research data security

[Steve Brukbacher <sab2 () UWM EDU>]

Hi,
I'm working on my strategy for working with our researchers.  We are
beginning to work more formally with researchers as part of the IRB
process.

The variety of their work is great. Everything from one on one
interviews going into an access database all the way to much larger
web-based survey instruments that will need to handle PHI.

What I'm wondering is how are other institutions handling these
situations?  Do you do a risk assessment/security planning engagement
with each of them?  Is it left up to departmental IT staff?

Any tips for managing the workload on these?

Anyone have checklists that have been useful in getting the basics taken
care of?


--
Steve Brukbacher, CISSP
University of Wisconsin Milwaukee
Information Security Architect
UWM Computer Security Web Site
www.security.uwm.edu
Phone: 414.229.2224