Data Privacy, Cybersecurity & Research Security
Data privacy, cybersecurity, and research security cover the overlapping legal and technical frameworks that govern how research data, controlled technology, and personal information must be protected. This is one of the fastest-changing areas of research compliance, and this sub-cluster organizes it by the type of obligation involved: information-security controls, data-protection law, export controls, and the newer federal research-security requirements aimed at foreign-influence and interference risks. Information-security obligations for research handling federal controlled unclassified information are increasingly defined by NIST SP 800-171 and the associated Cybersecurity Maturity Model Certification (CMMC) framework used in Department of Defense contracting, while ISO/IEC 27001 provides an internationally recognized information-security-management-system standard many institutions adopt more broadly. Data-protection law includes the EU General Data Protection Regulation (GDPR), which governs research involving personal data of EU residents regardless of where the research is conducted, and the US Family Educational Rights and Privacy Act (FERPA), which protects student education records relevant to research conducted within academic institutions. Export-control law — the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR) — governs the transfer of controlled technology, software, and technical data, including to foreign nationals working within a US lab, known as deemed exports. A newer strand, federal research security, stems from National Security Presidential Memorandum 33 (NSPM-33), which directs federal agencies to require disclosure of research support and affiliations and to implement institutional research-security programs. Pages here cover how these frameworks intersect and where institutional responsibility for each typically sits.
Guides
SentinelOne pricing for universities, research institutes and trials units
SentinelOne pricing decoded: what Core, Control and Complete really include, Vigilance, minimum seats, education discounts and the reseller route.
Penetration Testing Cost: What Drives the Quote, and How to Budget for One
Penetration testing cost bands by scope — external, internal, web app, cloud and social engineering — plus a worked budget line for research institutions.
Compliance management software for institutions running several frameworks
Compliance management software compared for institutions running NIST 800-171, HIPAA, ISO 27001 and SOC 2 at once — what it automates, and what it cannot.
Security Awareness Training for Staff: What a Real Programme Contains
Cyber security awareness training for employees: modules, phishing simulation cadence, reporting — and the endpoint layer that catches what training misses.
Huntress vs CrowdStrike: managed EDR for institutions with no SOC
Huntress vs CrowdStrike for a research institute with no 24/7 SOC: what each really covers, what happens at 3am, and where Bitdefender GravityZone fits.
Bitdefender GravityZone Business Security vs Premium
Bitdefender GravityZone Business Security vs Premium: which tier a research institute needs for EDR, CMMC and NIST 800-171 — and when not to upgrade.
SOC 2 compliance cost: what a research group actually pays
What SOC 2 compliance cost really covers for a research core or university spinout: readiness, auditor fees, automation platform and remediation.
CMMC compliance for research institutions
What CMMC compliance obliges a research office to do: Level 1 vs Level 2, the 110 NIST 800-171 controls, CUI scoping, and where tooling stops.
The best patch management software for research and lab estates
How to choose patch management software for lab estates: maintenance windows, reboot deferral, third-party app coverage and reporting an auditor will accept.
Bitdefender GravityZone review for research institutions
GravityZone reviewed for research groups: what the tiers cover, why independent test results are the only real evidence, and the honest limitations.
EDR vs antivirus: which does a research group need?
How EDR differs from antivirus, why the difference matters after a breach, and how to decide which one your research data classification requires.
Endpoint security for research groups and small institutions
What EDR is, why research security requirements now expect it, and how to protect lab machines and controlled data without a security operations team.
“US Person” Status and Foreign National Access in Export-Controlled Research
Who counts as a US person under export control law, how the ITAR (22 CFR 120.62) and EAR (15 CFR 772.1) definitions differ, and what the determination means for foreign-national lab access and deemed exports.
Zero Data Retention for AI Tools in Research: How It Works and What It Doesn’t Cover
What OpenAI zero data retention (ZDR) actually does, the exact procedure to request and enable it on the API, and the specific gaps it leaves for HIPAA PHI, FISMA-covered data, and CUI in research settings.
