Updates for NIH Controlled-Access Data Repositories, Approved Users, and Developers
The NIH Security Best Practices for Users of Controlled-Access Data
The “NIH Security Best Practices for Users of Controlled-Access Data” is intended to ensure that Approved Users of NIH controlled-access data under the GDS Policy maintain such data on institutional IT systems and third-party computing infrastructures that meet certain standards in accordance to NIST SP 800-171 “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” To that end, NIH expects that:
-
Approved Users of NIH controlled-access data will attest to NIH that their institution is compliant with NIST SP 800-171.
-
Approved Users choosing a third-party IT system and/or Cloud Service Provider (CSP) for data analysis and/or storage will provide NIH with an attestation affirming that the third-party system is compliant with NIST SP 800-171.
-
Non-U.S. users that are unable to attest to the NIST SP 800-171 may attest to the equivalent ISO/IEC 27001/27002 standard.
Compliance
By executing the DUC, researchers and their institutional signing official attest that they will use either their organization’s NIST-compliant environment or a linked TRE.
If your IT environment does not meet the relevant NIST SP 800-171 or ISO/IEC 27001/27002 cybersecurity standards, when available, you will analyze the data through a Trusted Research Environment (TRE) or Compute Analysis Platform linked through the Portal.
To learn more about ARK Portal TREs please visit our documentation at Sending Data to Cloud Analytical Platforms.