As an authorized institution, UAB has met all necessary requirements to submit applications to the Federal government (DUNS, EIN, SAM.gov, Grants.gov, eRA Commons). However, you will be required to register with eRA Commons for the proper role prior to submitting your application.

Modular Versus Detailed Budget

To determine whether to use a detailed versus modular budget for your NIH application, see the flowchart below. For information on preparing both modular and detailed budgets, visit Developing Your Budget.

For more information, flow charts, and other resources please visit our Prepare Proposal webpage for Federal Grants.

For general information about submitting NIH applications, please visit our Prepare Proposal page.

For more detailed guidance on submitting NIH grant applications to OSP, please visit the Submit Application page.

Be aware that NIH grant submissions to OSP are subject to OSP Proposal Submission Requirements.

If your application receives a fundable score, NIH will request Just In Time (JIT) information that includes other support for key personnel, IRB (Human subjects) approvals and training, IACUC (Animal subjects) approval. JIT can be requested via eRA Commons or directly from your grants management specialist. Please contact your officer when you have completed the requested information.

Once your grant is funded OSP will request a detailed budget that corresponds with the Notice of Grant Award. At this time, you will need to make sure that all approvals are met and up-to-date.

Then you are ready to manage your award...

Managing your award is very important in the success of your research. There are certain reporting requirements and modifications that may be necessary. The most common reporting requirements and modifications are listed below. Detailed information can be found at Award Management.

For additional reading on common tasks and additional resources related to managing your award, please visit our Managing Your Award page.

No. The salary cap only applies to grants funded by PHS agencies (NIH, SAMSHA, AHRQ, CDC, HRSA, etc.) - not, for example, DOD, NSF, or NASA.

Federally funded clinical trials do not use the clinical-trial rate. Rather, these clinical trials must apply UAB's applicable federally negotiated rate.

Generally, yes. Notice of Grant Awards (NGA) issued by HRS approve funds for specific budget categories, such as salaries and wages, equipment, and travel. Departments are generally permitted to rebudget between budget categories in the approved total direct cost (TDC) budget. However, if a department wishes to rebudget restricted funds or make a significant rebudget (i.e. more than 25% of the budget) prior approval is required. 

There are two types of NSF no-cost extensions:

• Grantee-Approved No-Cost Extensions
• NSF-Approved No-Cost Extensions.

The grantee (i.e. UAB) may unilaterally extend the expiration date of the grant by up to 12 months. This one-time extension cannot be to use the unliquidated balance of the grant, but instead must be to assure adequate completion of the project. The request must be made through Fastlane at least 10 days prior to the expiration date of the grant. The request must include supporting reasons for the extension and the revised expiration date.

To request additional time beyond the initial no-cost extension, a formal request must be submitted to NSF through Fastlane. The request must be submitted at least 45 days prior to the expiration date of the grant, explaining the need for the extension and estimating the unobligated funds remaining and the plan for use of the funds. In short, the request should contain the revised expiration date, the funds remaining, the justification for the extension, and the plan for using the unobligated funds.

Yes, but it is not recommended. Uploading a proposal to Fastlane is much easier than submitting an SF424. Also, collaborative proposals submitted as separate submissions from multiple organizations must be submitted through Fastlane.

To obtain a username and temporary password, please e-mail the following information to your Other Federal OSP Officer:

• First name
• Last name
• UAB e-mail address
• Phone number
• Fax number
• Department
• Degree type
• Degree year
  

1. On the Fastlane home page, select "Proposals, Awards, and Status" which will display the "Principal Investigator (PI) / Co-Principal Investigator (Co-PI) Management" screen.
2. Click on "Proposal Functions".
3. Select "Proposal Preparation".
4. Select "Prepare Proposal".
5. Click the "Create Blank Proposal" button to access the "Form Preparation" screen, where you can create your proposal.
6. In order for OSP to view, edit, and submit the proposal, on the "Proposal Actions" screen, you must click the "Allow SPO Access" button. The "Proposal Errors/Warnings Screen" will display. Hit the "Proceed" button. You can then press the "Allow SRO to view, edit, and submit proposal" button, which will grant OSP access to the proposal.
   

