Chapter 430: Research Security

430.010 Industrial Security Program

kuscheld — Fri, 19 Jul 2024 19:55:01 +0000

430.010 Industrial Security Program kuscheld Fri, 07/19/2024 - 19:55

Bd. Min. 06-27-24; Amended Bd. Min. 11-20-24.

Statement of Purpose
1. This rule addresses The Curators of the 91�㽶��Ƶ (a.k.a., the 91�㽶��Ƶ System (UM System)) compliance with U.S. industrial security policy, including applicable federal statutes, Executive Orders (E.O.), Code of Federal Regulations (CFR), Department of Defense Instructions (DoDI), and other applicable authorities. UM System is committed to compliance for the protection of classified information disclosed to or developed by contractors of the U.S. Government (USG), employed or the responsibility of UM System (contractors).
2. This rule will be applied to achieve compliance with applicable federal authorities, including:
  1. E.O. 12829, National Industrial Security Program
  2. E.O. 10865, Safeguarding Classified Information within Industry
  3. 32 CFR Part 2004, National Industrial Security Program
  4. DoDI 5220.22, National Industrial Security Program
  5. 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM)
3. This rule implements policy, assigns responsibilities, and establishes requirements for the protection of classified information disclosed to, or developed by contractors across the UM System.
Scope and Compliance Policy
1. This rule applies to all cleared facilities (i.e., Facility Clearances or FCLs) within the UM System holding a FCL, to all personnel whose personnel security clearances are held by a UM System or subsidiary FCL, and to all personnel who hold roles related to ensuring compliance with the authorities outlined in subsection A.2 (e.g., Key Management Personnel or KMPs).
2. The UM System is the “corporate family” for all classified work taking place at any FCL within the System. Individual universities may have subsidiary Facility Clearances under the UM System Facility Clearance if they have federal authorization to hold classified materials on-site, a secondary place-of- performance, or flow down to a sub-tier contractor.
3. The UM System shall implement a corporate-wide Insider Threat Program to address insider threats throughout the UM System.
4. The President will appoint the following personnel to oversee and implement the UM System industrial security program (ISP) (System ISP):
  1. Senior Management Official (SMO)
  2. Insider Threat Program Senior Management Official (ITPSO)
  3. Facility Security Officer (FSO)
5. The personnel identified in subsection B.4 must:
  1. Oversee the implementation of the requirements of the NISPOM;
  2. Undergo the same security training that is required of all contractors, in addition to any position specific training;
  3. Be designated in writing; and
  4. Undergo a personnel security investigation and national security eligibility determination for access to classified information at the level of the entity’s eligibility determination for access to classified information.
6. SMO: The President of the UM System is the SMO for the UM System FCL and for all subsidiary FCLs held by an individual university within the UM System. The SMO will:
  1. Ensure a system of security controls in accordance with the NISPOM;
  2. Appoint an UM System ITPSO and FSO in writing;
  3. Remain fully informed of the UM System ISP classified operations;
  4. Make decisions based on the threat reporting and information and the potential impacts to the UM System ISP; and
  5. Retain accountability for the management and operations of the System’s ISP without delegating that accountability.
7. ITPSO: The Director, Research Security and Compliance is the ITPSO and will be designated in writing by the SMO. The ITPSO will:
  1. Ensure the FSO(s) is part of the insider threat program;
  2. Complete training in accordance with the NISPOM; and
  3. Develop an insider threat program that meets the requirements of the NISPOM.
8. FSO: An FSO will be appointed in writing by the SMO for any University with an active FCL. Each FSO will:
  1. Supervise and direct security measures necessary for implementing the NISPOM to ensure the protection of classified information.
  2. Complete security training as deemed appropriate by the Cognizant Security Agency (CSA) who accredits the FCL. Both direct and reciprocity CSAs training must be met.
  3. Appoint an Information System Security Manager (ISSM) if classified information will be processed on an information system at a University with an FCL.
9. ISSM: If classified information will be processed on an information system at a University with an FCL, the FSO will appoint an ISSM. Each ISSM will:
  1. Be adequately trained and possess the technical competence required to operate, maintain, and secure the contractor’s classified information system; and
  2. Oversee development, implementation, and evaluation of the University's classified information system program.
91�㽶��Ƶ Research Security and Compliance Team
1. UM Research Security and Compliance Team
  Each FCL within the UM System will have an appointed FSO who reports to the UM System Director of Research Security and Compliance. Each FSO shall be a member of the 91�㽶��Ƶ Research Security and Compliance Team (“UM RSC Team”).
2. Collaboration
  Recognizing both the necessity and administrative efficiencies gained, the UM RSC Team shall work in collaboration with each other and with those also holding responsibilities for compliance with the authorities outlined in subsection A.2. to ensure that no single point of failure exists within the System.
3. Accountability and Alignment
  To ensure the accountability and alignment of the UM RSC Team, each Chancellor shall designate one of that University's Vice Chancellors to work with the UM System Director for Research Security and Compliance, who will jointly approve the following as it relates to the FSO at each institution:
  1. Recruitment and hiring decisions;
  2. Disciplinary and termination decisions; and,
  3. Annual performance evaluations and compensation decisions.
  For situations in which concurrence is not reached, the collective decision will be made with the President.
Strategies
1. The FSO(s) will develop the industrial security strategies for the UM System to establish, document, and implement processes and procedures to ensure the System remains in compliance with the authorities outlined in subsection A.2. These strategies will be brought before the UM RSC Team for approval before implementation.
2. A Standard Practice Procedures (SPP) is developed and maintained by the UM RSC Team and maintained. This SPP documents the current processes and procedures used across the System. The SPP will contain information describing acceptable structures for the Security Executive Committee (SEC).
3. University-specific appendices will be maintained within the SPP as needed.
4. At least once annually, the Board of Curators will review and ratify a Security Resolution outlining the members of the SEC and those who are excluded from the SEC in alignment with the structure outlined in the SPP.
Implementation
The FSOs and Insider Threat Program Senior Official on the UM RSC Team are responsible for the implementation of the industrial security programs and the Insider Threat Program for the UM System.

