Creating an RSEC Review

Process Overview

RSEC review forms are created and used by the staff and analysts on the RSEC team. If you are in need of a research security or export control review, please submit an ancillary request to the RSEC team. In the absence of ancillary review capabilities, send an email through PERA to the RSEC team to request a review.

This procedure guide provides step-by-step instructions for completing a Research Security and Export Controls (RSEC) Review in the PERA system. It outlines how to create an agreement, enter required information, assign ownership, and manage related submissions. The guide also explains how to review and approve language, generate and edit the agreement, and finalize the process by activating the RSEC Review. Following these steps will ensure the review is completed accurately and in compliance with institutional requirements.

Icons Guide

Create an RSEC Review

1. Create Agreement

Within the Agreements module, select Create Agreement.

1. Type the name of the PI for the RSEC Review. This should be the PI for the contract, study, or activity you are reviewing.

The Primary contact will automatically pull in the name of the person who is creating the RSEC Review agreement.

Check the First draft to be generated internally box.

No need to upload any document.

Type the agreement name. For RSEC Reviews we follow a strict naming convention: “RSEC Review for [PERA ID]”.

This text appears throughout the system as the Agreement name, for example, in My Inbox.

Select Research Security and Export Controls as the Agreement type.

In the description field copy and paste the title of the Agreement, i.e. RSEC Review for PERA ID

Skip this step. There is no need to upload any documents.

Select today’s date.

Select the Agreement type (i.e., SRA), select Continue to move to the next page, General Information.

1.1 General Information

1. Type the name of the Sponsor or other contracting party for the RSEC Review. Note: PERA uses the % symbol as the Boolean search modifier. Use the symbol to expand your search. It can be used anywhere in the search field, but may affect results depending on where it is placed.

2. For example, if you were searching for “The College Department”:

• A search of “The Department” would not return the intended result, but “The % Department” would.
• A search of “%College” or “%College%” would return “The College Department”.
• A search of “College%” or “College” would give results such as “College Department”, but NOT “THE College Department”.

Fill in sections 2 and 3 with N/A. Skip section 4.

Provide information for additional external parties or Prime Sponsors that are related to this RSEC Review.

Only if Yes was selected in #5

Select Add to add any additional Contracting Parties.

By default, this field displays the organization of the Agreements Manager/PI entered on the Agreement Upload page.​ If no value displays, then you must select a value.​

In case the Manager/PI is changed in an agreement, the organization value gets updated automatically.​

Skip Step 7.

Fill in Section 8 with N/A.

Only if Yes was selected in #5

Fill in with N/Aand select Continue to move to the next page, Completion Instructions.

1.2 Completion Instructions

Follow the steps outlined in the Completion Instructions.

Once you have finished, select Finish to exit the form.

Your RSEC Review is now in the “Pre-Submission” status.

2. Submit RSEC Review

Select Submit.  Confirm that all the information is correct and select OK.

 The RSEC Review will now be in an Unassigned stage.

3. Assign Owner to RSEC Review

Select Assign Owner. Select your name as the designated owner.  When finished select OK.

The status will now change to In Review.

4. Manage Relationships

Click “Manage Relationships” from the Dashboard.

Insert the relevant PERA ID (i.e., the SRA number or FP number). There is no need to add comments or supporting documents. Once finished, select OK.  

The reference to the RSEC review will now show up on the related PERA record.

5. Create RSEC Review

Click RSEC Review at the bottom left side of the screen to open the Activity Form. Note: Only RSEC has visibility to this Activity Form, and subsequent questions may be different than this training material based on the Agreement type selected in Step 9.

Only if Yes was selected in #1

Enter further information about which restricted party list or sanction applies.

If Yes is selected, the information arising during or resulting from this research project may not qualify as Fundamental Research.

Only if Yes was selected in #2

Select the box applicable to this RSEC review.

If Yes is selected, the information arising during or resulting from this research project may not qualify as Fundamental Research.

Only if Yes was selected in #3

Select the boxes applicable to this RSEC review.

Note: Some cybersecurity requirements like DFARS 252.204-7012 require Fundamental Research to be nullified in order to be applicable. For example, if you are reviewing a contract with DFARS 252.204-7012 and it does not have access or dissemination restrictions, select “Not applicable”; however, if you have both DFARS 252.204-7000 and DFARS 252.204-7012, select “Yes”.