If UAB is the non-lead organization, you must assign your proposal a proposal PIN. You must provide the proposal PIN and the temporary proposal ID created by Fastlane to the lead organization before it submits its proposal to NSF.

To assign a PIN to your proposal, on the “Proposal Actions” screen, highlight the proposal you want to assign a PIN, and then click the “Proposal PIN” button. Next, simply type a PIN in the boxes provided and click the “OK” button. Then click the next “OK” button that displays.

If UAB is the lead organization, on the “Form Preparation” screen, click the “GO” button next to “Link Collaborative Proposals.” Enter the Temporary Proposal ID and PIN provided by the non-lead organization and click “Add Collaborative TPI to Proposal” button. Then click the “Yes” button and then the “OK” button.

The separately submitted proposals are considered a single proposal. Thus, they should be submitted within a reasonable timeframe of one another.

No. The PI may submit a pre-application to eBRAP. If the PI is invited to submit a full application, that must be submitted by OSP.

Yes. UAB's Organizational Name in eBRAP is "Alabama, University of, at Birmingham".

If you are applying for an educational training grant, as determined by the Secretary of Education, the indirect-cost reimbursement is limited to 8% of a modified-total-direct-cost base, as directed in the RFA. The modified-total-direct-cost base consists of total direct costs minus stipends, tuition and related fees, equipment, and the amount of each subaward in excess of $25,000. If you are applying for a grant other than an educational training grant and the RFA does not limit the rate, then you should use UAB’s applicable, full negotiated rate.

Notify the Office of Sponsored Programs that your project was Withdrawn or Disapproved at either This email address is being protected from spambots. You need JavaScript enabled to view it. or This email address is being protected from spambots. You need JavaScript enabled to view it.. Please ensure that you include all relevant OSP Assigned Numbers for affected projects. Also, indicate if any subprojects are affected (if applicable). Upon notification, the Office of Sponsored Programs will update the status of indicated projects in IRAP.

“JIT” is an acronym for Just-In-Time and refers to the application timeframe requiring applicants to send information to the NIH only if an award is likely. This process decreases the administrative burden for the 75%-80% of the applications that will not receive funding and provides NIH with the most current information “Just-in-Time” for award. Applications that have received an impact score of 40 or less will receive the automatic system generated email indicating the importance of beginning the JIT process, particularly the need to obtain any necessary IRB and IACUC approvals.

Investigators should not rely on this automated email as an indicator of the need to submit JIT information. JIT information includes up-to-date Other Support, IACUC, IRB, and Human Subjects Education Documentation. When “JIT” is posted in the “Action” column of your NIH eRA Commons account, it signifies that your application has completed the peer review process and has received a rank for which funding may be possible. For additional information, view a standard NIH request for JIT information at this website.

Applicants should not submit any JIT information until it is requested by the grantor agency. NIH issues just-in-time emails for all applications that receive an overall impact score of 40 or less.

The Just-in-Time link appears for all grant applications within 24 hours after the score is released to ensure its availability should the grantor agency request the Just-in-Time information. Applicants should not see this link as an indicator of the need to submit JIT information and should rely on a specific request from agency staff.

On April 20, 2012, NIH changed their procedures for requesting JIT.

• NIH now makes the JIT link available for all projects that receive a peer review impact screen score of 40 or less regardless of the Institute's pay line.
• The automated email received by PI's is sent immediately after the peer review phase.
• This email up to 8 months in advance of the expected start date.
  

According to the electronic submission policy, applicants are required to submit their information using the JIT feature of the eRA Commons as least 60 days before the applicant’s proposed project period start date (or sooner if requested by the IC). This recommendation is because NIH understands key personnel’s Other Support can (and most likely will) change between the time the JIT link becomes available and the time NIH begins its JIT review (which is 45 to 60 days prior to the start date).

