The InfoEd Human Subjects module supports the submission and review of human subjects research protocols and related activities.

Major updates to the Human Subjects Module were implemented on December 16, 2024.  The User Guides below apply to the updated application form and procedures.  The How To Materials apply to those who are still working with the old forms and procedures.

Most active studies will need to be migrated to the new form for the system to work as intended. Information and instructions, including important deadlines, are available in the Study Migration Guide.

USER GUIDES – NEW

• User Guide for Researchers
• User Guide for Department Reviewers
• User Guide for Ancillary Reviewers

HOW TO MATERIALS – OLD

• Show or list my existing human subjects IRB protocol applications.pdf Updated
• Search for an existing human subjects IRB protocol application.pdf Updated
• Create a new re-approval (continuation), amendment, protocol deviation, or adverse events submission for an existing approved human subjects IRB protocol.pdf
• Respond to a human subjects IRB protocol application that requires modifications to secure an approval determination.pdf
• Add institutional forms and upload supporting documents for a human subjects IRB protocol – All Submission Types.pdf
• Review and approve human subject IRB protocol routing submissions.pdf

 

For technical issues with InfoEd, please email era-support@UConn.edu.

The InfoEd IRB Module has been updated!

See the InfoEd Updates page for more information including training opportunities. 

User Guides are also available.

NEW studies with external funding and studies with more than 2 external collaborators/study personnel for which single IRB review (by UConn/BRANY) is being requested are now submitted to BRANY IRB.     Please visit the BRANY IRB tab under IRB Reliance for more information.

IRB Submission Platform

Applications to the IRB, including requests for review by BRANY IRB, requests for other external IRBs to serve as the reviewing IRB, and Human Subjects Research Determinations and requests are submitted using the Human Subject/IRB Module of the UConn InfoEd eRA Portal at https://www.infoed.uconn.edu.  The platform has undergone significant updates, users are strongly encouraged to consult the new User Guides before using the system.

Migration of Existing Studies to the New Application Form

The IRB module of InfoEd was updated on December 16, 2024, The system does not allow for an automatic migration of documents and information from existing InfoEd records. Additionally, the upgraded system includes questions built into the application that were not previously captured electronically. As such, currently approved studies will need to be manually transitioned by the investigator to the upgraded version. Please see the Migration of Study Information guide for details.

Adding Undergraduate Students to InfoEd

Undergraduate students are not auto-populated into InfoEd. Each undergraduate student must be manually added to the system. Click here to add undergraduate students to InfoEd prior to adding these students as personnel on a study. Adding the students before completing the application form will result in less time and effort completing the form as it can take 20 minutes for the student’s name to become available in the system.

Uploading CITI training completion reports to InfoEd

Please follow these instructions for uploading CITI completion reports.docx as part of your IRB protocol submission. Completion reports are only required when (1) adding UConn personnel who completed training elsewhere or (2) adding non-UConn personnel.

 

Submission Forms

The new IRB application form in InfoEd will ask you to upload certain supplemental forms and materials.  Be sure to check this page to ensure that you are using the current versions, most of our forms and materials have been updated or will be updated soon.  For assistance with preparing your IRB submissions, contact the IRB Office at irb@uconn.edu to schedule a help session. If you experience technical issues with InfoEd, please contact era-support@uconn.edu.

Human Subjects Research (HSR) Determination

Investigators who are unsure if their proposed activity constitutes “human subjects research” according to federal regulations, may submit a request for a Human Subjects Research (HSR) Determination through InfoEd. Investigators are especially encouraged to submit for a determination when there are plans for dissemination as requests for IRB documentation are increasingly common. Based on the information provided, the IRB Office will determine if the proposed activity meets the regulatory definitions of “human subjects” and “research” and either grant a Not Human Subjects Research (NHSR) letter or advise as to next steps regarding the need to secure formal exemption or approval from the IRB.

