Toolkit: Research Information Security & Cybersecurity

| Back to Toolkits |

Research Cybersecurity Frequently Asked Questions (FAQs)

NOTE: VA network access required to access the following links.

• Research Support Division FAQs (Google Chrome Required)
• Research Scientific Computing Devices (RSCD) FAQs (September 23, 2020)

Guidance Documents

NOTE: VA network access required to access the following links.

• Memorandum of Record "Definition for Research Scientific Computing Device (RSCD)" (December 8, 2020)
• White Paper: “Research Scientific Computing Devices: Case for Governance Framework & Life Cycle Management Support” (November 30, 2020)
• Research Scientific Computing Device (RSCD) Management Standard Operating Procedure (November 5, 2020)
• Electronic Methods for Obtaining Informed Consent- (October 15, 2020)
• Enterprise Research Data Security Plan (ERDSP) Template and User Guide (February 1, 2021)
• Research Information Security Compliance SOP (October 1, 2020)
• Transfer of Images and Data (TRIAD) Used to Support VA Research & NCI Clinical Trials Evaluations (April 29, 2019)
• Standards for Recordable Mobile Devices (Audio Files Only) (October 24, 2018)
• Standards for Recordable Mobile Devices (Cameras - Photo/Video/Audio) (October 24, 2018)
• Release of VA Research Information to Non-VA entities and External Web Portal Reviews (August 28, 2018)

Bulletins

• Research Support Division Bulletins (VA network access required)

Template(s)

• Enterprise Research Data Security Plan (ERDSP) (February 2, 2021) (VA network access required)

General Webinars

• VHA Regulatory Research Cybersecurity Guidance Request Process & ServiceNow (yourIT) Intake Portal (10/8/2021)
• Cybersecurity Process for Connecting VA Research Scientific Computing Devices (10/6/2020)
• Spring Research Town Hall (May 4, 2020)
• ACOS/AO Education Series: Research Cybersecurity Awareness (March 26, 2020)
• Enterprise Research Data Security Plan (ERDSP) Training for the Implementation of VAIRRS (March 20, 2020)
• Cybersecurity Support for VHA Research (July 31, 2019)
• Monthly National Cybersecurity Research Teleconference Sessions (VA network access required)
• VA Research Overview for Information System Security Officers and Managers (ISSOs/ISSMs)
  Select OnDemand. Query by TMS ID: 4486855 located at the bottom of search criteria selection
• Research Institutional Review Board ISSO Protocol Review
  Select OnDemand. Query by TMS ID: 4486857 located at the bottom of search criteria selection
• Research Electronic Case Report Form (eCRF)/Web Portal Security Review for ISSOs
  Select OnDemand. Query by TMS ID:  4486853 located at the bottom of search criteria selection
• Preparing for a Research Cybersecurity/Information Security Compliance Assessment
  Select OnDemand. Query by TMS ID: 4533233 located at the bottom of search criteria selection

RSCD Webinars

• Cybersecurity Process for Connecting VA Research Scientific Computing Devices (October 6, 2020)



NOTE: VA network access required to access the following links.

• RSCD Role-based Enterprise Risk Analysis Service Now (SNOW) Intake training for Business Owners/Principal Investigators (PART 1) (August 17, 2020)
• RSCD Role-based Enterprise Risk Analysis Service Now (SNOW) Intake training for Business Owners/Principal Investigators (PART 2) (August 18, 2020)
• RSCD Role-based Enterprise Risk Analysis Service Now (SNOW) Intake training for Area Managers/ISSOs (August 19, 2020)

Information Security Systems, Applications, and Devices

NOTE: VA network access required to access the following links.

Mobile Devices & Applications

Approved VA Mobile Devices and Applications

• VA Approved Government Furnished Equipment
• VA Approved FIPS 140-2 Validated Removable Storage Devices
• VA Approved Mobile Applications

Reviewed VA Mobile Devices and Application

• List of Reviewed Portable Storage or Computing Devices
  Reviewed product does not equate to Approved product. Refer to VA Approved link to determine if the devices in the reviewed list have been approved for use at the VA.

Requesting Review and Approval of Mobile Applications and Devices

• Mobile Application (Public Commercial Off the Shelf (COTS) Applications)/Mobile Device Assessment Request Portal
• New Mobile Application Development Request (New VA Branded Mobile Applications Only) VIPR (New VA Branded Mobile Applications Only)
• Email Endpoint Device Backoffice to request review of new audio recording device.
• Website & Mobile Application Security Testing

Desktop Applications

Approved Desktop Applications

• Technical Reference Model (TRM) (Searchable list of approved desktop applications)

Requesting Review and Approval of Desktop Applications

• Desktop Application Approval Request Form

Requesting Strategic Technology Alignment (STAT) Waiver

• Strategic Technology Alignment Team (STAT) Waiver TRM - Refer to FAQ #36 & 51 - Complying with the TRM
  Use when desktop application is no longer approved by VA and placed on the unapproved list by TRM.

Cloud Services Applications

Approved Cloud Services/Applications

• VA Enterprise Cloud (VAEC) Platform
• VA Approved Cloud Software Applications

Requesting Review and Approval of Cloud Services/Applications

• Software as a Service (SaaS) Request Portal
• Platform as a Service (PaaS) submit via VIPR Request Portal
• Infrastructure as a Service (IaaS) submit via VIPR Request Portal

Research Scientific Computing Devices (RSCD)

Requesting Review and Approval of RSCDs

• Enterprise Risk Analysis User Guide (August 12, 2020)
• Request Enterprise Risk Analysis (ERA) for RSCD
• RSCD Distribution List: [email protected]
  Use to contact RSD regarding questions/concerns regarding Research Scientific Computing Devices (RSCD)
• Research Scientific Computing Device (RSCD) Cybersecurity Control Standards - COMING SOON!

Electronic Case Reporting Form (eCRF)

VA Approved Electronic Case Reporting Form (eCRF)

• Listing of VA Approved Electronic Data Transition Review (eDTR) Transfer

Requesting Review and Approval of eCRF

• Electronic Data Transfer Review (eDTR) Review & Approval Request
  Only local ISSOs can submit request via “New Submission” link

External Non-VA Systems

NOTE: VA network access required to access the following links.

ATO Status of Existing Research Systems

• Research System ATO Status
  Use to determine existing status of ATO request for non-VA research systems

Request Review and Approval of External Non-VA System

• ATO Process Authorization Requirement SOP
• Pre-Registration GRC Oversight Committee to determine if ATO is required
• GRC Oversight Committee Email questions to GRC Oversight Committee

External System (Air-Gapped) Tracking System

• External Research Information System Connections Tracking (aka Air-Gapped Networks)
Contact local ISSO to have external system (formerly known as Air-gapped added to this tracking system)

Other RSD Research Resources

• [email protected] Research Support Division (RSD) Request for Information Mailbox
• RSD SharePoint Site