430.020 Export Control and Sanctions Compliance

kuscheld — Mon, 30 Jan 2023 14:59:50 +0000

430.020 Export Control and Sanctions Compliance kuscheld Mon, 01/30/2023 - 14:59

Executive Order No. 49, issued 1-24-23; Amended 11-21-24.

Statement of Purpose
1. This rule addresses the University’s compliance with U.S. export control and sanctions laws and regulations (“export controls”). The University is committed to export control compliance in all activities that may result in an export or sanctioned transaction with a foreign person, entity, or country.
2. Unless otherwise indicated, this rule applies to all transactions by the 91�㽶��Ƶ System, its administration, and four universities and all of their component parts (hereafter referred to as "University" or "UM System"), regardless of whether or not those transactions are research related, and is intended to comply with the Foreign Assets Control Regulations (“FACR”) at 31 CFR §§ 500-599, the International Traffic in Arms Regulations (“ITAR”) at 22 CFR §§ 120-130, the Export Administration Regulations (“EAR”) at 15 CFR §§ 730-799, the Foreign Trade Regulations (“FTR”) at 15 CFR § 30, and other similar regulations to which export controls or sanctions apply.
Scope and Compliance Policy
1. This rule applies to all University employees, students, contractors, consultants, and any other persons acting on behalf of or at the direction of the University.
2. No person may do or facilitate anyone doing any of the following on behalf of the University:
  1. Engaging in transactions prohibited by the Foreign Assets Control Regulations (FACR) or other sanctions programs administered by the U.S. Department of the Treasury, unless otherwise authorized;
  2. Exporting items, technical data, or defense services subject to the ITAR other than as authorized by the U.S. Department of State;
  3. Exporting items, technology, or software subject to the EAR other than as authorized by the U.S. Department of Commerce; or
  4. Violating any other U.S. export control law or regulation.
3. All persons must be mindful of export control requirements across all University activities. This includes, but is not limited to, the considerations listed below. This list is only illustrative, and compliance will be determined by applicable statutes and regulations in place at the relevant time, so all persons should seek guidance whenever activities may involve exports or involve interactions with countries, persons, or entities subject to sanctions.
  1. Performing any service of value for a person or entity located in a sanctioned destination (regardless of that person’s citizenship) may be regulated by the FACR.
  2. The ITAR and EAR regulate the transfer of controlled items, technical data, technology, and software to foreign persons or destinations, in addition to regulating defense services. An export may include:
    
