You are here

FAQs

A research study in which one or more human subjects are prospectively assigned to one or more interventions (which may include a placebo or other control) to evaluate the effects of those interventions on health-related biomedical or behavioral outcomes.1

(1)  U-M has adopted NIH's definition of clinical trials to track and monitor organizational metrics.  See full NIH definition with detailed footnotes(link is external).

The Awards tab (for PI & Project Teams) is where you find awards awaiting action (similar to the PAFs tab). Awards on this tab are grouped by:

  • Awards Awaiting PI Signature
  • Modifications Awaiting PI Signature
  • Change Requests with Required Action
  • Awards on Hold

You can find a list of active awards on the Active tab.

No. PAF comments will not be migrated over to the Award.

IRB approval is required for the study, but the IRB does not review the registration record in ClinicalTrials.gov.  Once registration on ClinicalTrials.gov is complete, add the NCT # to the IRB application.

Required Informed Consent Language for Applicable Clinical Trials:

Applicable clinical trials must use the unaltered consent template language provided below in the informed consent document:

  • "A description of this clinical trial will be available on http://www.clinicaltrials.gov/, as required by U.S. Law. This Web site will not include information that can identify you. At most, the Web site will include a summary of the results. You can search this Web site at any time."

Required Informed Consent Language for NIH and other Sponsor Requirements for Registration and Reporting

NIH funded clinical trials that began on or after 1/18/2017 must refer to ClinicalTrials.gov in their informed consent document (unless they are conducted under a grant submitted prior to that date, with no competing renewals on or after 1/18/2017).   Use the below language:

  •  “This trial will be registered and may report results on www.ClinicalTrials.gov, a publicly available registry of clinical trials.” 

U-M Informed Consent templates contain the above language.  Refer to IRMED Informed Consent Template and IRB HSBS Informed Consent Template

Yes, it will show up as Hardship. The Project/Grant will not have an award ID until it is awarded.

Post-award hardship requests will be submitted through a new award change request type available both on the PAC-R form and the online Award Change Request.

You can enter the new end date in the Comments/Instructions for ORSP box. Refer to Award Change Request.

When Award Management goes live in August, fully automated routing of unit requests will not be in place but is planned for a future system upgrade.

Until then, the PI/Project Team will have two options to request an award change:

  • Complete the current PACR form, obtain ink signatures, and upload the form using the new Request Action/Modification activity available in the Award workspace 
    Or
  • Use the new online Request Action/Modification activity
    • Fill out the online Request Action/Modification form, print the form, and obtain ink signatures
    • Upload the signed form to your change request and click Submit

No. The PAF exists for historical purposes. Once a PAF is funded, it is for reference only.

All modifications are handled on the award. When a modification is made to the award, the PAF will not change. Links to modifications display on the Modifications tab in the Award workspace.

All PAFs tied to a single award will show up on the Related Records tab. From this tab, you can link back to the PAF if needed.

No. If you update personnel (Investigators or Administrative) on the Award, the related PAF is not updated.

Yes. Click on the Name of the item to edit. Refer to Manage Deliverables.

Both units and ORSP have the ability to create Deliverables.

Units are not required to use Deliverables. You are encouraged to check with your unit about any guidelines or requirements in place regarding the use of Deliverables.

  • The AWD Docs tab lists associated award, modification, change request, supporting and other documents, and security plans.
  • On the Unit Docs tab, you will see documents uploaded by you or others in your unit with access to the award (e.g., PI). Documents stored here are also visible to central offices.
  • The Activity Log tab holds documents added through the Post a Comment activity.

Yes, a "snapshot" of the closed PAFs will be available in a single table in the data warehouse for running queries.

What is getting converted?