This form is also used for 45 CFR 46.118 certifications (aka Approval in Principle, Development Only, Delayed Onset).  A grant or contract may require certification of IRB approval as a condition of submitting for or releasing funds but before definitive plans for the involvement of human subjects have been fully developed (e.g., measures or tools need to be developed, animal studies are needed).  Refer to 4.1.15.2 in the NIH Grants Policy Statement or the NSF Proposal & Award Policies and Procedures Guide (PAPPG), Chapter II: proposal Preparation Instructions, Section E(5) for information.  Note that 45 CFR 46.118 certifications are not limited to proposals submitted to Federal Agencies.

Human Subjects Research (HSR) Determination Form

 

IRB Reliance Forms

Please see the IRB Reliance pages (IRB Reliance – General, BRANY IRB) for instructions and information about requests for external IRBs to serve as the IRB of record for a study and for requests for the UConn IRB to serve as the IRB of record for other entities (including UConn Health). Requests to cede review to an external IRB, including BRANY IRB, are initiated in InfoEd.  Requests for UConn to serve as the IRB of record for other entities are initiated outside of the system using the Request for UConn to Serve as the IRB of Record Form on the IRB Reliance – General webpage.

BRANY IRB template forms are available on the BRANY IRB webpage.

Cede Application Form

External Personnel Log

Request for UConn to Serve as the IRB of Record

 

Protocol Templates

A study protocol must be included with all applications to the IRB for expedited or convened board review. Protocols for exempt studies are optional at this time, but may be requested by the IRB staff when the application alone doesn’t provide sufficient detail.

Standard Protocol Template

Ethnographic Protocol Template

Repository Protocol Template

 

Supplemental Forms

Based on study specifics, the IRB Application Form may guide you to upload one or more supplemental forms.  A Data Security Assessment Form (DSAF) is required for all exempt, expedited, and convened board submissions.

Data Security Assessment Form UPDATED 06-12-2025

IND Assessment Worksheet

International Research Supplement

IRB Conflict of Interest (COI) Disclosure Form

Language Translation Certification Form

Request for HIPAA Waiver or Alteration

Sample Demographic Worksheet – for Continuations

 

Consent/Authorization Templates

Informed Consent Resource for Secondary Research with Data and Biospecimens.

Consent Checklist for Investigators.docx

 

For Non-exempt (Expedited, Full Board Review) Studies:

Adult Consent Form Template.docx

Simplified Consent Form Template.docx This template may be used in conjunction with the template for the adult consent form for people with communication disorders. Emily Myers, Ph.D. developed this form for research participants with communication disorders, such as aphasia, and generously provided permission for its use by others. This form or another method may be proposed when enrolling individuals with communication disorders where the process will help facilitate comprehension and enable participants to make informed decisions about research participation.

Parent Permission Form Template.docx (for participants under 18 years old)

Assent Form for Minor Participants.docx (under 18 years old)  Federal regulations do not dictate how minor assent is documented. This template is designed to be used with younger children with the content of the Adult Consent or Parent Permission Form used as a guide. The assent process should convey the information noted in the assent template using age-appropriate language. Use of this template is not required; Investigators should develop assent processes and forms that are appropriate for the population that they will enroll.  For example, when enrolling teens, it may be more appropriate to have an assent form that is similar to the Adult Consent or Parent Permission Form.

HIPAA Authorization Form Template.docx (A HIPAA Authorization Form is needed in addition to a research consent form when the research includes the access, use, or disclosure of Protected Health Information (PHI) unless a waiver of the requirement for authorization is approved or another exception applies (e.g., use of a Limited Data Set with a Data Use Agreement).

 

For Exempt/Limited Studies:

Exempt Study Adult Prospective Agreement/Consent Form Template.doc

Exempt Study Parent Prospective Agreement/Permission Form Template.doc (for participants under 18 years old)

Exempt Study Assent Form for Minor Participants.docx (under 18 years old)  Federal regulations do not dictate how minor assent is documented. This template is designed to be used with younger children with the content of the Adult Consent or Parent Permission Form used as a guide. The assent process should convey the information noted in the assent template using age-appropriate language. Use of this template is not required; Investigators should develop assent processes and forms that are appropriate for the population that they will enroll.  For example, when enrolling teens, it may be more appropriate to have an assent form that is similar to the Adult Consent or Parent Permission Form.

