University Research Data Protection Starts at the Records Layer

For many research universities, research data security is a named strategic priority. IT leaders must secure an expanding and diverse library of sensitive data. As is often the case, this directive comes without a corresponding increase in headcount.

Networks and endpoints dominate research data security discussions. Firewalls, VPNs, multi-factor authentication. Not to mention physical facility access and campus security.

Those are all important. But when research teams are formulating their Data Management Plans (DMPs), they're thinking about the documents and information itself. For example:

• Grant applications with PII
• Institutional Review Board (IRB) protocols
• Informed consent forms
• Final closeout reports
• Data use agreements
• Staff records, including CVs, licenses, and certifications
• Data Management Plans themselves

These files get emailed, messaged, and shared across departments, often piling up in SharePoint directories with unclear permissions.

The Compliance Landscape

Each of these document types is beholden to its own compliance obligation:

• Grant applications and data use agreements that include student data fall under FERPA, triggered by the presence of PII in student records (enrollment, academic performance). Grant terms from funders like NIH, NSF, or DoD often layer additional, award-specific data security requirements on top.
• IRB protocols and informed consent forms fall under the Common Rule (45 CFR 46). Approved protocols typically specify who on the research team may access identifiable participant data, how it's stored, and how long it's retained.
• Clinical or health-related research data found in closeout reports and DMPs for clinical studies often brings HIPAA into play.
• Staff records typically fall under state personnel-record confidentiality rules and general state data breach law.
• Research data involving Controlled Unclassified Information under federal contracts is governed by NIST SP 800-171 (and sometimes CMMC flow-down requirements).

An audit will look for who can access a specific document, when, and why. That must be answerable at the level of the individual file.

These are records management challenges. Role-based security in a compliant document management platform gives research leadership and IT partners a means of explicitly dictating precise access. The Etrieve platform from Softdocs applies document-level security, not just folder-level permissions. For example, an investigator's team sees the grant file; the department's business office sees a different slice of the same record.

Conditional access applies another layer, evaluating geographic sign-in location and device before granting entry.

Every action is captured in a complete audit trail, which can be used to generate reports in minutes.

Etrieve Document Management Directly Supports Data Management Plans

A DMP outlines what data will be collected or created, including file types, volume, sources, and whether the data is quantitative, qualitative, experimental, clinical, or observational.

A DMP is a planning commitment made at the proposal stage. Funders don't audit the document management platform itself; they audit whether the institution actually followed through on what the DMP said it would do. A platform like Etrieve gives IT and research teams the technical means to carry out those commitments:

1. How will data be gathered, named, structured, documented, and version-controlled?
2. Where will data be stored, how often will it be backed up, who can access it, and what protections will be used? Sensitive research requires encryption and restricted access.
3. How and when will data be shared, with whom, under what conditions, and through which repository?
4. Which team members are responsible for data collection, quality control, security, documentation, sharing, and long-term preservation?
5. How long will data be kept, what formats will be preserved, and what will happen to the data after the project ends?

Built-in security, retention policies, granular permissions, and approval workflows give an institution the operational backbone and tools to follow through on what its DMPs promise — turning the plan into something enforceable rather than a document that sits in a proposal file.

Best Practices Today Beat Audit Findings Tomorrow

The security of research information is evaluated at the document level. Departments storing research documents on shared drives or searching for email attachments will inevitably face tough questions. Designing a stringent, documented, compliant records layer before an audit helps dodge unnecessary stress, expense, and distractions.

With Etrieve, your research department head can control exactly who can see any given file, as well as change those permissions without submitting an IT ticket every single time. 

Research data security is only as strong as the controls protecting each record, and the right time to put those controls in place is now, not later.