Research Security Control Guide
The research security program requirements that bear on a secure computing environment, who carries each one in a tiCrypt deployment, and what the university still owns. CMMC Level 2 guide NIST SP 800-171 Rev 3 guide
Sources: NSPM-33 (January 14, 2021), the National Science and Technology Council's implementation guidance (January 2022), the Office of Science and Technology Policy's guidelines for research security programs (July 9, 2024), and sections 10229 and 10634 of the CHIPS and Science Act. The 2024 guidelines supersede the 2022 guidance on research security programs, so its cybersecurity protocols are shown as superseded and are not counted.
A platform bears only on the cybersecurity element. Research security training, foreign travel security, export control training and the disclosure requirements of NSPM-33 are the institution's: tiCrypt does not provide them.
The requirements for a research security program that touch the computing environment, quoted from NSPM-33, the 2022 guidance and the 2024 guidelines. An answer inherited from a CMMC Level 2 practice names the practice and keeps its wording, which speaks of CUI. Select a row to read it in full.
| Row | Title | Responsibility | Requirement | How tiCrypt addresses it | University action | Element | Status | CMMC L2 practices | SSP control card (800-53) | Learn more |
|---|---|---|---|---|---|---|---|---|---|---|
Certification of a research security program | University | Within 12 months of the date of this memorandum, heads of funding agencies shall require that research institutions receiving Federal science and engineering support in excess of 50 million dollars per year certify to the funding agency that the institution has established and operates a research security program. | University control, not addressed by tiCrypt | Program | Active | No CMMC Level 2 counterpart | ||||
Program elements | Shared | Institutional research security programs should include elements of cyber security, foreign travel security, insider threat awareness and identification, and, as appropriate, export control training. | tiCrypt bears on the cyber security element only, for the research run inside it: see the cybersecurity rows. It provides no training, and its published documentation describes no capability for foreign travel security. | Build and run the program. For export-controlled research, the ITAR and EAR guide covers the computing side; the training is yours. | Program | Active | No CMMC Level 2 counterpart | |||
Cybersecurity program: institutions of higher education | Shared | As the first element of the standardized requirement, federal research agencies shall require institutions of higher education to certify that the institution will implement a cybersecurity program consistent with the cybersecurity resource for research institutions described in the CHIPS and Science Act, within one year after the National Institute of Standards and Technology (NIST) of the Department of Commerce publishes that resource. | tiCrypt is not an institution's cybersecurity program. For the research it hosts, it provides the technical controls documented in the CMMC Level 2 and NIST SP 800-171 Rev 3 guides. | Run the institution-wide program and make the certification. When this guide was written, NIST listed only an initial public draft of that resource (NIST IR 8481, August 31, 2023), so check its status before you certify. | Cybersecurity | Active | No CMMC Level 2 counterpart | |||
Cybersecurity program: other covered institutions | Shared | For covered institutions that are not institutions of higher education, federal research agencies shall require covered institutions to certify that the institution will implement a cybersecurity program consistent with another relevant cybersecurity resource maintained by NIST or another federal research agency. | tiCrypt is not an institution's cybersecurity program. If the institution chooses NIST SP 800-171 as its resource, tiCrypt's coverage of it is in the CMMC Level 2 and NIST SP 800-171 Rev 3 guides. | Choose the resource, run the institution-wide program and make the certification. | Cybersecurity | Active | No CMMC Level 2 counterpart | |||
This guide maps Tera Insights' published shared-responsibility model for tiCrypt to the federal research security program requirements. Each funding agency sets its own terms and dates, and the certification is the institution's. Release baseline (ticrypt.com/releases, November 12, 2026): Frontend 2.19.0 · Backend 3.16.3 · Host Controller 1.3.2 · Audit 1.10.1 · SFTP 1.5.1