>> HELLO, WELCOME TO TODAY'S
OVERVIEW OF THE NIH SECURITY
BEST PRACTICES FOR USERS OF
CONTROLLED ACCESS DATA.
I'M DR. CHEN OF THE NATIONAL
INSTITUTES OF HEALTH OFFICE OF
DATA SCIENCE STRATEGY.
TODAY WE'LL ADDRESS DATA
MANAGEMENT AND SECURITY UPDATES
DESCRIBED IN THE GUIDE NOTICE
IMPLEMENTATION UNDER THE GENOMIC
SHARING POLICY.
THE LINK WILL BE INSERTED INTO
THE CHAT FOR ZOOM.
THIS IS -- IF JOINING BY
VIDEOCAST YOU CAN SEARCH FOR
IMPLEMENTATION UPDATE FOR DATA
MANAGEMENT AND ACCESS PRACTICES
UNDER THE GENOMIC DATA SHARING
POLICY, OR NOT-0D-24-157 IN YOUR
PREFERRED SEARCH ENGINE.
I HAVE A FEW HOUSEKEEPING ITEMS.
WE HAVE CLOSED CAPTIONING AND AN
AMERICAN SIGN LANGUAGE
INTERPRETER FOR TODAY'S
PRESENTATION.
RESPONSE TO TODAY'S PRESENTATION
HAS BEEN OVERWHELMING AND WE
HAVE PARTICIPANTS BY ZOOM AND
BROADCAST VIA NIH VIDEOCAST.
WE HAVE INSERTED THE VIDEOCAST
LINK.
THIS PRESENTATION IS ALSO BEING
RECORDED FOR FUTURE VIEWING.
THE RECORDING WILL BE AVAILABLE
ON THE NIH SHARING WEBSITE.
IF YOU JOINED BY ZOOM YOU'LL SEE
THE LINK IN THE CHAT.
BY VIDEOCAST YOU CAN GO TO THE
ADDRESS SHARING.NIH.GOV.
AND CLICK ON RESOURCES FOR
GENOMIC DATA SHARING POLICY.
UNDER THE RESOURCES PAGE, CLICK
ON THE WEBINAR ICON.
THE SLIDES FOR THE PRESENTATION
ARE ALSO AVAILABLE ON THAT WEB
PAGE.
THERE WERE QUESTIONS SUBMITTED
PRIOR TO DECEMBER 17, 2024, TO
ADDRESS DURING THE DEDICATED
HOUR.
IF YOU HAVE ADDITIONAL QUESTIONS
THAT WE MAY GET TO, AND HAVE
JOINED BY ZOOM, ENTER YOUR
QUESTIONS IN THE Q&A FOR
PRESENTERS TO ADDRESS.
IF YOU JOINED BY VIDEOCAST AND
HAVE ADDITIONAL QUESTIONS SEND
YOUR QUESTIONS GDS.MAIL.NIH.GOV.
THOSE PARTICIPATING IN ZOOM HAVE
ABILITY TO UPVOTE QUESTIONS
ENTERED IN Q&A.
WE'LL BE ADDRESS RELEVANT
QUESTIONS SUBMITTED PRIOR TO
DECEMBER 27, 2024, AS MANY
DURING THE DEDICATED HOUR FROM
THOSE WHO JOINED.
IF THE QUESTIONS ARE NOT
ANSWERED LIVE, THEY WILL BE
GROUPED AND GENERAL RESPONSES
WILL BE POSTED AT A LATER DATE.
NOW I'M EXCITED TO INTRODUCE
TODAY'S SPEAKER DR. CHERYL
JACOBS, AND MS. MAUREEN
FALVELLA.
NEXT SLIDE PLEASE.
DR. JACOBS IS ASSISTANT DIRECTOR
FOR GENOMICS FROM NIH, OFFICE OF
SCIENCE POLICY.
DR. JACOBS HAS OVER 10 YEARS OF
EXPERIENCE WORKING ON AND
LEADING EVIDENCE-BASED POLICIES
TO SUPPORT THE BROAD AND
RESPONSIBLE SHARING OF DATA AND
ASSOCIATED DATA.
SHE BRINGS KNOWLEDGE OF RESEARCH
PARTICIPANT PROTECTIONS AND
FACILITATING ACCESS TO GENOMIC
AND SCIENTIFIC DATA.
MS. FALVELLA IS CHIEF SECURITY
OFFICE, 15 YEARS OF EXPERIENCE
DIRECTING OPERATIONS AND
OVERSEEING CYBERSECURITY
PROGRAMS TO PROTECT INFORMATION
ASSETS AT THE NATIONAL
INSTITUTES OF HEALTH.
INCLUDING SECURING NIH RESEARCH
IN COVID TO ENHANCE RECOVERY
KNOWN AS ReCOVer COVID
INITIATIVE, THE NHLBI BIODATA
CATALYST PROGRAM.
SHE BRINGS EXTENSIVE EXPERIENCE
AND ADVANCED TECHNICAL EXPERTISE
AND STRONG UNDERSTANDING OF THE
SCIENTIFIC MISSION.
TODAY THEY WILL DISCUSS UPDATED
TO TAKE EFFECT ON JANUARY 25,
2025.
AGAIN, TODAY'S PRESENTATION HAS
PARTICIPANTS JOINING BY ZOOM,
ALSO BROADCAST ON NIH VIDEOCAST,
BEING RECORDED FOR FUTURE
VIEWING.
NEXT SLIDE PLEASE.
THE PRESENTATION WILL BE DIVIDED
INTO THREE SECTIONS, WITH
GENERAL OVERVIEW OF THE NIH
GUIDE NOTICE FOCUSING ON NIH
SECURITY BEST PRACTICES FOR
USERS OF CONTROLLED ACCESS DATA,
FOLLOWED BY IN DEPTH OVERVIEW OF
THE SECURITY CONTROLS THAT
INSTITUTIONS AND APPROVED USERS
ARE EXPECTED TO ADHERE TO
BEGINNING ON JANUARY 25, 2025.
FOLLOWED BY TIME FOR QUESTIONS
AND ANSWERS.
AGAIN, IF YOU HAVE JOINED BY
ZOOM ENTER YOUR QUESTIONS IN THE
Q&A.
IF YOU JOINED BY VIDEOCAST SEND
YOUR QUESTIONS TO
GDS@MAIL.NIH.GOV.
WE'LL TRY TO ANSWER AS MANY
RELEVANT QUESTIONS AS POSSIBLE.
I WILL HAND THE PRESENTATION
OVER.
DR. JACOBS, OVER TO YOU.
>> TERRIFIC.
THANK YOU, DR. CHEN.
AND GOOD MORNING, EVERYONE.
I'M DR. JACOBS, AND I'M EXCITED
TO TALK TO YOU TODAY ABOUT THE
UPDATES THAT NIH HAS ISSUED FOR
DATA MANAGEMENT AND SHARING
PRACTICES.
SO ON THIS SLIDE I'M PROVIDING A
BRIEF DESCRIPTION OF NIH GENOMIC
DATA SHARING FOR GDS POLICY,
DESCRIBE EXPECTATIONS OF THE
POLICY, AND BY WHICH UPDATES
WILL TAKE EFFECT.
POLICY HAS BEEN IN EFFECT SINCE
JANUARY 25, 2015, ENSURES BROAD
AND RESPONSIBLE SHARING OF BOTH
NON-HUMAN AND HUMAN LARGE SCALE
GENOMIC DATA.
AND IN PART, BY EXPECTING
PARTICIPANT CONSENT FOR RESEARCH
WHEN USING HUMAN LARGE SCALE
GENOMIC DATA.
THERE ARE OTHER ASPECTS OF THE
POLICY THAT FACILITATE THE BROAD
AND RESPONSE SHARING THAT WE'LL
TOUCH ON LATER IN THE TALK.
THE POLICY SCOPE TO APPLY TO
GENERATION OF LARGE SCALE
GENOMIC DATA AS WELL AS TO THE
USE OF THESE DATA BY SECONDARY
RESEARCHERS, AND THIS IS
IRRESPECTIVE OF THE FUNDING
MECHANISM.
NEXT SLIDE PLEASE.
SO WHEN SHARING LARGE SCALE
HUMAN GENOMIC DATA UNDER THE GDS
POLICY THERE ARE ADDITIONAL
CONSIDERATIONS.
