Statistical Standards Program - Appendix J: Restricted-use Data Security Plan Form

Skip Navigation

U.S. Department of Education
Institute of Education Sciences

Statistical Standards Program

Publications & Products|Staff

Appendix J: Restricted-use Data Security Plan Form

Download Form (66 KB)

Institute of Education Sciences (IES)

Restricted-use Data Security Plan

Name of Institution / Organization:

_____________________________________________________________________

Name of PPO: ___________________________

Type of Security Plan:

New

Renewal

Modification

License Number (if renewal or modification): ___________________________

Physical Location of Data

Project Office Location:
(no P.O. Box numbers; specify building names and room numbers)

_____________________________________________

Prj Office Phone Number:

_____________________________

Note: The restricted-use data must only be used at this location. When the data are not being used, the data must also be stored under lock and key at this location.

Physical Security of Data

Describe Building Security:
(Describe building security arrangements where project office is located)

___________________________________________

Describe Project Office Security:
(Describe the office security arrangements for the room where the computer will be located)

___________________________________________

Computer Security Requirements

Description of Computer System:

___________________________________________

Operating System: ___________________________

Anti-Virus Software Installed on Computer: ___________________________

Note: The restricted-use data must be loaded and run on a standalone computer. Use of laptop computer is strictly prohibited. If a modem or LAN connection is attached to the computer, it must be disconnected when the restricted-use data are installed and then used on the computer. Prior to attaching the computer to a modem or LAN connection, the restricted-use data must be purged and overwritten on the computer.

The following physical location and computer security procedures must be implemented when in possession of restricted-use data. By checking the box next to each security procedure, you signify your acceptance of these procedures and that you will implement them for the duration of the project:

Access will be limited to the secure room/project office by locking office when away from computer.
Data will only be accessed and used within the secure room/project office (as specified on page 1 of this plan).
A password will be required as part of the computer login process.
Passwords for computer access will be unique and contain 6 to 8 characters with at least one non-alphanumeric character.
Computer passwords will change at least every 3 months.
Read-only access will only be initiated for the original data.
An automatic password protected screensaver will enable after 5 minutes of inactivity.
No routine backups of the restricted-use data will be made.
Project office room keys will be returned and computer login will be disable within 24 hours after any staff leave the project. PPO will notify IES of staff changes.
Restricted-use data will not be placed on a server (network) or laptop computer.
The data will be removed from the project computer and overwritten, whether at the end of the project or when reattaching a modem or LAN connection.
Posting warning notification: During the computer log-in process, a warning statement (shown below) will appear on the computer screen before access is granted. If it is not possible to have the warning appear on the screen, it must typed and attached to the computer monitor in a prominent location.

WARNING

Federal Restricted-use Data

Unauthorized Access to Licensed Individually Identifiable Information is a Violation of Federal Law and Will Result in Prosedcution

Do you wish to continue? (Y)es or (N)o

Notice

Proposed Publications Using Restricted-use Data

Restricted-use data licensees are required to provide a copy of each publication that contains information based on the data to the National Center for Education Statistics (NCES). If any such publication or other research results could reasonably raise questions about the disclosure of individually identifiable information, copies of such documents must be sent to NCES prior to their dissemination or publication. For example, any document that presents information or has tables showing unweighted cell sizes having less than three (3) cases must be reviewed by NCES prior to any dissemination or publication.

Signature Page – Management Review and Approval

I have reviewed the requirements of the license agreement and the security procedures in this plan that describes the protection procedures for access to the restricted-use data.

I hereby certify that the computer system and physical location security procedures and requirements meet all the requirements of the license and will be implemented for the duration of the project and license period.

___________________________________		_______________________
Senior Official Signature		Date

___________________________________		_______________________
Senior Official Name (print)		Phone Number



___________________________________		_______________________
Principal Project Officer Signature		Date

___________________________________		_______________________
Principal Project Officer Name (print)		Phone Number



___________________________________		_______________________
System Security Officer Signature		Date

___________________________________		_______________________
System Security Officer Name (print)		Phone Number

Note: The National Center for Education Statistics (NCES) processes licenses and disseminates restricted-use data for all centers in the Institute of Education Sciences (IES) including the National Center for Education Research (NCER), the National Center for Education Statistics (NCES), the National Center for Education Evaluation (NCEE), and the National Center for Special Education Research (NCSER).

NCES Headlines

|Institute of Education Sciences|NCER|NCEE|NCSER

1990 K Street, NW
Washington, DC 20006, USA
Phone: (202) 502-7300 (map)

Statistical Standards|FedStats.gov