecurity Maturity Model Certification (CMMC)).
Principal Investigator: An individual vested by the university with the primary responsibility to independently design, conduct, and supervise sponsored projects awarded to the university; see CAM Policy RP-06, “Eligibility to Serve as Principal Investigator of an Externally-Sponsored Activity”.
System Security Plan: A system security plan is a document that describes security requirements for an information system and the security controls to meet those requirements consistent with NIST 800-171 Revision 2 or Revision 3 standards or Cybersecurity Maturity Model Certification (CMMC) requirements as applicable.
The Regulated Research Data Compliance Program documentation is available at https://go.illinois.edu/RegulatedResearchDataProgram.
The Vice Chancellor for Research and Innovation and the Chief Information Officer may jointly approve exceptions to this policy.
If campus approved environments are not suitable for a particular research project, the Principal Investigator (PI) may request approval to store or manage CUI on a system for which the PI has an approved System Security Plan consistent with NIST 800-171 standards or CMMC requirements as applicable.
Office of the Chief Information Officer, securitysupport@illinois.edu
Office of the Vice Chancellor for Research and Innovation, ovcri@illinois.edu