(A)
Purpose.
This rule describes the
responsibilities of university of Cincinnati faculty and staff, students,
volunteers, and visitors to comply with university policies and procedures and,
as applicable, federal, state and local laws and regulations concerning
activities involving the access, dissemination or storage of sensitive but
unclassified information at the university, or with the direct or indirect use
of university resources. Sensitive but unclassified information includes but is
not limited to export-controlled information, controlled unclassified
information (CUI), law enforcement sensitive (LES), sensitive homeland security
information, sensitive security information (SSI), or critical infrastructure
information (CII).
(B)
Scope.
All university faculty, staff,
students, volunteers, and visitors involved in the development, production,
handling, and storage or use of sensitive but unclassified information and any
related research, international travel, international collaboration, or
proprietary work (collectively referred to herein after as "activities
involving sensitive but unclassified information") at or on behalf of the
university are subject to this rule. The policy excludes personal consulting
activities under the existing rules and regulations of the university that do
not involve the use of university facilities or resources and that are outside
activities approved in accordance with university policy.
(C)
Foundational principles.
The university of Cincinnati values the
free dissemination of knowledge through education, publication, and other
means. To the greatest extent possible, the university of Cincinnati seeks to
ensure that research and other information developed is available to the public
without restriction. There may be instances where government funded research or
other university research may require protection of information, such as in the
context of sensitive but unclassified information. The university of Cincinnati
recognizes that there may be instances in which the expertise of the university
and its facilities may be needed to meet sponsor or contract requirements and
that such circumstances may justify a determination that the performance of
activities involving sensitive but unclassified information is in the best
interests of the university.
(D)
Requirements for
approval of activities involving sensitive but unclassified information.
(1)
Activities
involving sensitive but unclassified information require the approval of the
vice president for research. Such approval should be obtained prior to the
submission of a formal proposal to the potential sponsor where possible. In all
cases, however, approval is required before acceptance of the award by the
university. The vice president for research, in collaboration with the general
counsel and other appropriate university offices, shall establish procedures
setting out the process for vice president for research approval of activities
involving sensitive but unclassified information and any training or other
requirements for access and storage of sensitive but unclassified information
consistent with this board rule, applicable U.S. federal, state and local laws
and regulations, university policies and procedures, and the mission of the
university.
(2)
Requests for approval of activities involving sensitive
but unclassified information will be submitted to the office of research with
the following information:
(b)
Names of
principal investigator and co-investigators
(c)
The university of
Cincinnati location of the activity
(3)
The following
factors should be considered in connection with a decision to approve of
activities involving sensitive but unclassified information:
(a)
Whether the
individual undertaking the activity is appropriate, supported, and capable of
doing the proposed activity;
(b)
Whether the
proposed activity is appropriate for the university and aligned with the
university's mission and values, appropriate mechanisms are in place to ensure
continued alignment with university mission and values throughout the course of
the project or activity, and necessary and comprehensive oversight and
management over the activity will remain in place to ensure compliance with
applicable policies, procedures, laws, and regulations;
(c)
Whether the
university has the appropriate facilities and capabilities to undertake the
proposed activity in compliance with applicable policies, rules, laws and
regulations; and
(d)
Whether the merits of the proposed activity and the
potential benefits outweigh the disadvantages and costs of engaging in
activities that involve compliance with applicable policies, rules, laws and
regulations.
(4)
All proposed activities involving sensitive but
unclassified information shall be reviewed and approved by the appropriate
academic unit head prior to submission to the vice president for
research.
(5)
Projects receiving continuation funds may require
further review and approval in accordance with a change in the scope of the
required security arrangements.
(E)
Additional
conditions for the performance of approved activities involving sensitive but
unclassified information:
(1)
Export controls.
Any activities involving sensitive but
unclassified information must be conducted in compliance with all federal
export control laws and regulations and university board policy, rule
3361:10-17-11of the
Administrative Code.
(2) Classified research.
Any activities involving classified
information must be conducted in compliance with all federal classified
research laws and regulations and university board rule 3361: 10-30-04 of the
Administrative Code.
(3)
Patent
rights.
The interests of university faculty and
of the university in patentable discoveries, inventions, and improvements that
are made during the performance of approved activities involving sensitive but
unclassified information shall be subject to the university's patent
policy.
(4)
Human and animal studies.
Federal law and guidelines mandate that
the usual committee reviews for human and animal studies, when included in
sensitive but unclassified research, will not be modified in any way from those
required for other types of research.
(5)
Utilization of
sensitive but unclassified research in faculty personnel decisions.
The university will continue to base
decisions concerning faculty personnel matters on contributions to teaching,
research, and service. Sensitive but unclassified research results which may
not be published in the open literature will not be considered in faculty
personnel decisions until and unless the research results are released for
publication, unless the information cannot be released publicly due to federal
law or regulation (e.g., export control).
(6)
Student
theses/dissertations.
Students must be free to pursue
knowledge in an open environment. Consequently, formal academic work by
students (coursework, theses, dissertations, etc.) shall not include sensitive
but unclassified research unless approved by the appropriate academic unit head
and vice president for research and is conducted in compliance with applicable
policies, rules, laws and regulations governing sensitive but unclassified
information.
(F)
Training and
visitors.
All university employees and students
engaged in activities at or on behalf of the university involving sensitive but
unclassified information shall receive regular training on all applicable U.S.
federal, state and local laws and university policies associated with sensitive
but unclassified information on no less than an annual basis, or more
frequently, as determined by the vice president for research.
(G)
Compliance with applicable laws and regulations.
All faculty, staff, students,
volunteers, and visitors engaged in activities at or on behalf of the
university involving sensitive but unclassified information must comply with
all applicable federal, state and local laws and regulations as they relate to
such activities.
Replaces: 3361:10-30-03
