Controlled Information & Data Security

When research is subject to export controls, the university has obligations under federal law to protect the technology that comes from the research— including any information, data, and software— according to a complex set of regulations (as defined by ITAR, EAR, OFAC).  

See ORSEC’s Export Control Compliance Program Manual for more information. 

CUI was defined in Executive Order 13556 as information held by or generated for the Federal Government that requires safeguarding or dissemination controls. Research data and other project information that a research team receives, possesses, or creates during the performance of federally funded research may be CUI. The obligation to determine whether an award will involve CUI belongs to the federal sponsor; award documents should specifically identify CUI and applicable security requirements.  

As defined in Federal Acquisition Regulations (FAR) 52.204-21, federal contract information (FCI) is “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.”  

See OCG's Federal Contract Information (FCI) page for more information. 

CU Boulder's Large File Transfer service is a web tool that sends large files securely to any email address, on or off campus. This on-demand and automated transfer service is a secure solution for anyone sending large files, but particularly for researchers who share large datasets. Using LFT avoids sending files from email systems, improving performance, and reducing email storage. 

https://oit.colorado.edu/services/file-transfer-storage-infrastructure/large-file-transfer 

The Preserve is an environment available to researchers who engage in projects that contain confidential or highly confidential data. It is highly controlled to specifically protect research that must meet Cybersecurity Maturity Model Certification (CMMC)*, Controlled Unclassified Information (CUI) and certain Export Control regulations. 

https://www.colorado.edu/rc/secure-research-computing-resources 

Cybersecurity Maturity Model Certification program (CMMC) is a unified assessment model created by DOD in response to the growing threat of cyberattacks and data theft from the defense contractors. CMMC is designed to ensure that DOD contractors and subcontractors adequately safeguard sensitive government information.  

If your research is determined to be subject to export controls, ORSEC will work with you to create a Technology Control Plan (TCP), which will address the need for secure storage and transmission of controlled data.