 

Recruitment Flyer Template

Important! When preparing an announcement for the Daily Digest, Lifeline or similar, please be reminded that online platforms often have character limits that could impact study postings; tag lines and headings should provide information about the study and should not emphasize that subjects are paid for participation. The IRB study number is required on any announcement.

Sample Recruitment Flyer Template (with tabs).docx

InfoEd IRB module updates were implemented on December 16, 2024.

The IRB Office is pleased to announce that the long-awaited updates to the IRB module of InfoEd were implemented on December 16^th. The updated system streamlines IRB submission and review processes, and makes it easier to keep track of your protocols.

 

IS TRAINING AVAILABLE?  Training sessions are available and open to all UConn faculty, staff, and students. Please contact Nick Lacafta (nicholas.lacafta@uconn.edu) for information about upcoming sessions. A recorded session will be made available soon for those unable to attend in person.

WHAT IS DIFFERENT?

• Consolidated Smart Forms: The prior electronic application forms (e.g., IRB-1, IRB-5, IRB-7, IRB-9) have been consolidated into a single Main Application form that uses logic to drive your experience. If the IRB determines that a different level of review is required, you will not need to start from scratch, you will simply modify the review type and answer the additional questions that populate.
• Responding to IRB Feedback: System enhancements make it easier for study teams to respond to IRB feedback. IRB staff can add pre-review comments directly into the electronic form for study team review and response. IRB staff can also compare new and historical versions of e-forms and the most documents uploaded within them reducing the need to submit clean and track changes versions of documents.
• Routing: Routing is automated; submitters will not have to add the PI and Department Head to the route for review and sign-off. Automated emails will inform study teams as the submission moves through routing and when it arrives to the IRB.
• Personnel Roles: Personnel roles (i.e., PI, Co-I, Student Investigator, Correspondent) drive who on a study team is able to edit, manage, and submit submissions to the IRB and who will be included on system messages and IRB correspondence. All submissions other than personnel changes and reportable events will be automatically routed to the PI for review and sign-off.
• Amendments: There are three types of amendments: Personnel Changes, Transition Amendments (for transitioning to the new form), and regular Amendments (for changes to the study itself or study materials). Only one amendment can be in process at any given time. Differentiating the amendment types allows the IRB office to identify personnel changes at a glance so that they can be prioritized.
• Ancillary Reviews:  Questions are now built into the application form that determine the need for most ancillary reviews (e.g., Privacy, Information Security) and automatically inform the responsible party that a review is needed.
• Reportable Information/Events: All reports of issues that arise during research or information that is required to be reported to the IRB are now reported using a single smart form. There are no longer separate forms for Adverse Events and Protocol Deviations.
• Administrative Check-Ins: Exempt studies, studies that do not require submission of a continuing review application, and studies overseen by external IRBs will receive periodic notices to either complete an administrative check-in or a study closure. This will allow the University to have current information about studies and to be able to accurately report.
• IRB Reliance: Requests for UConn to cede IRB review to another IRB, including BRANY IRB, will now be initiated in InfoEd. Requests for UConn to serve as the IRB of record for other entities are initiated outside of the system using the Request for UConn to Serve as the IRB of Record Form on the IRB Reliance – General webpage. Please see the IRB Reliance pages (IRB Reliance – General, BRANY IRB) for additional information.

WHAT DOES THIS MEAN FOR EXISTING STUDIES?

Most existing studies will need to be migrated to the updated application form for the system to work as intended. Migration will be required before continuing review or with the next submission to the IRB (for studies without continuing review). A Study Migration Guide with detailed information and instructions is available here: https://ovpr.uconn.edu/services/research-it/infoed/human-subjects-module/.

