External Funding and Information Security Requirements
Sponsors, particularly the Federal government, are imposing increasingly stringent requirements in an effort to ensure the security of project data and the Information Technology (IT) systems used in their funded projects. These requirements most often appear in Federal contracts, and the cost of meeting them can be significant. If not budgeted as part of the original proposal, these sponsor security requirements may result in (1) an award being turned down outright, or (2) an unwelcome cost-sharing commitment.
To avoid these situations, please be sure to review any RFP you are working on for language that refers to specific laws, regulations, security frameworks and/or security standards such as those listed below. Also note, that sponsors may also have their own security requirements that are unrelated to law or regulation. A non-comprehensive list of laws/regulations includes:
Laws, Regulations, Executive Orders and Programs
- Federal Information Security Modernization Act of 2014 (link is external) (FISMA)
- Executive Order 13556, Controlled Unclassified Information (link is external) (CUI)
- Federal Risk and Authorization Management Program (link is external) (FedRAMP)
- The National Archives and Record Administration (NARA) final rule on Controlled Unclassified Information (CUI) – (81 FR 63324, September 14, 2016)
- ISO/IEC 27000-series (also known as the ‘ISMS Family of Standards’ or ISO27k)
- Special Publication 800-171, Protecting Controlled Unclassified Information in Non-federal Information Systems and Organizations
- Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations
- Federal Information Processing Standard Publication 199 (FIPS-199), Standards for Security Categorization of Federal Information and Information Systems
- Federal Information Processing Standard Publication 200 (FIPS-200), Minimum Security Requirements for Federal Information and Information
Federal Acquisition Regulations (FAR)
Defense Federal Acquisition Regulations Supplement (DFARS)
- 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls
- 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
- 252.239-7999 Cloud Computing Services (DEVIATION 2015-O0011) (February 2015)
Health and Human Services Acquisition Regulation (HHSAR)
- 352.239-70 through 352.239-73, Standard for Security Configurations, Standard for Encryption Language, Security Requirements for Federal Information Technology Resources, Electronic and Information Technology Accessibility
The appearance of any one of these terms is a red flag that you should contact Contract Officer Jessica Smith-Kaprosy, J.D., in the WSU Office of Research Support and Operations (ORSO) at firstname.lastname@example.org or 509-335-5447. Jessica will coordinate efforts between ORSO, your unit, the appropriate WSU information security professional, and potentially the sponsor.
If you suspect any one of the above terms will apply to your resulting award, do not submit your proposal until you have consulted with Jessica Smith-Kaprosy.
Only submit once you are certain that your unit can comply with the security standards that may be imposed by the sponsor or you have requested sufficient funding in your budget to account for the cost of compliance.