External Research Services & Service Providers

Before using an external research service, researchers should understand which legal entity will provide the service and where the work will actually be performed.

The organization issuing a quote, invoice, or agreement may not necessarily be the organization or location that performs all aspects of the service. Service providers may use affiliates, laboratories, data centers, subcontractors, or personnel in other locations, including outside the United States.

When relevant, researchers should understand:

• The legal entity providing the service.
• Where samples or materials will be sent.
• Where testing, analysis, processing, or other work will occur.
• Where research information or data will be stored or processed.
• Whether personnel outside the United States may access research information, software, technology, or other project resources.
• Whether affiliates, subcontractors, or other third parties will participate in providing the service.

ORS can assist in evaluating research security considerations associated with the service provider and locations involved.

External service providers may require Restricted Entity Screening before research information, data, samples, materials, software, technology, or other research resources are provided.

U.S. government restrictions may apply not only to organizations specifically identified on a restricted party or entity list, but in certain circumstances to other entities based on their ownership by listed or restricted parties.

ORS conducts appropriate screening and research security due diligence based on the parties and circumstances involved. Researchers are not expected to independently determine corporate ownership structures or the applicability of ownership-based federal restrictions.

Contact ORS when a proposed service involves a foreign provider, an unfamiliar organization, or another party that may present restricted entity or ownership concerns.

Consider what research information or data the service provider will receive, store, process, analyze, or otherwise access.

Additional requirements may apply to:

• Controlled Unclassified Information (CUI) or Federal Contract Information (FCI).
• Proprietary or confidential research information.
• NIH Controlled-Access Data.
• Export-controlled technology or technical information.
• Sponsor-controlled or contractually restricted information.
• Unpublished research information subject to specific access, use, storage, or security requirements.
• Other research information requiring enhanced safeguards.

Providing research information to an external service provider may also require review of the provider's computing, storage, security, access, or data-handling arrangements.

ORS coordinates with appropriate DoIT/SBM-IT, Research Computing & Informatics, privacy, contracting, and other offices when additional review is needed.

External services may require researchers to send biological samples, chemicals, research materials, specimens, equipment, prototypes, or other physical items to the service provider.

International shipments or transfers may be subject to U.S. export controls, economic sanctions, customs, shipping, biological material, or other requirements.

Researchers should determine where samples and materials will be sent and whether they may subsequently be transferred to another laboratory, affiliate, subcontractor, or location.

Contact ORS before sending potentially export-controlled research materials or other items requiring research security review outside the United States.

Providing a service provider with software, source code, designs, specifications, technical information, technology, or access to research systems may create requirements that are different from those associated with sending ordinary research data.

Under U.S. export control regulations, certain shipments or transmissions outside the United States and certain releases of controlled technology or source code to foreign persons may constitute exports.

ORS can determine whether the proposed service involves export-controlled software, technology, technical data, or other items and whether authorization or additional safeguards are required.

A service provider's U.S. address, U.S. subsidiary, U.S. contracting entity, or U.S. billing location does not necessarily mean that all aspects of the service will occur within the United States.

Research information, data, samples, materials, software, or technology may be transferred to or accessed from other countries through affiliated laboratories, personnel, subcontractors, data centers, or other service arrangements.

Before using an external service for research involving restricted or controlled resources, researchers should understand where the service will be performed and whether research resources may be transferred to or accessed from outside the United States.

ORS can review proposed international transfers and determine whether export control, sanctions, research security, sponsor, or other requirements apply.

Federal awards, industry-sponsored research agreements, data use agreements, nondisclosure agreements, and other research agreements may establish requirements affecting the use of external service providers.

Requirements may address:

• Where research information or data may be stored or processed.
• Who may access project information or technology.
• Use of subcontractors or third-party providers.
• Cybersecurity or information protection standards.
• Export control or citizenship requirements.
• Geographic or foreign access restrictions.
• Confidentiality and data use.
• Approval or notification before using an outside provider.

Researchers should not assume that a commercially available service is permitted for a particular research project simply because the service is generally available.

ORS can assist in identifying research security-related requirements and coordinate with Sponsored Programs, contracting offices, DoIT/SBM-IT, Procurement, Legal, or other University offices as appropriate.