Users can only have a single account, if needed we will move the sponsorship or upgrade the account to a more privileged role, we never issue new accounts once you are in our database. your account can be “rehydrated” again later.

Disabled Accounts

If you can’t log in it might be because your account has been disabled. Accounts could go into the Disabled” state for a number of reasons. Most commonly:

• your account is idle for some time because you have not logged in to one of the FASRC services, (ssh into the cluster, log into SPINAL, use OOD, etc)
• your PI retired or your Sponsoring PI asked us to remove you from their lab. Without a valid, active sponsor an account will be disabled
• your account had an expiration date on it and that date has passed
• your account has been compromised or we were asked to disable it for some other reason

In order to have your account re-enabled and rehydrated, we will need approval from your sponsor. Ideally, have your sponsor contact us and indicate that they wish your account to be re-enabled. You may also contact us, but bear in mind that we will still need to contact your sponsor for approval, so this will take slightly longer than if they contact us directly.

Please allow time for us to process your request. FASRC Support Hours

Adding Groups, Cluster Access. or Changing Labs

See Adding additional lab groups or cluster access for details and instructions. A new account is not required to add groups, acces, or change labs.

Again, signing up for an additional account if you already have or have ever had a FASRC account is never the correct answer. See: Add or Change Lab Groups

Account Sharing

Sharing accounts or account credentials is against university security policy. See: Sharing Accounts

Billing

Cluster usage and additional resources such as storage may be subject to charges to the PI, school, or department.  All billing is done exclusively via Harvard internal billing codes at the Tub/school level.

See our Data Storage Billing documentation.

Academic and Administrative Use

The FASRC clusters (Cannon and FASSE) are for research only and cannot be used for academic purposes. Harvard provides an Academic Cluster for those purposes.

FASRC cluster storage is for research data and results and is not suitable for administrative data storage.

Accounts

Accounts and account credential sharing is not allowed under university policies and reasonable precaution should be taken to keep your account credentials secure and private. No university staff will ever ask for your password.  Additionally, a user may have only one account at FASRC. All individual account holders, whether Harvard affiliates or outside collaborators agree to be held accountable by the Harvard University Electronic Access and Information Security polices: http://huit.harvard.edu/information-technology-policies. In addition, researchers should make themselves familiar with the university research policies maintained by the Provost’s Office.

All account holders agree to respect requests from support staff around how they use the system. The support staff may, as needed, impose whatever policies are required to ensure the system runs effectively for all users of the system.

Data Security

The Cannon cluster is for data rated as Level 2 or below. Level 3 data must be secured and processed on the FASSE cluster and storage. Level 4 or above data is not allowed on any FASRC cluster or storage.

Please also review the FASRC Cluster Storage Policy for guidelines an best practices around storage.

Customs and Responsibilities

In addition, the FASRC clusters and storage are shared resourcesm so please familiarize yourself with our Cluster Customs and Responsibilities.

This policy defines FAS RC standards and procedures for the retention and deletion of research data, outputs, temporary files, and associated digital resources managed by the FAS RC in support of research activities. 

Scope: 

This policy applies to all research data stored, processed, or managed on servers, workstations, cloud resources, storage systems, or backup media provisioned by the FAS Research Computing Service Group.

Data Retention: 

Following the departure of faculty from the University, the associated primary department will assume responsibility for the maintenance, storage, and cost of housing the remaining research data.

Home Directories:

Aligning with the University Research Data Security Policy and the Retention and Maintenance of Research Records and Data Frequently Asked Questions (“FAQs”), home directories will be retained for no more than 7 years following a researcher’s departure from the University or the deactivation of their FASRC account. The researcher’s last login to their FASRC account will be used to track compliance. 

Project Data:

Principal Investigators (PIs) should notify FAS RC 60 days prior to their departure from the University including the duration of any appointments (courtesy or associate), with instructions and next steps for remaining datasets. 

