Data Privacy, Cybersecurity & Research Security
Data privacy, cybersecurity, and research security cover the overlapping legal and technical frameworks that govern how research data, controlled technology, and personal information must be protected. This is one of the fastest-changing areas of research compliance, and this sub-cluster organizes it by the type of obligation involved: information-security controls, data-protection law, export controls, and the newer federal research-security requirements aimed at foreign-influence and interference risks. Information-security obligations for research handling federal controlled unclassified information are increasingly defined by NIST SP 800-171 and the associated Cybersecurity Maturity Model Certification (CMMC) framework used in Department of Defense contracting, while ISO/IEC 27001 provides an internationally recognized information-security-management-system standard many institutions adopt more broadly. Data-protection law includes the EU General Data Protection Regulation (GDPR), which governs research involving personal data of EU residents regardless of where the research is conducted, and the US Family Educational Rights and Privacy Act (FERPA), which protects student education records relevant to research conducted within academic institutions. Export-control law — the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR) — governs the transfer of controlled technology, software, and technical data, including to foreign nationals working within a US lab, known as deemed exports. A newer strand, federal research security, stems from National Security Presidential Memorandum 33 (NSPM-33), which directs federal agencies to require disclosure of research support and affiliations and to implement institutional research-security programs. Pages here cover how these frameworks intersect and where institutional responsibility for each typically sits.
Guides
ISO 27799:2016 in Healthcare and Clinical Research: Health Informatics Security Management, EHR Audit Trails, and ISO/IEC 27002
Technical guide to ISO 27799:2016 health informatics security management using ISO/IEC 27002, covering CIA profiles for clinical assets, EHR audit trail availability, and ISMS governance.
HIPAA Audit Log Requirements: 45 CFR § 164.312(b) Audit Controls, 6-Year Retention Rules, ASTM E2147 Events, and EHR Checklist
A regulatory and engineering compliance guide to HIPAA audit log requirements under 45 CFR § 164.312(b) (Audit Controls) and § 164.308(a)(1)(ii)(D) (Information System Activity Review), explaining the 6-year retention rule (§ 164.316(b)(2) / § 164.530(j)), ASTM E2147-18 and ONC § 170.315(d)(2) mandatory fields, and an audit log template.
NIST SP 800-66 Rev. 2: HIPAA Security Rule Implementation, NIST CSF Crosswalk, and HHS HPH Cybersecurity Performance Goals (CPGs)
Technical implementation guide to NIST SP 800-66 Revision 2 (2024): mapping the HIPAA Security Rule (45 CFR Part 164 Subpart C) to the NIST Cybersecurity Framework, NIST SP 800-53 Rev. 5, HHS 405(d) HPH CPGs, and Public Law 116-321 recognized security practices.
HITRUST CSF vs. SOC 2 Type 2 in Healthcare: Control Prescriptiveness, HIPAA Mapping, and ISO 27799 Compared
A structured comparison of HITRUST CSF Certification (e1, i1, and r2) and AICPA SOC 2 Type 2 attestation for healthcare organizations, clinical research platforms, and HIPAA Business Associates, including how both relate to the HIPAA Security Rule, ISO/IEC 27001, and ISO 27799.
Self-Sovereign Identity (SSI) in Healthcare: W3C DIDs, Verifiable Credentials, Patient Identity, and Physician Credentialing
How Self-Sovereign Identity (SSI) in healthcare uses W3C DIDs and Verifiable Credentials for patient identity and physician credentialing.
Google Cloud Confidential Computing: Confidential VMs, GKE, Confidential Space, AMD SEV-SNP & Intel TDX in Healthcare
How Google Cloud Confidential Computing (Confidential VMs, GKE, and Confidential Space on AMD SEV-SNP & Intel TDX) protects HIPAA ePHI and AI in memory.
HIPAA Encryption Requirements: 45 CFR § 164.312 Technical Safeguards, Data at Rest vs. In Transit, NIST SP 800-111/800-52, and Breach Safe Harbor
Technical guide to HIPAA encryption requirements: 45 CFR 164.312 at-rest and in-transit rules, NIST SP 800-111/800-52, AES/TLS, and Breach Safe Harbor.