For more information regarding NIH's JIT process, please visit: NOT-OD-12-101

To minimize delays, OSP strongly recommends that all of the JIT documents are reviewed as follows:

• Review Other Support pages for accurate listing of all active and pending support.
• Review Other Support pages for accurate actual effort (for active grants) and committed effort (for pending grants).
• Effort must be listed as calendar months, e.g. 0.5 or 1.0 calendar months. Please note that Other Support should not exceed 12 calendar months or 100%.
• Review Other Support to ensure that an overlap statement of scientific, budgetary, and effort overlap is included. If none, so state.
• Ensure that the IACUC Approval Notice and Date are uploaded. The Approval Notice should have the same project title and sponsor as the proposed project.
• Ensure that the IRB Approval Notice and Date are uploaded. The Approval Notice should have the same project title and sponsor as the proposed project.
• Human Subjects Education training certificates must be included for all relevant Key Personnel.
  

Once NIH requests Just-In-Time information, the Principal Investigator (or PI's delegate) will:

• Log on to eRA Commons.
• Click on the "Status" at the top and select "Just In Time" on the left.
• Search by Grant Number, PI name, etc.
• Click on the "JIT" link under the "Action" column.
• Import or enter the required information.
• Upload combined PDF of "Other Support" in the "Other Support File".
• Enter IACUC Approval Date and upload Approval Letter to "Other Upload", if applicable.
  
• Enter IRB Approval Date, select the Federal Wide Assurance (FWA) Number from the dropdown, and upload Approval Letter to "Other Upload", if applicable.
• NIH IC's may also request additional Just-In-Time information on a case-by-case basis, such as revised budgets or changes to the human subjects or vertebrate animals sections of the application. These changes should be submitted as an "Other Upload" file in the eRA Commons Just-In-Time module.
• Upload combined PDF document of Human Subjects Education, if applicable.

NOTE: The option to enter dates is only available when animals and/or humans are being used.

• Press the SAVE button.
• Click "View Just In Time Report" to make sure everything looks as intended.
• Department Administrator should review for accuracy.
• Department Administrator should notify OSP by This email address is being protected from spambots. You need JavaScript enabled to view it. that the JIT is ready in eRA Commons. The subject line of the email should state: "JIT Information Uploaded for PI: Doe, John Grant: 1 R01AB0123456-01".
  

• Log the JIT request in Integrated Research Administration Portal (IRAP).
• Review JIT Report from eRA Commons and verify information.
• If changes are needed:
• OSP will contact the Department Administrator and/or the PI to update and save information on eRA Commons.
• Department Administrator and/or PI needs to contact OSP after changes are made.
• If no changes are needed:
• OSP will submit the JIT information.
• OSP and the PI will receive email confirmation from eRA Commons once the JIT information is submitted. The email confirmation will also be forwarded to the Department Contacts and stored in IRAP.
  

Yes. This is required so that the OSP reviewer may revise the agreement appropriately.

Services contracts are for so called below the neck functions. For example, a contract where the PI’s role is to perform specific testing according to a list provided by the sponsor would be services. Research contracts are for above the neck functions. For example, a contract where the PI has developed a research plan to test the basic makeup of some material and provide information to the sponsor would be research. 

Another factor in the differentiation is that there will be no intellectual property arising out of services, whereas with research, development of intellectual property is more likely. Your OSP officer can provide more guidance on the type of project you are submitting, and if needed, can provide template services or research agreements to your sponsor.

This will be a subcontract from the company to UAB, and the company should provide you with an agreement. UAB does not draft agreements in this situation because the terms of company’s agreement with PharmaCo will be incorporated into the subcontract, and UAB does not have access to this. You will submit the agreement to OSP like any other, with the Extramural Checklist, RPL, budget, etc.

Ask your contact for an agreement. This will save UAB drafting a master agreement for you only to have the company refuse to use it. If your contact indicates they do not have a template agreement to provide, contact your OSP officer.

OSP’s goal is to have each CTA finalized 40 days from the time OSP receives all required documents. However, the length of time is dependent on whether a CRO is involved, how long the sponsor takes to review UAB’s edits, and whether there are unique issues involved.

OSP officers are assigned by type of project and by department. Your department has an OSP officer for NIH, other federal grants, federal contracts, non-profit, and for industry. These are posted on the OSP website. Also, the officer handling the project is listed in the IRAP project record on the Summary page.