Using AI With PHI in Research: HIPAA Rules and the BAA Question
ChatGPT and most AI tools are not HIPAA compliant by default. This guide covers when a Business Associate Agreement applies, which AI product tiers actually qualify, and how to handle PHI in research prompts safely.
Wolf Amendment: NASA Funding and Chinese Collaboration
The Wolf Amendment bars NASA, OSTP, and the National Space Council from spending appropriated funds on bilateral activity with China or a Chinese-owned company without a certified exception. This guide explains the statutory text, the certification process, and how it differs from ITAR and NSPM-33 research-security requirements.
Sanctions, Embargoes, and Countries of Concern in University Research
OFAC sanctions, BIS/ITAR export controls, the CHIPS Act’s countries of concern, and the DOJ’s Data Security Program under EO 14117 are four separate regimes, not one list. A decision guide mapping research activities — data sharing, shipping, payments, visiting scholars — to the regime, the office, and the list that applies.
SPRS Score: Calculating and Submitting Your NIST 800-171 Assessment
How to calculate an SPRS score under the DoD’s NIST SP 800-171 Assessment Methodology (110-point start, 5/3/1-point deductions) and how to submit it to the Supplier Performance Risk System under DFARS 252.204-7019/7020.
CUI Cover Sheets and Marking: A Working Guide
A working guide to CUI cover sheets, banner markings, and designation indicators — the required format under 32 CFR Part 2002 and the NARA CUI Registry, worked examples, and where DD Form 2923 fits.
NIST SP 800-171 and CUI in University Research
When DFARS 252.204-7012 flows down to a university award, NIST SP 800-171 and CUI safeguarding become real obligations — distinct from, and often confused with, the fundamental research exclusion. This guide covers triggers, control families, SSP/POA&M, enclave strategy, subaward flowdown, and Section 889.
ITAR and EAR Compliance for University Research
A compliance-framework overview of ITAR (22 CFR 120-130) and EAR (15 CFR 730-774) for research administrators: jurisdictional split, EAR99, the fundamental research exclusion, deemed exports, Entity List/Denied Persons List screening, travel risk, and penalties.
Writing an AI Acceptable Use Policy: Clauses, Scope and Enforcement
A working AI acceptable use policy is not an IT tool ban list. This guide sets out the ten clause types a research institution needs — from data classification and human accountability to funder compliance and enforcement routing — and where the NIST AI RMF and ISO/IEC 42001 fit around it.
What Are Dual-Use Items? EU and US Export Control Definitions
Dual-use items are goods, software, and technology usable for both civilian and military purposes. This guide defines them under EU Regulation 2021/821 and the US EAR/CCL/ECCN system, explains classification, and distinguishes dual-use items from Dual-Use Research of Concern (DURC).
What Is OSTP? The Office of Science and Technology Policy and Its Research Policy Role
What the White House Office of Science and Technology Policy (OSTP) is, the statute behind it, and the policy memos — Holdren, Nelson, NSPM-33, scientific integrity — that eventually become award terms and conditions.
BIS “Affiliates Rule” (50% Rule, Red Flag 29): What University Export-Control Screening Offices Must Do Before November 10, 2026
BIS’s Affiliates Rule automatically extends Entity List and Military End-User List restrictions to majority-owned affiliates. Suspended since Nov 10, 2025, it is due to reimpose on Nov 10, 2026 — here is what university export-control screening offices need to do to prepare, including the Red Flag 29 ownership-diligence duty.
Quantum Computing Export Controls: Deemed Exports and Foreign-National Access Rules for University Quantum Research
Quantum computing hardware, components, software, and technology were newly captured by US export controls in 2024. This guide walks through what that means for a university lab: which items are controlled, what a deemed export looks like on a quantum bench, and how the fundamental research exclusion interacts with foreign-national access.