  • PAFs with Active P/Gs
    • Single PAF = New Award/Single P/G
    • Multiple PAFs with same P/G = New Award/Single P/G
    • (Includes PAFs that are expended but related to an active P/G)
    • Includes projects that are complete, but not yet Closed)
  • A list of historical PANs and PACs will display on the Modifications tab of the Award record.  
    • An award modification reference will be created for each historical PAN/PAC. 
      • All modifications of a project will have a Modification ID in order of the PAN or PAC create date.  
      • The name of the modification will be the PAF ID on which it was created followed by the PAN/PAC ID (e.g., 18-PAF012345-F055555-01).
      • The modification type will start with "Legacy" (e.g., Legacy - PAC Financial, Legacy - Administrative, etc.) to indicate that it is a converted record
      • These records are intended for reference only and will not contain any content. The original PAN/PACs, including detailed content, can be found on their respective PAFs. 

What is NOT getting converted?

  • Closed Projects. PAFs will remain in the system in a Closed state.
  • Documents - No documents will be moved from the PAF to the Award record. Documents will remain on the PAF for historical reference.

For more details, please see Data Conversion on the ITS website.

The following training resources will be available the week of July 23, 2018, on the eRPM Training and Reference Materials web page:

  • Narrated training video with system demonstrations
  • Step by step job aids and other helpful documentation

In addition, eRPM users have access today to the eRPM “sandbox”, where you can practice using real data. Please note that data entered in the sandbox will not be reviewed, processed, or approved.

We are also planning to hold two interchanges (one on central campus, one on North Campus) just prior to the go live. Details will be shared once the schedule and locations are confirmed.

  1. We cannot guarantee we will find and announce every limited funding opportunity.
  2. We sometimes learn of a limited opportunity belatedly. We will do our best to announce it within a reasonable time.
  3. If you find a funding opportunity of interest and believe it is limited, but do not see it here or in our archived emails, you still must follow our process. Let us know the opportunity you have found. This process is critical: extra submissions can result in the sponsor's rejection of all from the University of Michigan.
  4. If the sponsor deadline has not expired, you may be able to still apply. Contact UMORlimitedsubmissions@umich.edu.
  5. We will try to work with all interested parties to achieve a satisfactory outcome.

Conflicts of Interest (COI) represent financial or other situations where an individual has an outside interest (e.g., equity in a company, intellectual property, consultant activity with a company) that could affect the design, conduct or reporting of their research.  Also refered to as personal or individual COI.

 

Institutional conflicts of interest (ICOI) represent financial or other situations where the University, as an institution, has an outside interest (e.g., equity in a company doing business with the University) that could affect the design, conduct, reporting, review or oversight of research conducted by its employees or students.

 

Organizational conflicts of interest (OCI) represent situations where an individual's service or work on behalf of a U.S. government agency or other funding sponsor may provide the University, as an institution, an unfair competitive advantage when other University members apply for a funding opportunity with that agency or sponsor.  

A Covered Official of the University is an executive officer, dean, or institute/center director with day-to-day responsibility for the supervision of faculty and staff participating in research conducted at or under the auspices of the University.

The initial award notification will come in an email, and all information that we currently know as PAN (Project Award Notice) or PAC (Project Award Change) will reside in the AWD system. If you wish to have a hard copy printed, your best course of action would be to save the email notification as a PDF. 

User Acceptance Testing (UAT). During the UAT process, representatives from the schools/colleges/institutes and central offices  (who were involved in the working groups) will be asked to preview the online workflow. Additionally, this is a time to redefine or identify any remaining "offline" business processes. No new functionality is expected to be added during UAT. The UAT process simply ensures that requirements have been met.

 

The eRA Commons (electronic research administration commons) website, by the National Institutes of Health (NIH), that provides principal investigators and their research staff with online features and tools including the abilities to:

  • View a full application
  • Review current status of an application
  • Check for errors
  • View application assignment information
  • Obtain PDF copies of applications
  • Access copies of previous Notices of Grant Award

Get current information on the program official and the grants management specialist

More information from ORSP about using Grants.gov through the U-M eResearch Proposal System

