Requirements for NIH Controlled-Access Data Repositories and Users

Required Security and Operational Standards for NIH Controlled-Access Data and Repositories

The NIH is committed to ensuring that NIH controlled-access data are appropriately safeguarded. To achieve this, NIH issued “Required Security and Operational Standards for NIH Controlled-Access Data Repositories,” NOT-OD-25-159, to establish detailed security and operational standards for repositories and access management systems that meet the following criteria:

• Are part of the Intramural Research Program or are supported by an NIH cooperative agreement, intramural funding, contract, Other Transaction, or grant;
• Provide long-term storage for, or provide access to, data for research purposes;
• Control access to data by prospective review of data access requests or partner with access systems that control access via prospective review of requests; and
• Use federal employees to conduct reviews and authorize access, or partner with access systems that use federal employees for those purposes.

Repositories and access management systems meeting these criteria are considered NIH Controlled-Access Data Repositories (CADRs) and are listed below. A detailed explanation of the requirements, instructions for meeting them, and responsible parties is provided in the National Institutes of Health (NIH) Controlled-Access Data Repository Guidebook to Adhere to “Required Security and Operational Standards for NIH Controlled-Access Data Repositories” (NIH CADR Guidebook), available here.

NIH Controlled-access Data Repositories (CADRs)

NIH Security Best Practices for Users of Controlled-Access Data and Repositories

As of January 25, 2025, investigators and their institution or corporation, who access data from NIH Controlled-Access Data Repositories (CADRs) sharing studies subject to the NIH Genomic Data Sharing Policy (listed above) are expected to secure data according to the security standards outlined in the NIH Security Best Practices for Users of Controlled-Access Data.

Effective February 25, 2026, investigators, and their institution or corporation, who access data from an NIH CADR (listed above) will be expected to adhere to the security standards outlined in the NIH Security Best Practices for Users of Controlled-Access Data, as stipulated in new or renewed agreements. Users approved prior to February 25, 2026, should secure data according to the security standards outlined in the agreement until project close-out or renewal. For additional information, see these FAQs.

NIH CADRs, as denoted in the list above, are to secure data according to the NIH Security Best Practices for Controlled-Access Data Repositories.

For additional information, please see NOT-OD-25-159 and the NIH CADR Guidebook found here.