J-8a-MCC_Restricted_Use_Data_Form.docx

[This template has been developed in consultation with OMB’s Office of Information and Regulatory Affairs. Consult with MCC’s Office of General Counsel before making any modifications to the template’s text. (Revised 12/9/2014)]

Restricted Access Data Certification

The Millennium Challenge Corporation (MCC) is committed to providing public access to high-value data collected as part of the development, implementation, and evaluation of MCC-funded assistance programs, while being equally committed to protecting the confidentiality of individuals and organizations from which the data are collected. To achieve these twin aims, MCC publishes anonymized public use files of microdata on its website through the MCC Evaluation Catalog.

In addition, MCC may make restricted-access data files available when the anonymization efforts for public use files require data perturbation that may limit replicability of evaluation results and/or usability of data for specific analytical purposes. Access to restricted data is only provided to users that have certified their agreement with certain terms of access.

Accordingly, the undersigned, on behalf of [Name of Requesting Organization] (Requesting Organization), and in consideration of MCC providing access to [List Data Sets to Be Provided] (the Restricted Data), hereby certifies and agrees that:

1. The undersigned is an authorized representative of the Requesting Organization and has the power and authority to sign and deliver this Certification on behalf of the Requesting Organization and to legally bind the Requesting Organization.

2. The undersigned is and will be the point of contact for all communications relating to the Restricted Data and its use during the term of access granted to the Requesting Organization.

3. The Requesting Organization will maintain control over the Restricted Data and will not grant access to the Restricted Data in any form to any entity or individual other than certain select employees of the Requesting Organization who will be specifically identified and monitored by the Requesting Organization. If any employee that has been granted access to the Restricted Data leaves the employ of the Requesting Organization, the Requesting Organization will immediately terminate such employee’s access to the Restricted Data.

4. The Restricted Data will be used solely for statistical analysis and reporting of aggregated information, and not for investigation of specific individuals or organizations.

5. No attempt will be made to re-identify any individual or organization.

6. If the identities of any individuals or organizations are discovered inadvertently through use of the Restricted Data, the Requesting Organization will not make any use of these identities and will inform MCC.

7. No attempt will be made to produce links among datasets that could identify individuals or organizations.

8. The Requesting Organization will implement the following security measures with respect to all Restricted Data to prevent unauthorized access to the Restricted Data:

a. Data at rest.

i. Any Restricted Data resting on a mobile or removable media device (e.g. laptops, universal serial bus (USB) flash drives, compact discs (CD), CD ROMS or removable hard drives) must be encrypted.

ii. The encryption standard used for any Restricted Data must be Advance Encryption Standard (AES) 256-bit encryption, and encryption for hard drives and USB flash drives must utilize full-disc encryption.

iii. User authentication must be required for access to data on encrypted hard drives.

b. Data in transport.

i. All Restricted Data that is moved or transmitted outside of encrypted zones must include a transmission path that is encrypted at an Advance Encryption Standard (AES) 256-bit, or over secure socket layer (SSL)/transport layer security (TLS) module standard.

c. Authentication.

i. A form of user identification (UserID) and password, biometric, or two-factor authentication method must be used to authenticate to each media device, session, and account. For example, stationary computer systems (workstations) and laptops will require, at a minimum, a UserID and password for operating system authentication.

ii. The information system must not display the password when typing.

iii. The information system must lock the user session after five unsuccessful log-in attempts for at least 15 minutes.

iv. The information system must not transmit passwords in clear text, or without the use of encryption.

v. The information system must terminate inactive user sessions after 30 minutes of inactivity.

vi. The information system must lock a computer screen after 15 minutes of user inactivity.

vii. A form of identification, or challenge and reply must be required to retrieve forgotten passwords.

viii. Passwords must be a minimum of eight characters long and be complex. Passwords must be forced to utilize upper case characters, lower case characters, at least one special character, and at least one number.

ix. Passwords must not be names, words, or dictionary words of any language. Passwords must be random characters.

x. Temporary passwords must be changed on the first use.

d. User responsibilities. Employees of the Requesting Organization granted access to the Restricted Data must:

i. Keep their passwords safe and secure and not share their passwords with anyone.

ii. Avoid keeping a record of their passwords, and not write down their password.

iii. Change their passwords if they suspect possible compromise.

iv. Report lost or stolen equipment, passwords or data to their respective administrators.

It is recommended to utilize a password management system that uses AES-256 bit level encryption.

9. Any books, articles, conference papers, theses, dissertations, reports, or other publications that employ the Restricted Data will cite the source of data in accordance with the Citation Requirement provided by MCC with the Restricted Data.

10. Any books, articles, conference papers, theses, dissertations, reports, or other publications that employ the Restricted Data will be produced in a way that respects respondents’ confidentiality.

11. The Requesting Organization acquires only the right to use the Restricted Data by virtue of this Certification, and does not acquire any ownership rights or title in, or to, the Restricted Data. If the Requesting Organization receives any request for the Restricted Data under the federal Freedom of Information Act, 5 U.S.C. 552 or a comparable law or regulation, or in connection with any other legal process, the Requesting Organization will immediately notify MCC, and will not disclose the Restricted Data.

12. This Certification is effective as of the date MCC grants approval of access to the Restricted Data, and remains in force for a period of 24 months. If access to this data is required past 24 months, the Requesting Organization must submit a request for renewal for an additional 24 months at least one month in advance of expiration.

13. The Requesting Organization will destroy any copies[footnoteRef:1] of the Restricted Data upon expiration of the term of this Certification, and the Requesting Organization will confirm such destruction in writing to MCC. [1: The Restricted Data will only be provided in electronic form.]

14. If MCC determines that any of the terms or conditions of this Certification have been violated, MCC may, without limiting any other available remedies, take any of the following actions:

a. Terminate this Certification and deny the Requesting Organization and its employees future access to Restricted Data.

b. Report the violation to the Requesting Organization’s institutional review board or other office responsible for scientific integrity and misconduct; or

c. Seek such other remedies as may be available to MCC under law or in equity, including injunctive relief.

The undersigned hereby signs this Restricted Access Data Certification as of the date noted below.

Signature:

image1.png