For research data associated with completed or inactive research projects and/or departed faculty where no notice has been given to FAS RC as to where the research data should be stored: 

1. The PIs Harvard affiliated primary department becomes responsible for the storage and cost of the research data. Closure of the PIs group and project in FAS RC will be used to track compliance. 
2. The research data will be retained in the source storage directory for 2 years following project completion or inactivity. Completion of a project occurs after: 
   1. final reporting to the research sponsor 
   2. final financial close-out of a sponsored research award segment 
   3. final publication of research results 
   4. cessation of academic or scientific activity on a specific activity on a specific research project, regardless of whether its results are published, whichever is later. 
3. Following 2 years of inactivity, data will be migrated to FASRC Long-Term Storage. The data will be retained for an additional 5 years to meet the University Data Retention guidelines. Following the completion of 5 years, the data can be deleted. Departments will be notified via email prior to the deletion.

Temporary and Scratch Storage:

Data stored in scratch or temporary directories may be deleted after 90 days without notice to maximize available resources. 

Deletion Procedures: 

• Faculty and/or departments will be notified in advance of research data being deleted, per the timelines above. If PIs or Faculty are no longer associated with the University, the relevant department leadership will be notified via email. 
• Data will be deleted using secure erasure methods in accordance with institutional IT security standards. 
• Requests for retention extension can be made in writing and are subject to approval by FASRC and the department; individuals requesting the extension will be responsible for all associated storage costs. 

Ownership and Roles: 

• University: Harvard University owns all research data generated through projects conducted under its authority or using its resources. While PIs and researchers manage and safeguard the data, the University is ultimately responsible for compliance with legal and sponsor requirements, ensuring confidentiality and security. 
• Principal Investigators: Principal Investigators (PIs) are stewards of research data. If PIs choose to delegate responsibility within their research groups, the PI remains accountable to the University for stewardship of the data. Principal Investigators are responsible for ensuring proper data management, storage, and accessibility, meeting all University, legal, and sponsor requirements. This involves setting up procedures for data retention, confidentiality, and sharing while respecting data use agreements. 
• Departments: In the case that a PI has left the University without delegating responsibility for data, the associated primary department of the departed PI takes on the role of steward. 
• Researchers: Harvard community members who assist with management of data created, analyzed, and stored on FAS RC systems.
• FAS RC: Responsible for executing deletions as outlined, maintaining logs of deletion actions, and responding to extension or exception requests. 

Policy Review: 

This policy will be reviewed and updated annually or as required by regulatory or operational changes. 

Last modification date: 2025-12-02

Related Policies and Information 

• Guidance on Retention of Research Records and Data
• Research Data Ownership Policy
• Harvard Research Data Security Policy (HRDSP)
• Harvard University General Records Schedule
• FAS RC Offboarding Policies and Procedures
• Longwood Research Data Management: Offboarding

The transition consolidates and modernizes a significant portion of existing storage filesystems by migrating research data to new and improved hardware. 

Benefits: 

• Enhanced support for computationally heavy workflows including AI and Machine Learning  
• Improved researcher experience with greater visualizations and storage tracking capabilities including data lifecycle management  
• Streamlined and consolidated storage environments reducing the need for migrations and complex data workflows 
• More resilient and reliable hardware decreasing the potential for security risks and vulnerabilities
• Built-in storage backups and encryption to prevent data loss 
• Greater technological efficiency, reducing operational costs while allowing for long-term growth and scalability

Improvements:

• Scalable, cost-effective storage designed to support researcher demands and lifecycle trends
• Improved service quality with resilient infrastructure, providing reliable enterprise-grade support for a better user experience
• Reduced manual overhead on data migration efforts, reallocating staff resources to strategic initiatives
• Provides a predictable long-term cost recovery model with transparent pricing
• Supports future initiatives including AI/ML workflows, secure multi-protocol access, and ever evolving scientific workflows

Identification of an appropriate storage location for your research data is a critical step in the research data lifecycle, as it ensures research data remains usable. We recommend you review the available storage options and select the preferred storage offering for your group’s intended workflow, keeping in mind how often the data will be consistently utilized and accessed. The offerings below are designed to store research data, rather than administrative data.

Each FASRC account is provided with a 100GiB Home Directory for individual use. Each PI or Lab Account also receives a 4TiB Lab Directory, for use by all members of the PI’s lab group and a 50TiB allotment of scratch (networked scratch). See the matrix below for more details.