Find Your Officer

The department is responsible for negotiating the budget with the sponsor as well as obtaining the IRB/WIRB and CIRB approvals and/or device letter from the UAB Hospital. These processes should be moving forward concurrently with the agreement negotiations to expedite start of your trial.

First, you need to submit all the documentation you received from the sponsor to OSP with an Extramural Checklist, detailed budget, and RPL. The award agreement will be reviewed in OSP and by Research Foundation and Office of Counsel as applicable. OSP will contact the sponsor to let them know they will be receiving properly signed paperwork for your project. As the PI, you are not authorized to bind the university in contracts, so your signature is not operative.

Once the necessary reviews are completed and IRB/CIRB approvals are in place, signatures will be obtained and your project will be processed to Grants Accounting.

If your grant is ending and you are seeking an extension, then provide OSP with the following:

• Expedited Checklist (completed)
• Written approval from sponsor of the extension including a specific new end date
• Budget detailing remaining grant funds
  

Even though no-cost extensions do not involve additional funds from your sponsor, a no-cost extension creates a new budget period. The new budget period is separate from those already set forth in your award. Because of the new budget period, the existing budget for the project no longer reflects the status of the funds going forward. The no-cost extension budget should show the grant funds remaining for the project, broken down by category. The dates should be the start and end dates of the extension period.

UAB's policy is that it cannot properly sign an agreement for a PI to conduct research without having the proper approvals in place. In many cases, these agreements specify that the proper institutional approvals will be in place. Signing only when approvals are in place also ensures that no work will be performed before a contract is in place, and that no work will be performed without IRB approval.

Instructions from the UA System can be found here.
An IRS letter of determination can be found here.

F&A costs, sometimes referred to indirect costs, are the cost of conducting business that are incurred for common or joint objectives and therefore cannot be identified readily and specifically with specific projects (such as individual grants or contracts) or with a specific activities (such as instruction, research, public service).

F&A costs are real costs incurred by the institution to acquire and maintain its buildings and equipment, and to provide operational support. These support services include maintenance and operations (utilities, janitorial services, police services, etc.), library operations and administrative services. All of these costs are real, and without them, the institution could not exist. For example, accounting and payroll services are administrative functions that are not directly identifiable to specific projects or activities; however these services are necessary for the University to exist.

When the UAB performs activity for others such as the federal government, foundations, and private industry, through contracts, grants and other agreements, UAB policy requires it to recover the "full cost" associated with such projects, including all direct and F&A costs. Direct costs are the costs directly identifiable to individual projects. F&A costs are assigned to projects as a percentage of direct costs.

The F&A costs paid to UAB by project sponsors in this fashion are referred to as "F&A cost or overhead recovery", and represent the recovery of costs incurred by the university to provide the facilities and operational support for the project.

Sponsored projects are budgeted for direct and F&A costs. F&A cost recovery is the "recovery" of institutional costs incurred by the university to support the project. The recovery is reallocated to each School/College based on their share of the recovery. In certain cases, a portion of the recovery may be reallocated to principal investigators through their school’s/college’s budgeting procedures.

Construction and renovation of laboratories that are necessitated by the requirements of a particular project must be paid for by that project. Thus such reconstruction and renovation costs must be charged as a project direct cost. General renewal, reconstruction and renovation not necessitated by specific projects are funded by the institution and are not charged directly to projects.

Periodically, almost every entity that applies for federal funding prepares and presents a cost proposal to the university's cognizant federal agency for the purpose of negotiating F&A cost rates applicable to federally funded contracts and grants. The cost proposals are prepared according to the requirements specified in OMB 2 CFR 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (aka Uniform Guidance), using actual cost data from prior year operations. The proposals are reviewed by the federal negotiators and rates are negotiated.

Unless otherwise indicated by UAB’s F&A policy, UAB applies the federally negotiated rates to all sponsor types, federal and non-federal.

UAB’s F&A rates are not to be negotiated with industry sponsors. Budgets to industry sponsors are to be total costs budgets.

For example, a line item budget: If direct costs for a supply item is $1,000.00 and the applicable F&A is 48.5% the line item in the sponsor budget would read $1,485.00.