HIPAA Security Rule Changes (HHS OCR NPRM): Elimination of Addressable Specs, Mandatory MFA & Encryption, and 72-Hour Recovery
Detailed breakdown of the HHS Office for Civil Rights (OCR) HIPAA Security Rule Notice of Proposed Rulemaking (90 FR 898), covering the elimination of addressable implementation specifications, mandatory encryption and MFA, network segmentation, and 72-hour restoration timelines.
HIPAA-Compliant Email Encryption: 45 CFR § 164.312(e), Microsoft 365 & Google Workspace Setup, and Patient Consent
How HIPAA-compliant email encryption works under 45 CFR § 164.312(e), Microsoft 365 Purview OME and Google Workspace setup, and patient consent.
HIPAA Administrative Safeguards (45 CFR § 164.308): The 9 Standards, Contingency Planning, and Sanction Policies
Complete regulatory guide to the nine HIPAA Security Rule Administrative Safeguards under 45 CFR § 164.308, detailing Security Management Process, Sanction Policies, Incident Procedures, Contingency and Disaster Recovery Plans, and Business Associate Contracts.
AWS HIPAA Compliance: Shared Responsibility, HIPAA-Eligible Services, BAA Execution, and Multi-Cloud Architecture
How healthcare organizations and clinical research teams configure HIPAA-compliant cloud infrastructure across AWS, Microsoft Azure, and Google Cloud using Business Associate Agreements (BAAs), HIPAA-eligible services, and encryption controls.
ISO/IEC 27018:2019: Cloud PII Processor Privacy Controls in Healthcare and Clinical Research
How ISO/IEC 27018:2019 extends ISO/IEC 27001 and 27002 to govern public cloud service providers acting as PII processors, prohibiting secondary commercial or AI training use of clinical and research data.
HIPAA Physical Safeguards (45 CFR § 164.310): Facility Access, Workstation Security, Device & Media Controls, and Audit Checklist
Complete regulatory reference and audit checklist for the four HIPAA Physical Safeguards under 45 CFR § 164.310: Facility Access Controls, Workstation Use, Workstation Security, and Device and Media Controls (including NIST SP 800-88 ePHI media disposal).
HIPAA Technical Safeguards (45 CFR § 164.312): The 5 Standards, Required vs. Addressable Specs, and Compliance Checklist
Complete regulatory breakdown and implementation checklist for the five HIPAA Security Rule Technical Safeguards under 45 CFR § 164.312 (Access Control, Audit Controls, Integrity, Person or Entity Authentication, and Transmission Security) mapped to NIST SP 800-66 Rev. 2.
NIST SP 800-88 Rev. 1: Media Sanitization (Clear, Purge, Destroy), Cryptographic Erase, and HIPAA ePHI Disposal Checklist
How NIST Special Publication 800-88 Rev. 1 defines Clear, Purge, and Destroy media sanitization methods, Cryptographic Erase (CE) requirements for SSDs/NVMe and cloud block storage, Appendix G Certificates of Sanitization, and HIPAA 45 CFR § 164.310(d)(2) compliance.
HIPAA Violation Penalties: 4-Tier Civil Money Penalties (45 CFR § 160.404), Inflation Adjustments, and DOJ Criminal Tiers (42 U.S.C. § 1320d-6)
Statutory reference to HIPAA violation penalties: the four-tier Civil Money Penalty (CMP) schedule under 42 U.S.C. § 1320d-5 and 45 CFR § 160.404, annual inflation adjustments under 45 CFR § 102.3, DOJ criminal prosecution tiers under 42 U.S.C. § 1320d-6, and HITECH recognized security practices.
ISO/IEC 27701:2019 (PIMS): Privacy Extension to ISO 27001, PII Controller vs. PII Processor Controls (Annex A & B), and GDPR/HIPAA Mapping
Technical guide to ISO/IEC 27701:2019 Privacy Information Management System (PIMS): Clauses 5–8 extension to ISO/IEC 27001 and 27002, PII Controller (Annex A) vs. PII Processor (Annex B) control objectives, EU GDPR Annex D mapping, and HIPAA alignment for clinical research and EHR vendors.