  1. Extended definition for federal exemption #2 [pre-2018 Common Rule] (proposed by IRB-HSBS, 2013; adopted by all U-M IRBs)
    Federal exemption category 2 applies to projects involving educational tests, surveys, interviews, or observation of public behavior.  It does not allow for any other research intervention in conjunction with the durvey, etc., regardless of the risk.  U-M exemption #2a expands the federal definition to minimal-risk research with adults that involves a non-invasive intervention followed by data collection vai survey, interview (including focus groups) or observation.  Examples of non-invasive interventions include, but are not limited to:
    • Reading a story or vignette
    • Playing an electronic game
    • Using a computer program or website
    • Watching a video
    • Using a robot arm or device
    • Being exposed to stimuli, such as color, light or sound (within safe limits)

  2. Two-year approval periods (proposed by IRB-HSBS, 2007; adopted by IRB-Flint, 2014, IRBMED, 2015)
    Federal regulations require continuing review of research at least annually, depending on the degree of risk to the subjects.  For research projects posing no more than minimal risk to subjects, U-M postulated that lengthening the review period beyone one year was unlikely to increase risks to subjects.

  3. Exemption for analysis of identifiable data:  U-M Exemption #7 [pre-2018 Common Rule] (proposed by IRB-HSBS, 2007; adopted by all U-M IRBs) Federal regulations require annual continuing review for all studies, including minimal risk studies where research activity is limited to analysis of identifiable data.  U-M proposed that for research involving no direct interaction or intervention with human subjects, the requirement to submit annual continuing reviews doesn not enhance subject safety.  A new exemption category was created to provide appropriate review and subsequent exemption from regulatory oversight.  Anticipated benefits included:
    • Reduction of administrative workload for investigators
    • Reduction of application volume for IRB staff and reviewers
    • Reduced turn-around time for application review of U-M Exemption #7 studies

  4. Pilot of the 2018 Common Rule for non-federally funded research (June 2018-January 2019)
    Pilot to evaluate business process changes, validate burden-reducing efforts, and test changes to the IRB application prior to the implementation of the 2018 Common Rule, including:
    • Implementing new and updated exemption categories (except 7 and 8);
    • Implementing new exemption review paths, specifically the "system-generated" determination workflow for exemptions 1, 2, and 3; and
    • Removing the requirements for continuing review of expedited studies (i.e., minimal risk studies).

HRPP's criteria for demonstration projects includes:

  1. The research must be determined to pose no more then minimal risk to subjects.

  2. The research must not include:
    • Federal sponsorship, including federal training grants
    • FDA regulated components
    • Sponsor or other contractual restrictions requiring adherence to federal regulations for clinical interventions (including clinical behavioral interventions)
    • Prisoners as subjects
    • NIH-issued Certificates of Confidentiality

  3. The project must evaluate the impact of procedural improvements, including the:
    • Compatibility with the current electronic IRB application
    • Ease of training and informing investigators, study teams, and the IRB staff
    • Ability to monitor the projects.

  4. The project must signify the impact of procedural improvements on the research community, such as:
    • Elimination of regulatory excess that is not protective of human subjects
    • Enhanced regulatory outcomes for minimal risk research
    • No increase in effort required for investigators.

Innovations U-M has implemented to date include:

  1. Streamlining the IRB application paths (i.e., types of applications) in eResearch for:
    • Secondary use of existing data/records/specimens
    • Exempt human subjects research
    • Activities not regulated as human subjects research
    • Requests for review by a non-UM IRB.

  2. Updating IRB policies regarding staff roles for:
    • Exempt reviews - authorization for IRB staff to make exempt determinations
    • Scheduled Continuing Review (SCR) - authorization for qualified IRB-HSBS staff to conduct expedited review of non-federally funded research.

  3. Implementing U-M guidelines regarding:

  4. Expanding the interpretation of federal exemption category #5 to cover public benefit and service programs sponsored by the State of Michigan.

32 CFR Part 2002 identifies three control levels that guide the safeguarding or dissemination of CUI:

  • CUI Basic - requires or permits the agencies to control or protect the information, but provides no specific information security controls
  • CUI Specified - requires or permits the agencies to control or protect the information, and provides specific information security controls
  • CUI Specified, but with CUI Basic Controls - requires or permits the agencies to control or protect the information, and provides only some of the controls

When the university accepts a contract that includes CUI, the Research Information Security Liaison determines the level of CUI (basic or specified) control required and works with the research team to ensure that the appropriate controls are implemented for the life of the project.

