Computing & Data Services

POLICY STATEMENT

The CCSS Research Support Resources Terms of Use policy outlines the expectations for the use of CCSS resources, including but not limited to CCSS Research Support computing resources (servers, software applications, file storage, secure access rooms, etc.), computing accounts (Research, Class and all levels of restricted access accounts), and the CISER Data & Reproduction Archive.

The appropriate use and protection of all systems and associated resources is expected from all clients including faculty, students, employees, and visitors throughout the institution. In addition, each CCSS Research Support service has distinctive policies specific to usage obligations.

A majority of the CCSS Research Support services do not require any form of registration, allowing you to visit our web site and Data Archive without telling us who you are. However, some services may require you to provide us with Personal Data. In these situations, if you choose to withhold any Personal Data requested by us, it may not be possible for you to gain access to certain services and for us to respond to your query. 

Computing Resources and Computing Accounts:

CCSS Research Support computing resources (servers, software applications, file storage, etc.) and computing accounts (Research, Class and all levels of restricted access accounts), are provided for research and academic needs only. Research and academic usage includes use associated with Cornell-approved research, class work for which a student is currently enrolled, and staff work associated with supporting the mission of Cornell University. These resources may not be used for any personal purposes, including but not limited to storage or backup of personal files (e.g. audio, images, photos, video files, etc.), personal email, use of social media, private consulting or business -related activities, watching streaming video or other personal activities.

Computing Resources-Related Terms:

1. The statistical software installed on the CCSS Research Support servers may not be used for private consulting or for non-academic research. Users may not distribute licensed software from our environment to themselves or to any other persons.

2. CCSS Research Support servers are a limited, shared resource available to multiple clients at any time. Each client is expected to maintain an acceptable level of performance and must assure that excessive or inappropriate use of the resources does not degrade performance for others.

3. CCSS provides multiple levels of secure computing environments. It is the client’s responsibility to select the appropriate level of technical security required to be in compliance with the terms and conditions, as well as laws and regulations, for the type of data to be used.

Computing Accounts-Related Terms:

1. CCSS Research Support computing accounts and passwords may not be shared with any other person. Sharing passwords and/or account information violates these Terms of Use, as well as Cornell’s Authentication to Information Technology Resources Policy 5.8.

2. It is the responsibility of every CCSS Research Support computing account holder to keep CCSS apprised of any changes to the information provided in your account application, including change in affiliated faculty member/supervisor, academic status, and your contact information.

3. CCSS collects personally identifiable information about you, such as your full name, phone number and email address when you register for an account. Personal Data is securely stored for the purposes of providing support services, analyzing computing usage statistics and maintenance communications.

4. CCSS clientele are responsible for complying with all applicable federal, state and local laws and must abide by Cornell University policies. Any misuse of computing resources, proprietary software, or data violates Cornell's Campus Code of Conduct and the Authentication to Information Technology Resources Policy 5.8.

5. CCSS reserves the right to disable a computing account immediately upon identification of possible misuse of any CCSS services, or non-compliance with CCSS or Cornell University policies. Account termination will occur if misuse is confirmed through appropriate channels, and no reinstatement will be allowed.

6. If requested within 60-days after account expiration, files left on the CCSS file storage may be made available to the affiliated faculty/staff advisor, or account holder, based on compliance with these Terms of Use. On day 61, the account will be closed, and all data files will be deleted. CCSS will not maintain a backup of any user data.

7. By applying for an account and using CCSS Research Support computing resources, you agree to the CCSS Research Support Resources Terms of Use as set out above.

CISER Data Archive:

1. Users are required to adhere to the CCSS Data & Reproduction Archive Acceptable Use Policy (review in tab below)  and any and all licensing requirements as stipulated by the providers of datasets held in the archive.

2. CISER Data & Reproduction Archive non-public use files which require Cornell University authentication may not be distributed to anyone other than current faculty, staff, and students, or used for private consulting or for non-academic research.

As determined by university administration, any employee found to have violated this CCSS Research Support Resources Terms of Use Policy may be subject to disciplinary action, up to and including termination of employment.

Contact

If you have questions about specific issues regarding this CCSS Resources Terms of Use Policy, contact CCSS by email at socialsciences@cornell.edu or by telephone (607)255-1986.

Cornell Center for Social Sciences (CCSS) is committed to protecting your privacy.

The following privacy notice describes what information we collect from you when you visit our website and affiliated web applications and how we use this information. Please read this privacy notice carefully so that you understand our privacy practices.

Effective Date of Privacy Notice

The privacy notice was introduced on November 27, 2018.

What information we gather during your visit

Information we gather:

We automatically collect certain information from you when you visit our websites. This data is used in conjunction with Google Analytics to gather metrics on site usage including geographic location of visitors, pathways navigated through the website, and which portion of our audience is internal to the Cornell network. The information we collect is not linked to anything that identifies you as an individual. Your session will be tracked but you will remain anonymous as a user. As part of Google Analytics, we also gather device and browser-related information.