Only if Yes was selected in #4

Select the boxes applicable to this RSEC review.

Note: If the work is free from access/dissemination restriction (i.e., questions 2 and 3 are both answered “No”) the information arising during or resulting from this research project qualifies as Fundamental Research. If there are indications that controlled information will be provided to the research team, you may still mark “Yes” for this box.

Only if Yes was selected in #5

Select the boxes applicable to this RSEC review.

If questions 2 and 3 are both marked “No”, then the answer to this question should be “Yes”.

Only if Yes was selected in #6

Enter “See question 2” or “See question 3” or “See questions 2 and 3”.

Only if Requires determination was selected in #6

Select the box applicable for this review.

Only if Yes was selected in #7

Select the information applicable for this review. Note: Even on fundamental research projects, the building of defense articles may constitute a defense service if a foreign person is involved. Restricted end uses may be found in 15 CFR § 744.

RSEC has standard export controls language that should be added into agreements in which the University may receive physical items or confidential/proprietary information.

Only if No was selected in #8

Recommend that standard export controls language be added to the agreement requiring the other party to seek approval from the University prior to providing controlled articles, technology, or software.

Only if Yes was selected in #9

NOTE: On questions 10-15 Export Controls needs to engage with Research Security.

The following workflow has been created to ensure a clear handoff between Export Controls and Research Security. However, any internal discussion or clarification needed from either Research Security or Export Controls should occur outside of PERA through standard team communication channels.

Only if Yes was selected in #10

If “Yes” is selected, a review by the research security team is required, prior to completion of the RSEC review. At this point the Analyst send a correspondence through PERA to the Associate Director of Research Security by selecting Email Agreement and include in the Subject Line, “FOR RESEARCH SECURITY REVIEW” to ensure the email is seen by research security personnel in RSEC.

The EC Analyst will hold further processing of the RSEC review form, pending the completion of the research security review.

Upon receipt of an RSEC review notification, the Associate Director of Research Security will assign to an RS analyst for review. The RS analyst will confirm if either a Research Security Plan or a Risk Mitigation Plan is required by contract. If another potential research security risk is identified, the analyst will determine if further review is warranted, and if any related controls are needed to mitigate risk.

If “No” was selected, proceed to Step 11.

Only if Yes was selected in #11

If “Yes” is selected, send a correspondence through PERA to the Associate Director of Research Security by selecting Email Agreement and include in the Subject Line, “FOR RESEARCH SECURITY REVIEW” to ensure the email is seen by research security personnel in RSEC.

The EC Analyst will hold further processing of the RSEC review form, pending the completion of the research security review.

Upon receipt of an RSEC review notification, the Associate Director of Research Security will assign to an RS analyst for review. The RS analyst will confirm if either a Research Security Plan or a Risk Mitigation Plan is required by contract. If another potential research security risk is identified, the analyst will determine if further review is warranted, and if any related controls are needed to mitigate risk. Upon completion of the Research Security review, the RS analyst will include comments on Q11-13 of the RSEC review form as appropriate, and then send a correspondence through PERA to the EC analyst by selecting Email Agreement and include in the Subject Line, “RESEARCH SECURITY REVIEW COMPLETE.” The email should indicate what actions, if any, are recommended to mitigate research security risks, and whether any actions must be completed prior to completing the related ancillary review.

If “No” was selected, proceed to Step 12.

Only if Yes was selected in #12

If “Yes” is selected, send a correspondence through PERA to the Associate Director of Research Security by selecting Email Agreement and include in the Subject Line, “FOR RESEARCH SECURITY REVIEW” to ensure the email is seen by research security personnel in RSEC.

The EC Analyst will hold further processing of the RSEC review form, pending the completion of the research security review.

Upon receipt of an RSEC review notification, the Associate Director of Research Security may assign to an RS analyst for review. The RS analyst will confirm if either a Research Security Plan or a Risk Mitigation Plan is required by contract. If another potential research security risk is identified, the analyst will determine if further review is warranted, and if any related controls are needed to mitigate risk. Upon completion of the Research Security review, the RS analyst will include comments on Q11-13 of the RSEC review form as appropriate, and then send a correspondence through PERA to the EC analyst by selecting Email Agreement and include in the Subject Line, “RESEARCH SECURITY REVIEW COMPLETE.” The email should indicate what actions, if any, are recommended to mitigate research security risks, and whether any actions must be completed prior to completing the related ancillary review.

