Risk Management and Compliance © Copyright Showeet.com Kathleen Robbins

Introduction CUI Regulatory Requirements Risk Assessment Secure Pre-vetted environment - ResVault Questions Introduce myself Working with Erik's team for around 4 months Asked to give a high level overview on ResVault day about security CUI - and explain what it is Regulatory requirements associated with CUI and why we need to comply with these Risk Assessment process and how we work to achieve these requirements Describe the Secure pre-vetted environment ResVault Finish up with Questions

What is CUI?

Controlled Unclassified Information (CUI) CUI is information that law, regulation, or government wide policy requires to have safeguarding or disseminating controls Replaces many previous federal designations, for example SBU, LES and FOUO with one designation Over 20 categories including Export Control and Privacy (student data, health records) Statutory and regulatory requirements for the protection of CUI are consistent, whether the CUI resides in federal information systems or nonfederal information system There were over 100 designations used by the federal government SBU = Sensitive But Unclassified LES = Law Enforcement Sensitive FOUO = For Official Use only

What are the Regulatory Requirements for protecting CUI?

Regulatory Requirements – NIST Special Publication 800-171 “Protecting CUI in Non-Federal Organizations ” Applies to all nonfederal systems and organizations that process, store, or transmit CUI Focuses on protecting the confidentiality of CUI in nonfederal systems and organizations There are 14 security control families and over 250 individual security control items to be assessed Integrity and Availability

How do we meet the Regulatory Requirements ?

Risk Assessment For every new Research project request :- Information Security Office Determine if the data is CUI Review the proposed architecture and data flow Assess all the information provided against the regulatory requirements Develop a remediation plan Present any residual risks to leadership for acceptance and authorization Each Risk Assessment takes time, costs money and presents different risks for UF.

Compliance with Regulatory Requirements Compliance with NIST SP 800-171 for CUI involves more than technology 4 key factors for success UF policies UF Organizational processes at multiple levels Information system Architecture Technical controls People Training and behaviors 4 key factors for success

This process can be both time consuming and expensive Keeping all these factors in mind How can Research CUI be secured in the most effective way

Secure Pre-vetted Environment – keeping Research CUI in one location and Secure? So whats the answer

Secure Pre-vetted Environment - Research Options considered 1. Layer security onto existing systems Can be cumbersome and expensive to secure all general use computers and networks Creates usability problems 2. Outsource (Cloud) Cloud providers offer pre-certified Federally compliant systems They handle some controls, but we’re still responsible for many controls 3. Enclave(ResVault) A dedicated secure environment with all required security controls Ability to deploy new projects rapidly

Secure Pre-vetted Environment – Option Chosen 3. ResVault A dedicated environment within UF with added security controls Provides the ability for Researchers to deploy new projects rapidly

ResVault Is a secure risk assessed environment It is built, operated, and is maintained as a system It is tested, monitored, audited and authorized as a system Provides Team based secure access for each individual project Can more easily be assessed for ongoing NIST 800- 171 compliance

Benefits Optimizes researcher time Reduces risks for new research projects Reduces overall costs to UF

Questions?