Healthcare Cybersecurity: Threats, HHS 405(d) HICP, and Network Segmentation
How hospitals and clinical research institutions defend electronic health records and connected medical devices using HHS 405(d) Health Industry Cybersecurity Practices, HPH Cybersecurity Performance Goals, and HIPAA Security Rule safeguards.
MPC in Healthcare: Secure Multiparty Computation for Multi-Site Clinical Research
How secure multiparty computation (MPC) and cryptographic secret-sharing protocols allow hospitals, biobanks, and clinical trial networks to compute joint survival curves, regression models, and genome-wide association studies without transferring raw Protected Health Information.
Confidential Computing in Healthcare: Trusted Execution Environments (Intel SGX/TDX, AMD SEV-SNP, NVIDIA H100) and Federated EHR Research
Explain Confidential Computing in healthcare: hardware TEEs (Intel SGX/TDX, AMD SEV-SNP, NVIDIA H100), remote attestation, and federated EHR research.
RBAC vs. ABAC in Healthcare: EHR Access Control, HIPAA 45 CFR § 164.312, and Break-the-Glass Workflows
Technical comparison of Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) in healthcare EHRs, covering NIST SP 800-162, HIPAA minimum necessary rules, and Break-the-Glass emergency overrides.
HIPAA Breach Notification Rule (45 CFR §§ 164.400–414): Risk Assessment, Timelines, and Checklist
The HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D) requires covered entities and business associates to notify affected individuals, the HHS Secretary, and in larger incidents the media following a breach of unsecured protected health information.
HITRUST Certification (HITRUST CSF): e1, i1, and r2 Assessments, HIPAA Mapping, and Control Inheritance
Explain HITRUST CSF certification: e1, i1, and r2 assessment tiers, HIPAA Security Rule and NIST SP 800-53 mapping, and MyCSF cloud control inheritance.
SOC 2 Type 2 (Type II): AICPA Trust Services Criteria, Type I vs. Type II, and HIPAA Mapping in Clinical Research
A SOC 2 Type 2 (Type II) report is an independent CPA attestation engagement conducted under AICPA standard AT-C Section 205 that evaluates both the design suitability and the operating effectiveness of a service organization’s controls over a 6- to 12-month audit period across the five Trust Services Criteria.
HIPAA Security Rule: Safeguards, Implementation Specifications, and Risk Analysis (45 CFR Part 164 Subpart C)
Guide to the HIPAA Security Rule (45 CFR Part 164 Subpart C): administrative, physical, and technical safeguards, risk analysis, and NIST SP 800-66 Rev. 2.
Export License: When BIS Requires One, How to Apply and What Happens Next
Export license under the EAR: who issues it, SNAP-R filing, 15 CFR 750.4 review limits, validity and replacement rules.
HITECH Act: Overview, HIPAA Rules, and Compliance
The HITECH Act modified HIPAA by establishing breach notification rules, extending liability to business associates, and setting research data standards.
DDTC (Directorate of Defense Trade Controls): ITAR Registration and Reporting
What DDTC does, who must register under 22 CFR 122, the research exemption, and how voluntary disclosure works.
CMMC RP: What a Registered Practitioner Is, Costs, and Limits
CMMC RP (Registered Practitioner) explained from the Cyber AB page: role, fees, steps, RP vs RPA vs RPO, and why an RP cannot assess a client it helped.
CMMC CCA: Certified CMMC Assessor Requirements and Exam
CMMC CCA requirements from ISACA and the Cyber AB: CCP first, ATP training, the 150-question exam, fees, and when Tier 3 is needed.
CMMC Final Rule: 32 CFR 170, the DFARS Rule and the Four Phases
The CMMC final rule is two rules, 32 CFR Part 170 and a DFARS rule. Here is what each does and how the four phases are defined.
CMMC CAP: The CMMC Assessment Process Explained
The CMMC CAP is the Cyber AB procedural guide C3PAOs follow for Level 2 certification assessments: four phases, appeals, evidence retention and limits.
NIST SP 800-39: The Three-Tier Risk Management Approach
NIST SP 800-39 explained: four risk management components, three tiers, who it applies to, and how it relates to SP 800-30 and 800-37.
CMMC C3PAO: Authorization and Requirements
What a CMMC C3PAO is, how the Accreditation Body authorizes and accredits it, and what 32 CFR 170.9 requires of the organization.
