Whether you are looking for answers regarding cybersecurity, compliance and privacy practices; learn more about UBC requirements; how to assess the security posture of your project; or require a deep dive into a solution to identify security risks; UBC Advanced Research Computing (ARC) is here to help. Consult the list of services and resources below and select the one that best matches your needs.

Security Consultation
A security consultation consists of an in person, phone, or virtual consultation between ARC and the research project team. During this consultation, ARC will respond to your security and privacy questions and provide guidance based on UBC policies, standards, and cybersecurity good practices.

Information Security Compliance Checklist
The ARC Information Security Compliance Checklist covers high-level information security for a solution. It contains a list of items to verify for both compliance with UBC Security Policy and Standards as well as good cybersecurity practices. Note that this document is not solution specific and will not be reviewed.

Security Threat Risk Assessment
A Security Threat and Risk Assessment (STRA) is a valuable process that evaluates the security posture of systems and solutions used in research. It helps researchers identify potential threats, vulnerabilities, and cyber risks, ensuring compliance with regulations, ethics, institutional policies, and contractual agreements. STRAs support the implementation of appropriate security controls and safeguard research data, participants, and the integrity of the work. By conducting a STRA, researchers protect their projects, the university, and uphold the credibility of their outcomes.
STRA Level 0
A Level 0 STRA provides an automated assessment of a UBC research project or service against selected controls from the UBC Information Systems Policy (SC14) and associated standards. It is designed for low-risk initiatives and helps identify basic compliance issues and high-level cybersecurity risks.
STRA Level 1
Building on the Level 0 assessment, Level 1 includes a brief review by a Research Cybersecurity and Compliance Specialist. Suitable for research projects or services with a medium to high risk profile, this level may require additional information to provide a more tailored and accurate assessment.
STRA Level 2
In addition to the compliance assessment provided by the STRA Level 0, a Level 2 STRA offers a thorough analysis of the security posture of research project or service, including a detailed technical assessment, an in-depth analysis of the project's/service's associated components, as well as a governance and research data management review. It is intended for high to critical risk projects or services. Participation from solution providers is often required, and technical familiarity with the solution is strongly recommended.
STRA FAQ
What a STRA?
A Security Threat and Risk Assessment (STRA) analyzes the security posture of a research project or service. For UBC research, it includes reviewing how information is collected, processed, and stored with a focus on cybersecurity and compliance with UBC Information Security requirements. The assessment identifies potential threats, gaps, and associated risks.
Why are STRAs important?
At UBC, researchers are responsible for securing research information against unauthorized access, disclosure, modification, or deletion. A STRA helps identify significant security gaps, supports compliance with UBC policies, and can help prevent cybersecurity incidents.
Are STRAs required
STRAs may be required to meet institutional policies, regulations, funding agency requirements, ethics board expectations, or contractual obligations. Not sure if you need one? Check the use cases here under "Are research project treated differently" or contact us for help.
How long does it take to complete a STRA?
Timelines vary depending on the STRA level and current workload. ARC aims to deliver assessments in a reasonable timeframe.
I have a time sensitive matter; can I get the service expedited?
Expedited service is not currently available due to resource constraints. STRAs are processed on a first-come, first-served basis, but we’ll do our best to support your timeline.
When should I start the STRA process?
It is best to start the STRA process prior to an agreement being signed with the solution provider, and prior to implementation, but only once the solution's architecture has been selected. A STRA requires collection of technical information that will generally be available after the solution's architecture has been defined. Engaging in the STRA process sooner than later is recommended as this can allow flexibility for possible changes to be made prior to deployment.
What is the outcome of a STRA?
You’ll receive a report summarizing the project or service, its components (if applicable), and identified risks and recommendations.
Can ARC implement security controls for my research project?
ARC does not currently offer technical implementation services.

System Security Plan
A System Security Plan (SSP) is a document defining the architecture, and security controls of a research solution/project at high level. The plan is created by ARC, in collaboration with the researcher and IT at UBC. It is designed to document the controls and procedures in place for a specific research project (e.g.: In a grant application).

Training and Presentations
Discover our ready-to-go and tailored research cybersecurity related presentations that are available for in-person or hybrid delivery and in a variety of different durations.

Research with Private-Sector Partners or Advanced/Emerging Technologies
If you are planning to apply for federal government funding for research that involves a private sector partner, or that could be advancing a sensitive technology research area, you should be aware of potential implications or requirements relating to research security. UBC's Research Security team can support you to learn more about those requirements and implement best practices to safeguard your research.
Resources
Planning Research with Security and Privacy in Mind
New project coming? Don't forget security and privacy considerations during planning.
OneDrive and Teams for Research
Did you know some UBC research information can be stored on the UBC Microsoft cloud? Learn more about the requirements and best practices when using these tools.
Sharing Research Information
Learn more about UBC requirements and best practices when sharing research information.
ARC Sockeye Security and Privacy
Learn more about how we protect your research information when using our ARC Sockeye service.
ARC Chinook Security and Privacy
Learn more about how we protect your research information when using our ARC Chinook service.
ARC REDCap Security and Privacy
Learn more about how we protect your research information when using our ARC REDCap service.
Can’t find what you are looking for?
Send us an email at arc.suport@ubc.ca to talk to one of our subject matter experts.