An single IRB-of-Record (sIRB) may charge for their services on a cooperative or multi-site, non-exempt human research project.  Estimated expenses are calculated on a case-by-case basis and, if allowed by project sponsor, listed as a direct cost in the budget for a funding proposal and award.

Common IRB services include, but are not limited to:

  • IRB Reviews
    • Initial review of the research protocol, investigator/site qualifications, informed consent plan and documentation, and subject recruitment materials
    • Continuing/annual protocol review (regulatory requirement) for subsequent years of the project
    • "Periodic" review of any incident reports (e.g., Adverse Events or ORIOs), as they are filed
    • Amendments/modifications -  changes to the study that require IRB review
  • Administrative Services - letters, study changes not requiring IRB review, etc.
  • Site/Project Closeout - review of the final status report, resolution of outstanding issues 
  • Other - services as applicable to the project, e.g., foreign language translation, etc.

Factors that impact the budget for sIRB services include the number of performance sites, level of risk to the participants of the research and/or to the institution, duration of the study, and more.  See the External sIRB fee schedule -sample for an example.

Warning iconAlways contact your U-M IRB to determine the best option and requirements for the sIRB prior to submitting funding proposals for cooperative non-exempt human subjects research.

Contact:

UMOR’s Research Information Security Program
Phone: 734-764-7248
Email: Research.Information.Security@umich.edu

 

Failure to comply may result in contract challenges to, or loss of, the award and result in future ineligibility to be awarded government contracts.

Failure to accurately report the status of compliance could result in charges of fraud and criminal penalties for the individual researcher.  In addition, the university could also experience adverse reputational, legal, or financial consequences.

The controls for CUI are only implemented when we have accepted a contractual obligation to implement specified NIST SP 800-171 controls. Federal agencies may issue contract amendments that would require CUI controls at any time after a contract has been accepted. Consequently, information security controls may change during a project's lifecycle, but these new terms would only be effective from the date we contractually accept them.

All implementations of a CUI controlled environment will result in shared responsibilities between ITS, IA, the school/college/unit, and the research program. Housing CUI research in the Yottabyte Research Cloud or a cloud-based solution will only address about ⅔ of the required controls. The remaining ⅓ of controls will be the responsibility of the school/college/unit and the research program. The majority of these controls are policies and procedures the research group must implement along with training for all personnel working with CUI.

NIST 800-171 allows for nonfederal entities to meet CUI security requirements by “isolating CUI into its own security domain by applying architectural design principles.”  

 

In this vein, there is currently an ITS-led project initiative in collaboration with ARC-TS to develop a CUI compliant enclave. The Yottabyte Research Cloud will greatly facilitate data-intensive research by providing a flexible computing cloud for complex computational analyses of data classified as Restricted or High, such as CUI. ITS is also developing a proof of concept for a CUI compliant commercial cloud enclave. This will provide a rapidly deployable alternative when the Yottabyte research cloud cannot support a project's technical requirements.

 

An overarching compliance program is being developed as a partnership between U-M Information Assurance (IA), University of Michigan Office of Research (UMOR), Michigan Medicine Compliance, Office of General Counsel (OGC) and the schools and colleges most likely to work with CUI. Components of the program will include the development of policy, process, security templates, training, periodic risk assessments (RECONs), and the certification that appropriate controls are in place.  

 

Our experience to date is that, after consultation with contracting agencies, we often are able to eliminate CUI provisions and requirements from the final contract.

A research project may include CUI when the funding source is a federal contract or a subcontract where the prime sponsor is a federal agency. The university enters into approximately 1700 new federal contracts/subcontracts each year, but only a small subset are expected to involve CUI. The Office of Research and Sponsored Projects (ORSP) reviews and negotiates all incoming sponsored research contracts and subcontracts for the university.

 

When ORSP identifies contract language (normally a DFAR or FAR clause) requiring CUI compliance, it requests a review from the Information Security liaison in the Office of Research Ethics and Compliance. The liaison reviews the contract and research proposal works with the Principal Investigator (PI) to determine the applicability of the clause, and then works with ORSP to clarify precisely what materials are CUI and/or negotiate the clause out of the contract.