Confucius Institute Closures and Rebranding: GAO Findings and What They Mean for Foreign-Influence Compliance
What GAO’s 2023 review of Confucius Institute closures actually found, how that differs from separate reporting on institute rebranding, and what both mean for ongoing foreign-influence compliance monitoring.
China’s PIPL and Cross-Border Data Transfer Rules for International Research
PIPL requires separate consent, a PIPIA, and one of three transfer mechanisms (CAC security assessment, SCC filing, or certification) before personal information can leave China — here is what applies to international research collaborations and why it matters.
EU Dual-Use Export Control Regulation 2021/821 and Internal Compliance Programmes
A guide to the EU’s dual-use export control regime for universities and research organisations: Regulation (EU) 2021/821, Commission Recommendation (EU) 2021/1700 on internal compliance programmes, and the 2025 Annex I control-list update.
RCAT: UK’s Research Collaboration Advice Team Explained
What the UK’s Research Collaboration Advice Team (RCAT) does, how institutions engage it for case-by-case national-security advice, and how it differs from the Trusted Research framework it helps institutions apply.
Brazil’s LGPD and Research Data: The Academic-Purpose and Anonymized-Data Exemptions
How Brazil’s LGPD (Law 13,709/2018) applies to research data: the Article 7/11 lawful bases for research bodies, the partial Article 4 academic-purpose exemption, the Article 12 anonymized-data exclusion, and the mandatory Encarregado (DPO) under Article 41.
PIPEDA and Academic Research Data: Federal vs. Provincial “Substantially Similar” Privacy Regimes
How Canada’s PIPEDA applies to academic research data, why it often is not the operative law for core university research, the s. 7(2)/7(3) research-and-statistical-study consent exception, and the substantially-similar provincial regimes in Alberta, BC, and Quebec.
UFIT and Australia’s Guidelines to Counter Foreign Interference in the University Sector
UFIT is the joint Australian government-university taskforce (established Aug 2019) behind the Guidelines to Counter Foreign Interference in the Australian University Sector — a co-designed, principles-based research-security framework, distinct from the UK’s Trusted Research guidance and the US’s agency-enforced NSPM-33 regime.
Canada’s NSGRP: Risk Assessment Form, Due Diligence, and the STRAC Sensitive-Technology List
How Canada’s National Security Guidelines for Research Partnerships (NSGRP) work: the Risk Assessment Form, the due-diligence process, the STRAC sensitive-technology list, and the rule against discrimination as a mitigation tactic.
Horizon Europe Research Security: “As Open As Possible, As Closed As Necessary” and Sensitive-Technology Screening
How Horizon Europe balances its default open-science principle against mandatory security appraisal and sensitive-technology screening, and how that EU framework differs from US research-security regimes like NSPM-33.
MFTRP Annual Re-Certification: What Senior/Key Personnel Must Do Every Year
The recurring annual MFTRP certification for senior/key personnel at NSF and NIH: deadlines, systems (Research.gov vs. RPPR), and what happens when it’s missed.
Empowered Official: The ITAR-Required Export-Control Compliance Role
22 CFR 120.67 defines the Empowered Official ITAR requires every DDTC-registered institution to designate: who can hold it, what independent sign-off authority it requires, and how it differs from a Research Security Officer or EAR compliance lead.
Whistleblower Protections for Reporting Export Control (EAR/ITAR) Violations in Research
Reporting an EAR or ITAR violation on a federally funded research project runs on different statutes than research-misconduct whistleblowing. This guide covers 41 U.S.C. 4712, the DoD-specific 10 U.S.C. 4701, False Claims Act anti-retaliation, DOJ’s 2024-2025 Corporate Whistleblower Awards Pilot Program, and exactly where a report should go.