*Snapshots are copies of a directory taken at a specific moment in time. They offer labs a self-service recovery option for overwritten or deleted files within the specific time period. Disaster recovery is a copy of an entire file system that can be used internally by FASRC in case of system-wide failure.

Storage Offerings (Paid)

Requesting Storage

To request a new storage allocation, or to modify an existing storage allocation, please login to the Coldfront Storage Allocation tool. To login to Coldfront, please use your FASRC username and password. If you have difficulties with your password, you can reset it. You may also need to clear the cache on your website browser. If requesting a new storage allocation, you will need to indicate which storage offering you would like to acquire and the associated 33-digit billing code. If you do not have a FASRC Account, you will need to request one before logging into Coldfront.

PIs, General Managers, and Storage Managers are able to request new allocations, or make changes to existing allocations. PIs can email rchelp@rc.fas.harvard.edu if they would like to assign a General Manager or Storage Manager role to their lab, as this will allow the lab member to add and/or modify storage allocations.

NOTE: All new Lab Storage allocation requests can now be fulfilled. All new FASSE Storage allocation requests will be fulfilled beginning in late June. Compute Storage Allocation requests will continue to be stored on Tier 0 until the Compute Storage environment is available later this Summer. For more information about the timeline of the Storage Modernization Initiative, please visit the Data Storage website.

** Long-term Storage is a new offering for FAS RC. As such, we are still investigating additional features including the option to offer Disaster Recovery for a cost and increase the security level to Level 3. Further information will be provided to the community regarding disaster recovery cost and higher security levels later this year.

Storage Offerings (Complimentary*)

*Harvard-sponsored

Data Storage Workflow

Default Directory Structure

Two subdirectories will be present by default within the parent directory to enable easier Globus transfers and provide some initial guidance for how to organize storage.

Lab: This directory is intended as the primary working directory. It is also the directory shared out via Globus. By default, folders in this subdirectory are visible to the whole lab. Individual users may update their permissions to adjust access as they like though we highly recommend keeping access open to all lab members to allow for easier collaboration and data cleanup after you leave the university.

Everyone: This directory is visible to any one on the HPC cluster and is intended for collaboration with other labs on the cluster. Data in this directory is by default owned by the lab who hosts the data. Note that this directory is not available on Globus and is intended only for internal sharing.

While this is the default structure, labs may request additional folders be set up. Please email rchelp@rc.fas.harvard.edu if you have questions.

Directory structures on the cluster may differ depending on when they were created. Some older storage folders may have a third subdirectory called Users. We have deprecated use of this folder due to issues related to data access by the lab and PI’s, especially after users have left the university. If you are migrating data from a storage system that has a Users subdirectory we recommend moving that data into the Lab directory and making it available to the lab to view and access.

Contact:

If you have questions regarding the data storage options at FASRC, please email the Research Data Manager at rdm@rc.fas.harvard.edu.