Because UAB is a state institution, it cannot charge industry sponsors less than the negotiated rates; otherwise, it could be seen as subsidizing for-profit work. Further, the University has agreed to consistently apply its DHHS federally negotiated rates to all sponsor types, including industry. Certain program exceptions are codified in UAB’s F&A policy.

The F&A Task Force, the campus-wide committee charged with revising the policy, evaluated the many factors related to this issue. When we evaluated the projects that were the fee-for-service activities, the large majority were most often funded by a for-profit company and being performed in the same labs as research activities being led by the same faculty. Because the activity requires the same space, equipment, and institutional resources, it was decided it would be inappropriate to charge a for-profit corporation less than what we charge the U.S. Government. Therefore, fee-for-service activities will fall under the same rate as Organized Research.

No. UAB’s F&A Policy covers the circumstances under which exceptions to its DHHS federally negotiated rates apply.

In certain circumstances the School may elect to cost share part of the F&A costs. The basis for such decision is generally to support a School business purpose. For example, a pilot project or proof of concept project that is limited in duration and scope with the plan to obtain a larger grant in the future that would cover the full total costs. You will need to submit a Cost Sharing Commitment form with your materials to OSP. This form requires several signatures, and you must obtain all of them before routing the form to OSP. At the time of award, GCA will set-up the cost share account so that these costs are covered by the Department/School and not charged to the sponsor. The sponsor will pay their percentage, and the PI asks that the rest be borne by the Department and School.

If fifty percent (50%) or more of the extramurally funded project is performed in facilities not owned by UAB and rent is directly allocated in the project budget, then the off-campus rate applies.

Here are some examples:

1. Research will take place at a lab at Innovation Depot. Rental costs for the space are a line item in the funded project’s budget. The project will be charged at the off-campus rate.
2. Research will take place at a lab at Innovation Depot and the rental costs for the space are paid for centrally by UAB or UABRF. The project will be charged at the on-campus rate.
3. The research is strictly computer/data driven and will be done at the PI’s home rather than their office. The project will be charged at the on campus rate.
4. The research will take place at Children’s Hospital. The project will be charged at the on campus rate. Since Children’s Hospital is not owned by UAB, UAB centrally leases space there for university purposes. The leased building list is located on the Financial Affairs website. 

UAB has an internal form, the Indirect Cost Revenue Redistribution Form, that allows for the redistribution of the F&A (indirect) cost revenue among departments. The form should be submitted with the proposal submission for each sponsored project.

The NIH Grants Policy Statement section 7.4 Reimbursement of Facilities and Administrative Costs limits the rate to 8% of the modified total direct costs, exclusive of tuition and fees, expenditures for equipment, and consortiums in excess of $25,000.

A confidential disclosure agreement, also known as a confidentiality agreement or a non-disclosure agreement, is a legal contract designed to protect confidential information that may be released or exchanged between two or more parties.

When UAB is considering doing business with another entity and needs to exchange confidential or other information that is not generally known in order to evaluate a project or understand the processes used in another’s business, it is best practice to enter into a CDA.

A CDA may be unilateral or mutual. A unilateral CDA is used when only one of the parties is disclosing confidential information. An example of when a unilateral CDA is appropriate is when a Principal Investigator (PI) is considering whether or not to participate in a clinical trial and the Sponsor wishes to send a study protocol for review and consideration. A mutual CDA is used when both parties will be disclosing confidential information.

1. To understand exactly what information is defined as confidential information and subject to the terms of confidentiality.
2. Only disclose during the “disclosure period” which will be defined in the terms of the executed document. Any confidential information disclosed outside the disclosure period will not be subject to the protection of the agreement.
3. Note the “period of confidentiality” which is defined in the terms of the executed document. The period of confidentiality is the length of time the confidential information is subject to the terms of the agreement and may extend beyond the period of the executed CDA.
4. Dispose of any confidential materials in the way described in the agreement.
   

A CDA is a contract between a sponsor and UAB. The person signing for UAB must have authority to bind the university to the contract, otherwise it is ineffective.