The following studies need to be migrated:

• Open studies that received approval or exemption determination from UConn Storrs IRB prior to the system updates (December 16, 2024);
• Open studies that were approved by an external, non-UConn IRB, that have a record in InfoEd.

The following projects do not need to be migrated:

• Research studies that are closed;
• Activities that received a Not Human Subjects Research (NHSR) Determination;
• Projects for which data collection is complete and the only remaining activities are data analysis;
• Projects that can be closed because they no longer involve human subjects.

Investigators are encouraged to close studies that are eligible for closure as soon as possible. Studies are eligible for closure when:

1. Enrollment is closed,
2. Interactions and Interventions with participants are complete,
3. Data collection is complete, and
4. Analysis of identifiable information and/or identifiable biospecimens for the purposes of the current research is complete.
5. When the UConn IRB is serving as the IRB of record for other sites, the study may be closed when all sites meet the above criteria.

Simply maintaining identifiable data/biospecimens without using, studying, or analyzing the data/biospecimens does not require an open protocol with the IRB.

WHERE CAN I LEARN MORE? 

The IRB Office (irb@uconn.edu) is always available to answer any questions you may have.

User Guides with step-by-step instructions are available including:

• Study Migration Guide
• User Guide for Researchers
• User Guide for Ancillary Reviewers
• User Guide for Department Reviewers

Researchers who travel domestically or overseas should be aware of security considerations that apply to themselves. Our office has provided a list of some useful travel tips for those of you who work on any sponsored research.  These tips are useful for any traveler and are often overlooked in the rush to acquire tickets, hotel reservations, visas, etc.

Please remember that secure research cannot be conducted outside the United States – this includes traveling with devices that may contain research.  Please contact us or the Export Control office with any questions as they may pertain to your situation: researchsecurity@uconn.edu or exportcontrol@uconn.edu

Depending on your travel situation, we are available to provide country-specific travel briefings.  Please contact our office researchsecurity@uconn.edu to arrange an agency briefing.

All university-sponsored international travel requests are routed through the Concur system, of which the Export Control office is part of the approval workflow for specific destination countries, to included sanctioned and high-risk countries.

Travelers to sanctioned countries are prohibited from taking regular use laptops, tablets, and/or university-provided equipment.

Loaner equipment is provided to travel to high risk countries to ensure sensitive or export-controlled information, data or materials with them.

If you are planning to travel to a country which is comprehensively sanctioned by the United States Government, you are required to submit a Pre-Travel Application for Embargoed Country Travel.

Contact exportcontrol@uconn.edu with any questions, to access the Pre-Travel Application for Embargoed Country Travel form, or to request a pre-travel informational meeting.

 

Travel Security ‘101’

Every time you move away from your residence, place of work, or some other safe static location you need to focus on what is going on ‘around you’; to be always situationally aware.  Notice what is ‘normal’ to include people, objects, and environment and pay attention when that ‘normal’ adjusts or changes.  Never disregard your gut feeling as the human body amazingly is able to detect stimulus long before our brains consciously pull it all together.  Prepare for the unexpected.  Noticing small things consistently can better assist with preparing yourself and those you might be traveling with anything threat-wise that may come later.

 

Plan Ahead

Always be prepared before you travel, research where and how you are traveling, staying, or living – – what does the on-the-ground situation look like?  Are there beyond normal security and safety considerations to focus on?  Areas to avoid?  Ongoing demonstrations and/or political strife that could affect movements and onward travel?  Your pre-travel preparations should be deliberate and fulsome.

 

Keeping A Low Profile

Do your best to minimize unwanted attention.  Review what you are packing or wearing, clothing, jewelry, and even overtly displayed religious items if you typically display them on your person.  Avoid items that might necessarily identify you as an American by alternately wearing non-descript attire that enables you to blend in as best as possible especially moving through public venues.  Do not accept letters, personal messages, photographs, packages, or other material to be carried in or out of the country.