NIST MEP (Manufacturing Extension Partnership): What It Is and How to Use It
NIST MEP explained: who runs the Manufacturing Extension Partnership, how its cost share works, and how a manufacturer reaches a state MEP Center.
CMMC CCP: Certified CMMC Professional Requirements and Fees
The CMMC CCP is the entry credential toward CCA. Who runs it now, the fees and windows, the Tier 3 check, CPE rules and role limits.
When Does a Conflict of Interest Occur for an Employee?
A conflict of interest arises under three federal tests: a direct and predictable financial effect, a covered relationship, or a real or apparent conflict.
NIST SP 800-160: Systems Security Engineering Guide
NIST SP 800-160 explained: Volume 1 vs 2, which revision is current, what the appendices contain, and how NIST says to use it selectively.
NIST SP 800-82 Explained: Guide to Operational Technology (OT) Security (Rev. 3)
NIST 800-82 Rev. 3 explained: what the OT security guide covers, what changed from Rev. 2, how it is organized, and where Rev. 4 stands.
NIST SP 800-60 Explained: Information Types
NIST SP 800-60 maps information types to FIPS 199 security categories: the two volumes, the four steps and the Rev. 2 draft status.
What Is NIST SP 800-53A? Assessment Procedures, Methods and Findings
NIST SP 800-53A Rev. 5 explained: assessment objectives, methods, depth and coverage, the S/O findings model, and the August 2025 release 5.2.0.
Examples of CUI: Categories in the Federal CUI Registry
Examples of CUI by National Archives Registry grouping, what counts as CUI, why it is not a classification, and how Basic and Specified differ.
ITAR Regulations: 22 CFR Parts 120-130, Part by Part
A Part-by-Part map of the ITAR regulations (22 CFR 120-130): who must register, what approvals apply, and what counts as a violation.
NIST SP 800-171A: Assessment Procedures for CUI
NIST 800-171A sets the assessment procedures for CUI requirements. Which edition applies, and how objectives, methods and findings work.
CMMC Level 3: Requirements and DIBCAC Assessment
What CMMC Level 3 requires under 32 CFR part 170: Final Level 2 first, a DIBCAC assessment of 24 NIST SP 800-172 requirements, and the 3-year cycle.
CMMC Scoping Guide: The Five Level 2 Asset Categories
How 32 CFR 170.19 sorts assets into five Level 2 categories, what each must document, and how external and cloud service providers are scoped.
CMMC Level 1 Self-Assessment: Steps, SPRS Entry and Annual Affirmation
How a CMMC Level 1 self-assessment works under 32 CFR 170: scoping FCI systems, the 15 safeguards, SPRS entry, annual affirmation and record retention.
NIST Privacy Framework: Functions, Profiles and Version 1.1
NIST Privacy Framework explained: five Functions, Profiles, Tiers, Ready-Set-Go steps and where Version 1.1 stands.
CMMC Level 2 Assessment: Self vs C3PAO, Scoring and POA&M Rules
How a CMMC Level 2 assessment works under 32 CFR 170: self-assessment vs C3PAO, the 0.8 POA&M ratio, six barred requirements and the 180-day closeout.
NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments
NIST SP 800-30 Rev. 1 sets a four-step, 15-task risk assessment process and leaves scales, tools and report format to the organization.
NIST SP 800-53 Rev. 5: Control Families, Baselines and Who Must Use It
NIST 800-53 Rev. 5 explained: the 20 control families, the 800-53B baselines, and when it is mandatory versus voluntary for research organizations.
DOE Sensitive Country List and Foreign National Access Under DOE Order 142.3
DOE Order 142.3 sets a risk-based approval process for foreign national access to DOE sites, information and technology, keyed to the Sensitive and Other Designated Countries List.
Alberta’s Health Information Act (HIA): Research Disclosure Requirements
How Alberta’s Health Information Act lets custodians disclose health data to researchers without consent under section 50, and how it differs from PHIPA, Alberta PIPA, and PIPEDA’s substantially-similar regime.
42 CFR Part 2: The Research Exception, Consent Rules, and How It Differs From HIPAA
42 CFR Part 2 protects substance use disorder patient records with a redisclosure prohibition stricter than HIPAA. This guide covers the research-disclosure pathway under Subpart D, the 2024 final rule’s HIPAA-alignment changes, and how Part 2 differs from a Certificate of Confidentiality.
