Protecting Research. Encouraging Reporting.
The University of Arizona is committed to protecting research information, safeguarding federal contract information, and complying with applicable cybersecurity requirements, including the Cybersecurity Maturity Model Certification (CMMC).
Researchers, employees, contractors, and members of the public are encouraged to report suspected cybersecurity violations, improper handling of protected research information, or other concerns involving the University's research cybersecurity practices.
You do not need proof of a violation to report a concern. Reports made in good faith help the University identify potential risks, address vulnerabilities, and protect the integrity of its research activities.
What Should Be Reported?
Examples of reportable concerns include:
- Unauthorized access to, disclosure of, or sharing of Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).
- Improper storage, transmission, or public posting of protected research information.
- Failure to follow applicable research cybersecurity requirements or safeguards.
- Suspected misrepresentation of cybersecurity compliance, assessments, or certifications.
- Unauthorized use of systems or technology involving federally funded research.
- Suspected retaliation against individuals who raise research cybersecurity concerns.
Reports may involve CMMC requirements, federal contract cybersecurity obligations, or other research cybersecurity concerns.
Submit a Report
If you become aware of a potential research cybersecurity violation or concern, we encourage you to report it.
Submit a Research Cybersecurity Concern
Reports may be submitted anonymously where supported by the reporting system. Providing contact information may assist with follow-up, but is not required for anonymous submissions.
Please do not include passwords, FCI, CUI, or other sensitive information in the initial report. The University may arrange a secure method to obtain additional information if necessary.
What Happens After a Report Is Submitted?
Reports are reviewed and referred to appropriate University officials for assessment and follow-up. Depending on the nature of the concern, this may involve the Research Security Program, Information Security Office, or other responsible University offices.
The University may request additional information, evaluate potential cybersecurity risks, and take appropriate corrective action.
Immediate Cybersecurity Threats
If you suspect an active cybersecurity incident, including unauthorized system access, compromised accounts, or exposure of protected information, report it immediately through the University's established information security incident reporting process.
Report a Cybersecurity Incident
Questions?
For general questions about research cybersecurity requirements, contact the University of Arizona Research Security Program.