“Covered Individual” Under NSPM-33: Who Qualifies and What They Must Disclose
Who counts as a “covered individual” under NSPM-33 and the CHIPS and Science Act, the Tier I/Tier II distinction, and exactly what biosketch, Current and Pending Support, MFTRP, and training disclosures each must make.
Insider Threat Program Mechanics Under NSPM-33: Behavioral Indicators and Reporting Channels
NSPM-33’s research security training element requires insider-threat awareness content and a reporting channel — a narrower obligation than NISPOM’s ITPSO-led Insider Threat Program. This guide covers the behavioral indicator categories a compliant training program should name and the reporting-channel mechanics (intake, confidentiality, escalation, non-retaliation, recordkeeping) that make a channel functional rather than nominal.
Deemed Export Screening at Lab Onboarding: A PI Checklist
A practical, step-by-step checklist for PIs and lab managers screening international students, postdocs, and visiting scholars (F-1/J-1/H-1B) for deemed-export risk before granting lab access — covers foreign-person status, visa documents, restricted-party screening, and Technology Control Plans.
Criminal Liability Under the Foreign Direct Product Rule: What Researchers Need to Know
The Foreign Direct Product Rule (15 CFR 734.9) extends U.S. export-control jurisdiction to foreign-made items built on controlled U.S. technology. This guide explains how FDPR works, when a violation becomes criminal rather than civil under 50 U.S.C. 4819, and how researchers and institutions can reduce exposure.
Restricted Research Designation: What It Means and How Institutions Manage It
What makes a project “restricted research,” who at an institution decides, and the operational controls that follow: publication review, technology control plans, restricted-access facilities, and foreign-national exclusion.
Countries of Concern Under the CHIPS and Science Act: What Research Restrictions Actually Apply
The CHIPS and Science Act’s own countries-of-concern list names China, Russia, Iran, and North Korea, plus a Secretary of State designation process, and triggers two specific research restrictions: the malign foreign talent recruitment program ban and Foreign Financial Disclosure Reporting.
5 Actions Required for EAR Compliance: A Checklist for Research Offices
A practical, five-item checklist for what a university EAR compliance program actually needs in place: written policy, restricted-party screening, deemed-export access controls, training, and recordkeeping.
Who Is Responsible for CUI Compliance at a University?
No single office owns CUI compliance at a university. This guide breaks down the distinct responsibilities of the institutional CUI program lead, the IT security office (NIST SP 800-171/CMMC), the sponsored programs office (contract flow-down), and the principal investigator.
Foreign Travel Security Policy: What Research Institutions Must Require Before International Trips
What a compliant NSPM-33 foreign travel security policy actually requires operationally: pre-travel disclosure and registration, destination and restricted-party screening, device and data-security precautions, and post-travel reporting.
ECCN Lookup Guide for Research Equipment: Self-Classification vs. BIS Commodity Classification (SNAP-R)
A practical, step-by-step guide to determining the Export Control Classification Number (ECCN) for research equipment — self-classification against the Commerce Control List, when to request a Commodity Classification from BIS via SNAP-R, and how this fits into university procurement and international shipping.
The Four Pillars of Export Control Compliance
The four operational areas most university export control programs are built around: cybersecurity and deemed-export controls, international travel screening, foreign talent recruitment program disclosure, and training.
NSPM-33 Research Security Program Requirements: The Four Mandated Elements
What NSPM-33’s four required research security program elements (cybersecurity, foreign travel security, training, export control) actually require institutions to build and operate.
Embargoed Countries List for Export Control: OFAC Sanctions and University Research
OFAC’s comprehensively-sanctioned countries list operates on different logic than EAR/ITAR, and universities that only screen for controlled technology can still hit an OFAC problem. This guide covers the current list and what it means for research collaboration, travel, and technology transfer.
DoD Component Decision Matrix: 2026 Foreign-Influence Risk Review
The DoD/DoW’s 2026 Component Decision Matrix screens fundamental research proposals for foreign-influence risk, expanding Prohibited Entity Lists from 4 to 13 and adding an equipment-sourcing restriction.
