Cybersecurity in Sponsored Programs

Executive Orders & Federal Policy Directives

• Executive Order 13556 (2010): Standardized how the executive branch defines and handles Controlled Unclassified Information (CUI), eliminating fragmented agency-specific markings.
• Executive Order 14025 (2021): "Improving the Nation's Cybersecurity"—mandates Zero Trust architecture, supply chain integrity, and standardized contractual security clauses.
• National Security Presidential Memorandum 33 (NSPM-33) & CHIPS and Science Act (2022): Directs federal funding agencies to mandate standardized research security programs, conflict of commitment disclosures, and baseline cybersecurity assessments for higher education institutions receiving federal research funding.

Federal Acquisition Regulations (FAR) & Defense Regulations (DFARS)

• FAR 52.204-21: Basic Safeguarding of Covered Contractor Information Systems (establishes 15 basic cyber hygiene controls for Federal Contract Information / FCI).
• DFARS 252.204-7012: Mandates the protection of Covered Defense Information (CDI/CUI) via NIST SP 800-171 and mandates reporting incidents to the DoD within 72 hours.
• DFARS 252.204-7019 & 7020: Requires institutions to perform NIST SP 800-171 self-assessments and enter scores into the DoD Supplier Performance Risk System (SPRS).
• DFARS 252.204-7021 / Title 32 CFR Part 170: Codifies the Cybersecurity Maturity Model Certification (CMMC) framework, shifting DoD compliance from unverified self-attestation to formal assessments.

NIST Standards (National Institute of Standards and Technology)

• NIST SP 800-171: 110 security requirements across 14 security families (e.g., Access Control, Incident Response, Risk Assessment) required for handling CUI.
• NIST SP 800-172: Enhanced security controls designed to protect high-priority research/data against Advanced Persistent Threats (APTs).

The Division of Information Technology and the Research Security Program within the Office of the Vice Chancellor for Research provide support to researchers to comply with federal cybersecurity policies. Use the links below for more information on the support and resources provided by these groups.

Cybersecurity for Researchers
Research Security Program

Current Secure Environments at UW-Madison

• Restricted Research Drive, provided by Division of IT
• Social Sciences Computing Cooperative (SSCC), provided by College of Letters & Science
• Platform X or Platform R, provided by School of Medicine and Public Health (SMPH)

UW-Madison has enacted or complies with the following policies:

• Cybersecurity Risk Management
• Restricted Data Security Management
• Network Firewall Policy
• Endpoint Management and Security Policy

To streamline your proposal and award, keep the following in mind:

At the Proposal Stage

• Identify data needs
• Budget appropriately - environment costs are direct costs
• Work with Cybersecurity early and often

At the Award/Agreement Stage

• RSP Contracts team will confirm cybersecurity requirement apply
  • Negotiate out if possible
• RSP may need additional information from PI/Dept - timely response required
• Cybersecurity may need to be involved

Plan ahead and allow sufficient time for cybersecurity reviews. DoIT's Risk Management & Compliance (RMC) team conducts the reviews. While the actual length of time for reviews varies according to the complexity of cybersecurity within each research environment, PIs and teams should plan for assessment to take about 30 days to complete.