The NIST AI Risk Management Framework: What It Means for Research Institutions
A plain explanation of NIST AI RMF 1.0 — its four core functions, why research institutions are building policy around it, and how its Measure function connects to content-provenance and AI-text detection in an academic-integrity context.
NIST Cybersecurity Framework 2.0: What It Actually Requires for a Federally Funded Research Lab
What CSF 2.0’s six functions (including the new Govern function) actually mean, how CSF 2.0 relates to NIST 800-171/CUI compliance obligations research offices already navigate, and what its Protect function requires at the endpoint level.
CMMC compliance for research institutions
What CMMC compliance obliges a research office to do: Level 1 vs Level 2, the 110 NIST 800-171 controls, CUI scoping, and where tooling stops.
“US Person” Status and Foreign National Access in Export-Controlled Research
Who counts as a US person under export control law, how the ITAR (22 CFR 120.62) and EAR (15 CFR 772.1) definitions differ, and what the determination means for foreign-national lab access and deemed exports.
Zero Data Retention for AI Tools in Research: How It Works and What It Doesn’t Cover
What OpenAI zero data retention (ZDR) actually does, the exact procedure to request and enable it on the API, and the specific gaps it leaves for HIPAA PHI, FISMA-covered data, and CUI in research settings.
Using AI With PHI in Research: HIPAA Rules and the BAA Question
ChatGPT and most AI tools are not HIPAA compliant by default. This guide covers when a Business Associate Agreement applies, which AI product tiers actually qualify, and how to handle PHI in research prompts safely.
Wolf Amendment: NASA Funding and Chinese Collaboration
The Wolf Amendment bars NASA, OSTP, and the National Space Council from spending appropriated funds on bilateral activity with China or a Chinese-owned company without a certified exception. This guide explains the statutory text, the certification process, and how it differs from ITAR and NSPM-33 research-security requirements.
Sanctions, Embargoes, and Countries of Concern in University Research
OFAC sanctions, BIS/ITAR export controls, the CHIPS Act’s countries of concern, and the DOJ’s Data Security Program under EO 14117 are four separate regimes, not one list. A decision guide mapping research activities — data sharing, shipping, payments, visiting scholars — to the regime, the office, and the list that applies.
SPRS Score: Calculating and Submitting Your NIST 800-171 Assessment
How to calculate an SPRS score under the DoD’s NIST SP 800-171 Assessment Methodology (110-point start, 5/3/1-point deductions) and how to submit it to the Supplier Performance Risk System under DFARS 252.204-7019/7020.
CUI Cover Sheets and Marking: A Working Guide
A working guide to CUI cover sheets, banner markings, and designation indicators — the required format under 32 CFR Part 2002 and the NARA CUI Registry, worked examples, and where DD Form 2923 fits.
NIST SP 800-171 and CUI in University Research
When DFARS 252.204-7012 flows down to a university award, NIST SP 800-171 and CUI safeguarding become real obligations — distinct from, and often confused with, the fundamental research exclusion. This guide covers triggers, control families, SSP/POA&M, enclave strategy, subaward flowdown, and Section 889.
ITAR and EAR Compliance for University Research
A compliance-framework overview of ITAR (22 CFR 120-130) and EAR (15 CFR 730-774) for research administrators: jurisdiction, EAR99, the fundamental research exclusion, deemed exports, restricted-party screening, and civil/criminal penalties, voluntary self-disclosure, and debarment under the AECA.
Writing an AI Acceptable Use Policy: Clauses, Scope and Enforcement
A working AI acceptable use policy is not an IT tool ban list. This guide sets out the ten clause types a research institution needs — from data classification and human accountability to funder compliance and enforcement routing — and where the NIST AI RMF and ISO/IEC 42001 fit around it.
What Are Dual-Use Items? EU and US Export Control Definitions
Dual-use items are goods, software, and technology usable for both civilian and military purposes. This guide defines them under EU Regulation 2021/821 and the US EAR/CCL/ECCN system, explains classification, and distinguishes dual-use items from Dual-Use Research of Concern (DURC).