If “No” was selected, proceed to Step 13.

Only if Yes was selected in #13

If “Yes” is selected, send a correspondence through PERA to the Associate Director of Research Security by selecting Email Agreement and include in the Subject Line, “FOR RESEARCH SECURITY REVIEW” to ensure the email is seen by research security personnel in RSEC.

The EC Analyst will hold further processing of the RSEC review form, pending the completion of the research security review.

Upon receipt of an RSEC review notification, the Associate Director of Research Security may assign to an RS analyst for review. The RS analyst will confirm if either a Research Security Plan or a Risk Mitigation Plan is required by contract. If another potential research security risk is identified, the analyst will determine if further review is warranted, and if any related controls are needed to mitigate risk. Upon completion of the Research Security review, the RS analyst will include comments on Q11-13 of the RSEC review form as appropriate, and then send a correspondence through PERA to the EC analyst by selecting Email Agreement and include in the Subject Line, “RESEARCH SECURITY REVIEW COMPLETE.” The email should indicate what actions, if any, are recommended to mitigate research security risks, and whether any actions must be completed prior to completing the related ancillary review.

“No” was selected, proceed to Step 14.

If “No” was selected for 11-13, the EC analyst can proceed without review by RS. However, if any one was marked as “Yes” the EC analyst should wait to complete Q14 until after receiving an email from the RS analyst regarding the outcome of the research security review.

The EC analyst will receive an email from the RS analyst through PERA upon completion of the Research Security review. The email should indicate the research security review has been conducted, which actions are recommended to mitigate research security risks, and whether these actions must be completed prior to completing the related ancillary review. The EC analyst can then complete the RSEC review.

Note: Only mark “Research Security Plan” or “Risk Mitigation Plan” after having received written confirmation of this from the RS analyst.

Conditions may be things like:

• Rescoping of contractual language to ensure Fundamental Research
• Insertion of standard export controls language in the agreement
• Implementation of a GGM, TCP, RSP, or RMP

Only if Yes, with conditions was selected in #15

Only if no was selected in #15

Once you have finished answering all questions, select OK. 

6. Approve Language

After the RSEC Review Form is complete, the language needs to be approved.

Open the RSEC Review and click “Approve Language”.  Fill in the following:

• Signature type: Select Digital
• Should the agreement be routed for internal signature first? Select Yes
• Does the agreement contain evergreen clauses? Select No
  • Note: an evergreen clause is a provision in a contract that automatically extends the contract’s term for a specified period unless one party provides notice of termination before the renewal date. Essentially, it’s a self-renewing contract, preventing the need for renegotiation of termination if neither party takes action to end it.
  • Effective Date: Select today’s date
  • Expiration Date: Select today’s date 2 years out. Unless directed otherwise by a specific review type SOP
  • Notes: Leave blank
  • Supporting Documents: Leave blank

  When finished, select OK.

  7. Generate Agreement

  

  Select Generate Agreement within the RSEC Review.  Select RSEC Review under the generated agreement from template drop-down.  Click Generate.  The agreement will now appear in #2 as a document. Once finished, select OK.

  8. Edit Agreement Document

  

  Review the generated agreement by clicking on the link next to Agreement.  A document will open with the current RSEC Review.

  

  Make any necessary changes or edits within the word document.

  9. Convert to PDF

  

  Select Convert to PDF.  Click OK to convert the approved agreement to PDF.

  

  The final agreement for the RSEC Review Form in PDF format will now be visible under the original agreement document.  Click on the final agreement and correct the template to remove any comments or notes within the document.  

  10. Activate RSEC Review

  

  Select Activate. Fill in the following:

  • People who have signed: select your name
  • Internal signing date: The date the review is finalized
  • External signing date: The date the review is finalized
  • Effective date: The date the review is finalized
  • Expiration date: 2 years from the date the review is finalized

  Once finished, select OK.

  

  The RSEC Review is now complete.

  11. Close Out Ancillary Review

  Note: If a GGM, TCP, RSP, or RMP are required, do not proceed with this step until after receiving approval from the person pulling that Plan together. Generally, the Plan needs to be fully developed and executed before the original agreement can move forward, though exceptions may be made on a case-by-case basis.

  

  Select Submit Ancillary Review.

  

  Review the questions related to the ancillary review you are submitting.  Add a PDF of the RSEC Review final agreement as supporting documentation.  When finished, select OK.