Overview

At the University of Michigan, security, safety, and compliance are foundational elements of  our research mission to generate and disseminate knowledge in the public interest. These elements are essential to how that knowledge is created, communicated, preserved, and applied. The university requires that all research activities performed on campus adhere to applicable laws, regulations, sponsor requirements, and university policies while maintaining a commitment to the highest possible standards in research and scholarship.

The university considers research security to encompass the safeguarding of the entire research enterprise, inclusive of the physical security of the university’s research infrastructure, intellectual property, and information technology assets, against the misappropriation of research and development to the detriment of national or economic security, related violations of research integrity, and foreign government interference.

This policy will promote consistency and compliance in safeguarding and expanding the university’s research activities through adherence to applicable legal, regulatory, contractual, ethical, and other security requirements. 

Scope

All members of the university community have individual and shared responsibilities to comply with these applicable laws, regulations, and policies.

This policy is applicable to all units of the Regents of the University of Michigan, including its colleges, schools, departments, centers, and institutes and all individuals and all university community members that engage in or support the research enterprise, including but not limited to faculty, staff, students/trainees, and visitors.

Policy

University Responsibilities and Commitments:

The university, through the offices charged with specific research compliance responsibilities, will:

1. Adhere to all applicable research security regulations.
2. Certify institutional compliance, as appropriate, with applicable research security requirements and laws, and regulations.
3. Articulate and disseminate policies and procedures for the purpose of enabling compliance with research security requirements.
4. Maintain a robust research security program which includes training, cybersecurity, foreign travel security, and export control.
5. Maintain a robust cybersecurity program for the components of the research enterprise.
6. Maintain a robust physical security program for the components of the research enterprise.
7. Administer and enforce a research security training program for the university community.
8. As appropriate or required, engage with funding agencies and the higher education community on research security matters.

University Community Requirements:

Members of the university community must:

1. Adhere to all policies regarding the appropriate conduct of research at the university.
2. Disclose, in a timely manner, outside interests, commitments, and activities, including those with foreign entities, as required by applicable laws, regulations, and policies. 
3. Not participate in prohibited malign foreign talent recruitment programs (MFTRPs) as outlined in the university policy prohibiting such participation. 
4. Cooperate with the university and external sponsors to mitigate research security gaps and risks.
5. Complete all research security and related training as required.
6. Cooperate fully with the university on any research security-related investigation. 
7. Report instances of potential or suspected noncompliance.

  Research security compliance concerns should be reported to [email protected] or via the confidential University Compliance Hotline. 

Oversight and Enforcement

The Office of the Vice President for Research (OVPR) is responsible for the development, implementation, monitoring, and enforcement of the university’s research security program. In carrying out these responsibilities, OVPR relies upon and coordinates with other university units who perform essential research security functions that contribute to program implementation and regulatory compliance, including monitoring, enforcement, and sponsor notification, where applicable. University units are responsible for fostering an environment that supports compliance with the research security program. 

Violations and Sanctions

Depending upon the severity of non-compliance, the individual may also be subject to criminal sanctions, civil liability, or administrative penalties, under law. In addition, violations of this policy by any member of the university community may result in disciplinary action, up to and including suspension or revocation of computer accounts and access to networks and physical facilities, termination of employment, non-reappointment, discharge, dismissal, and/or legal action. Non-compliant individuals may also be subject to termination of federal awards and contracts, suspension or debarment from eligibility for internal and external research funding, and/or revocation of privileges to participate in university research and sponsored projects.