What Is OSTP? The Office of Science and Technology Policy and Its Research Policy Role
What the White House Office of Science and Technology Policy (OSTP) is, the statute behind it, and the policy memos — Holdren, Nelson, NSPM-33, scientific integrity — that eventually become award terms and conditions.
BIS “Affiliates Rule” (50% Rule, Red Flag 29): What University Export-Control Screening Offices Must Do Before November 10, 2026
BIS’s Affiliates Rule automatically extends Entity List and Military End-User List restrictions to majority-owned affiliates. Suspended since Nov 10, 2025, it is due to reimpose on Nov 10, 2026 — here is what university export-control screening offices need to do to prepare, including the Red Flag 29 ownership-diligence duty.
Quantum Computing Export Controls: Deemed Exports and Foreign-National Access Rules for University Quantum Research
Quantum computing hardware, components, software, and technology were newly captured by US export controls in 2024. This guide walks through what that means for a university lab: which items are controlled, what a deemed export looks like on a quantum bench, and how the fundamental research exclusion interacts with foreign-national access.
Confucius Institute Closures and Rebranding: GAO Findings and What They Mean for Foreign-Influence Compliance
What GAO’s 2023 review of Confucius Institute closures actually found, how that differs from separate reporting on institute rebranding, and what both mean for ongoing foreign-influence compliance monitoring.
China’s PIPL and Cross-Border Data Transfer Rules for International Research
PIPL requires separate consent, a PIPIA, and one of three transfer mechanisms (CAC security assessment, SCC filing, or certification) before personal information can leave China — here is what applies to international research collaborations and why it matters.
EU Dual-Use Export Control Regulation 2021/821 and Internal Compliance Programmes
A guide to the EU’s dual-use export control regime for universities and research organisations: Regulation (EU) 2021/821, Commission Recommendation (EU) 2021/1700 on internal compliance programmes, and the 2025 Annex I control-list update.
RCAT: UK’s Research Collaboration Advice Team Explained
What the UK’s Research Collaboration Advice Team (RCAT) does, how institutions engage it for case-by-case national-security advice, and how it differs from the Trusted Research framework it helps institutions apply.
Brazil’s LGPD and Research Data: The Academic-Purpose and Anonymized-Data Exemptions
How Brazil’s LGPD (Law 13,709/2018) applies to research data: the Article 7/11 lawful bases for research bodies, the partial Article 4 academic-purpose exemption, the Article 12 anonymized-data exclusion, and the mandatory Encarregado (DPO) under Article 41.
PIPEDA and Academic Research Data: Federal vs. Provincial “Substantially Similar” Privacy Regimes
How Canada’s PIPEDA applies to academic research data, why it often is not the operative law for core university research, the s. 7(2)/7(3) research-and-statistical-study consent exception, and the substantially-similar provincial regimes in Alberta, BC, and Quebec.
UFIT and Australia’s Guidelines to Counter Foreign Interference in the University Sector
UFIT is the joint Australian government-university taskforce (established Aug 2019) behind the Guidelines to Counter Foreign Interference in the Australian University Sector — a co-designed, principles-based research-security framework, distinct from the UK’s Trusted Research guidance and the US’s agency-enforced NSPM-33 regime.
Canada’s NSGRP: Risk Assessment Form, Due Diligence, and the STRAC Sensitive-Technology List
How Canada’s National Security Guidelines for Research Partnerships (NSGRP) work: the Risk Assessment Form, the due-diligence process, the STRAC sensitive-technology list, and the rule against discrimination as a mitigation tactic.
Horizon Europe Research Security: “As Open As Possible, As Closed As Necessary” and Sensitive-Technology Screening
How Horizon Europe balances its default open-science principle against mandatory security appraisal and sensitive-technology screening, and how that EU framework differs from US research-security regimes like NSPM-33.
MFTRP Annual Re-Certification: What Senior/Key Personnel Must Do Every Year
The recurring annual MFTRP certification for senior/key personnel at NSF and NIH: deadlines, systems (Research.gov vs. RPPR), and what happens when it’s missed.
Empowered Official: The ITAR-Required Export-Control Compliance Role
22 CFR 120.67 defines the Empowered Official ITAR requires every DDTC-registered institution to designate: who can hold it, what independent sign-off authority it requires, and how it differs from a Research Security Officer or EAR compliance lead.
