Planning Research with Security and Privacy in Mind

The following questions may help identifying your research information:

• What is (will be) the nature of the research?
• Does it include collection, procession and/or storage of information?
• Who is the owner of the information?
• Is the information subject to a specific regulation, or bound by a data sharing agreement?
• Does it include any information that would allow an individual (or group of) to be identified?
• Does it include Intellectual Property?

When considering the security of your research information, one of the first actions you should take is identify its classification. Information classification (also known as data classification) is a crucial step in building your research projects security posture, as it defines the safeguarding requirements that should be in place to ensure your research remains safe, and compliant. Information classification is also a requirement of UBC Information Systems Policy SC14 and is defined in UBC Information Security Standard U1 (ISS-U1).

To assign a classification to your information:  

1. Consult UBC Information Security Standard U1 (ISS-U1) and our Research Information Classification page;
2. Review the nature of your information;
3. Identify the elements you collect, process or store that meets the highest risk in ISS-U1
4. Assign an information classification to your research information based on the results of step 3.

Now that you’ve identified your information classification, it is important that you evaluate your project requirements. Here are a few key considerations:

• What is the expected size of the information collected, processed, or stored?
• Who will need access to the information?
• How will the information be collected?
• How will the information be analyzed/processed?
• Will a third party be involved in collection, processing, or storage?
• What will happen to the information after the research is completed?
• How long will the information be retained?

For more information, visit rdm.ubc.ca

Security and Privacy requirements can be divided in three segments:

UBC Security requirements:
UBC information must be protected following the requirements of UBC Information Systems Policy. To facilitate the compliance verification process, you may complete our Security Compliance Checklist, or visit our Information Security page. 
UBC Privacy requirements:
Based on the nature of your project’s information, and the risk involved, you may be required to complete a Privacy Impact Assessment. Visit our Information Privacy page for more information. 
Regulatory and contractual requirements:
If you work with regulated data, or information that is bound by a data sharing agreement, you may be required to meet specific security and privacy requirements that are defined by the regulation, or agreement. It is recommended that you review all regulation(s) and/or agreement(s) to identify any security and privacy requirements. Need help? Contact us at arc.support@ubc.ca.
Funding agencies and partnership requirements:
When collaborating with funding agencies or partner organization (including partner institutions in the public and private sector), it is important to consider compliance with Canadian regulation, institutional policies, as well as contractual requirements. Visit the UBC Safeguarding Your Research page for more information.  

Once you’ve identified your information, what you plan to do with it, and what are the safeguarding requirements; the next step is to find where it should live during, and after completion of the research project. UBC offers a number of storage solutions and the best solution will vary depending on the requirements identified in the previous steps. Try our UBC Research Storage Finder or contact us at arc.support@ubc.ca for help.

Your Data Management Plan (DMP) covers the entire lifecycle of the information associated with your research project, from planning to long term preservation. From a cybersecurity perspective, the DMP allows you to identify the security controls required at each stage of the project lifecycle. For more information, visit rdm.ubc.ca.

Regardless of how your information is collected, processed, and stored, you should have standard operating procedures in place to ensure it is properly handled and safeguarded during its lifecycle. Here are a few recommended procedures to document:

• On-Boarding and Off-Boarding procedures;
• Responsible, Accountable, Consulted, Informed (RACI) chart;
• User Access review and audit procedure;
• Participant Consent Withdrawal procedure;
• Information transfer and sharing procedures
• Information backup and restore procedures;
• Incident response plan;