Planning Research with Security and Privacy in Mind

The following questions may help identifying your research information:

• What is (will be) the nature of the research?
• Does it include collection, procession and/or storage of information?
• Who is the owner of the information?
• Is the information subject to a specific regulation, or bound by a data sharing agreement?
• Does it include any information that would allow an individual (or group of) to be identified?
• Does it include Intellectual Property?

When considering the security of your research information, one of the first actions you should take is identify its classification. Information classification (also known as data classification) is a crucial step in building your research projects security posture, as it defines the safeguarding requirements that should be in place to ensure your research remains safe, and compliant. Information classification is also a requirement of UBC Information Systems Policy SC14 and is defined in UBC Information Security Standard U1 (ISS-U1).

To assign a classification to your information:  

1. Consult UBC Information Security Standard U1 (ISS-U1) and our Research Information Classification page;
2. Review the nature of your information;
3. Identify the elements you collect, process or store that meets the highest risk in ISS-U1
4. Assign an information classification to your research information based on the results of step 3.

Now that you’ve identified your information classification, it is important that you evaluate your project requirements. Here are a few key considerations:

• What is the expected size of the information collected, processed, or stored?
• Who will need access to the information?
• How will the information be collected?
• How will the information be analyzed/processed?
• Will a third party be involved in collection, processing, or storage?
• What will happen to the information after the research is completed?
• How long will the information be retained?

For more information, visit rdm.ubc.ca

Security and Privacy requirements can be divided in three segments:

UBC Security requirements:
UBC information must be protected following the requirements of UBC Information Systems Policy. To facilitate the compliance verification process, you may complete our Security Compliance Checklist, or visit our Information Security page. 
UBC Privacy requirements:
Based on the nature of your project’s information, and the risk involved, you may be required to complete a Privacy Impact Assessment. Visit our Information Privacy page for more information. 
Regulatory and contractual requirements:
If you work with regulated data, or information that is bound by a data sharing agreement, you may be required to meet specific security and privacy requirements that are defined by the regulation, or agreement. It is recommended that you review all regulation(s) and/or agreement(s) to identify any security and privacy requirements. Need help? Contact us at arc.support@ubc.ca.
Funding agencies and partnership requirements:
When collaborating with funding agencies or partner organization (including partner institutions in the public and private sector), it is important to consider compliance with Canadian regulation, institutional policies, as well as contractual requirements. Visit the UBC Safeguarding Your Research page for more information.  

Once you’ve identified your information, what you plan to do with it, and what are the safeguarding requirements; the next step is to define how and where it will be be collected, processed and stored. Finding the right tool might be challenging, but it is important to keep in mind your requirements and compliance items when considering options. Here are a few tips:

1. Use UBC Approved tools where possible. UBC offers a number of solution like UBC Survey tool, ARC REDCap, Nvivo, Tableau and more. visit the UBC Software Licensing page or try our UBC Research Storage Finder for storage options.
2. Use our Information Security Compliance Checklist to ensure the solution provider meets UBC Information Security requirements.
3. Look for a Security and Privacy Statement on the website of the solution provider. While not required, it usually helps with assessing compliance.
4. Consider at least a couple options and ask for demos. Contacting a few solution providers to compare pricing and see how their solution works is recommended.
5. Consult with UBC procurement before signing any contracts. Depending on the solution and its associated cost, you may not have the signing authority to enter in a contract with a solution provider.
6. Consult with one of our subject matter experts during your solution provider search. Contact us at arc.support@ubc.ca for help.

Note:  New solution may require a Security Threat Risk Assessment. Consult our Security and Privacy page for more information about his service.

Your Data Management Plan (DMP) covers the entire lifecycle of the information associated with your research project, from planning to long term preservation. From a cybersecurity perspective, the DMP allows you to identify the security controls required at each stage of the project lifecycle. For more information, visit rdm.ubc.ca.

Regardless of how your information is collected, processed, and stored, you should have standard operating procedures in place to ensure it is properly handled and safeguarded during its lifecycle. Here are a few recommended procedures to document:

• On-Boarding and Off-Boarding procedures;
• Responsible, Accountable, Consulted, Informed (RACI) chart;
• User Access review and audit procedure;
• Participant Consent Withdrawal procedure;
• Information transfer and sharing procedures
• Information backup and restore procedures;
• Incident response plan;