Controlled Information & Data Security
What Type of Information Requires Controls?
When research is subject to export controls, the university has obligations under federal law to protect the technology that comes from the research— including any information, data, and software— according to a complex set of regulations (as defined by , , ).
See for more information.
CUI was defined in as information held by or generated for the Federal Government that requires safeguarding or dissemination controls. Research data and other project information that a research team receives, possesses, or creates during the performance of federally funded research may be CUI. The obligation to determine whether an award will involve CUI belongs to the federal sponsor; award documents should specifically identify CUI and applicable security requirements.
Contact 鶹ѰBoulder's Office of Compliance, Ethics, and Policy (compliance@colorado.edu) for support.
- Management of CUI (Office of Contracts and Grants)
As defined in Federal Acquisition Regulations (FAR) , federal contract information (FCI) is “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.”
See OCG's Federal Contract Information (FCI) page for more information.
IT Solutions for the Protection of Controlled Information
鶹ѰBoulder's Large File Transfer service is a web tool that sends large files securely to any email address, on or off campus. This on-demand and automated transfer service is a secure solution for anyone sending large files, but particularly for researchers who share large datasets. Using LFT avoids sending files from email systems, improving performance, and reducing email storage.
The Preserve is an environment available to researchers who engage in projects that contain confidential or highly confidential data. It is highly controlled to specifically protect research that must meet Cybersecurity Maturity Model Certification (CMMC)*, Controlled Unclassified Information (CUI) and certain Export Control regulations.
Cybersecurity Maturity Model Certification program (CMMC) is a unified assessment model created by DOD in response to the growing threat of cyberattacks and data theft from the defense contractors. CMMC is designed to ensure that DOD contractors and subcontractors adequately safeguard sensitive government information.
鶹ѰBoulder Resources
CMMC Federal Resources
If your research is determined to be subject to export controls, ORSEC will work with you to create a Technology Control Plan (TCP), which will address the need for secure storage and transmission of controlled data.
鶹ѰBoulder has IT infrastructure solutions to secure data and information according to standards required by U.S. export controls and other federal regulations. is a division of the campus’s information security program and is dedicated to advancing 鶹ѰBoulder research efforts.