Onboarding Checklist: Faculty

• Familiarize yourself with FAS Research Computing Services
• Review Harvard policies and procedures
  • Research Data Ownership Policy
  • Harvard Research Data Security Policy (HRDSP)
  • Harvard University General Records Schedule
  • Harvard Data Security Levels
  • Retention and Maintenance of Research Records and Data Frequently Asked Questions (“FAQs”)
  • Harvard Data Safety Website
  • PI Responsibilities on the Cluster
    • Identify a data manager for the lab 
  • FASRC Data Ownership and Access Policy
• Get a FASRC account using the account request tool
  • Set your FASRC password
  • Set up OpenAuth for two-factor authentication (2FA)
  • Set up FASRC VPN
  • Link FASRC account to HarvardKey 
    • If you have a HarvardKey, but are denied access to approve new accounts, visit and complete the FAS Onboard tool for approvers. 
  • Faculty can sponsor FASRC accounts for any researcher working in their lab, including external collaborators. If a collaborator does not have a Harvardkey account, they may apply for an external FASRC account. External accounts need to be reenabled every 90 days. PIs will need to request an extension every 90 days to prevent the account from being suspended. 
• Learn how to utilize the High Performance Compute cluster 
  • User Quick Start Guide
  • Review Running Jobs
  • Review Cluster Customs and Responsibilities
  • Command line access with Terminal (login nodes)
  • Understand Fairshare on the cluster
• Review FASRC storage offerings 
  • Request a new storage allocation in Coldfront
    • Coldfront is a resource allocation management system FASRC adapted to manage allocations on the FASRC cluster. The platform enables the viewing and management of lab groups (Projects), and storage and cluster allocations (Allocations).
    • FAS Secure Environment
• Connect to your new storage folder from a desktop computer
• Transfer data to your new storage folder
• Create a well-defined storage workflow 
  • Develop streamlined directory structures
  • Establish consistent file naming conventions
• View information about storage folders associated with your group/lab
  • Utilize the Starfish Zones tool to view key information about your group’s storage folders. The Starfish Zone User Interface is a self-service visual tool that enables users to view group storage amounts and locations. Users can navigate folder structures to access detailed information about files and storage. Labs and groups are strongly recommended to utilize this tool to assist with their data organization and cleanup efforts.
• Installing and using software on FASRC cluster
• Attend FASRC introductory trainings 
  • Training calendar 
• Contact 
  • Email rchelp@fas.harvard.edu if you have any questions
  • Virtual Office Hours: Wednesdays 12-3PM 

Onboarding Checklist: Researchers

• Familiarize yourself with FAS Research Computing Services
• Review Harvard policies and procedures
  • Research Data Ownership Policy
  • Harvard Research Data Security Policy (HRDSP)
  • Harvard University General Records Schedule
  • Harvard Data Security Levels
  • Retention and Maintenance of Research Records and Data Frequently Asked Questions (“FAQs”)
  • Harvard Data Safety Website
• Get a FASRC account using the account request tool
  • Set your FASRC password
  • Set up OpenAuth for two-factor authentication (2FA)
  • Set up FASRC VPN
• Learn how to utilize the High Performance Compute cluster 
  • Introduction to Cluster Computing Docs and Video
  • Review Cluster Customs and Responsibilities
  • Command line access with Terminal (login nodes)
  • Understand Fairshare on the cluster
• Review FASRC storage offerings 
  • FAS Secure Environment
• Connect to your new storage folder from a desktop computer
• Transfer data to your new storage folder
• View information about storage folders associated with your group/lab
  • Utilize the Starfish Zones tool to view key information about your groups storage folders. The Starfish Zone User Interface is a self-service visual tool that enables users to view group storage amounts and locations. Users can navigate folder structures to access detailed information about files and storage. Labs and groups are strongly recommended to utilize this tool to assist with their data organization and cleanup efforts.
• Attend FASRC introductory trainings 
  • Training calendar 
• Contact 
  • Email rchelp@fas.harvard.edu if you have any questions 
  • Virtual Office Hours: Wednesdays 12-3PM

If you require a VM for web hosting or other needs or for hosting or sharing data sets, please see the following options.

Harvard-based options:

• Harvard Dataverse: hosting for data sets https://dataverse.harvard.edu
• Harvard Web Publishing group: Web publishing and consulting https://hwp.harvard.edu
• Research Support options https://researchsupport.harvard.edu/dissemination-preservation
• More data sharing and publishing options https://researchsupport.harvard.edu/data-sharing-and-publishing
• Digital Scholarship Support Group: Web consulting services https://dssg.fas.harvard.edu/initiatives/research
• HUIT’s Cloud services: Help with using AWS and other cloud resources https://cloud.huit.harvard.edu/services

Self-service, pay as you go, managed by you:

• Amazon Web Services (AWS): https://aws.amazon.com
• Google Cloud Platform (GCP): https://cloud.google.com
• Digital Ocean: https://www.digitalocean.com
• NERC: Self-service VM provisioning and other services https://nerc.mghpcc.org (this service is no longer run by Harvard)

Please note that PIs and other data owners are responsible for following Harvard Information Security Policy and all other applicable Harvard policies and requirements. This includes knowing your data and following  the requirements for Data Security Level for servers and Research Data Management Security and Ownership Policies