Please send the editable version of the agreement and an Expedited Checklist. No RPL is required. Please complete the Checklist fully, as the contact information you provide for the Sponsor, CRO, and PI contact will expedite the review of your submission. Please always include the full title of the subject matter of the CDA, whether that is a study, drug, compound, or protocol. Please ask the PI to sign the agreement before submitting to OSP:

• If the CDA is with a Federal sponsor, submit to This email address is being protected from spambots. You need JavaScript enabled to view it..
• If the CDA is with a non-Federal sponsor, submit to This email address is being protected from spambots. You need JavaScript enabled to view it..
  

UAB-approved templates are available at the UAB Office of Sponsored Programs website. Choose the appropriate template and send it to the sponsor. Upon receipt of a signature or comments from the project sponsor, submit an expedited checklist and the red-lined or signed CDA for review and processing.

• If the CDA is with a Federal sponsor, submit to This email address is being protected from spambots. You need JavaScript enabled to view it..
• If the CDA is with a non-Federal sponsor, submit to This email address is being protected from spambots. You need JavaScript enabled to view it..
  

It is important to identify what parts of the conversations between the PI and the Sponsor are confidential and who is divulging the confidential information (sponsor/partner or UAB). Narrowing the scope is accomplished by identifying the “General Purpose of the Disclosure” or “Project Title” in the Confidential Disclosure Agreement.

In order to develop this, it is important to think of why this potential sponsor or partner wants to talk to you. What kind of specific expertise do you bring to table? What kind of research or project development is the sponsor doing that can benefit from disclosure of confidential information to you? What type of confidential information will you disclose and/or what type of confidential information will the other party disclose? Is there any intellectual property that will be discussed and who owns it? Identifying a middle ground between an overly broad description and an overly specific description will serve the discussion best.

In the event a sponsored research project results from the discussions, the funding agreement will contain an updated project title and confidentiality terms that will supersede those in the CDA.

Example of acceptable Purpose and/or Project Title for preliminary discussions or projects with no set protocol number or study title:

• Discussions regarding Ocean’s LLC blue-green algae sequencing for use in the early detection of pollution in inland retention ponds

• Nanoparticle technology
• Dry Skin conditions
• Discussions pursuant to a future business relationship

Submit an Expedited Checklist and an editable version of the CDA to OSP based on the sponsor type:

• If the CDA is with a Federal sponsor, submit to This email address is being protected from spambots. You need JavaScript enabled to view it..
• If the CDA is with a non-Federal sponsor, submit to This email address is being protected from spambots. You need JavaScript enabled to view it..
  

The UAB OSP will negotiate terms and conditions acceptable to UAB with the Sponsor. The final version will be routed for PI’s signature if needed and UAB signature. UAB employees should not sign any document themselves unless a request comes from the OSP.

The contact person as indicated on the checklist will receive an acknowledgement email from the OSP email address*. This email includes the agreement’s OSP Assigned Number (OAN). The OAN is how the agreement is tracked through the Integrated Research Administration Portal (IRAP). A PI may see the status of her or his agreement at any time by logging into IRAP and searching for the OAN.

* Note that OSP processes federal and non-federal CDAs separately:

• If the CDA is with a Federal sponsor, This email address is being protected from spambots. You need JavaScript enabled to view it. is used.
• If the CDA is with a non-Federal sponsor, This email address is being protected from spambots. You need JavaScript enabled to view it. is used.
  

If a Sponsor is willing to agree to the terms of UAB’s Expedited CDA template, a CDA can be executed within 24 hours. The Expedited CDA is available at the OSP website and should be submitted with an Expedited Checklist to OSP:

• If the CDA is with a Federal sponsor, submit to This email address is being protected from spambots. You need JavaScript enabled to view it..
• If the CDA is with a non-Federal sponsor, submit to This email address is being protected from spambots. You need JavaScript enabled to view it..
  

Contact Eloise Gooden [(205)996-4873 | This email address is being protected from spambots. You need JavaScript enabled to view it.]. The OSP is happy to assist in getting an appropriate agreement in place to facilitate your needs.

FISMA is the Federal Information Security Management Act of 2002, 44 U.S.C sec. 3541 et seq. FISMA was enacted as Title III of the E-Government Act of 2002 (Public Law 107-347, Volume 116 Statutes, pages 2899 - 2970, H.R 2458). The bill requires that federal agencies provide information security, including those services provided by contractors or other sources. FISMA assigns responsibilities to National Institute of Standards & Technology (NIST) to provide standards and guidance to aid agencies in meeting the requirements of the law.

