Research Physical Security Baseline

Overview

Physical security is an important component of protecting research information, equipment, and research environments from unauthorized access, loss, theft, damage, or disclosure.

The Physical Security Baseline identifies basic physical security practices that support University research activities. These practices are generally appropriate for research that does not have additional physical safeguarding requirements established by a sponsor, contract, regulation, Data Use Agreement, or other obligation.

Research involving government information, export-controlled information, sponsor- or contractually restricted information, controlled-access research data, or other protected information may require additional physical safeguards.

The Office of Research Security (ORS) assists researchers in identifying project-specific physical safeguarding requirements and coordinates with the appropriate University offices when additional protections are required.

CONTACT ORS

Control Physical Access to Research Areas

Access to laboratories, offices, research facilities, and other areas containing research information or equipment should be limited to individuals with an appropriate University or research-related need for access.

Researchers should:

• Limit physical access to authorized personnel.
• Periodically review who has access to laboratories and other research spaces.
• Request removal or modification of access when personnel leave a project or no longer require access.
• Keep doors secured when research areas are unattended.
• Avoid sharing keys, access cards, or other access credentials.
• Promptly report lost or stolen keys or University identification cards.
• Follow University procedures for requesting and managing physical access.

Key and card access requests may be submitted through the FIXIT Work Request System.

Manage Visitors & Guests

Visitors, guests, service personnel, collaborators, and others who do not normally have authorized access to a research area should be appropriately managed.

Researchers should:

• Know who is entering research spaces and the purpose of the visit.
• Escort visitors when appropriate.
• Avoid providing visitors unnecessary access to research information, equipment, or restricted areas.
• Secure sensitive information before tours, demonstrations, maintenance, or other visits.
• Follow project-specific visitor requirements when additional access controls apply.

Projects involving export-controlled information, government information, sponsor restrictions, or other controlled information or equipment may have specific visitor authorization, documentation, or escort requirements.

Contact ORS before providing visitors access when you are uncertain whether additional requirements apply.

Protect Physical Research Information

Research information in physical form should be protected from unauthorized access, disclosure, loss, or theft.

Examples include:

• Laboratory notebooks.
• Printed research data.
• Engineering drawings and technical documentation.
• Research records.
• Portable media.
• Sponsor-provided documents.
• Government-provided information.
• Other physical research materials containing non-public information.

Researchers should:

• Minimize unnecessary printing of research information.
• Avoid leaving research records unattended in publicly accessible areas.
• Retrieve documents promptly from shared printers.
• Store non-public research information in appropriately secured locations when not in use.
• Dispose of research records and media using appropriate University procedures.
• Apply any additional physical storage or destruction requirements established by sponsors, contracts, regulations, or agreements.

Secure Research Equipment & Devices

Computers, portable devices, laboratory equipment, removable media, and other equipment used for research should be physically protected against unauthorized access, theft, or loss.

Researchers should:

• Secure laptops, portable devices, removable media, and other equipment when unattended.
• Avoid leaving research devices or media in unsecured public locations.
• Maintain awareness of equipment that stores or provides access to research information.
• Report lost or stolen University equipment promptly through applicable University procedures.
• Follow any project-specific requirements governing the physical location or use of research equipment.

Additional controls may be required for equipment containing or providing access to controlled or otherwise protected research information.

Maintain Appropriate Workspaces

Good physical security practices help reduce accidental disclosure and unauthorized access.

Researchers should:

• Keep research workspaces organized so missing documents, devices, or equipment can be more readily identified.
• Avoid leaving sensitive research information visible when a workspace is unattended.
• Secure research records, portable media, and devices when not in use.
• Position computer screens and research materials to reduce unnecessary viewing by unauthorized individuals.
• Avoid discussing sensitive or restricted research information in public or other inappropriate locations.

Working Outside University Research Spaces

Working in public locations, while traveling, or from other non-University environments can increase the risk of unauthorized access, loss, or disclosure of research information.

When working outside normal University research spaces:

• Maintain physical control of University devices and research materials.
• Avoid leaving devices, documents, or portable media unattended.
• Be aware of visual observation or "shoulder surfing."
• Avoid displaying sensitive research information where it can be viewed by others.
• Use University-supported computing and network resources when appropriate.
• Follow applicable University requirements for remote access and use of University information systems.

Additional restrictions may apply when working with government information, export-controlled information, controlled-access research data, or other information subject to sponsor, contractual, regulatory, or institutional requirements.

Laboratory Safety & Security

Physical security of research information is distinct from laboratory safety and the management of hazardous materials, biological materials, chemicals, radiation, and other regulated research materials.

Researchers should follow applicable University laboratory safety and security requirements administered by Environmental Health & Safety (EH&S).

A research activity may require both laboratory safety controls and research information protection measures.

When Additional Physical Safeguards May Be Required

The Physical Security Baseline does not replace project-specific safeguarding requirements.

Additional physical security measures may be required when research involves:

• Controlled Unclassified Information (CUI).
• Federal Contract Information (FCI).
• Classified information.
• Export-controlled information or equipment.
• Sponsor- or contractually restricted information.
• Controlled-access research data.
• Proprietary or confidential information.
• Information subject to a Data Use Agreement or confidentiality agreement.
• Other information subject to specific access, storage, handling, or dissemination requirements.

Depending on the project, additional requirements may include controlled research spaces, access authorization procedures, visitor controls, locked storage, physical access records, restrictions on portable media or equipment, or other project-specific safeguards.

Researchers should not assume that the baseline practices on this page are sufficient when a sponsor, contract, regulation, agreement, or other requirement establishes additional safeguards.

How ORS Can Help

The Office of Research Security assists researchers by:

• Identifying sponsor, contractual, regulatory, export control, and other physical safeguarding requirements.
• Determining when baseline practices are sufficient and when additional safeguards are required.
• Developing or coordinating project-specific safeguards, including Technology Control Plans or Data Protection Plans, when applicable.
• Coordinating with Research Computing & Informatics (RCI), the Information Security Office, Environmental Health & Safety, Facilities, the Office of Sponsored Programs, and other University offices, as appropriate.
• Providing guidance throughout the proposal, award, and research lifecycle.

Need Assistance?

If your research involves government information, export-controlled information, sponsor- or contractually restricted information, controlled-access research data, or other information subject to specific safeguarding requirements, contact the Office of Research Security before determining that the Physical Security Baseline is sufficient.

ORS will assist in identifying applicable requirements and coordinate with the appropriate University offices when additional physical safeguards are required.

CONTACT ORS