Whistleblower Protections for Reporting Export Control (EAR/ITAR) Violations in Research
Reporting an EAR or ITAR violation on a federally funded research project runs on different statutes than research-misconduct whistleblowing. This guide covers 41 U.S.C. 4712, the DoD-specific 10 U.S.C. 4701, False Claims Act anti-retaliation, DOJ’s 2024-2025 Corporate Whistleblower Awards Pilot Program, and exactly where a report should go.
“Covered Individual” Under NSPM-33: Who Qualifies and What They Must Disclose
Who counts as a “covered individual” under NSPM-33 and the CHIPS and Science Act, the Tier I/Tier II distinction, and exactly what biosketch, Current and Pending Support, MFTRP, and training disclosures each must make.
Insider Threat Program Mechanics Under NSPM-33: Behavioral Indicators and Reporting Channels
NSPM-33’s research security training element requires insider-threat awareness content and a reporting channel — a narrower obligation than NISPOM’s ITPSO-led Insider Threat Program. This guide covers the behavioral indicator categories a compliant training program should name and the reporting-channel mechanics (intake, confidentiality, escalation, non-retaliation, recordkeeping) that make a channel functional rather than nominal.
Deemed Export Screening at Lab Onboarding: A PI Checklist
A practical, step-by-step checklist for PIs and lab managers screening international students, postdocs, and visiting scholars (F-1/J-1/H-1B) for deemed-export risk before granting lab access — covers foreign-person status, visa documents, restricted-party screening, and Technology Control Plans.
Criminal Liability Under the Foreign Direct Product Rule: What Researchers Need to Know
The Foreign Direct Product Rule (15 CFR 734.9) extends U.S. export-control jurisdiction to foreign-made items built on controlled U.S. technology. This guide explains how FDPR works, when a violation becomes criminal rather than civil under 50 U.S.C. 4819, and how researchers and institutions can reduce exposure.
Restricted Research Designation: What It Means and How Institutions Manage It
What makes a project “restricted research,” who at an institution decides, and the operational controls that follow: publication review, technology control plans, restricted-access facilities, and foreign-national exclusion.
Countries of Concern Under the CHIPS and Science Act: What Research Restrictions Actually Apply
The CHIPS and Science Act’s own countries-of-concern list names China, Russia, Iran, and North Korea, plus a Secretary of State designation process, and triggers two specific research restrictions: the malign foreign talent recruitment program ban and Foreign Financial Disclosure Reporting.
5 Actions Required for EAR Compliance: A Checklist for Research Offices
A practical, five-item checklist for what a university EAR compliance program actually needs in place: written policy, restricted-party screening, deemed-export access controls, training, and recordkeeping.
Who Is Responsible for CUI Compliance at a University?
No single office owns CUI compliance at a university. This guide breaks down the distinct responsibilities of the institutional CUI program lead, the IT security office (NIST SP 800-171/CMMC), the sponsored programs office (contract flow-down), and the principal investigator.
Foreign Travel Security Policy: What Research Institutions Must Require Before International Trips
What a compliant NSPM-33 foreign travel security policy actually requires operationally: pre-travel disclosure and registration, destination and restricted-party screening, device and data-security precautions, and post-travel reporting.
ECCN Lookup Guide for Research Equipment: Self-Classification vs. BIS Commodity Classification (SNAP-R)
A practical, step-by-step guide to determining the Export Control Classification Number (ECCN) for research equipment — self-classification against the Commerce Control List, when to request a Commodity Classification from BIS via SNAP-R, and how this fits into university procurement and international shipping.
The Four Pillars of Export Control Compliance
The four operational areas most university export control programs are built around: cybersecurity and deemed-export controls, international travel screening, foreign talent recruitment program disclosure, and training.
NSPM-33 Research Security Program Requirements: The Four Mandated Elements
What NSPM-33’s four required research security program elements (cybersecurity, foreign travel security, training, export control) actually require institutions to build and operate.
Embargoed Countries List for Export Control: OFAC Sanctions and University Research
OFAC’s comprehensively-sanctioned countries list operates on different logic than EAR/ITAR, and universities that only screen for controlled technology can still hit an OFAC problem. This guide covers the current list and what it means for research collaboration, travel, and technology transfer.