Compliance is the activity of following laws, regulation and policies (governance). This governance is imposed by Federal, Alabama, County or municipal law, contracts, the University of Alabama System and UAB Policies, Standards and Procedures.

All projects that are funded by the Federal Government that collect, store, process, use or transmit data must comply with FISMA.

NIST provides a rich set of guidance for compliance with FISMA. The UAB IT Information Security organization can help you with planning and understanding your requirements.

FISMA is a very rigorous process requiring formal design, documentation and monitoring. The cost of compliance will depend on the information being protected, the integrity requirements, the availability requirements, size of data and the quantities of computing systems needed for the project.

Strategies for reducing the cost of compliance include minimization of scope and re-use of compliant services. UAB IT is developing a set of common services that can be used by researchers requiring FISMA compliant information systems.

Audits are conducted by the governing authority to provide assurance of the compliance. For FISMA, a recognized third party or the Inspector General Office performs audits. The audits test the compliance requirements according to the standards that are provided in the NIST SP 800-53A audit guide.

The decision by the Approving Authority to operate the system is an Authorization to Operate. The ATO is a letter from the Approving Authority that states the conditions under which the authorization is given.

A risk assessment or risk analysis is an activity that must be formally carried out before performing an activity. The assessment must be documented in a standard way and used to guide the recognition and reduction of risk and includes the selection of the controls used to mitigate risks and a measure of the residual risk that remains for an activity. The Risk Assessment provides evidence to the auditors and approvers that the organization conducting the activity has done the due diligence to meet the compliance requirements.

NIST publishes the Federal Information Processing Standards (FIPS). FIPS 199 is the standard that determines the risk category of a system. FIPS 199 categorizes the risk of a system according to three measures: Confidentiality, Integrity and Availability. Within these three measures, a rating of Low, Medium or High is determined.

A System Security Plan (SSP) documents the controls that have been selected to mitigate the risk of a system. The controls are determined by the Risk Analysis and the FIPS 199. For Federal systems (which include all systems that are funded by Federal money) NIST SP 800-53 provides a catalog of controls with templates according to the FIPS 199 Low, Moderate or High category. The SSP lists important information about the system including the system owner, name of the system, and list of security controls selected for the system. Each control listing includes a sufficient description which would allow the system owner or an auditor to verify the effectiveness of that control.

Controls are policies, processes, procedures and technical features that reduce the likelihood that a threat may succeed. Controls are also called "safeguards". They are a defense and discovery mechanism and are preventative or investigative. The NIST SP 800-53 is a catalog of controls that are used in FISMA compliance.

The Guide for Conducting Risk Assessments" describes the six step Risk Management Framework. This framework includes:

1. categorize
2. select security controls
3. implement security controls
4. assess the security controls
5. authorize
6. monitor security controls

For more information about NIST SP 800-30, go here. You may need to scroll down the page.

"Security and Privacy Controls for Federal Information Systems and Organizations" is a catalog of controls for information assurance. All Federal information systems must implement security controls listed in the catalog that apply for the FIPS 199 risk category system.

For further reading, please visit the following pages:

• NIST SP 800-53
• FIPS 199
  

If a project is funded by the Federal government and it provides an information system which collects, stores, processes, uses or transmits information on behalf of the Federal Government, then it must comply with FISMA. If the category of the system is shown to be Low according to the FIPS 199, then the minimum controls that are defined in the NIST SP 800-53 will apply. If the data are public, the Confidentiality should be Low. As long as there are not stronger requirements for Integrity or Availability, the FISMA Low would be the bar to meet.

If you receive an error message while working in IRAP or if the system does not respond as expected (e.g., folders are missing, previously entered data has disappeared, and you no longer have the access you previously had), it is very important that ASKIT and This email address is being protected from spambots. You need JavaScript enabled to view it. are notified as soon as possible.

Please visit the RTC Contact Us webpage for detailed guidance on how to report problems and get support for the IRAP system.