The WUSTL Secure Enclave service is designed to support the Cybersecurity Maturity Model Certification (CMMC) (inclusive of NIST Special Publication 800-171) framework, which the Department of Defense defined as a way to verify compliance to protect Controlled Unclassified Information (CUI).
Controlled Unclassified Information (CUI) is a category of unclassified data that federal agencies create or possess or that a non-federal entity (e.g., WUSTL) receives, possesses, or creates for, or on behalf of, the federal government, which is required by law, regulation, or government-wide policy to have safeguarding or dissemination controls.
The federal government has introduced heightened security standards for university systems that house or transmit sensitive information, known as Controlled Unclassified Information (CUI), set forth by the National Institutes of Standards and Technology (NIST).
If you plan to respond to a federal government RFP or RFI and anticipate that CUI may be involved, you must have adequate cybersecurity measures to accept the contract. CUI may include research data and other project information that a research team receives, possesses, or creates during the performance of a contract funded by the federal government.
RIS can help you with an initial assessment and give you cost estimates for the technology needs that will be needed for compliance.
The assessment and cost estimates for technology needs may include:
- Communication Requirements – secure O365 accounts
- Data Storage and Compute requirements– Azure VM in a secure enclave
- Hardware requirements – security and software constraints
- Data Transfer requirements
- Instrumentation – bringing lab equipment into the enclave
- Physical Security
- CUI Training
- Background Checks
Services and rates for SEn can be found in WUSTL Box.
Examples of SEn project rates can be found in WUSTL Box.
Please visit the Office of Information Security and The Office of the Vice Chancellor for Research for additional information or assistance determining whether your RFP/RFI involves CUI.