Thousand Talents Program and Research Security
China’s Thousand Talents Program, how it became the center of US research-security enforcement, the DOJ’s China Initiative prosecutions (including the Charles Lieber case), and the disclosure rules that replaced it.
ITAR US Munitions List (USML): What It Is and How It Applies to University Research
What the USML (22 CFR Part 121) is, its 21 categories, and how it applies to defense-related university research, controlled technical data, and deemed exports.
US-China Research Collaboration: Research Security and Compliance Concerns
US-China research collaboration compliance spans four overlapping regimes — undisclosed foreign talent programs, export control, federal/statutory disclosure requirements, and CFIUS investment screening. This guide orients institutions to how they fit together.
Malign Foreign Talent Recruitment Program (MFTRP): Definition, Disclosure, and Consequences
What makes a foreign talent recruitment program “malign” under the CHIPS and Science Act, the certification requirements this creates for federal grant applicants and recipients, and the consequences of non-compliance.
Export Control Reform and Research Security: What’s Changing and Why
A tracker of the legislative, regulatory, and agency-level reform activity reshaping how EAR, ITAR, and federal research-security requirements apply to US university research since 2022.
CMMC Compliance for Universities: A Guide for Research Institutions
A guide for research administrators on how CMMC 2.0 applies to universities, research institutes, UARCs, and FFRDCs that handle DoD-funded controlled unclassified information (CUI) — levels, scoping, assessment paths, and the phased rollout.
CMS Data Use Agreement (DUA) Mechanics for Research Data
How the CMS Data Use Agreement process works for researchers accessing Medicare and Medicaid claims data: LDS vs. RIF file types, the ResDAC application process, VRDC security requirements, permitted-use restrictions, and how it interacts with general HIPAA obligations.
NIH Foreign Subawards: PF5/UF5 Activity Codes and the 2025-2026 Policy Overhaul
How NIH regulates foreign components and subawards: the foreign-component definition, the new PF5/UF5 (and linked RF2/UL2) activity-code application structure effective January 2026, subrecipient monitoring, and disclosure duties.
Restricted Party Screening
Restricted party screening is the institutional process — not the lists themselves — of checking collaborators, vendors, visiting scholars, and students against the CSL, OFAC, and BIS/State restricted-party lists before engaging with them.
32 CFR Part 117 (NISPOM): A Guide for Universities with Classified Research
32 CFR Part 117 (NISPOM) sets the federal security requirements for facility and personnel clearances at institutions holding classified research contracts. This guide explains what it requires, who at a university it affects, and how it differs from export control.
ISO 27001 for Research Data Security
ISO/IEC 27001 is a general information security management standard, not a research-data standard — here is what it actually certifies, why funders and clinical trial sponsors increasingly reference it, how it relates to CoreTrustSeal and FAIR, and what certification involves.
GDPR and Data Protection Compliance in Research Involving Personal Data
How the GDPR applies to research involving personal data — Article 89 safeguards and derogations, the lawful bases available to research controllers, Article 9 special-category data rules, and pseudonymisation — connected to Data Management Plan practice.
Material Transfer Agreements (MTA): The Practical Process for Sharing Research Materials
The practical process behind a Material Transfer Agreement: standard US templates (UBMTA, NIH Simple Letter Agreement), who negotiates and signs, common IP and publication-rights sticking points, export control and biosafety overlays, and realistic timelines.
Export Control (EAR/ITAR) and International Research Collaboration
How the fundamental research exclusion under EAR and ITAR works, when export-controlled technology or technical data crosses that exclusion, deemed-export rules for foreign national researchers, and practical compliance steps for institutions running international collaborations.
EU AI Act: Obligations and Exemptions for Research Organizations
What the EU AI Act’s Article 2(6) research exemption actually covers, when it stops applying, and what research administration offices need to track as implementation phases in through 2026-2028.