 

Airports and Airplanes

Arrive early for your flights and proceed as quickly as possible through check-in and security to your gate as this offers the best level of in-depth security against a possible terrorist or criminal threat(s).  Keep close control of all carry-on items and stay alert to those other passengers and airport personnel moving around you until you board the aircraft.  Once onboard, pay attention to the location of the closest exits by counting rows of seats, both in front and behind if that is your closest exit.  Remember if and when smoke fills the cabin, you will be unable to see the lighted strips on the floor so counting seats and placing that fact in your muscle memory can be critical in evacuating safely.  When placing carry-on bags in overhead compartments, place them with their zippers and openers towards the back making it more difficult for potential thieves to get inside.  If placing bags underneath seats, turn your bag upside down to cover the zipper or even wrap the bags strap around your foot for an additional security measure.

 

Hotel Safety

Request a room between the second and fifth floors as those are rooms too high typically for thieves but would allow fire equipment to reach in the event of a potential fire emergency.  Locate your closest emergency exit(s) and develop a plan when/if there is a fire or other emergency where quicker egress is necessary minus using elevators.  When in your room, always use all the provided door locking hardware, and check to ensure if there are any opening windows or sliding glass doors, that they too are secured properly.  Keep your room neat so you can quickly notice anything that might be out of place or conversely messy which might do the same trick.  When leaving the room typically use the ‘do not disturb’ sign on the door and keep a light on and the television also at a low volume to give the impression that someone is in the room.

 

Vehicle Safety

Always keep your doors locked and windows rolled up, especially if transiting busy thoroughfares with multiple stoplights or anything that reduces your vehicle speed.  Leave distance between you and the vehicle in front of you, typically if you cannot see the rear wheels of the vehicle in front, then you are too close and would be unable to move in the event you needed to. When parked, find well illuminated areas and keep any valuables you might have locked in your trunk and out of sight to passersby.

 

​​​​​​​Other Travel Related Resources

The U.S. Department of State, Bureau of Consular Affairs maintains a comprehensive library of information that can help you prepare for a unexpected crisis overseas. Their site includes links to additional information about other aspects of security for persons living overseas, including children.

The U.S. Department of State Smart Traveler Enrollment Program (STEP) is a free service to allow U.S. citizens and nationals traveling and living abroad to enroll their trip with the nearest U.S. Embassy or Consulate, receive information from the Embassy about safety conditions in the destination country, and help the U.S. Embassy contact you in an emergency, whether natural disaster, civil unrest, or family emergency.

Traveling overseas with mobile phones, laptops, PDAs, and other electronic devices from The National Counterintelligence and Security Center.  Additionally, the Air Force Office of Special Investigations has created a similar brochure with additional information

U.S. Department of State Current Travel Warnings are issued to describe long-term, protracted conditions that make a country dangerous or unstable. A Travel Warning is also issued when the U.S. government’s ability to assist American citizens is constrained due to the closure of an embassy or consulate or because of a drawdown of its staff.

Also see the CIA World Factbook, which contains a plethora of excellent travel data in one-page synopses.

The State Department’s annual Country Reports on Terrorism details key developments in 2020 in the global fight against international terrorist groups.​​​​​​​

 

What Is Academic Solicitation?

Academic Solicitation is the use of students, professors, scientists, or researchers as collectors improperly attempting to obtain sensitive information. Placing academics at, and requesting to collaborate with, U.S. research institutions under the guise of legitimate research in order to access developing technologies and cutting-edge research. These attempts can include requests for, or arrangement of, peer or scientific board reviews of academic papers or presentations; requests to study or consult with faculty members; and requests for and access to software and dual-use technology. Academic solicitation can also occur when a faculty member, student, employee, or visiting scholar seeks access to this same information. The number of foreign academics requesting to work with classified programs continues to rise, and the academic community will likely remain a top target for the foreseeable future. Although most academic contacts are likely legitimate, some foreign academics may ultimately take advantage of their placement and access to further their country’s research and development goals. 

