Managing Regulated Research
Laws, U.S. Codes, and Regulation
There are numerous laws, U.S. Codes, and Regulations for each CUI type.
Develop a partnership with the Regulator Office. THEY are the experts on this subject.
The institution should map policies to regulatory requirements and address gaps.
Researchers should review the Acceptable Use Policy and the Incident Response Policy.
See the Laws, U.S. Code, and Regulation section of the CUI page for more.
Identifying and Marking CUI
Look for DFARS 52.204.7012 in contracts/grants. If included, determine if CUI is being generated or received. It is possible to not receive, generate, or access CUI; this could be fundamental research.
When CUI is created, there is a responsibility for identifying and marking CUI when applicable.
Want to learn more about marking? See: Introduction to Marking.
Jurisdiction
Determine which contractor you are working with (e.g. ITAR vs EAR). Work within their rules and regulations.
- Dissemination Limits?
- Restrictions on Participants?
- Publication Approvals?
The regulatory office should be reviewing these items and more.
Export Control
Export Controlled information is any information or data that is restricted from being shared outside of the United States. This would include, but is not limited to data for: ITAR, EAR, and OFAC.
Term | Definition |
---|---|
US Person |
|
Foreign Person | Everyone else, including foreign students on student visas(J and F) and foreign employees on H1-B or O visas |
Export |
|
Technology(EAR) & Technical Data(ITAR) | The terms used in regulations to mean controlled technical information. |
Deemed Export |
ANY disclosure of information or release of controlled technologies to a foreign person in the US is deemed to be an 'export' of that information or technology. Note: ANY method of disclosure would apply. Emails, texts, face to face, etc... |
Jurisdiction and Classification |
|
Setting up a Technology Control Plan(TCP) for Export Control
A TCP should provide clear guidelines and controls necessary to keep controlled technical data, information, and equipment that is subject to export control safe.
Things to consider while setting up a TCP:
- How is the CUI being received and/or generated
- How is the CUI being processed and/or stored
- Who will need access to the CUI?
- How will research results be shared with sponsors securely?
A TCP should additionally address
- Authorized Personnel
- Dissemination/Publication rules
- Physical Security
A TCP should at least be signed by the Principle Investigator and the projects team. It is also a good idea to have department heads and representatives from the regulatory office sign the TCP as well.
Export Control Regulations
The 3 most likely regulations to impact university activity are those of the State Department (ITAR), the Commerce Department (EAR), and the Treasury Department (OFAC). The following activities could be in scope:
- Performing Controlled or Proprietary Research
- Performing Research Outside the U.S.
- Travelling outside the U.S.
- Presenting at Conferences Outside the U.S.
- Hosting International Visitors
- Shipping Equipment, Software or Technical Information Internationally\
- Engaging in International Collaborations or Partnerships
- Paying Someone in Another Country for Items or Services
- Advising Students from Countries Subject to U.S. Comprehensive Sanctions
Export Control regulations apply to technical information as well as physical items - and when controlled information is given to a Foreign Person it is considered to be an export to that person's country, even if it happens in the US, even if it happens on a university campus.
When collaborating with people in other countries, emails are exports. When travelling, you're exporting everything you take with you. And, of course, shipping an item outside the U.S. is exporting. These could all lead to export control violations with consequences.
Keeping a TCP Current
Amend a TCP to keep it current. Some examples of situations where a TCP might need to be updated would be:
- Significant changes to the scope/project plan
- Personnel additions or deletions
- IT hardware additions or deletions
- IT storage or software changes
- Physical location change(office/lab changes)
- Significant changes to physical security
- Change to student thesis/dissertation committee or new plan of study submission
This work is supported by the National Science Foundation under Grant No. 1840043. Any opinions, recommendations, findings, or conclusions expressed are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.