Covered Applications
Overview
Federal agencies may restrict the presence or use of certain software applications on devices and information technology used to perform federally sponsored activities. These restrictions are intended to reduce cybersecurity risks and protect federal information and information systems.
Requirements may be established through federal laws and regulations, agency guidance, contracts, grants, cooperative agreements, or other award terms and conditions.
Researchers performing federally sponsored activities may be required to comply with restrictions on covered applications on University-owned or personally owned devices used to perform the sponsored activity.
The Office of Research Security (ORS) assists researchers in identifying when these requirements apply and coordinates with the appropriate University offices to support compliance.
What Are Covered Applications?
The term covered application may be used in federal requirements to identify software applications whose presence or use is prohibited or restricted on certain information technology.
One federal requirement, established under the No TikTok on Government Devices Act, restricts TikTok and certain successor applications or services developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.
Other federal agencies or award terms may establish additional restrictions on software, applications, or technologies.
Researchers should review the requirements applicable to their specific award and should not assume that the same restrictions apply to every federally sponsored activity.
When Might These Requirements Apply?
Covered application or similar software restrictions may apply when:
- Performing work under a federal contract or subcontract containing applicable restrictions.
- Performing research under a grant, cooperative agreement, or other award containing sponsor-specific application or technology restrictions.
- Using information technology subject to federal, sponsor, or contractual cybersecurity requirements.
- Using University-owned or personally owned devices to perform sponsored activities when those devices are within the scope of an applicable requirement.
- Other award terms or sponsor requirements restrict the presence or use of particular applications or technologies.
Applicable requirements depend on the sponsoring agency, award type, specific terms and conditions, information technology involved, and other circumstances of the activity.
Common Requirements
Depending on the applicable federal or sponsor requirement, researchers may be required to:
- Remove or refrain from installing covered applications on devices subject to the requirement.
- Refrain from using covered applications in connection with certain federally sponsored activities.
- Follow sponsor or contractual cybersecurity requirements.
- Use University-approved information technology or research computing resources.
- Coordinate with appropriate University offices regarding devices or systems used to perform covered activities.
The specific requirements depend on the applicable federal authority and the terms and conditions of the award.
Personally Owned Devices
Some federal requirements may apply to personally owned devices when those devices are used to perform covered activities.
For example, certain federal contract requirements apply to information technology used or provided by a contractor in performing the contract, including equipment provided by contractor employees, subject to the scope and exceptions established by the applicable requirement.
Researchers should not assume that personally owned devices are excluded from sponsor or contractual cybersecurity requirements.
How ORS Can Help
The Office of Research Security assists researchers by:
- Reviewing sponsor and award requirements.
- Determining whether covered application or similar technology restrictions apply.
- Helping researchers understand which research activities or devices may be subject to applicable requirements.
- Coordinating with the Information Security Office, Research Computing & Informatics (RCI), the Office of Sponsored Programs, and other University offices, as appropriate.
- Providing guidance throughout the life of the project.
Federal Requirements
Federal requirements addressing covered applications include Federal Acquisition Regulation (FAR) 52.204-27, Prohibition on a ByteDance Covered Application, which applies to certain federal contracts and subcontracts.
Federal agencies may also establish covered application or similar technology restrictions through grant, cooperative agreement, or other award terms and conditions.
Because requirements vary by sponsor and award and may change over time, researchers should contact the Office of Research Security for assistance determining which requirements apply to a specific project.
Need Assistance?
If your research is federally sponsored or you are uncertain whether restrictions on covered applications, software, or other technologies apply to your research activities or devices, contact the Office of Research Security.
ORS will assist in identifying applicable sponsor and award requirements and coordinate with the appropriate University offices to support compliance.