Indiana University created the ResGuard secure research enclave to provide a compliant environment for storing, processing, and managing Controlled Unclassified Information (CUI) and other regulated research data and applications. The platform is designed to satisfy the cybersecurity requirements established by the Federal Government, including the security controls defined in NIST Special Publication 800-171, which are commonly incorporated into federally funded research agreements. ResGuard has been self-certified to CMMC Level 2.
ResGuard Secure Enclave
When to use ResGuard
The requirement to use IU ResGuard is determined during the sponsored project agreement review process. The Office of Research Administration (ORA), working in collaboration with the Research Security Office, evaluates contract terms to identify projects that require a secure computing environment, most often through the presence of clauses such as DFARS 252.204-7012 or standards like NIST SP 800-171. When a project is determined to have these contractual requirements, Indiana University researchers are required to use ResGuard to store, process, and protect research data subject to federal security controls or dissemination restrictions. If contract language imposes restrictions that are broader than necessary, ORA will work with the sponsor to seek appropriate revisions.
How ResGuard Supports Secure Research
IU ResGuard provides a secure, cloud-based research environment hosted within Microsoft Azure Government Community Cloud High (GCC High), enabling researchers to meet federal cybersecurity and data protection requirements while working from university-owned and managed devices.
Key capabilities include:
- Secure virtual research environment: Access a dedicated ResGuard workspace hosted in Microsoft Azure GCC High using an IU-managed computer.
- Collaborative project workspaces: Share data and collaborate securely with approved Indiana University project team members within a controlled environment.
- Compliant research infrastructure: Leverage secure computing, storage, and networking resources designed to support sponsored research, contracts, grants, and collaborative projects that require compliance with enhanced federal security requirements, including NIST SP 800-171 and CMMC Level 2.
- Dedicated support: Receive technical assistance from the Research Security Office Information Security Team by submitting a ServiceNow request or contacting resguard@iu.edu.
ResGuard Limitations and Considerations
To maintain compliance with federal security requirements, ResGuard operates with several restrictions that may affect research workflows:
- Supported operating systems: ResGuard currently supports Windows and Linux environments only.
- Application approval: Software not already available in ResGuard must undergo a security and compatibility review before it can be installed or used.
- No high-performance computing: High-Performance Computing (HPC) resources are not currently supported within the ResGuard environment.
- U.S.-only access: Access to ResGuard is restricted to users located within the United States.
- No printing: Printing from the ResGuard environment is disabled.
- Restricted external storage: Standard removable media, including USB storage devices, cannot be used with ResGuard.
- Controlled data transfers: The transfer of Controlled Unclassified Information (CUI) into or out of the ResGuard enclave is permitted only through approved methods established by the Research Security Office. CUI can be securely transferred to external partners/collaborators using Virtru — IU’s compliant solution — or a Sponsor-approved solution.
- Communication restrictions: Standard Indiana University-hosted Microsoft Teams and VoIP services must not be used to discuss or share CUI with participants outside the ResGuard environment. However, Teams and VoIP communications between users operating within the secure enclave are supported.
- Managed device requirement: Researchers must access ResGuard using an Indiana University-owned and managed computer.
- Third-party data sharing: Once project data is transferred to an external organization, such as a sponsor, subcontractor, or vendor, it is no longer covered by Indiana University's security controls. The project team is responsible for ensuring the recipient is authorized to receive and protect the data in accordance with applicable contractual and regulatory requirements.
Are There Training Requirements?
Yes. Before being granted access to the ResGuard environment, all users must complete required training on the proper handling and protection of information maintained within the secure enclave. This training covers the responsibilities and security practices associated with safeguarding Controlled Unclassified Information (CUI) and other protected research data.
Researchers may self-enroll in the required training through Indiana University's Expand learning platform:
Enroll in the Controlled Unclassified Information (CUI) Training course
CUI Best Practices
Controlled Unclassified Information (CUI) should be handled only in locations where access is limited to individuals who have been authorized to view or work with the information. Appropriate locations may include secured offices, facilities requiring badge access, or work areas that are actively monitored. Restricting these spaces to approved personnel helps prevent accidental exposure or unauthorized access to CUI.
Workstations used to access or process CUI should be set up in a way that minimizes the possibility of unauthorized viewing. This can include positioning computer screens away from hallways or other shared areas, installing privacy filters, and maintaining a clean workspace. Printed documents and other CUI materials should also be properly stored or secured whenever they are not being actively used or when the workspace is left unattended.
Accessing CUI in public or otherwise unsecured environments, such as airports, hotels, or coffee shops, should be avoided unless suitable security measures have been implemented. When CUI must be accessed remotely, appropriate safeguards should be used to protect the information. These measures may include encrypted devices, privacy screens, approved secure network or VPN connections, and precautions to prevent others from overhearing conversations involving sensitive information.
CUI is not limited to information stored electronically. In addition to digital files, email messages, and database records, CUI can exist in physical formats such as printed reports, handwritten notes, technical drawings, records, blueprints, and other paper documents.
Within research environments, physical CUI may include printed technical information subject to export-control requirements, sensitive research or project records, and personally identifiable information (PII) associated with research participants. CUI must receive the required level of protection regardless of whether it is stored electronically or maintained in a physical format.
Physical objects connected to environments where CUI is stored, accessed, or processed may also require appropriate safeguards. Examples can include removable storage media, prototypes, and access-control items such as keys and security badges. Protecting these items helps prevent unauthorized individuals from gaining access to locations, systems, or information containing CUI.