WHEN AWARDEES ARE FUNDED BY NIH,
GENERATE LARGE SCALE HUMAN DATA,
THE POLICY EXPECTS INVESTIGATORS
TO CONSIDER APPROPRIATENESS OF
SHARING DATA, AND IF THEY ARE
SHARING THE DATA TO SHARE
ACCORDING TO PARTICIPANT
CONSENT, AND MAKING THAT
DECISIONS TO HAVE AN IRB PRIVACY
BOARD OR EQUIVALENT BODY REVIEW
THE CONSENTS AND ALSO ADVISE ON
THE RISK OF SHARING THESE DATA.
AND ULTIMATELY AFTER THE REVIEW
AND ADVICE RECEIVED FROM THE
IRB, SUBMIT THAT DATA TO NIH AND
TELL NIH HOW THAT DATA OUGHT TO
BE SHARED.
WHEN INVESTIGATORS REQUEST
ACCESS TO THESE DATA FROM NIH,
FROM AN NIH DATA REPOSITORY
THERE ARE TERMS AND CONDITIONS
THAT USERS WHO ARE KNOWN AS
APPROVED USERS AGREE TO.
TO TERMS OF ACCESS, THAT INCLUDE
SECURING DATA ACCORDING TO
SECURITY STANDARDS, AND THIS
EXPECTATION IS FOR APPROVED
USERS THAT ARE FUNDED BY NIH OR
NOT FUNDED BY NIH.
NEXT SLIDE PLEASE.
SO HERE I'M GOING TO GIVE AN
OVERVIEW OF THE GUIDE NOTICE
THAT WAS ISSUED IN THIS PAST
JULY.
THIS GUIDE NOTICE ADDS DIFFERENT
COMPONENTS OF SECURING DATA
ACCESS IN MANAGEMENT.
SO, THE FIRST COMPONENT IS
SCOPED NIH CONTROLLED ACCESS
DATA REPOSITORIES, AND THESE ARE
DEFINED BY REPOSITORIES THAT ARE
SUPPORTED BY AN NIH GRANT,
COOPERATIVE AGREEMENT, OTHER
TRANSACTION, CONTRACT, OR
INTRAMURAL SUPPORT.
THEY STORE OR PROVIDE ACCESS TO
HUMAN GENOMIC DATA UNDER THE GDS
POLICY.
THERE ARE CONTROLS TO ACCESS
THESE DATA, MEANING THAT THE
DATA ARE NOT UNRESTRICTED
ACCESS.
THERE'S SOME SORT OF FIREWALL
BETWEEN THE USER ASKING FOR DATA
AND ACTUALLY GETTING ACCESS TO
THAT DATA.
AND THERE'S A USE OF FEDERAL
EMPLOYEES TO CONDUCT REVIEWS AND
AUTHORIZE ACCESS.
AND REALLY THE MOST FAMILIAR
ALLEGORY TO THIS WOULD BE THE
USE OF A DATA ACCESS COMMITTEE,
OR A DAC.
SECONDLY, THIS IS SCOPED TO
DEVELOPERS WHO ARE FUNDED TO
PROVIDE SOME SORT OF SERVICE,
FOR SUPPORT, THOSE
NIH-CONTROLLED ACCESS DATA
REPOSITORIES.
AND WE HAVE A BROAD DEFINITION
OF DEVELOPERS.
THEY TEST PLATFORMS, PIPELINES,
ANALYSIS TOOLS, DO VARIOUS SORTS
OF WORK ON THOSE NIH
CONTROLLED-ACCESS DATA
REPOSITORIES.
AND WE CAN PUT A LINK IN THE
CHAT TO THOSE REPOSITORIES THAT
WE'RE REFERRING TO.
AND THIRD, THIS UPDATE AFFECTS
SECURITY STANDARDS FOR APPROVED
USERS WHEN THEY GET ACCESS OF
THESE DATA.
THERE'S AN EXPECTATION OF HOW
THE DATA OUGHT TO BE SECURED.
NEXT SLIDE PLEASE.
SO, TO SPEAK TO THE FIRST ITEM,
THE NIH HAS IDENTIFIED CURRENTLY
20 REPOSITORIES IN SCOPE OF THIS
SECURITY UPDATE.
AND AS I SAID, THEY ARE LISTED
ON THE SHARING WEBSITE, AND THE
LINK SHOULD BE IN THE CHAT.
THIS IS KEPT UP TO DATE AND MAY
CHANGE.
HOWEVER, IF YOUR REPOSITORY IS
NOT CURRENTLY LISTED, YOUR
REPOSITORY IS NOT IN SCOPE OF
THE SECURITY UPDATE.
WE WANT TO REMIND EVERYONE IF
YOU ARE A DATA GENERATOR, IF NIH
FUNDS YOU, TO GENERATE LARGE
SCALE GENOMIC DATA, YOU'RE NOT
IN SCOPE OF THIS PARTICULAR
SECURITY UPDATE.
THIS UPDATE ONLY APPLIES TO
THOSE REPOSITORIES THAT MEET THE
FOLLOWING CRITERIA, THAT I WENT
THROUGH ON THE PREVIOUS SLIDE.
DATA GENERATORS ARE NOT IN
SCOPE.
NEXT SLIDE PLEASE.
SO, THIS SECOND PART OF THE
GUIDE NOTICE SPEAKS TO A MINIMUM
STANDARD OPERATING PROCEDURES
FOR DEVELOPERS TO GAIN ACCESS TO
THOSE DATA THAT ARE UNDER THE
GDS POLICY AND NIH CONTROLLED
DATA ACCESS REPOSITORIES.
WE WANT TO NOTE THAT THIS IS
SPECIFIC FOR NIH OR FEDERALLY
FUNDED DEVELOPERS.
CENTRAL TO THIS DEFINITION IS
NOT WHAT A DEVELOPER IS BUT WHAT
THE DEVELOPER IS FUNDED TO DO.
AND, AGAIN, WE WANT TO FOCUS ON
THE DEVELOPERS ARE FUNDED BY NIH
OR THE FEDERAL GOVERNMENT TO
ESTABLISH, SUPPORT, OR MAINTAIN
ONE OF THE 20 NIH CONTROLLED
ACCESS DATA REPOSITORIES.
BEGINNING ON JANUARY 25, 2025,
NIH NOTICE OF FUNDING
OPPORTUNITIES, CONTRACTS, OR
OTHER TRANSACTIONS WILL INDICATE
APPLICABILITY OF THIS PARTICULAR
UPDATE.
NEXT SLIDE PLEASE.
SO HERE WE'RE JUMPING INTO WHAT
YOU ALL HAVE JOINED THE WEBINAR
FOR.
THE SECURITY EXPECTATIONS FOR
APPROVED USERS OF CONTROLLED
ACCESS HUMAN GENOMIC DATA.
SO, THE EXPECTATION IS THAT ON
OR AFTER JANUARY 25, 2025,
APPROVED USERS, P.I.s THAT
SUBMIT A DAR AND APPROVED ACCESS
DATA WILL BE EXPECTED TO
SECURITY DATA ACCORDING TO THE
UPDATED SECURITY STANDARDS,
DESCRIBED IN NIH SECURITY BEST
PRACTICES FOR USERS OF
CONTROLLED-ACCESS DATA.
THIS APPLIES TO NEW REQUESTS,
THAT ARE SUBMITTED ON THAT DAY,
AS WELL AS ANY REQUEST THAT HAS
EXISTING ACCESS BUT IS RENEWED
AFTER THAT DAY.
SO ONE THING TO POINT OUT, YOU
HAVE EXISTING ACCESS RIGHT NOW.
AND THE JANUARY 25, 2025 DATE
COMES UP, YOU WILL NOT BE
EXPECTED TO ATTEST TO THE
UPDATED SECURITY STANDARDS.
IT'S ONLY AFTER YOUR RENEWAL,
AFTER THAT DATE.
WE WANT TO NOTE THAT THIS UPDATE
REPLACES EXISTING SECURITY BEST
PRACTICES FOR CONTROLLED-ACCESS
DATA SUBJECT TO NIH GENOMIC DATA
SHARING POLICY.
AND THAT WHAT WE'RE ASKING FOR
IN THIS UPDATED SECURITY
STANDARD IS AN ATTESTATION FROM
APPROVED USERS.
NOW, WE'LL DO A DEEPER DIVE HOW
TO MEET UPDATES TO SECURITY
EXPECTS BUT IN GENERAL WHAT THIS
ATTESTATION APPROVED USERS WILL
ATTEST BASED ON SELF-ASSESSMENT
THAT THEY DO THAT THEIR SYSTEM,
NOT THE ENTIRE INSTITUTION, THE
SYSTEM STORING THE HUMAN GENOMIC
DATA IS COMPLIANT WITH NIST,
800-171 CONTROLS.
