BU Office of Sponsored Programs, Industry Engagement, and other offices negotiate and sign research contracts, such as awards and data use agreements, for researchers. Today, more of these contracts include regulatory requirements and contractual requirements, such as compliance with HIPAA, NIST, or CMMC and using an isolated computer when working with the data.

We collaborate with our research contracting offices to ensure we can meet contractual security requirements. Where requirements seem unreasonable, we propose alternative contract language. In most cases, our standard offerings – BU network drive for identifiable health information and BU Shared Computing Cluster for anonymized data – will satisfy contract requirements. When a contract requires additional controls, we work with the research lab and IS&T or Partner IT group to implement them.

As part of our review, we provide guidance on what BU services can be used, and verify any devices that will be used meet our BU Minimum Security Standards.

Why do managed and personal computers need to be checked as part of this process?

We need to check BU-managed computers to ensure they are encrypted, and the operating system is up to date. While most BU-managed computers have encryption enabled, a few older computers do not. For personal computers used by students, we open a ticket for a technician to verify personal computers have these four minimum safeguards:

1. Current and supported Operating System

  • Researchers must use devices which have up to date OS, and must ensure all devices run a supported operating system – specifically Windows 10/11 or macOS 15+.

2. Malicious software protection 

  • Researchers must ensure the device they are using has some sort of malware protection software, such as Falcon, or Carbon Black. BU offers Crowdstrike Falcon for free for staff and students, and all BU managed devices come with Falcon pre-installed.

3. Encryption turned on

  • Researchers must ensure file encryption for all devices used for accessing, processing, or storing non-public data is enabled (Windows BitLocker or macOS FileVault).

4. 15 minute or less automatic screen lock

  • Researchers must endure a 15-minute or less automatic screen lock to password/code/biometric (10min or less on Mac).