 

Who Is Being Targeting? 

• Researchers, scientists, and subject matter experts conducting research/ projects on behalf of a U.S. Government customer 
• Researchers, scientists, and subject matter experts employed at academic institutions or with published in scientific or technical journals or presented at conferences
• Students, professors, and researchers with access to research and technical information (especially graduate and post-doctorate students) 
• Researchers, scientists, and subject matter experts working on cutting-edge technology 
• Subject matter experts teaching technical courses

 

What To Report  

Any contact (i.e., emails, telephone, personal contact) that is suspicious because of the manner or subject matter of the request. This may include requests from U.S. persons or from foreign nationals located in the United States or abroad, and may consist of:  

• Unsolicited applications or requests for undergraduate, graduate, postgraduate, or other research positions 
• Unsolicited requests for access to research papers or other research-related publications or documents 
• Unsolicited requests for assistance with or review of thesis papers, draft publications, or other research related documents 
• Unsolicited invitations to attend and/or present at international conferences
• Unsolicited grants or gifting of funds/equipment to conduct joint research projects from foreign academic institutions or foreign governments

 Contact the UConn Research Security Office at researchsecurity@uconn.edu with any concerns or questions.  If you suspect academic solicitation is taking place you can also file an anonymous report at compliance.uconn.edu. 

 

Economic Espionage

Economic espionage is foreign power-sponsored or coordinated intelligence activity directed at the U.S. government or U.S. corporations, establishments, or persons, designed to unlawfully or clandestinely influence sensitive economic policy decisions or to unlawfully obtain sensitive financial, trade, or economic policy information; proprietary economic information; or critical technologies. This theft, through open and clandestine methods, can provide foreign entities with vital proprietary economic information at a fraction of the true cost of its research and development, causing significant economic losses. 

 Our Nation’s secrets are in jeopardy, the same secrets that make your company profitable. The FBI estimates billions of US dollars are lost to foreign competitors every year. These foreign competitors deliberately target economic intelligence in advanced technologies and flourishing US industries.  

Foreign competitors operate under three categories to create an elaborate network of spies: 

• Aggressively target present and former foreign nationals working for US companies and research institutions;
• Recruit and perform technical operations to include bribery, discreet theft, dumpster diving (in search of discarded trade secrets) and wiretapping; and,
• Establish seemingly innocent business relationships between foreign companies and US industries to gather economic intelligence including proprietary information.

 What Are Trade Secrets? 

Trade secrets are all forms and types of financial, business, scientific, technical, economic or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, complied, or memorialized physically, electronically, graphically, photographically or in writing, (1) which the owner has taken reasonable measures to protect; and (2) which have an independent economic value from not being generally known to the public.  

Commonly referred to as proprietary information, economic policy information, trade information, proprietary technology, or critical technology. 

 What Are Some Methods Of Targeting Or Acquiring Trade Secrets? 

• Steal, conceal, or carry away by fraud, artifice, or deception;
• Copy, duplicate, sketch, draw, photograph, download, upload, alter, destroy, photocopy, replicate, transmit, deliver, send, mail, communicate, or convey; and,
• Receive, buy, or possess a trade secret, knowing the same to have been stolen or appropriated, obtained, or converted without authorization.

 Know The Signs 

• Working odd hours without authorization 
• Taking proprietary information home without authorization
• Unnecessarily copying material 
• Disregarding company policies on personal software and hardware 
• Accessing restricted websites
• Downloading confidential material 
• Conducting unauthorized research

Personal Behaviors 

• Unexplained short trips to foreign countries 
• Engaging in suspicious personal contacts with competitors, business partners or unauthorized individuals 
• Buying items they normally cannot afford
• Overwhelmed by life crises or career disappointments 
• Showing concern about being investigated