IF APPROVED USERS IS USING A
THIRD PARTY I.T. SYSTEM OR CLOUD
SERVICE PROVIDER, THE APPROVED
USER IS EXPECTED TO KNOW IF THAT
THIRD PARTY SYSTEM OR SERVICE
PROVIDER IS COMPLIANT WITH NIST
800-171 SECURITY CONTROLS AND
ATTEST ON THEIR BEHALF.
IF YOU'RE A NON-U.S. USER,
UNABLE TO ATTEST TO THE NIST
800-171 SECURITY STANDARDS YOU
MAY ATTACH THE EQUIVALENT
ISO/IEC 2700/27002 STANDARD.
ATTESTATION MAY VARY, IT'S NOT A
FORM, IT MAY VARY IN THAT IT'S
ONLY IN THE AGREEMENT THAT YOU
DESIGNED OR IT'S A PART OF THE
DAR PROCESS, BUT AT THE END OF
THE DAY THE ATTESTATION IS AN
ACKNOWLEDGMENT THAT THE
INSTITUTION HAS DONE ITS
SELF-ASSESSMENT AND ATTESTS THAT
THEIR LOCAL DEVICE STORING THE
GENOMIC DATA MEETS THE
EXPECTATIONS OF THE NIST 800-171
CONTROLS.
NOW, THIS CONCLUDES MY PART.
I WILL TURN IT OVER TO
MS. FALVELLA TO DO A DEEPER DIVE
INTO THE NIST 800-171 CONTROLS.
>> GOOD MORNING.
I'M MAUREEN FALVELLA, NIH CHIEF
INFORMATION SECURITY OFFICER AT
NIH.
TODAY WE'RE GOING TO DISCUSS
UNDERLYING REASONS WHY NIH MADE
CHANGES TO NIH SECURITY BEST
PRACTICES FOR USERS OF
CONTROLLED ACCESS DATA.
WE'LL THEN TOUCH UPON WHAT YOU
AS RESEARCHER NEED TO KNOW ABOUT
THE NIH SECURITY BEST PRACTICES,
BEFORE SHIFTING TO DEEP DIVE
WHAT YOU MIGHT NEED TO KNOW IF
YOU'RE AN I.T. SYSTEM
ADMINISTRATOR.
WE'LL RECAP KEY TAKEAWAYS AND
IDENTIFY RESOURCES AVAILABLE
BEFORE WE OPEN UP TO QUESTIONS.
FIRST LET'S DIVE IN TO THE
GLOBAL THREAT LANDSCAPE.
THERE ARE THREE MAJOR THREATS TO
RESEARCH INSTITUTIONS INCLUDING
NIH TODAY, INCLUDING NATION
STATE ACTORS LOOKING TO GAIN
INTELLIGENCE, DEMONSTRATE THEIR
CYBER CAPABILITIES AS A
DEFENDANT TACTIC OR MIGHT BE
SEEKING VALUABLE INFORMATION TO
GAIN COMPETITIVE EDGE.
WE HAVE TO CONSIDER CRIMINAL
ORGANIZATIONS SEEKING TO DEPLOY
SUPER ATTACKS WITH PRIMARY GOAL
OF FINANCIAL GAIN.
BOTH OF THESE THREAT ACTORS
LEVERAGED ADVERSARIAL
TECHNOLOGIES, WITH SUCH AS
ARTIFICIAL INTELLIGENCE THREATS
SUCH AS RANSOMWARE WHEN COMBINED
WITH SUPER COMPUTING POWER ARE
GROWING CONCERNS.
SO ALL THESE THREAT SOURCES HAVE
RESULTED IN A DIFFICULT
CHALLENGE FOR RESEARCH
INSTITUTIONS WHICH RELY ON
COLLABORATION AND INFORMATION
SHARING TO DRIVE INNOVATION AND
DISCOVERY.
EROSION OF PUBLIC TRUST AND
FINANCIAL LOSS FROM CYBERATTACKS
IS A SUBSTANTIAL CHALLENGE TO
RESEARCH INSTITUTIONS, TO
EMPHASIZE 84% INCREASE IN DATA
BREACHES OVER THE LAST DECADE.
HEALTHCARE AND RESEARCH
INSTITUTIONS EXPERIENCED A 123%
INCREASED IN RANSOMWARE ATTACKS.
AT NIH WE SEE THIS ALMOST DAILY.
OVER THE LAST TWO YEARS WE'VE
FIELDED AS MANY PRIVACY -- SPEND
HALF OF OUR TIME ADDRESSING
PRIVACY BREACHES.
WITH THE WORLD ON THE BRINK OF
POST QUANTUM COMPUTER POWER AND
ARTIFICIAL INTELLIGENCE LINKING
IDENTITIES IS A REAL CONCERN.
WE HAVE A UNIQUE ROLE TO PLAY.
NIH IS COMMITTED TO PROTECTING
PUBLIC TRUST AND PREPARING FOR
FUTURE NATIONAL SECURITY
DIRECTIVES AND SECURITY
POLICIES.
WE ALSO ACKNOWLEDGE THAT IN THE
PAST IT HAS BEEN DIFFICULT FOR
INSTITUTIONS SEEKING FUNDING
OPPORTUNITIES AT NIH GIVEN THE
PATCHWORK OF SECURITY STANDARDS
YOU MAY FACE.
ONE INSTITUTION MIGHT HAVE ONE
STANDARD WHILE ANOTHER
INSTITUTION MAY REQUIRE
COMPLETELY DIFFERENT STANDARD.
SO NIH IS UNIFYING OUR STANDARDS
TO EASE THE BURDEN ON
INSTITUTIONS SEEKING FUNDING
OPPORTUNITIES AT NIH.
THESE FACTORS NECESSITATE AND
WERE THE DRIVERS OF NIH
RELEASING THE UPDATED SHARING
POLICY AND SUPPORTING BEST
PRACTICE USES FOR CONTROL OF
DATA.
NEXT SLIDE PLEASE.
SO, IF YOU ARE A RESEARCHER,
HERE'S WHAT YOU NEED TO KNOW.
NIH SECURITY BEST PRACTICES ARE
SECURITY BENCHMARKS.
THEY ARE NOT REGULATORY
REQUIREMENTS.
THEY ALLOW YOU TO MEASURE YOUR
INSTITUTION SECURITY POSTURE
AGAINST THE NIST SPECIAL
PUBLICATION 171 SECURITY
CONTROLS THAT ALIGN TO THE NIST
RISK MANAGEMENT FRAMEWORK.
THIS FRAMEWORK OFFERS A PATHWAY
TO ACHIEVE ATTAINABLE SECURITY
PRACTICES THROUGH SIX-PHASE
PROCESS, DESIGNED TO
CONTINUOUSLY MONITOR RISK FOR
I.T. SYSTEMS LIFE CYCLES, THAT
STARTS AT THE INCEPTION OF AN
I.T. SYSTEM AND WILL GO THROUGH
TO A SYSTEM BEING
DECOMMISSIONED.
THE NIH SECURITY BEST PRACTICES
FOR CONTROLLED ACCESS DATA ARE
ONLY EXPECTED TO BE APPLIED TO
THOSE SYSTEMS THAT HANDLE NIH
CONTROLLED-ACCESS DATA.
I'M GOING TO STRESS AND REPEAT
BECAUSE IT'S WORTH REPEATING.
IT IS NOT EXPECTED THAT THE NIH
SECURITY BEST PRACTICE BE
APPLIED TO ALL YOUR I.T.
SYSTEMS, JUST THE SYSTEMS THAT
PROCESS NIH CONTROLLED-ACCESS
DATA.
SYSTEMS THAT DO NOT INTERACT
WITH NIH CONTROLLED-ACCESS DATA
ARE NOT EXPECTED TO ADOPT
SECURITY STANDARDS.
AS MENTIONED BY DR. JACOBS, DATA
GENERATORS SUCH AS THOSE WITHIN
THE DATA COLLECTION CENTERS,
DATA COORDINATING CENTERS, THAT
GENERATE DATA PRIOR TO IT BEING
SHARED WITH NIH
CONTROLLED-ACCESS DATA
REPOSITORIES ARE NOT WITHIN
SCOPE OF THE NIH GENOMIC DATA
SHARING POLICY AND SECURITY BEST
PRACTICES.
DATA DOWNLOADED AND PROCESSED
DIRECTLY FROM THE NIH
CONTROLLED-ACCESS DATA
REPOSITORIES ARE WITHIN SCOPE.
THIS SCOPE INCLUDES WORK
STATIONS, SERVERS, THIRD PARTY
SYSTEMS, CLOUD SERVICES THAT
ACCESS AND/OR PROCESS NIH
CONTROLLED-ACCESS DATA.
