Research sponsored by federal mission agencies may require the generation, transmission, storage, and/or analysis of controlled unclassified information (CUI). The Sponsored Program Office (SPO) works closely with researchers, sponsors, and various units within Michigan Tech to meet the unique requirements of projects that involve CUI.
What is CUI?
CUI is information held by or generated by the Federal Government that, while not classified, requires safeguarding and dissemination controls. This may include research data and other project information that Michigan Tech researchers receive, possess, or create during the performance of a federally funded project.
Additional information about CUI and the applicable laws, regulations, and policies is available on the Research Integrity website.
CUI on Projects and/or Proposals
The federal sponsor is responsible for determining whether an award will involve CUI and for ensuring that potential performers have the necessary safeguarding measures in place before CUI artifacts are shared or generated.
Often, the program solicitation will identify if the work they are soliciting will require, or has the potential to require CUI safeguarding.
Some sponsored project opportunities may develop from ongoing relationships with federal agencies and their program managers. In these situations, it is important to ask the program manager during the proposal stage whether a project will involve CUI and to share this information with SPO.
Researchers who are unsure whether CUI considerations are relevant to a particular funding opportunity should contact SPO, and provide the announcement (RFP, BAA, website, etc.) for the opportunity in question.
CUI Impact On Proposal Development
The data safeguarding and dissemination controls necessary for handling CUI require a CUI-compliant environment. This may include adjustments to physical facilities (i.e. access control improvements), adjustments to the scheduling/stationing of personnel, and security planning related to information technology. Depending upon the needs of the project, this may require a commitment of funds. In many cases, expenses required to handle CUI can be included in the budget for the respective project. While the budget allocation necessary will vary based on project needs (including the number of personnel who will access CUI, software needs, facilities available, etc.), the SPO can help generate estimates and unite the key campus players who will be involved in the necessary preparations.
CUI Impact on Project Operations
Projects that involve CUI require the development of and adherence to a Technology Control Plan (TCP) that outlines how sensitive data, technology, software, and other items will be managed, transmitted, and secured. Similarly, these projects require the development of and adherence to a System Security Plan (SSP) that identifies the functions and features of your information system (including hardware and software) and describes how Michigan Tech will meet the security requirements. These plans will include policies and procedures the research team will need to follow (i.e. information access restrictions, use of specific communication channels, facilities security).
Project personnel who access CUI are required to take an annual web-based training course that reviews CUI in detail.
As several steps must occur before Michigan Tech personnel handle any CUI, researchers should plan for at least 3-6 months of ramp-up time after an award is made before they begin working with CUI. In some situations, sponsors may be able to identify fundamental (non-CUI) research tasks that can be completed while plans for CUI-safeguarding are being implemented.
Support Available for Projects that Include CUI
Any faculty member who plans to pursue a funding opportunity that may include CUI should contact the Sponsored Programs Office. The earlier we know about a project, the more assistance we can provide, and it’s best to incorporate plans for CUI at the proposal stage.