    1) An actual shipment or transmission out of the United States, including the sending or taking of an item out of the United States, in any manner;
    2) Releasing or otherwise transferring technical data or technology (including software) to a foreign person in the United States (a “deemed export”);
    3) Transferring registration, control, or ownership of any spacecraft, aircraft, vessel, or satellite by a U.S. Person to a foreign person;
    4) Releasing or otherwise transferring a defense article to an embassy or to any of its agencies or subdivisions, such as a diplomatic mission or consulate, in the United States;
    5) Performing a defense service on behalf of, or for the benefit of, a foreign person, whether in the United States or abroad; or
    6) The release of previously encrypted technical data.
  3. The following types of technical data, technology, and software generally may be exempt from export control regulations:
    
    1) Publicly available information. Technical data and technology may be considered publicly available when they are generally accessible or available to the public through sales at newsstands and bookstores; through subscriptions which are available without restriction to any individual who desires to obtain or purchase the published information; through second class mailing privileges granted by the U.S. Government; at libraries open to the public or from which the public can obtain documents; through patents available at any patent office; through unlimited distribution at a conference, meeting, seminar, trade show or exhibition, generally accessible to the public, in the United States; or through public release (i.e., unlimited distribution) in any form (e.g., not necessarily in published form) after approval by the cognizant U.S. government department or agency.
    2) Educational information. Technical data may be considered educational information when it is general scientific, mathematical, or engineering principles commonly taught in schools, colleges, and universities. Technology may be considered educational information when it is released by instruction in a catalog course or associated teaching laboratory of an academic institution.
    3) Fundamental Research. Fundamental research generally may mean basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community, as distinguished from proprietary research and from industrial development, design, production, and product utilization, the results of which ordinarily are restricted for proprietary or national security reasons. Fundamental research should not be considered to apply to information and software received during the course of research. It should only be considered to apply to the technical data, technology, and software that arises from or is generated during the research. In order for technical data, technology, and software to qualify as fundamental research, the research:
    
    a. Must be conducted by an accredited institution of higher learning;
    b. Must take place in the U.S.; and
    c. The University and its researchers cannot have accepted other restrictions on publication of or access to scientific and technical information resulting from the project or activity.
91�㽶��Ƶ Research Security and Compliance Team
1. UM Research Security and Compliance Team
  Each University within the UM System will have at least one designated export controls and sanctions point of contact (POC) who reports to the UM System Director of Research Security and Compliance. The UM System Director of Research Security and Compliance, research security contacts designated pursuant to CRR 330.120.C.1, and all POCs comprise the 91�㽶��Ƶ Research Security and Compliance Team (“UM RSC Team”). Additional personnel with compliance responsibilities related to export controls and/or sanctions may be consulted by the UM RSC Team or included within the UM RSC Team at the designation of the UM System Director for Research Security and Compliance.
2. Collaboration
  Recognizing both the necessity and administrative efficiencies gained, the UM RSC Team shall work in collaboration to meet the needs of the UM System.
3. Accountability and Alignment
  To ensure the accountability and alignment of the UM RSC Team, each Chancellor shall designate one of that University’s Vice Chancellors to work with the UM System Director for Research Security and Compliance, who will jointly approve the following as it relates to the POCs and other export controls and/or sanctions professionals at each institution:
  1. Recruitment and hiring decisions
  2. Disciplinary and termination decisions
  3. Annual performance evaluations and compensation decisions.
  For situations in which concurrence is not reached, the collective decision will be made with the President.
Strategies
1. The Director of Research Security and Compliance, in collaboration with the UM RSC Team, will develop the export compliance strategies for the UM System to establish, document, and implement processes needed to ensure that the University, and its personnel, remain in full compliance with applicable U.S. export control and sanctions related laws and regulations while still achieving its academic and global outreach missions.
2. These strategies are outlined in an Export Compliance Management Program (ECMP) which operationalizes this policy, establishes processes, reiterates its commitment to compliance, and provides information and guidance to the University community.
3. Each university has the flexibility to develop university specific export compliance and sanctions strategies and procedures after consultation with the Director of Research Security and Compliance and so long as the strategies are not in conflict with or interfere with the UM System export compliance strategies.
Implementation
The 91�㽶��Ƶ Research Security and Compliance Team is responsible for the implementation of the export controls and sanctions compliance strategies for the UM System.