SO, BY JANUARY 25, 2025,
INSTITUTIONS ARE EXPECTED TO
ASSESS SYSTEMS AGAINST NIST
800-171 CONTROLS, AND TO THE
BEST OF THEIR ABILITY IMPLEMENT
SECURITY CONTROLS.
ANY DEVIATIONS MUST BE
DOCUMENTED WITHIN A PLAN OF
ACTION AND MILESTONES TO FURTHER
MITIGATE THE RISK.
ONCE YOU'VE MADE YOUR ASSESSMENT
AND DEVIATIONS DOCUMENTED
INSTITUTIONS SHOULD INFORM
RESEARCHERS THEY CAN ATTEST TO
THE NIH SECURITY BEST PRACTICES
WHEN THEY ARE SUBMITTING NEW OR
RENEWAL DATA ACCESS REQUESTS TO
NIH'S CONTROLLED-ACCESS GENOMIC
DATA.
ON OR AFTER JANUARY 25 APPROVED
USERS OF NIH CONTROLLED-ACCESS
GENOMIC DATA ARE EXPECTED TO
PROTECT THE DATA IN ACCORDANCE
WITH THE NIST 800-171 SERIES.
OR ITS EQUIVALENT INTERNATIONAL
STANDARDS.
IF YOU CHOOSE TO USE A
THIRD-PARTY I.T. SYSTEM OR CLOUD
SERVICE PROVIDER FOR DATA
ANALYSIS AND/OR STORAGE, FOR
YOUR PROJECT, YOU MUST REQUEST
AND BE PROVIDED ATTESTATION
STATEMENTS FROM THE SYSTEM OR
CLOUD SERVICE PROVIDER TO GIVE
ASSURANCES THEY ARE PROTECTING
AGAINST THE -- IN ACCORDANCE
WITH THE NIST SPECIAL
PUBLICATION 800-171, THAT WILL
GIVE THE ATURNSES -- ASSURANCES
FOR YOU TO ATTEST THE STANDARDS.
NEXT SLIDE.
SO WE'RE NOW GOING TO SHIFT TO
WHAT YOU NEED TO KNOW IF YOU'RE
AN I.T. SUPPORT STAFF AND YOU'RE
IMPLEMENTING NIST SPECIAL
PUBLICATION 800-171 SERIES.
SO, 800-171 ARTICULATES SECURITY
REQUIREMENTS ACROSS 17 SECURITY
CONTROL FAMILIES.
THESE RANGE FROM ACCESS
CONTROLS, GO THROUGHOUT THE LIFE
CYCLE AND COMPONENTS OF I.T.
ORGANIZATION, ALL THE WAY
THROUGH TO SUPPLY CHAIN RISK
MANAGEMENT.
WITH THE INTRODUCTION OF REV 3
LAST YEAR THREE FAMILIES WERE
ADDED TO ADDRESS SUPPLY CHAIN
RISKS, AN ACKNOWLEDGMENT AND
UNDERSTANDING THAT MOST
SOPHISTICATED ACTORS ARE
ENTERING THROUGH AUTHORIZED
SERVICE PROVIDERS, THROUGH
EXPLOITS OF SOFTWARE WE USE, AND
THROUGH EXPLOITS THAT HAVE
BEEN -- HAVE OCCURRED THROUGH
EQUIPMENT.
ADDITIONALLY THE REV 3
INTRODUCED CONCEPT ASSESSING
RISK SHOULDN'T JUST HAPPEN WHEN
YOU CREATE A SYSTEM OR YOU
DESIGN A SYSTEM BUT SHOULD ALSO
HAPPEN THROUGHOUT THE LIFE CYCLE
OF A SYSTEM.
IF YOU'RE AN INSTITUTION AND
YOU'RE ON REV 2, UNDERSTANDING
THAT REV 3 WAS INTRODUCED LAST
YEAR, WE UNDERSTAND THAT IT WILL
TAKE SOME TIME FOR YOU TO ADJUST
TO THE NEW REV 3 CONTROL FAMILY.
SO, I WANT TO STRESS NIH WILL
ACCEPT REV 2 AND REV 3, BOTH
FULFILL EXPECTATIONS OF NIH
SECURITY BEST PRACTICES, START
PLANNING NOW AND ASSESS AGAINST
THE THREE NEW CONTROL FAMILIES
INTRODUCED UNDER REV 3, AND THAT
YOU CREATE PLAN OF ACTION AND
MILESTONES FOR ANY OF THE
CONTROLS THAT YOU DON'T HAVE IN
PLACE TODAY BUT PLAN TO
IMPLEMENT IN THE FUTURE.
IN THIS WAY YOU'LL ACTIVELY
MANAGE THE RISK AS WELL AS
ENSURE YOUR EVENTUAL ADOPTION OF
REV 3.
NEXT SLIDE.
OKAY.
SO, LET'S DIVE INTO THE 800-171
SERIES A LITTLE BIT.
THE SERIES IS MADE UP OF TWO
DOCUMENTS, THE FIRST DOCUMENT
COVERS ALL THE CONTROLS AND HOW
THEY SHOULD BE IMPLEMENTED
WITHIN YOUR ORGANIZATION.
THE SECOND ONE IS NIST SPECIAL
PUBLICATION 800-171A, USED TO
ASSESS THE CONTROLS.
SO TWO DOCUMENTS, WE'LL COVER
FIRST THE DOCUMENT THAT COVERS
IMPLEMENTING CONTROLS.
SO NIST 800-171 ARTICULATES WHAT
THE CONTROL FAMILY IS, IT WILL
TELL YOU WHAT THE REQUIREMENT OF
THAT CONTROL FAMILY IS.
AND THEN IT WILL GIVE YOU A
DESCRIPTION OF THAT REQUIREMENT.
NOW CONTROLS THAT HAVE IN THEIR
DESCRIPTION ORGANIZATIONAL
REQUIREMENTS, THAT MEANS THAT'S
A CONTROL YOUR ORGANIZATION CAN
SELECT EITHER THE POLICY OR
PROCEDURE FOR THAT CONTROL.
YOU'LL GENERALLY SEE THAT WHEN
IT IS ACTUALLY ORGANIZATIONS
THAT DETERMINE FREQUENCY A
CONTROL IS TO OCCUR, OR IT IS
OFTEN USED IF IT IS UP TO YOUR
DISCRETION AT THE ORGANIZATION
LEVEL, HOW YOU'RE IMPLEMENTING
THAT CONTROL.
THESE CONTROLS OFFER MAXIMUM
FLEXIBILITY.
SO NEXT WE'LL DISCUSS THE
CONTROL BY GIVING YOU A
DESCRIPTION AND PROVIDE
ACCEPTABLE MEANS AND EXAMPLES OF
IMPLEMENTING THAT CONTROL.
AND FINALLY AT THE BOTTOM UNDER
REFERENCE IT GIVES ADDITIONAL
RESOURCES, PROVIDING A CROSSWALK
TO THE CONTROL FAMILIES AS THEY
RELATE TO THE PARENT DOCUMENT
WHICH IS THE NIST 800-53 CONTROL
SET, AS WELL AS GIVE ADDITIONAL
INITIAL DOCUMENT STANDARDS AND
RESOURCES LINKED AT THE BOTTOM
OF THE CONTROLS.
THE NIST 800-171 DOCUMENT
PROVIDES A GUIDE FOR HOW TO
IMPLEMENT THE CONTROLS, AND IT
WILL PROVIDE YOU WITH EVERYTHING
YOU NEED TO KNOW TO IMPLEMENT
THE PROTECTIONS UNDER THE
800-171.
NEXT SLIDE.
OKAY.
LET'S SHIFT GEARS AND NOW WE'LL
DIVE INTO THE 800-171A.
TO SELF ASSESS YOUR INSTITUTION
AND YOUR MATURITY YOU WILL USE
THE NIST SPECIAL PUBLICATION
800-171A FOR YOUR
SELF-ASSESSMENT, THIS IS A GUIDE
TO ASSESS CONTROLS YOU
IMPLEMENTED UNDER NIST SPECIAL
PUBLICATION 800-171.
SIMILAR TO THE 171, IT HAS A
SIMILAR FORMATTING, YOU HAVE THE
CONTROL NUMBER, NAME OF THE
CONTROL, AS WELL AS THE
REQUIREMENTS YOU'RE GOING TO
ASSESS YOURSELF AGAINST.
IT WILL THEN OFFER YOU THREE
METHODS OF ASSESSMENT.