Offboarding Checklist: Leaving Harvard University

Researchers:

1. General: 

   1. Inform FASRC via email prior to leaving the university, and provide us with an estimated departure date. 

2. Storage: 

   1. Please review all research data prior to your departure (FAS Storage, Google Drive, Dropbox etc.). Confirm with your PI and department what data can be deleted or moved to long-term storage. 
      1. Review and receive approval from your PI what data can be removed. 
         1. Delete any data approved by your PI. 
         2. Please ensure a record of what data was deleted is available to your PI, if needed.
         3. For protected data (Level 3), PIs are responsible for informing FAS RC if and when the data requires disposal. Please email FAS RC to discuss destruction options.
      2. If research data stored on FASRC storage is ready to be moved to long-term storage, work with FASRC’s Research Data Manager and your PI to migrate the data. 
         1. An FASRC account is required to access FASRC storage; please ensure you have an account prior to moving data via rclone or Globus. 
      3. Ensure your research data is available to your PI and other collaborators, moving all research data to a shared storage location prior to your departure. Please ensure a record of what data was migrated is available to your PI, if needed.
      4. If you would like to take data with you following your departure from the university, you will need approval from your PI and department. Research data generated at the university is owned and maintained by the university. 

3. Accounts 

   1. We will be closing your FASRC account when your appointment ends and your Harvard email account is closed. 
   2. If you need to maintain a FASRC account, please have your PI or authorized lab member (general manager or access manager) email us directly, prior to your departure, so we can convert the account to an external account. We will also need an external email address for the account, as your Harvard email will be disabled automatically. 
   3. Disabling the account will automatically remove you from associated groups, including secure groups (FASSE), administrative groups, and project groups. 

Faculty/PIs:

1. General: 

   1. Inform FASRC via email when you will be leaving the university. 
   2. Please inform FASRC if you will be returning or compensating FASRC for any physical resources (compute notes and storage servers).  
   3. Please ensure you review the FAS Employee Exit Checklist; the document highlights other offboarding responsibilities for faculty leaving Harvard.

2. Software: 

   1. All purchased software will remain on the cluster. Please delegate the software license responsibility to another entity (lab or department) or inform FASRC when the license will expire. 

3. Storage: 

   1. Please review all research data prior to your departure. Confirm what data can be deleted or moved to long-term storage.
      1. Please review Harvard’s Data Retention FAQs, to ensure you are in compliance with the university’s policy around data retention.
      2. Collaborate with FASRC’s Research Data Manager to migrate remaining data to long-term storage. 
   2. If you would like to take research data with you following your departure from the university, ownership of the original data may be transferred from Harvard to your new institution upon request. The University asserts ownership over research data for all projects conducted at the University, under the auspices of the University, or with University resources.
      1. Requirements:
         1. Prior written approval from the Vice Provost for Research;
         2. A written agreement from your new institution that guarantees its acceptance of ongoing custodial responsibilities for the data and allowing Harvard access to the original data, should such access become necessary for any reason;
         3. Relevant confidentiality restrictions, where appropriate.

4. Accounts 

   1. Inform FASRC via email when you will be leaving the university so they can disable your account. Your FASRC account will be closed when your appointment ends and your Harvard email account is closed. If you attain a different appointment at Harvard after your primary appointment ends, please notify FASRC as soon as possible.
   2. All lab members will need a new sponsor for their accounts. Please inform FASRC who the new sponsor will be for any remaining lab members. 
   3. Disabling your account will automatically remove you from associated groups, including secure groups (FASSE),  administrative groups, and project groups. 

5. Virtual Machines 

   1. Remove any data you would like to retain from virtual machines prior to your departure; please inform FASRC once the data has been removed 
   2. Virtual Machines will be decommissioned shortly after your departure, once it is no longer aligned with an active account.