 

A research project may also include CUI if it using data acquired under a Data Use Agreement (DUA) and the data is information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, and has been classified by the government as CUI.

For the majority of research projects at U-M, our information systems meet the definition of a “nonfederal” information system. It is important to note that federal agencies are specifically prohibited from requiring Information security controls above those specified in 32 CFR 2002 for nonfederal information systems.

 

NARA charged the National Institute of Standards and Technology (NIST) with developing the information security controls for CUI Basic. These controls are detailed in NIST Special Publication 800-171r1, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.”  This publication draws heavily from two earlier NIST information security standards, FIPS 200 and NIST 800-53, both of which are already significantly accounted for by U-M information security practices.  

 

When the university accepts a contract that includes CUI, we determine the classification of the CUI (basic or specified) and work with the research team to ensure the appropriate controls are implemented for the life of the project.

The National Archives CUI Registry identifies the information considered to be CUI by category/subcategories.  A non-exhaustive list of categories includes:

  • Controlled technical information with military or space application
  • Critical infrastructure information (e.g., energy infrastructure, water systems, etc.)
  • Export controlled information or materials used in research
  • Nuclear information related to protecting reactors, materials, or security
  • Statistical information (e.g., U.S. Census)
  • Transportation information (e.g., railroad safety, etc.)

​The CUI Registry is the authoritative online repository for information, policy, requirements and guidance on handling CUI.

It is critical to protect sensitive government information, some with national security or U.S. trade implications, to reduce the risks of unauthorized release or misue. Application of and compliance with the information security controls helps protect this information against threats to cyber security, data breaches, or other unauthorized disclosures.

 

Sign up for The RAP/RAPid newsletters  (be sure to also check the box that you wish to receive RAN Updates). You can also join the RA Forum on Slack. 

A Limited Submission is a funding opportunity in which the sponsor sets an institutional limit for the number of proposals it will accept. To participate, the University must organize to submit our most competitive proposal. This requires an internal competition. The process is critical; extra submissions can result in the rejection by the sponsor.

A group of raising hands The Call for Intent to Submit process relates to the many Limited Submission funding opportunities that exist -- about 250 funding opportunities each year from various sponsors.

 

We don't need to reserve competition dates for each opportunity if interest does not exist. So we prepare a weekly communication listing opportunities and asking for a show of hands to determine interest. If interest exceeds the sponsor's institutional limit, the U-M Office of Research may hold an internal Limited Submissions Competition and announce it at a later date.

 

Interested parties declare their interest in a Call for Intent to Submit and/or submit competition materials for a Limited Submission competition, through our InfoReady Limited Submissions website(link is external).

Controlled Unclassified Information (CUI) is federal non-classified information (i.e. information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the government) that requires safeguarding or dissemination controls compliant with law, regulations, and government-wide policies.

 

The CUI Program is a government-wide approach to creating a uniform set of requirements and information security controls directed at securing sensitive government information.

 

Additional Details:

 

For an overview of these requirements and the impact on research conducted at U-M, see U-M Office of Research (UMOR) External Funding and Information Security Requirements. UMOR’s Office of Research Ethics and Compliance provides assistance to investigators to help them understand when CUI regulations apply to research projects and to identify what U-M resources are available to meet the security requirements.

 

CUI requirements do not apply directly to non-federal entities, but can flow down when U-M non-federal information systems (e.g., research projects) are given access to such information by federal agencies under the terms of a contract, grant, or other agreement.  U-M researchers are frequently subcontractors handling CUI on behalf of a government agency, and CUI requirements apply equally to subcontractors.

 

On November 4, 2010, President Barack Obama issued Executive Order 13556 “Controlled Unclassified Information” for the purpose of establishing an open and uniform program for managing [Controlled Unclassified information] that requires safeguarding or dissemination controls pursuant to laws, regulations, and government-wide policies.