YOU CAN EXAMINE A POLICY OR
PROCEDURE.
YOU COULD INTERVIEW PERSONNEL.
OR YOU CAN TECHNICALLY TEST THE
CONTROL.
WHAT LEVEL YOU CONDUCT
ASSESSMENT IS UP TO YOU.
AND WHAT YOU DETERMINE IS THE
RIGHT BALANCE FOR YOUR
ORGANIZATION'S MATURITY.
YOU WILL WANT TO MAKE SURE YOU
ASSESS AT THE RIGHT LEVEL, BASED
ON THE CONTROLS YOU'VE
IMPLEMENTED AND RESOURCES AND
TIMES AVAILABLE TO YOU.
DEPENDING ON THE METHOD THE 171
ASSESSMENT WILL ARTICULATE WHICH
ARTIFACTS REVIEWED, WHO SHOULD
BE INTERVIEWS, WHAT CONTROLS MAY
BE APPLICABLE TO ATTEST.
TO RECAP, THE 171A WILL PROVIDE
YOU WITH EVERYTHING YOU NEED TO
KNOW FOR HOW TO CONDUCT A
SELF-ASSESSMENT OF THE CONTROLS.
NEXT SLIDE.
THIS PROVIDES A WEALTH OF TOOLS
FOR DOCUMENTING AND ASSESSING
CONTROLS INCLUDING THE NIST
CYBERSECURITY AND PRIVACY
REFERENCE TOOLS AS WELL AS SOME
CONTROL OVERLAY.
THESE TOOLS SEEK TO ACCELERATE
YOUR ADOPTION OF THE 171 SERIES,
AND WILL ALLOW YOU TO EXPORT ALL
THE CONTROLS INTO A NICE
SPREADSHEET.
YOU CAN USE THAT SPREADSHEET TO
DOCUMENT YOUR CONTROLS AND
BECOME YOUR SYSTEM SECURITY PLAN
AS WELL AS USE THAT TO DOCUMENT
YOUR ASSESSMENT PLAN AND THE
RESULTS OF YOUR ASSESSMENT.
AT THE VERY BOTTOM WE WANTED TO
SHARE AN INFORMATIVE
PRESENTATION NIST PROVIDED IT'S
A AT A RECENT CYBER CONFERENCE
COVERING EVERYTHING YOU NEED TO
KNOW ABOUT THE 800-171 SERIES AS
WELL AS PROVIDE A DEEP DIVE OF
HOW YOU CAN LEVERAGE
CYBERSECURITY AND PRIVACY TOOLS
THAT NIST PROVIDES.
NEXT SLIDE.
OKAY.
TO RECAP, IF YOU'RE AN I.T.
SUPPORT STAFF MEMBER SUPPORTING
THIS EFFORT, YOU ARE TO ASSESS
IN-SCOPE SYSTEMS AGAINST NIST
SPECIAL PUBLICATION 800-171
CONTROLS.
AND TO THE BEST OF YOUR ABILITY
IMPLEMENT THOSE CONTROLS.
YOU'RE ALSO TO DEVELOP A PLAN OF
ACTION MILESTONE FOR ANY
CONTROLS EITHER PARTIALLY
IMPLEMENTED OR PLAN TO BE
IMPLEMENTED.
ONCE THIS IS DONE YOUR
INSTITUTION SHOULD COMMUNICATE
COMPLIANT STATUS TO STAFF AND
RESEARCHERS SO THEY CAN ATTEST
TO THE APPROPRIATE PROTECTION.
IF YOU'RE A RESEARCHER ON OR
AFTER JANUARY 25 YOU'RE TO
ATTEST TO PROTECTING NIH GENOMIC
CONTROLLED ACCESS DATA WHEN
REQUESTING NEW ACCESS OR
REVIEWING ACCESS TO NIH
CONTROLLED ACCESS TO GENOMIC
DATASETS.
NEXT SLIDE.
SO, LAST BUT NOT LEAST, WE
WANTED TO POOL RESOURCES
AVAILABLE TO YOU ON ONE SLIDE.
NIH HAS A WEALTH OF INFORMATION
THAT WE'VE PUBLISHED TO OUR
PUBLIC SITES, AND THE LINKS ARE
HERE FOR ALL THE INFORMATION YOU
NEED TO KNOW ABOUT THE NIH
SECURITY BEST PRACTICES, GENOMIC
SHARING POLICY, FREQUENTLY ASKED
QUESTIONS ARE HERE AS WELL AS
LIST OF APPLICABLE NIH
CONTROLLED ACCESS DATA
REPOSITORIES.
NIST AS WE MENTIONED ALSO HAS A
WEALTH OF INFORMATION AVAILABLE
TO YOU, SO THEY ARE LISTED HERE
AS WELL.
I WANTED TO THANK YOU FOR
HANGING IN THERE AS WE COVERED
THIS WEALTH OF INFORMATION.
MICHAEL WILL SUPPORT ME TODAY
AND WE WILL START OUR Q&A
SESSION.
MICHAEL WILL BE COORDINATING OUR
SERVICES FOR OUR PANELISTS.
MICHAEL, WELCOME.
OVER TO YOU.
>> THANK YOU, MS. FALVELLA.
GREETINGS.
I'M MICHAEL DEBRAH,
COMMUNICATIONS LEAD, I WILL BE
FACILITATING THE Q&A SESSION FOR
TODAY'S EVENT.
PLEASE ENTER YOUR QUESTIONS IN
THE Q&A AND FOR THOSE
PARTICIPATING VIA ZOOM YOU'LL
HAVE ABILITY TO UPLOAD QUESTIONS
ENTERED IN THE Q&A FOR
PRESENTERS TO ADDRESS.
WE'LL TRY OUR BEST TO ANSWER AS
MANY RELEVANT QUESTIONS AS
POSSIBLE DURING THIS DEDICATED
HOUR.
ADDITIONAL QUESTIONS MAY BE SEND
TO GDS@MAIL.NIH.GOV.
SO TO KICK THINGS OFF THE FIRST
QUESTION WILL BE ROUTED TO
MS. FALVELLA.
WORK STATIONS THAT INTERACT WITH
SYSTEM AND SCOPE.
>> THANKS, MICHAEL.
YES, SHORT ANSWER IS YES, WORK
STATIONS THAT INTERACT WITH NIH
CONTROLLED ACCESS DATA ARE
WITHIN SCOPE.
ANY SYSTEM THAT DOWNLOADS,
PROCESSES, ACCESSES, TRANSMITS,
STORES, NIH CONTROLLED-ACCESS
DATA APPLICABLE TO THE NIH
GENOMIC DATA SHARING POLICY IS
WITHIN SCOPE.
>> SOUNDS GOOD.
NOW, DR. JACOBS, THIS IS FOR
YOU.
IT READS, IF YOU HAVE GENOMIC
DATA FROM ONE BASE NEEDED FOR
PERFORMANCE OF NIH-FUNDED GRANT
WILL THE COST OF COMPLIANCE BE
CHARGEABLE AS DIRECT COST TO THE
GRANT?
>> YES, SO FOR THAT QUESTION,
THE ANSWER REALLY NEEDS TO BE
ADDRESSED TO NIH'S GRANTS
MANAGEMENT TEAM BECAUSE THERE
ARE A LOT OF DEPENDENCIES AND
HOW THAT AWARD IS COMPOSED AND
EXACTLY HOW THE DATA WOULD BE
MANAGED AND SHARED.
AND SO WE'LL BE PUTTING A LINK
IN THE CHAT TO CONTACT GRANTS
MANAGEMENT AT NIH.
SO THEY CAN GIVE A MORE ACCURATE
QUESTION BASED ON HOW THE
FUNDING MECHANISM IS SET UP AND
HOW THAT DATA OUGHT TO BE
SHARED.
>> THANK YOU.
ANOTHER QUESTION FOR YOU.
CAN YOU PLEASE CLARIFY WHAT THE
RESEARCHERS ARE CERTIFYING TO,
WILL ONLY RESEARCHERS THAT NEED
TO NIST 800-171 BE ASKED TO
CERTIFY?
>> WE CAN TAG TEAM THIS
QUESTION.
I'LL BEGIN BY SAYING THAT THE
ATTESTATION WILL BE -- WILL
CONSIST OF A SELF-ASSESSMENT OF
SECURING NIST CONTROLS, BY THE
INSTITUTIONAL, EXCUSE ME,
SECURITY STAFF INSTITUTIONAL
TECHNOLOGY DIRECTOR OR OTHER
PERSONSES AT THAT INSTITUTION
ASSESSING THAT THEY ARE ABLE TO
MEET NIST CONTROLS INCLUDING
PLANS OF ACTIONS AND MILESTONES
THAT ARE OUTLINED.
