Governance and Security
CUIMC takes cloud governance seriously. Cloud services are deployed within a framework of security, compliance, and operational oversight designed to support research while protecting institutional and regulated data. Our approach emphasizes secure defaults, risk-based review, and clear governance processes to ensure cloud adoption aligns with university policies, HIPAA requirements, and research objectives.
Key governance guardrails include:
- Centrally managed cloud environments aligned with institutional security and compliance standards.
- Standardized architectures and pre-configured security controls to accelerate adoption while reducing risk.
- Risk-based review processes for cloud, AI, and data-intensive research projects.
- Data classification and handling requirements that guide where sensitive data may be stored, processed, and shared.
- HIPAA-aligned controls and oversight for regulated research environments where applicable.
- Security, privacy, compliance, and architecture reviews involving Research IT, Information Security, Privacy, and other institutional stakeholders.
- Preference for institutionally managed platforms, storage services, and approved collaboration tools over unmanaged external services.
- Continuous governance through formal review processes, policy oversight, and emerging technology assessment.
- Cost management, monitoring, billing transparency, and operational controls designed to promote responsible use of cloud resources.
- Secure-by-default onboarding pathways and reference architectures that allow researchers to focus on science rather than infrastructure complexity.