Common Factors  

• Financial need 
• Greed 
• Unhappiness in the workplace 
• Different allegiances to another company or country 
• Drug/Alcohol abuse 
• Vulnerability to blackmail 
• Job offers from other organizations

Targeted Industries Or Sectors 

• Information and communication technology 
• Business information that pertains to supplies of scarce natural resources or that provides global actors an edge in negotiations with U.S. businesses or the U.S. government 
• Military technologies (marine systems, unmanned aerial vehicles, and aerospace/aeronautic technologies) 
• Civilian and dual-use technologies in fast-growing sectors (clean energy, health care and pharmaceuticals, and agricultural technology)
• Academia

  

As part of a nationwide campaign to raise awareness of the growing economic espionage threat, the FBI has released a short video, “The Company Man: Protecting America’s Secrets.” Based on an actual case, the video illustrates how one company was targeted by foreign actors and what the FBI did to help. 

 Contact the UConn Research Security Office at researchsecurity@uconn.edu with any concerns or questions.  If you suspect economic espionage is taking place you can also file an anonymous report at compliance.uconn.edu.

 Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that requires safeguarding or dissemination controls consistent with applicable laws, regulations, and Government-wide policies but is not classified under Executive Order 13556 “Classified National Security Information” or the Atomic Energy Act, as amended. 

  CUI Regulations

The CUI security controls must be compliant with the federal regulations specified in 32 CFR Part 2002(link is external) and by the National Archives and Records Administration (NARA), who acts as the CUI Executive Agent (EA) to oversee the federal agency CUI compliance. The most commonly encountered Federal CUI requirements and guidelines include:

NATIONAL INSTITUTES OF STANDARDS AND TECHNOLOGY (NIST) SPECIAL PUBLICATION (SP)

• NIST SP 800-53r5(link is external) – Security and Privacy Controls for Federal Information Systems and Organizations
• NIST SP 800-171r2(link is external) – Protecting CUI in Nonfederal Systems and Organizations
• NIST SP 800-172(link is external) – Enhanced Security Requirements for Protecting CUI: Supplement to 800-171 Rev. 2

FEDERAL ACQUISITION REGULATION (FAR) SECURITY REQUIREMENTS

• FAR 52.204-21(link is external) – Basic Safeguarding of Covered Contractor Information Systems

DEPARTMENT OF DEFENSE FEDERAL ACQUISITION REGULATION (DFARS)

• DFARS 252.204-7012(link is external) – Safeguarding Covered Defense Information and Cyber Incident Reporting
• DFARS 252.204-7020(link is external) – NIST SP-171 DoD Assessment Requirements
• DFARS 252.204-7021(link is external) – Cybersecurity Maturity Model Certification Requirements

Other requirements and guidance as directed in agency-specific regulations and certain legal documents may also apply.

“Information” as defined by the Federal CUI Program may include research data and other project information, including non-public Federal Contract Information (FCI).  FCI is normally protected in accordance with FAR 52.204-21 when a research team receives, possesses, or creates FCI in the performance of a sponsored contract.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information systems may include electronic media, non-electronic media, and physical environments.

 

CUI Onboarding

The United States Government has instituted a requirement that only United States Persons (USPERS) with a lawful, government purpose be granted access to CUI. The Government defines a USPERS for the purpose of CUI access as those naturalized citizens, Lawful Permanent Resident Aliens, and those born in the United States.  The following acceptable forms of documentation will be utilized to establish USPER status for UConn CUI project participants:

List A: Valid US Passport, I-551 Permanent Resident Card

List B: US Military Photo ID, State Issued Driver’s License, or Government issued photo ID

List C: Original or Certified Copy of State Issued Birth Certificate, US Consular Report of Birth FS-240, DoS Certificate of Birth Abroad DS-1350, Certificate of US Citizenship, or Certificate of US Naturalization

A determination of USPER status will require one item from List A; or one item from List B and one item from List C. All documents produced to verify birth in the US must be either the originals or certified copies.