THAT'S WHAT THEY ARE ATTESTING
TO.
THERE'S BEEN ASELF-ASSESSMENT,
THERE ARE SECURITY CONTROLS IN
PLACE, AND MILESTONES TO MEET
THOSE THAT ARE PARTIALLY
IMPLEMENTED.
AND WOULD BE ATTESTED BY
PRINCIPAL INVESTIGATOR
SUBMITTING THE REQUEST, AND
INSTITUTIONAL SIGNING OFFICIAL
ON BEHALF OF THE INSTITUTION, SO
THE AUTHORIZED INDIVIDUAL AOR
ARE NOT BE EXPECTED, AND
MS. FALVELLA CAN ADD TO WHAT
I'VE STATED.
>> THE I.T. SUPPORT STAFF ARE
REALLY THE PRIMARY ROLES WHO
WILL BE REVIEWING THE 800-171
CONTROL FAMILIES DOCUMENTING THE
CONTROLS, COORDINATING
ASSESSMENT OF THOSE CONTROLS,
AND THEN INSTITUTION, AND
IMPLEMENTING TO THE BEST OF
THEIR ABILITY THE CONTROLS AS
DR. JACOBS MENTIONED, THE I.T.
STAFF WILL ALSO BE DEVELOPING
ANY PLAN OF ACTIONS AND
MILESTONES, ONCE ALL OF THAT IS
DONE.
THEN THE INSTITUTION SHOULD
COMMUNICATE OUT THE COMPLIANCE
STATUS TO THEIR STAFF, AND TO
RESEARCHERS, AND THAT WILL ALLOW
THE RESEARCHERS TO ATTEST TO THE
STANDARDS AND BE GIVEN
REASONABLE ASSURANCES THAT THEY
ARE COMPLIANT WITH THEIR DATA
USE AGREEMENTS FOR THE DATA
REPOSITORIES THEY ARE REQUESTING
ACCESS TO BUT CHERYL IS SPOT ON,
JUST A LITTLE CONTEXT ON THE
ROLES.
THANKS.
>> SOUNDS GOOD.
THANK YOU SO MUCH.
NOW, WE HAVE SOME QUESTIONS FROM
THE LIVE Q&A SECTION.
I'M GOING TO TURN MY ATTENTION
TO THAT.
THIS IS FOR YOU GIVEN THE SHORT
NOTIFICATION TIME IS NIH
CONSIDERING EXTENDING DEADLINE
FOR IMPLEMENTATION, RESEARCH
WILL BE LIMITED GIVEN LACK OF
TIME TO IMPLEMENT.
AND NUMEROUS QUESTIONS,
REGARDING HOW TO DEMONSTRATE
COMPLIANCE, IMPLEMENTATION MAY
BE PARTICULARLY WARRANTED GIVEN
EVEN EFFECT OF THE POLICY
DEPENDING ON WHEN USERS DATA
ACCESS RENEWS, VERBOSE BUT YOU
GET THE GIST.
WHAT'S THE REACTION TO THAT?
>> I'LL LET MS. FALVELLA BEGIN.
>> SORRY, DELAY TO UNMUTE.
NIH IS NOT CONSIDERING DELAYING
THE DEADLINE FOR IMPLEMENTATION,
GUIDE NOTICE WAS RELEASED IN
JULY OF LAST YEAR, AND WE FEEL
THERE'S ENOUGH TIME FOR
INSTITUTIONS TO SELF-ASSESS
AGAINST 171 STANDARD AND DEVELOP
PLAN OF ACTION MILESTONES FOR
HOW THEY WILL BRING SYSTEMS
FULLY INTO MEETING THE CONTROL
SET.
WITH THOSE OPTIONS AVAILABLE TO
STAFF, TO INSTITUTIONS, TIME TO
IMPLEMENT GUIDE NOTICE AND
PROTECT DATA IN ACCORDANCE WITH
THE GUIDE NOTICE.
CHERYL, I DON'T KNOW IF YOU HAVE
ANYTHING TO ADD TO THAT.
>> TO MEET THE NIST STANDARDS,
IT'S BUILT IN FLEXIBILITY WITH
THAT, THERE ARE EXISTING
SECURITY CONTROLS OF YOUR SYSTEM
AND IF YOU HAVE NOT SECURED ALL
THE CONTROLS, HAVING A PLAN OF
ACTION AND MILESTONE IS -- WILL
ALLOW YOUR INSTITUTION TO ATTEST
YOUR SECURITY DATA ACCORDING TO
THE NIST 800-171.
>> GREAT POINT.
MOST PEOPLE WILL REALIZE ONCE
THEY DIVE IN, MOST I.T. SHOPS
WILL REALIZE ONCE THEY DIVE IN
THE CONTROLS ARE THE BEST
PRACTICES FOR TODAY'S MODERN
WORLD, AND SO I THINK MOST
ORGANIZATIONS FIND ONCE THEY GET
STARTED ON LOOKING AT THE
CONTROLS THAT THEY ACTUALLY ARE
MEETING A MAJORITY OF THOSE
TODAY, I THINK MOST
ORGANIZATIONS FOR EXAMPLE
CONDUCT TRAINING ON SECURITY
AWARENESS, AND DO THINGS LIKE
ACCESS CONTROL THROUGH, YOU
KNOW, USER NAME AND PASSWORDS
WITH TOKENS, SO I THINK A LOT OF
THESE THING ONCE YOU DIVE INTO
THE SERIES IT SHOULD PUT SOME OF
YOUR CONCERNS AT EASE.
AND THE NIST PROVIDES A WEALTH
OF RESOURCES FOR HOW TO
IMPLEMENT THE CONTROLS WITH
VARYING LEVELS OF MATURITY SO
EVEN ORGANIZATIONS THAT HAVE
VERY SMALL RESOURCES HAVE BEEN
FOUND THE SERIES IS EASIER TO
ADOPT THAN THEY GENERALLY
THOUGHT.
SO DEFINITELY USE THE RESOURCES
PROVIDED BY NIST AND HOPEFULLY
THAT WILL HELP.
IS DATA PROSED THE ON THE NIH
SERVER COVERED, NOT A DOWNLOADED
DATASET PER SE BUT CATALYST.
>> YES, WHAT WE'RE TALKING ABOUT
IS AN A P.I. SUBMIT DATA ACCESS
REQUEST TO ONE OF THE 20
REPOSITORIES LISTED AND
APPROVED.
THAT DATA WHEN DOWNLOADED WOULD
BE EXPECTED TO BE SECURED
ACCORDING TO NIST 800-171.
NOW, THAT DATA IN YOUR
POSSESSION, YOU MAY WANT TO USE
THE IMPUTATION SERVER TOPMed
IMPUTATION SERVER AS SECURITY
STANDARDS IN PLACE THAT DO MEET
171 AND REALLY WHAT WE'RE
TALKING ABOUT IS HAVING THE P.I.
WHEN THEY ARE IN POSSESSION OF
THAT DATA, NOT NECESSARILY WHEN
THEY SHARE WITH IMPUTATION
SERVER, BUT THE SERVER IS ALSO
AT THAT STANDARD BUT WE'RE
TALKING ABOUT PRINCIPAL
INVESTIGATORS APPROVED WHO HAVE
DATA AND DOWNLOAD IT TO A LOCAL
SYSTEM OR THIRD PARTY I.T.
SYSTEM THEY ARE SECURING THAT
DATA ACCORDING TO NIST 800-171.
>> THANK YOU.
MS. FALVELLA, WHAT IS THE
MINIMAL ENDESCRIPTION STRENGTH
TO STORE DB DATA GAP, 128 IS
THAT ENOUGH?
>> THE CONTROL SETS, ENCRYPTION
MUST BE USED, REFERENCES AT THE
BOTTOM OF THE CONTROL THAT
ENCRYPTION MUST BE 141-3
CERTIFIED, DBC IS COMPLIANT BUT
I'M JUST REFERENCING HOW OTHER
INSTITUTIONS WHO MAY USE OTHER
ENCRYPTION PROTOCOLS CAN FIND
OUT THEY ARE COMPLIANT.
GO TO CONTROLS IN 171 CONTROL
SERIES, GO TO THAT BOTTOM
SECTION UNDER REFERENCES, THEY
WILL SEE A LINK TO 140-3, CLICK
ON THAT, THEY CAN FIND A WEALTH
OF INFORMATION OF ALL THE
PROTOCOLS THAT COULD BE
COMPLIANT TO MEET STANDARDS OF
THE 171 CONTROL SERIES.
