Working with Government Information
Overview
Government-sponsored research and other University activities may involve information provided by federal agencies, prime contractors, or other authorized organizations that is subject to specific safeguarding, dissemination, contractual, or regulatory requirements.
Government information may include Controlled Unclassified Information (CUI), Federal Contract Information (FCI), Government-Furnished Information (GFI), export-controlled technical information, or other government-provided or government-controlled information. Depending on the type of information and applicable requirements, administrative, technical, physical, or cybersecurity safeguards may apply that differ from those used for most academic research.
The Office of Research Security (ORS) assists researchers in identifying applicable research security, sponsor, export control, cybersecurity, contractual, and institutional requirements before government information is received, accessed, shared, stored, or used.
REQUEST A RESEARCH SECURITY REVIEW
Contact ORS Before You
Contact ORS before you:
- Receive non-public or controlled government information for a research project.
- Apply for or accept an award involving CUI, FCI, GFI, classified information, or other government-controlled information.
- Receive technical information from a federal agency or government contractor.
- Agree to contractual requirements governing the protection or dissemination of government information.
- Store, process, or transmit government information using University systems.
- Share government information with collaborators, subcontractors, consultants, or other organizations.
- Purchase or implement computing resources specifically intended to store or process government information.
- Are uncertain whether government information protection requirements apply.
Key Considerations
Government information may be provided directly by a federal agency, through a prime contractor, or under another authorized arrangement.
Examples include:
- Controlled Unclassified Information (CUI)
- Federal Contract Information (FCI)
- Government-Furnished Information (GFI)
- Classified information
- Export-controlled technical information
- Other government-provided information subject to safeguarding, dissemination, or access requirements
Each type of information may be subject to different safeguarding, dissemination, contractual, and regulatory requirements.
Government agencies and prime contractors frequently establish specific requirements governing how government information may be received, accessed, stored, shared, transmitted, and destroyed.
Researchers should review award documents, contracts, task orders, and other agreements to identify applicable information protection requirements before work begins.
ORS can assist researchers in identifying project-specific research security, export control, cybersecurity, and sponsor requirements.
Research Information Protection
Government information frequently requires safeguards beyond those used for most academic research.
Depending on the project, requirements may address:
- Access controls
- User authentication
- Information storage
- Encryption
- File sharing
- Physical security
- Visitor access
- Media protection
- Record retention
- Incident reporting
Researchers should ensure that government information is protected in accordance with applicable sponsor, contractual, and institutional requirements.
Some government research projects require the use of secure computing environments that satisfy sponsor, contractual, or federal cybersecurity requirements.
Depending on the project, researchers may need:
- Approved secure research computing environments
- Controlled access systems
- Multi-factor authentication
- Encryption
- Secure file storage
- Secure collaboration platforms
- Data Protection Plans
- Other project-specific cybersecurity safeguards
ORS coordinates with Research Computing and Informatics (RCI), the Information Security Office, and other University offices to assist researchers in implementing required safeguards.
Government information should only be shared with authorized individuals and organizations in accordance with applicable sponsor, contractual, regulatory, and institutional requirements.
Researchers should consider:
- Whether sharing is authorized.
- Who is authorized to receive the information.
- Whether additional agreements are required.
- Whether export control regulations apply.
- Whether secure transmission methods are required.
Researchers should consult ORS before sharing government-controlled information outside the research team or University.
Some government information may also be subject to U.S. export control regulations.
Export-controlled technical information, software, technology, or other controlled government-provided information may require additional safeguards or restrictions on access or transfer.
ORS can assist in determining whether export control requirements apply to a specific research project.
Related Guidance
| Related Guidance | Description |
|---|---|
| Controlled Unclassified Information (CUI) | Learn about federal safeguarding requirements applicable to Controlled Unclassified Information used in research. |
| Federal Contract Information (FCI) | Learn about Federal Contract Information, when it applies, and associated safeguarding requirements. |
| Research Information Classification | Learn how sponsor, contractual, regulatory, privacy, export control, and institutional requirements determine the appropriate protection for research data and information. |
| Sponsor & Agreement Requirements | Guidance for reviewing and complying with research security, export control, information protection, publication, and other project-specific requirements contained in sponsor solicitations, award terms, and research agreements. |
| Data Protection Plans | Guidance for developing, implementing, and maintaining sponsor-, contractual-, or institutionally required Data Protection Plans. |
| Secure Research Computing | Guidance for research requiring secure research computing environments, specialized storage, controlled access, or sponsor-required cybersecurity safeguards. |
| Sharing Research Information | Guidance for sharing research information, data, software, technology, technical information, presentations, publications, or other research outputs with collaborators, sponsors, companies, government agencies, or other third parties. |
| International Transfers (Shipments, Hand-Carry & Electronic Transmissions) | Guidance for shipping, mailing, hand-carrying, or electronically transferring research equipment, materials, software, technology, technical information, or research information internationally. |
| Protect Export-Controlled Equipment, Technology, & Information | Guidance for protecting export-controlled equipment, materials, software, technology, technical information, and other research assets from unauthorized access. |
Frequently Asked Questions
Does all federally funded research involve government information?
No. Most federally funded research does not involve government information requiring project-specific safeguarding controls. Additional requirements generally apply only when identified by the sponsor, contract, information markings, or other applicable federal requirements.
What is Controlled Unclassified Information (CUI)?
CUI is government information that requires safeguarding or dissemination controls pursuant to federal laws, regulations, or government-wide policies.
Not all government information is CUI, and not all federally funded research involves CUI.
Can government information be stored on any University computer?
Not necessarily.
Depending on the sponsor, contract, and type of government information involved, specific technical, administrative, and physical safeguards may be required before government information is stored or processed.
May I share government information with collaborators?
Possibly.
Sharing government information depends on the sponsor's requirements, contractual restrictions, applicable regulations, and the authorization of the receiving individual or organization.
Researchers should consult ORS whenever they are uncertain whether sharing is permitted.
Need Assistance?
Contact ORS if your research will involve non-public or controlled government information and you are uncertain whether sponsor, contractual, cybersecurity, export control, information protection, or other institutional requirements apply.