 

Prior to this, executive departments and agencies employed ad hoc agency-specific policies, procedures, and markings to safeguard and control this information.

 

The National Archives and Records Administration (NARA) was designated as the Executive Agent to implement the Order and oversee agency actions to ensure compliance with this order.

 

NARA established a CUI Registry, an online repository for all information, guidance, policy, and requirements on handling CUI. The registry identifies all CUI categories and subcategories, provides general descriptions for each, identifies the basis for controls, establishes markings, and includes guidance on handling procedures.

 

There are three ways in which law, regulation or government-wide policies may permit the safeguarding or dissemination controls:

 

  • CUI Basic – requires or permits the agencies to control or protect the information, but provides no specific information security controls.

  • CUI Specified - requires or permits the agencies to control or protect the information, and provides specific information security controls.

  • CUI Specified, but with CUI Basic Controls - requires or permits the agencies to control or protect the information, and provides only some of the controls.

 

A single IRB-of-Record (sIRB) is the institution review board that is designated (with negotiated terms via a formal service/authorization agreement) to act as the sole provider to conduct the initial, continuing, and any subsequent review of the research project to ensure human subjects protection regulations will be/are followed.

 

From U-M's perspective, an external IRB is any non-UM institutional review board.  An external IRB can be an accredited commercial, central, other academic, or hospital-based IRB.  When a U-M study team is not utilizing a U-M IRB for a non-exempt, multi-site human subjects research project, it will be using an external IRB.

 

A central IRB is an institutional review board that specializes in reviewing a specific type(s) of human subjects research; or is established to review projects funded by a specific agency.  For example, the NCI Central IRB reviews projects sponsored by the National Cancer Institute.

If non-compliance is identified during a routine review, the investigator may be asked to submit to the IRB specific changes to the protocol, informed consent, the eResearch application, or other study related materials.

If non-compliance is identified during a for cause review, the IRB of Record will craft a Corrective and Preventative Action Plan (CAPA) for the investigator which may include submission of a revised protocol, informed consent, or other materials.  ORCR will collaborate with the IRB to craft the CAPA plan and follow-up on required corrective actions.

For more detailed information, see ORCR SOP 101 (Not for Cause Routine Review) and ORCR SOP 102 (For Cause Review).

The Principal Investigator (PI) should plan on an initial 60-minute interview with an ORCR reviewer. This discussion will focus on areas of potential study risk. Interview questions may include but are not limited to: roles and responsibilities, recruitment, consenting process, study procedures, record keeping, data management, monitoring, and oversight. The scope of the review may vary and is tailored to the scope, nature, and complexity of the study.  Following the initial discussion, the ORCR reviewer will review study records with the study coordinator.  

Following the review, the investigator will have an opportunity to review a draft report to verify facts contained in the report. The IRB of record will also have an opportunity to review a draft of the report. The final ORCR report will be sent to the investigator, the IRB of Record, the Research Associate Dean, and Associate Chair for Research or Department Chair.

For more detailed information, see ORCR SOP 101 (Not for Cause Routine Review) and ORCR SOP 102 (For Cause Review).

Failure to register/update a trial/study or providing incomplete, false or misleading registration information may result in:

  • Monetary penalties
  • Withholding of federal research funds
  • Return of grant funds to the sponsor
  • Refusal of consideration by ICJME member (or other) journals

IRB approval is required for the study, but the IRB does not review the registration record in ClinicalTrials.gov.  Once registration on ClinicalTrials.gov is complete, add the NCT # to the IRB application.

Required Informed Consent Language for Applicable Clinical Trials:

Applicable clinical trials must use the unaltered consent template language provided below in the informed consent document:

  • "A description of this clinical trial will be available on http://www.clinicaltrials.gov/(link is external), as required by U.S. Law. This Web site will not include information that can identify you. At most, the Web site will include a summary of the results. You can search this Web site at any time."