BUT IN SHORT, YES.
THANK YOU.
>> I HOPE THAT ADDRESSES YOUR
CONCERN.
THE ANSWER IS QUESTION.
DR. JACOBS, SELF-ATTESTATION
IMPLIES THAT THE P.I. OR
INSTITUTION IS FULLY ACCOUNTABLE
FOR COMPLYING WITH 800-171.
IN THE EVENT OF AN INCIDENT
WHERE THERE'S UNAPPROVED ACCESS
TO THE DATA, WHAT ACTIONS COULD
NIH TAKE AND IS THERE AN
ESCALATING SCALE OF
CONSEQUENCES?
>> YES, SO IN THAT INSTANCE,
THERE ARE TERMS A HOW TO DEAL
WITH AN INCIDENT SUCH AS THAT,
EITHER A CYBERSECURITY INSTITUTE
OR DATA MANAGEMENT INCIDENT.
AND THERE ARE DIRECTIONS IN THE
AGREEMENT HOW TO DEAL WITH SUCH
AN EVENT, CONTACTING NIH AND
THEN WORKING WITH NIH TO ADDRESS
THE INCIDENT.
AND SO THERE ARE MULTIPLE
DEPENDENCIES HERE, ON THE TYPE
OF COMPLIANCE ACTIONS THAT NIH
WOULD TAKE, BUT MOST IMPORTANT
IS THAT NIH -- THAT IF THE
APPROVED USER, THAT THE APPROVED
USER RESPONDS TO NIH IN A TIMELY
MANNER AND IS VERY COOPERATIVE
WANTING TO GET THE INCIDENT
REMEDIATED AND RESOLVED, AND
THEN ADDITIONAL ENHANCEMENTS PUT
IN PLACE.
AND OPERATIONS AND PROCESS SO IT
WOULDN'T HAPPEN AGAIN.
>> SOUNDS GOOD.
ALSO FOR YOU, DR. JACOBS, DOES
THE NIST 800171 REQUIREMENT
APPLY TO DATA DOWNLOADED FROM A
CONTROLLED ACCESS REPOSITORY OR
ONLY TO GENOMIC DATA EXPORTED,
IF A RESEARCHER DOWNLOADED
DE-IDENTIFIED SURVEY RESPONSES
DOES THE REQUIREMENT APPLY THERE
AS WELL?
>> YEAH, SO FOR THE NIST
REQUIREMENT, IT APPLIES TO THE
ENTIRE REPOSITORY, SO IF ONE OF
THOSE REPOSITORIESES THAT
CONTROLLED ACCESS DATA, ALTHOUGH
NOT GENOMIC AND YOU GET ACCESS
TO THAT DATA, YOU WOULD BE
EXPECTED TO SECURE THE DATA
ACCORDING TO NIST 800-171.
WHEN GENOMIC DATA IS GENERATED
IT'S NOT IN ISOLATION .
ASSOCIATED DATA IS ALSO
GENERATED.
DATA FROM ONE OF THOSE 20
REPOSITORIES WILL STILL BE
EXPECTED TO THE NIST SECURITY
STANDARD.
>> ONE MORE BEFORE I TURN MY
ATTENTION TO DR. FALVELLA.
WILL THE SIGNING OFFICIAL
ATTESTATION ALWAYS BE REQUIRED
OR WILL ANY OF THE REPOSITORIES
RELY EXCLUSIVELY ON P.I.
ATTESTATION?
>> YEAH, THIS IS GOOD.
THIS IS GOOD.
I WANT TO REEMPHASIZE THAT WHAT
WE HAVE RIGHT NOW, WHAT EXISTS
NOW IS THAT WE EXPECT THE P.I.
WHEN REQUESTING ACCESS FOR DATA,
THE P.I. TO APPROVE THAT THEY
WILL MEET TERMS OF ACCESS IN THE
DATA USE CERTIFICATION AGREEMENT
AND FOR THE INSTITUTION TO DO
THAT, THAT DO IT IN KIND.
AND HOW THE INSTITUTION ATTESTS
NOW IS USE OF INSTITUTIONAL
SIGNING OFFICIAL.
SO THE USE OF THOSE TWO BODIES,
THE P.I. AND THEN INSTITUTIONAL
SIGNING OFFICIAL, ON BEHALF OF
THE INSTITUTION, THAT WILL NOT
CHANGE.
AND SO WHAT WE ARE EXPECTING AS
AN ATTESTATION BUT THIS IS IN
LINE WITH THE DAR PROCESS, IN
LINE WITH THOSE INDIVIDUALS THAT
WE ALREADY EXPECT, TO SIGN OFF
ON AGREEING TO THE TERMS.
SO WHEN ACCESS IS APPROVED,
ACCESS IS APPROVED FOR THE P.I.
AS WELL AS THE P.I.'S
INSTITUTION, SO WE'LL BE
EXPECTING INSTITUTIONAL SIGNING
OFFICIAL TO ATTEST, AND SO THEY
SHOULD HAVE KNOWLEDGE THAT WHAT
THEY ARE ATTESTING TO IS
ACCURATE, AS WELL AS THE
PRINCIPAL INVESTIGATOR AND
MS. FALVELLA, IF YOU WOULD LIKE
TO ADD ANYTHING, THERE'S STILL
QUESTIONS ABOUT THE AOR AND
THEIR ROLE, WE MIGHT WANT TO
JUST CLARIFY AGAIN WHAT WE'RE
ASKING FOR.
>> YEAH, SO WE'RE ASKING
INSTITUTIONS TO -- THIS IS
LARGELY, AGAIN, GOING TO BE DONE
BY THEIR I.T., YOUR I.T. SHOP,
TO ASSESS YOURSELF AGAINST THE
800-171 CONTROL SERIES, RIGHT?
THAT REQUIRES YOU TO REVIEW THE
DOCUMENTATION UNDER THE 800-171
AND THEN ASSESS YOURSELF AND
USING THE 800-171A AS YOUR
ASSESSMENT GUIDE.
AND SO THAT WILL BE DONE BY
LARGELY YOUR I.T. PROFESSIONALS.
ONCE THAT IS DONE, YOU ARE GOING
TO IMPLEMENT CONTROLS TO THE
BEST OF YOUR ABILITY BUT
PROBABLY ARE GOING TO HAVE SOME
PLAN OF ACTION AND MILESTONES
FOR PARTIALLY OR FULLY
IMPLEMENTED CONTROLS.
THEN THE INSTITUTION CAN
COMMUNICATE OUT COMPLIANCE
STATUS TO STAFF AND RESEARCHERS,
THEN THE RESEARCHERS CAN ATTEST
WITH ASSURANCES THEIR SYSTEMS
ARE COMPLIANT WHEN THEY ARE
ACCESSING NIH CONTROLLED-ACCESS
DATA.
AND HOPEFULLY, CHERYL, I GOT TO
EVERYTHING TO CLARIFY THAT.
EXCELLENT.
THANK YOU.
>> I HAVE A QUESTION FOR
MS. FALVELLA.
ARE THERE FUTURE PLANS TO
REQUIRE THAT THE NIST 800-171
ENVIRONMENTS HOUSING CONTROLLED
ACCESS DATA BE CMM 2 LEVEL
CERTIFIED.
>> GREAT QUESTION.
THERE ARE NOT FUTURE PLANS TO
REQUIRE ANY OTHER STANDARDS
OTHER THAN 800-171.
JUST TO PREFACE WHY THE 171 WAS
SELECTED, WHEN WE LOOKED ACROSS
NIH AND REMEMBER THE REFERENCE I
MADE ABOUT THE PATCH WORK OF
STANDARDS BEING USED ACROSS NIH,
WE FOUND THAT THERE WERE TWO
STANDARDS WIDELY USED, 171-53,
THE SAME USED FOR FEDERAL
SYSTEMS, AND SECOND MOST WIDELY
USED WAS 171, SO IF YOU WERE
SEEKING FUNDING FROM NIH, THOSE
TWO REQUIREMENTS WERE THE ONES
MOST PREDOMINANTLY USED AT NIH.
THE 800- 53 WE DIDN'T FEEL WAS
APPROPRIATE WITH CONTROLS AROUND
AVAILABILITY.
ADDITIONALLY LOOKING ACROSS THE
GOVERNMENT SAW 800-171 LARGELY
USED FOR SIMILAR PURPOSES, AND
SO IF YOU'RE SEEKING FUNDING
OPPORTUNITIES FOR EXAMPLE
THROUGH A VETERAN, FOR THE V.A.,
YOU WILL PROBABLY BE ASKED TO
FULFILL 800-171, THE DoD
WIDELY USES THAT, AND THEN MOST
OF THE OTHER R&D DEPARTMENTS ARE
USING 171.