In addition, please complete the following training prior to meeting with me, and please have your User Agreement, Technology Control Plan Briefing Acknowledgement and Non-Disclosure Statement, and Background Check completed/submitted:

DoD CUI Training (as mandated by DoD and provided by DCSA)

• Please access the training here: https://securityawareness.usalearning.gov/cui/index.html

Insider Threat Awareness 

• Please access the training here: https://www.cdse.edu/Training/eLearning/INT101/

This course provides a thorough understanding of how Insider Threat Awareness is an essential component of a comprehensive security program. The course promotes the reporting of concerning behavior observed within the place of duty. Using case study scenarios, the course teaches common indicators associated with insider risk. The instruction promotes a proactive approach to reporting, to support positive outcomes for the workforce.

University of Connecticut Technology Control Plan Briefing Acknowledgement and Non-Disclosure Statement

• https://uconn.kualibuild.com/app/builder/app/63ebd8543981ce38d8f61cfe/run

OVPR Export Control trainings required (2 modules, offered by CITI)

• Authorized USPER project participants will be required to successfully complete the following CITI online export training prior to working on the project and shall provide proof of completion to the Director of Export Compliance. CITI training can be accessed at https://www.citiprogram.org/?pageID=668
• Then, type in “UConn” to find the university.
• Then, sign in with your UConn SSO login.
• Under the “Learner Tools” section of the website after you log in (you’ll have to scroll down in the webpage to see this section), click “Add a Course”
• Then, check the box for the Export Compliance course, and follow the remaining steps to enroll and take the courses.
• Contact the Export Control Officer, exportcontrol@uconn.edu if you have any difficulty accessing these required trainings.

NIST 800-171 compliance training (2023 version – required if you will need access to Secure Research Infrastructure)

• 2023 CMMC 2.0 NIST 800-171 Compliance Training
• Please use this link to start your training:
  • https://training.knowbe4.com/auth/saml/667c8d12bf2d3
• Students will need to first contact SRITraining@uconn.edu to be added to take the training

NIUVT User Agreement (NIUVT projects only)

• https://uconn.kualibuild.com/app/builder/app/62432ba8d88f65e3695cad83/run

OVPR Export Control User Agreement (for all non-NIUVT projects)              

•  https://uconn.kualibuild.com/app/651c2dab32976c013a5ea4f0/run

  Background Check Required

As part of your work, you may have access to Controlled Unclassified Information, which requires safeguarding or dissemination controls consistent with various laws and regulations. One of these regulations, NIST SP 800-171, establishes the basic security requirements for protecting CUI. One of these requirements is to screen individuals prior to authorizing access to organizational systems containing CUI. To begin this process contact researchsecurity@uconn.edu.

Background Investigation Process:

Background investigations may include, but are not limited to, criminal history checks, employment verification, education verification, and reference checks. The results of background investigations will be used to assess the suitability of individuals for access to CUI.

 

FAQ:

https://research-compliance.umich.edu/research-information-security/controlled-unclassified-information-cui

 

Additional Resources:

National Policy 

• Executive Order (EO) 13556, Controlled Unclassified Information 
• 32 Code of Federal Regulations (CFR), Part 2002, Controlled Unclassified Information 
• NIST Special Publication 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations) 

DOD Policy 

• DODI 5200.48 Controlled Unclassified Information (CUI) 
• DFARS Section 252.204-7012 

 Useful Links 

• CUI Cover Sheet 
• CUI Quick Marking Tips  
• DOD CUI Marking Job Aid 
• DCSA CUI Frequently Asked Questions (FAQ)
• CUI Quick Start Guide
• DCSA CUI Resources One-Pager
• DCSA CUI Glossary & Policy Summaries
• DCSA CUI Landscape
• CUI Quick Reference Guide
• DCSA CUI Destruction Guidance

CUI Resources: https://www.dcsa.mil/Portals/91/Documents/CTP/CUI/DOD-CUI_Resources_One-Pager_for_DOD.pdf