DoD Component Decision Matrix: 2026 Foreign-Influence Risk Review
The DoD/DoW’s 2026 Component Decision Matrix screens fundamental research proposals for foreign-influence risk, expanding Prohibited Entity Lists from 4 to 13 and adding an equipment-sourcing restriction.
Thousand Talents Program and Research Security
China’s Thousand Talents Program, how it became the center of US research-security enforcement, the DOJ’s China Initiative prosecutions (including the Charles Lieber case), and the disclosure rules that replaced it.
ITAR US Munitions List (USML): What It Is and How It Applies to University Research
What the USML (22 CFR Part 121) is, its 21 categories, and how it applies to defense-related university research, controlled technical data, and deemed exports.
US-China Research Collaboration: Research Security and Compliance Concerns
US-China research collaboration compliance spans four overlapping regimes — undisclosed foreign talent programs, export control, federal/statutory disclosure requirements, and CFIUS investment screening. This guide orients institutions to how they fit together.
Malign Foreign Talent Recruitment Program (MFTRP): Definition, Disclosure, and Consequences
What makes a foreign talent recruitment program “malign” under the CHIPS and Science Act, the certification requirements this creates for federal grant applicants and recipients, and the consequences of non-compliance.
Export Control Reform and Research Security: What’s Changing and Why
A tracker of the legislative, regulatory, and agency-level reform activity reshaping how EAR, ITAR, and federal research-security requirements apply to US university research since 2022.
CMMC Compliance for Universities: A Guide for Research Institutions
A guide for research administrators on how CMMC 2.0 applies to universities, research institutes, UARCs, and FFRDCs that handle DoD-funded controlled unclassified information (CUI) — levels, scoping, assessment paths, and the phased rollout.
CMS Data Use Agreement (DUA) Mechanics for Research Data
How the CMS Data Use Agreement process works for researchers accessing Medicare and Medicaid claims data: LDS vs. RIF file types, the ResDAC application process, VRDC security requirements, permitted-use restrictions, and how it interacts with general HIPAA obligations.
NIH Foreign Subawards: PF5/UF5 Activity Codes and the 2025-2026 Policy Overhaul
How NIH regulates foreign components and subawards: the foreign-component definition, the new PF5/UF5 (and linked RF2/UL2) activity-code application structure effective January 2026, subrecipient monitoring, and disclosure duties.
Restricted Party Screening
Restricted party screening is the institutional process — not the lists themselves — of checking collaborators, vendors, visiting scholars, and students against the CSL, OFAC, and BIS/State restricted-party lists before engaging with them.
32 CFR Part 117 (NISPOM): A Guide for Universities with Classified Research
32 CFR Part 117 (NISPOM) sets the federal security requirements for facility and personnel clearances at institutions holding classified research contracts. This guide explains what it requires, who at a university it affects, and how it differs from export control.
ISO 27001 for Research Data Security
ISO/IEC 27001 is a general information security management standard, not a research-data standard — here is what it actually certifies, why funders and clinical trial sponsors increasingly reference it, how it relates to CoreTrustSeal and FAIR, and what certification involves.
GDPR and Data Protection Compliance in Research Involving Personal Data
How the GDPR applies to research involving personal data — Article 89 safeguards and derogations, the lawful bases available to research controllers, Article 9 special-category data rules, and pseudonymisation — connected to Data Management Plan practice.
Material Transfer Agreements (MTA): The Practical Process for Sharing Research Materials
The practical process behind a Material Transfer Agreement: standard US templates (UBMTA, NIH Simple Letter Agreement), who negotiates and signs, common IP and publication-rights sticking points, export control and biosafety overlays, and realistic timelines.
Export Control (EAR/ITAR) and International Research Collaboration
How the fundamental research exclusion under EAR and ITAR works, when export-controlled technology or technical data crosses that exclusion, deemed-export rules for foreign national researchers, and practical compliance steps for institutions running international collaborations.
EU AI Act: Obligations and Exemptions for Research Organizations
What the EU AI Act’s Article 2(6) research exemption actually covers, when it stops applying, and what research administration offices need to track as implementation phases in through 2026-2028.