SO IT WAS SELECTED BECAUSE IT'S
THE MOST WIDELY USED FOR THIS
USE CASE.
ADDITIONALLY, WE SELECTED
800-171 LOOKING AT FUTURE
REQUIREMENTS THROUGH THE FEDERAL
GOVERNMENT, SO IT IS THE
STANDARD EXPECTED TO BE WIDELY
MANDATED FOR THE GOVERNMENT TO
FOLLOW.
AND THAT ALSO ALIGNS WITH HHS'S
DEPARTMENT POLICY.
SO NO FUTURE PLANS, TO SWITCH
OFF THE 800-171.
>> THANK YOU.
IN THE NEIGHBORHOOD OF
CERTIFICATIONS, I HAVE A
QUESTION FOR YOU AS WELL.
WOULD AN ISO 2022 CERTIFICATE BE
CERTIFICATE AS ATTESTATION?
>> I BELIEVE SO, I BELIEVE
THAT'S AN EQUIVALENT STANDARD,
ACCEPT THE ATTESTATION FOR
INTERNATIONAL STANDARDS UNDER
ISO-R ARE THE EQUIVALENT SO THEY
ARE GENERALLY ACCEPTED.
ADDITIONALLY IF YOUR GOVERNMENT
HAS STANDARDS OR YOU FOLLOW YOUR
INTERNATIONAL PARTNER AND YOU
FOLLOW A STANDARD THAT DERIVES
FROM THE ISO STANDARD, IT'S
HIGHLY LIKELY YOU WILL ALSO BE
EQUIVALENT AND BE ABLE TO
ATTEST.
WE UNDERSTAND A LOT OF
COMPLIANCE WILL DERIVE FROM THE
ISO STANDARD IF YOU'RE AN
INTERNATIONAL PARTNER SO IT'S
LIKELY IT IS EQUIVALENT BUT
WE'RE ALSO HAPPY TO REVIEW ANY
OF YOUR STANDARDS IF YOU JUST
DROP US A LINE ON THE GDS MAIL
MAILBOX.
WE'RE HAPPY TO REVIEW YOUR
PARTICULAR INTERNATIONAL
STANDARD.
>> THANK YOU SO MUCH.
NOW -- GO AHEAD.
>> BEFORE YOU MOVE ON I WOULD
LIKE TO ADD THAT WE DON'T EXPECT
A CERTIFICATE OR ANY SORT OF
DOCUMENT, AGAIN THIS IS BASED ON
SELF-ASSESSMENT.
SO NIH IS NOT EXPECTING TO
RECEIVE ANYTHING AS A PART OF
THE ATTESTATION.
THIS IS IN GOOD FAITH THAT YOU
ALL HAVE DONE SELF-ASSESSMENT
AND YOU ARE ATTESTING TO NIH
THAT IN GOOD FAITH YOU HAVE DONE
SO ADHERE TO THE NIST OR ISO
SECURITY STANDARDS.
>> GREAT POINT.
THANK YOU SO MUCH FOR
EMPHASIZING THAT, DR. JACOBS.
THE ONE THING I WOULD ADD TO
THAT THOUGH IS THERE IS A
CYBERSECURITY BREACH, PRIVACY
BREACH FOR DATA MANAGEMENT
INCIDENT, THEN WE MAY ASK FOR
DOCUMENTATION TO VERIFY YOUR
COMPLIANCE AS PART OF OUR
INVESTIGATION OF THOSE
INCIDENTS.
AND SO THAT WOULD BE THE POINT
OF WHERE THE GOVERNMENT MAY
REQUEST ADDITIONAL DOCUMENTATION
FROM YOU TO MAKE SURE YOU'RE IN
COMPLIANCE WITH YOUR AGREEMENT,
BUT AGAIN TO DR. JACOBS' POINT
WE'LL NOT BE REQUESTING ANY
DOCUMENTATION IN ADDITION TO
RESEARCHERS ATTESTATION.
>> SOUNDS GOOD.
DR. CHERYL, THERE'S A QUESTION
ABOUT CUIs.
WILL THERE BE FURTHER
CLARIFICATION, CONTROLLED ACCESS
DATA IS NOT CONSIDERED CUI?
>> THANK YOU.
WE'RE NOT CONSIDERING GENOMIC
DATA AT CUI.
AND WE WANT TO SEPARATE WHAT IS
CUI, WHAT IS NOT CUI.
FOR JUST THE BASIC POINT THAT
THERE'S SECURITY CONTROLS
EXISTING NOW, IN THE GDS POLICY
THAT'S AN EXPECTATION TO PROTECT
DATA, SO WE'RE UPDATING THOSE
SECURITY CONTROLS USING A NIST
STANDARD.
AND WHETHER OR NOT CUI IS REALLY
NOT THE PURPOSE OF THE SECURITY
UPDATE.
THE SECURITY UPDATE IS THAT WE
ARE FOLLOWING NIST 800-171 AND
WE'RE LOOKING FOR INSTITUTION
THAT HOLDS THE DATA SO NOT --
EXCUSE ME, ON THE LOCAL SYSTEMS,
NOT THE ENTIRE INSTITUTION OR
CAMPUS.
I DID SEE A QUESTION ABOUT THAT.
IT'S THE LOCAL SYSTEM THAT HOLDS
THE DATA, WE'RE LOOKING FOR
SELF-ASSESSMENT OF THAT SYSTEM
FOR THE USER TO ATTEST TO THE
SECURITY CONTROL SO REALLY FOCUS
ON THE SECURITY CONTROLS AND
WHETHER OR NOT CUI IS REALLY NOT
THE GOAL OF THE UPDATE, THE GOAL
OF THE UPDATE ARE THE SECURITY
CONTROLS, 800-171.
ON THE SYSTEM, THAT'S SECURING
THE DATA, NOT THE ENTIRE CAMPUS.
IT'S THE SYSTEM.
>> SOUNDS GOOD.
NOW, WE ARE AT TIME NOW.
SO IF OUR PRESENTERS HAVE ONE
MORE QUESTION, THE TIME FOR ONE
MORE QUESTION, WE CAN DO THAT
AND WRAP UP.
I BELIEVE THIS RELATES TO THE
ATTESTATION FORM.
SO YOU'RE SAYING THERE'S A
COMMENT, YOU SAY ATTESTATION IS
NOT A FORM, WHERE SPECIFICALLY
WILL INVESTIGATORS SEE THIS
ATTESTATION?
>> YEAH, ATTESTATION WILL VARY
FOR DBGaP, YOU'LL SEE THIS
PART OF THE DAR PROCESS AS
YOU'RE GOING THROUGH AND SEEING
YOU'LL PROTECT DATA ACCORDING TO
DATA USE LIMITATIONS AND SUCH,
THERE WILL BE ANOTHER BOX YOU
WILL ATTEST. ATTEST TO, FOR DBP
THAT'S AN EXAMPLE THAT WILL BE
PART OF THE DAR PROCESS.
>> THANK YOU SO MUCH, DR.
JACOBS.
THIS CONCLUDES OUR Q&A SESSION.
I WILL NOW GIVE THE MIC TO DR.
CHEN.
PLEASE CLOSE US OUT.
THANK YOU SO MUCH.
>> THANK YOU, EVERYONE.
SPECIAL THANKS TO CLOSED
CAPTIONERS AND ASL INTERPRETERS,
TO THOSE WHO TOOK THE TIME OUT
OF YOUR DAY TO JOIN US FOR
TODAY'S OVERVIEW OF THE NIH
SECURITY BEST PRACTICES FOR
USERS OF CONTROLLED ACCESS DATA.
FOR ALL THE TIME THAT YOU SPENT
WITH US TODAY.
IF THERE ARE ADDITIONAL
QUESTIONS SEND THEM TO
GDS@MAIL.NIH.GOV, THEY WILL BE
GROUPED AND POSTED AT A LATER
DATE, RECORDING WILL BE
AVAILABLE AT A LATER TIME.
SLIDES CAN BE FOUND AT THE
SHARING.NIH.GOV, ONCE YOU SEE
GENOMIC DATA SHARING POLICY.
AND ONCE IN THE GDS POLICY
SECTIONS RESOURCES PAGE CLICK ON
WEBINAR.
THANK YOU FOR JOINING US AGAIN,
AND HAVE A WONDERFUL REST OF
YOUR DAY.
THIS CONCLUDES TODAY'S WEBINAR.
[END OF PROGRAM]