Offboarding Checklist: Changing Labs/Groups

Researchers:

1. Request to be added to the new group using Portal. Your PI can also utilize Coldfront to add users to their group. 
2. Review your research data to determine what data will need to remain in your previous lab folder(s) and what data needs to be migrated to your new lab folder. 
   1. Discuss the data migration with your former PI and get approval for the move.
   2. If you plan to continue to store research data in your previous lab folder, confirm this with your former PI, as there will be associated storage costs. 
   3. Delete any research data that will not be useful to either lab. Confirm with your former PI what data can be removed.
   4. Ensure your research data is available to your former PI and other collaborators, moving your research data to a shared storage location prior to your departure. Please ensure a record of what data was migrated is available, if needed.
   5. Review data in your group’s Scratch environment, as the data will be removed.
3. Your new PI must inform FASRC via email that they will be sponsoring your account, so they can be assigned as your primary group. Provide the date of transition. 
4. FASRC will then modify your FASRC account information.
   1. Add you to the new lab group/department
   2. Add your new PI as your manager
   3. Modify your Slurm group to be associated with the new lab
   4. Remove you from your previous lab and Slurm group. 
      1. If you require access to your previous lab, your former PI can re-add you to their group using the Coldfront application. 
5. Storage
   1. Home directory data will always remain with the user account. The data will not need to be transferred. 

Additional information:

1. Harvard Human Resources Offboarding Information 
2. Harvard IT Offboarding Information 

Contact:

If you have questions regarding the offboarding process, please email the FAS Research Data Manager at rdm@rc.fas.harvard.edu.

Examples of data that can be stored on FASRC storage are:

• Datasets
• Code
• Scientific software
• Research results

Examples of data that should not be stored on FASRC storage include:

• Clerical or lab administrative data
• Data related to personnel, grant proposals, business operations, or general lab management
• Data with personally identifiable or financial information 

FASRC storage filesystems are only approved for Data Security Level 1 (DSL1) and  DSL2 research data on the Cannon cluster. DSL3 data must be stored in the approved FASSE cluster project. Research data containing information classified as DSL 4 must be stored on an appropriate storage solution that is approved for DSL4 sensitive data.*

*A limited number of DSL4 projects exist in their own isolated environments

If it comes to the attention of the FASRC Staff that non research related data is being stored on the FASRC systems, we will alert the lab’s PI.

To view alternative storage options for administrative data, please refer to the FASRC website.  Additional information is also provided on the Harvard Security website regarding Data Security levels.

To preface this:  You are responsible for knowing, and complying with applicable Harvard Information Security Policy (controls that apply to DSL3 and lower), Harvard Research Data Security Policy, and any applicable contracts / data use agreements.

FASSE data transfers generally work the same as transfers for other environments.  For example:

• When connected to the FASSE VPN realm, you can copy files to and from the FASSE cluster, assuming this meets policy/DUA compliance requirements.
• While on FASSE nodes (compute, login, etc.) and the FASSE VPN, you have full access to the Internet through a proxy.
  • Generally, this means that you can push to or pull from any HTTPS, SFTP, or other service that supports a proxy.
  • For example, this means you should be able to pull data from data providers that provide an HTTPS, SFTP, or other service.  You may need to adjust certain configurations and workflows to use the proxy – Some details on this here

With that said, given that FASSE is rated for data security level (DSL) 3 data:

• Do not store DSL 3 / FASSE data in your home directory.
• If you have a DUA that requires encryption at rest, you must not use scratch for any data that the DUA applies to.  Neither local scratch, nor our global scratch, support encryption at rest.
• FASSE VPN, login, compute, and VDI environments use a proxy.  Some transfer solutions do not work through a proxy.  If you run into this:
  • Please ensure you have tried to use a proxy, and if you still run into trouble,
  • Open a ticket with rchelp@rc.fas.harvard.edu indicating
    • What you have tried
    • What you expected to happen
    • What actually happened
    • Include specific commands, where these ran, and output messages including all errors.
• Data security level 3 / FASSE storage is intentionally not included in Globus by default.  If you would like your FASSE project to be exposed through Globus, consider the following:
  • If any data in this project is governed by a contract / data use agreement (DUA), please review the DUA to ensure Globus is compliant.  You might consult your School Security Officer for this.
    • An example scenario where Globus would not be compliant:  DUAs indicating that a VPN or private network must be used for all access to the data.  Globus makes data available over the Internet without a VPN or private network
  • Please submit a ticket to rchelp@rc.fas.harvard.edu as follows:
    • This must include the path to the project to add to Globus (e.g. “/n/piname_project_l3”)
    • This must indicate that the PI attests to Globus being compliant with any contracts/DUAs governing the data in this project storage
    • This must be from, or receive a reply directly from the PI for this project confirming this information
• For Storage, FASSE storage is intentionally not provided SMB shares by default.  If you need your FASSE project exposed through an SMB share, consider the following:
  • Please submit a ticket to rchelp@rc.fas.harvard.edu as follows:
    • This must include the path to the project (e.g. “/n/piname_project_l3”)
    • This must indicate that the PI attests to understanding and accepting the risks of enabling SMB access to this data, given that any system or network that can talk to this tiered storage, could access this data if the credentials from an account in the project were used.  Some example scenarios:
      • Someone with access to your storage accesses it / copies data down to an unmanaged lab computer without data security level controls
      • Someone with access to your storage accidentally clicks the wrong link on a computer with access to this storage. Their computer is compromised, malware identifies SMB access to your data, and compromises the confidentiality, integrity, and/or availability of your data – maybe ransomware, stealing the data, etc.
    • This must include a brief explanation of why SMB access is needed, and from where you will use this SMB access
    • This must be from, or receive a reply directly from the PI for this project confirming this information

If you have any questions or concerns, please do not hesitate to consult us at at security@rc.fas.harvard.edu, although in some cases we may end up pulling in or pointing you to your school privsec officer.

PIs have a variety of responsibilities at Harvard University.  This document will cover the responsibilities specific to FAS Research Computing, especially around information security and risk.

PIs are individuals given continuous or limited PI rights by the university and whom control their own funding in a school that FAS RC supports. Co-Investigators are not considered PIs.

Responsibilities

• PIs are responsible for following all applicable Harvard University policies, including but not limited to Harvard Research Data Security Policy and Harvard Information Security Policy, as well as any requirements in data use agreements (DUAs) or contracts that impact them.
  • PIs are responsible for ensuring all accounts they sponsor follow all applicable Harvard University policies, including but not limited to Harvard Research Data Security Policy and Harvard Information Security Policy, as well as any requirements in data use agreements or contracts that impact them.
• PIs are responsible for creating and maintaining accurate data documentation in the Harvard Compliance System, as required by University policies, and complying with approved data security and management plans.  Guidance on which applications are needed for your data.
• PIs are responsible for submitting FASSE project requests for any data security level (DSL) 3 data they plan to use at FAS RC and keeping associated data in the specific FASSE storage provided for these projects.
• PIs are responsible for informing FAS RC of any changes to Research Administration applications (e.g. DAT12-1234, DUA12-1234, IRB12-1234) governing data they plan to use for their FASSE projects, before moving new data to FAS RC storage for these projects.  This includes informing FASRC before adding data from a new application (e.g. DUA12-1234) to an existing FASSE project.
• PIs are responsible for ensuring that any access they approve complies with all applicable Harvard University policies and DUA or compliance regimes.  For example, among many other scenarios:
  • If a DUA requires informing or obtaining approval from the data provider before providing access to the data, the PI must ensure this is done before they approve the associated FAS RC access
  • If a DUA states that only Harvard staff may have access to the data, the PI is responsible for ensuring they never approve access to non-Harvard members to that data (e.g. external collaborators)
• PIs are responsible for informing FAS RC when an account they have sponsored should be disabled (i.e. if they sponsor the account and the person has left or should otherwise be disabled)
• PIs are responsible for informing FAS RC when any accounts should be removed from groups they manage
• PIs are responsible for informing FAS RC if and when data needs secure disposal/sanitization, either as required by Harvard University policy or a DUA

Upcoming Responsibilities

• Coming soon: PIs are responsible for reviewing accounts they sponsor on an annual basis [1]
• Coming soon: PIs are responsible for reviewing access to groups they manage on an annual basis [1]