Required Informed Consent Language for NIH and other Sponsor Requirements for Registration and Reporting

NIH funded clinical trials that began on or after 1/18/2017 must refer to ClinicalTrials.gov in their informed consent document (unless they are conducted under a grant submitted prior to that date, with no competing renewals on or after 1/18/2017).   Use the below language:

U-M IRB Informed Consent templates contain the above language.  Refer to IRMED Informed Consent Template and IRB HSBS Informed Consent Template

The federal Controlled Substance Act defines and classifies drugs and other substances into five (5) controlled substance schedules (I - V) according their potential for abuse and addiction. The substance's schedule dictates the application process to use and guidelines to follow for security, storage, etc.

large C indicates controlled substance; the Roman numeral indicates the substance schedule

Schedule I:  illicit drugs, compounds and their chemical precursors that have a high potential for abuse, no accepted medical use, and lack of accepted safety protocols for medical use.  They are typically used for drug abuse/addiction research or for analytical research.

​Schedules II-V:  drugs, compounds, and their chemical precursors that have accepted medical uses and a decreasing potential for abuse.

 

The Foreign Corrupt Practices Act

It is illegal for U.S. persons to offer or pay anything of value to a foreign official for the purposes of obtaining, retaining, or furthering business activities, per the federal Foreign Corrupt Practices Act (FCPA) anti-bribery provisions. For example, making payments to custom officials in exchange for their agreeing not to inspect goods or to release goods held at points of entry would violate the FCPA. For more information, visit the U-M Export Controls FCPA guidance.

Be Aware

Customs officials in any country, including the U.S., may inspect your belongings, including electronic content of computers, phones, tablets, and storage devices. They may take possession of these items for various periods of time—even permanently.  It is a best practice to only take items with you that are absolutely needed for your trip.

Some countries also have import regulations that specifically prohibit travelers from bringing into those countries encrypted laptops or other mobile devices. Violations of those countries’ prohibitions could result in confiscation of your device by customs authorities and/or fines or other penalties.

What If You Encounter A Problem While Overseas?

You are required to report a stolen or lost device or other IT Security Incident. The U-M Office of Global Engagement provides detailed information on General Emergency Protocols for U-M International Travelers.
 

When traveling out of the United States, everything you take with you is considered an “export,” under U.S. export regulations. Some of these exports will require an export license from the government. However, in many situations, you will not need an export license because either (1) the items or data you are taking are not controlled to your destination or sometimes (2) a license exception is available.

Items That Require Export Control Review Before You Travel

Do not travel with any of the following items without first obtaining specific advice from the Export Control Program, as these items may require an export license:

  • Devices, systems or software that are not standard, off-the-shelf products generally available to the public

  • Devices, systems, or software that are specifically designed or modified for military or space applications

  • Data or information received under an obligation of confidentiality

  • Data or analyses that result from a project that has restrictions on the dissemination of the research results

  • Classified information

  • Export controlled information

Items That You May Be Able to Take With You

U-M employees and students may be able to use a “Tools of Trade” license exception to travel temporarily out of the U.S. and hand carry certain types of hardware, software and/or data. This license exception may be used by U-M employees and students traveling with personally-owned or U-M-owned hardware, software and data provided that the terms of the license exception are met.  This exception does not apply to items, technology, data, or software regulated by the International Traffic in Arms Regulations (ITAR). Please contact the Export Control Program if you would like more information on using this exception when traveling internationally.

If your hardware, software or data are not eligible for the “Tools of Trade” license exception, the Export Control Program will discuss other options with you.  There are other less frequently used license exceptions that may apply, and if no license exception is available, you may be able to work with the Export Control Program to apply for an export license.  

Items That Need to Be Properly Secured For Travel

Whether you are traveling with a personally owned computer, a U-M owned computer, or any other device, you must make sure that you properly secure your hardware, software and data for international travel.  U-M Safe Computing has detailed guidance to help you secure your devices before, during and after travel.

If you are traveling with any export controlled information or other sensitive data on your devices, you must encrypt your devices to protect the data from unauthorized disclosure.  Please remember that before you travel with any data or devices, make sure that these items are able to be exported out of the country and taken with you to your intended destination. Encryption software that is not commercially available on a mass market basis may be regulated or restricted from being brought into some countries. See Export Controls on Encryption Software for more specifics.

Pages