Information you may provide:

As part of accessing our services, we collect information as described in this notice or other specific university privacy notices. In order to take advantage of our services, certain tools, such as CCSS Research Support computing account request form, and CCSS Research Support computing account password reset tool may request additional contact information and/or online identifiers (ex. name, email, Cornell netid, telephone number, affiliated faculty member, course number.)

How we use your information

We use gathered information to track user trends and site usage with the goal of improving our visitors’ experience and optimizing our websites. We also use the information to administer this website and prevent abuse.

Special cases - computing accounts:

If you use the CCSS Research Support computing account request form, the information that is gathered will be used to send you email regarding CCSS Research Support systems, notifying your faculty member of your account request, and notifying your college of your CCSS Research Support systems usage.

If you use the CCSS Research Support computing account password reset tool, the information that is gathered will be used to send you email providing you with a verification code. The email correlates to the one sent when submitting your computing account request form.

With whom we share your information

Information we gather may be shared with campus constituents to improve programs, outreach, and other campus initiative. However, we will not sell this data to third-parties for their use in direct marketing, advertising, or for the promotion of their products and services.

Cookies and other collection technologies

Cookies

Cookies are text files stored on your computer and accessible only to the websites which create them. Our websites may use cookies to keep you logged into secure areas of the website and/or to keep track of your preferences as you interact with certain services. You may disable cookies in your browser, however, our websites may not work properly if you do so.

Log Files

Our websites automatically gather anonymous information about our visitors including IP addresses, browser types, and the times and dates of webpage visits. The information collected does not include any personally identifiable details and is used to improve our services and administer our websites.

Protecting your information

No method of transmitting over the internet or storing electronic data is 100% secure, but this site has measures in place to help protect against the loss, misuse, or alteration of the information that is under our control.

Email Marketing

If at any time you would like to opt-out of receiving email from CCSS Research Support, please write to socialsciences@cornell.edu.

Social Media Presence

If you share our content through social media, such as liking us on Facebook or tweeting about us on Twitter, those social networks will record that you have done so and may set a cookie for this purpose. If you wish to opt-out of any of these social interactions please refer to the specific social media platform for instructions on how to do so.

Special Notice for EU Residents

If you are located within the European Economic Area (European Union, Norway, Liechtenstein, and Iceland), we acknowledge the rights granted to you under the General Data Protection Regulation (GDPR).

These rights may include:

1. Right to access your information held by us.

2. Right to correct inaccurate or incorrect information about you.

3. Right to the erasure of your information when it is no longer necessary for us to retain it.

4. Right to restrict processing of your personal information in specific situations.

5. Right to object to processing your information, including sending you communications that may be considered direct-marketing materials.

6. Right to object to automated decision-making and profiling, where applicable.

7. Right to complain to a supervisory authority in your jurisdiction within the EU.

Please contact us with any questions, concerns, or if you wish to exercise any of these rights: itservicedesk@cornell.edu.

Contact Information

If you have questions about our privacy notice or the privacy practices it describes, please contact: socialsciences@cornell.edu.

CCSS Research Support receives support from the Office of the Vice Provost for Research and Member Colleges. Acknowledgment of the CCSS Research Support services (or individual staff) in posters, publications, presentations and interviews helps to demonstrate the usefulness and effectiveness of the resources provided and can help strengthen institutional support. You can help us in this effort by acknowledging CCSS Research Support’s contribution to your research, such as use of data from the CCSS Data & Reproduction Archive, use of the CCSS Research Support or CRADC computing systems, and/or assistance from CCSS Research Support staff.

1. Add a citation acknowledging CCSS Research Support in your work

   Please acknowledge us in all posters, publications, and presentations of the work that utilized CCSS Research Support resources by using the following text:

   “This research was conducted with support and resources provided by the Cornell Center for Social Sciences (CCSS) at Cornell University.”

2. Notify us about your work which used CCSS Research Support resources

   Please send us information about your posters, publications, presentations and interviews to socialsciences@cornell.edu, so that we can reciprocate by linking to the data source to expand your research network.

3. Cite use of Data Archive Download Centers

   If you have used any of these CCSS Data & Reproduction Archive Download Centers, please also use this form to submit a citation:

   • Census 2010 SF1 – download center
   • Census 2010 SF2 – download center
   • Census 2010 Demographic and Housing Demonstration Files – download center
   • American Community Survey 2015 – download center

Additional references on research citations:

• https://data.research.cornell.edu/content/data-citation
• https://www.library.cornell.edu/research/citation
• http://guides.library.cornell.edu/c.php?g=31610&p=200436

Data Security Policy

Policy Volume: RD
Responsible Executive: CCSS Secure Data Services Manager
Responsible Office: Cornell Center for Social Sciences
(CCSS) Issued: 2020-10-01, revised 2023-11-30

NOTE: This policy replaces these previous policies:

• CRADC Data Security Policy [issued 2020-10-01, revised 2023-02-28]
• CRADC Data Security Policy [issued 2020-10-01]
• CRADC Data Security Policy [issued 2015-07-13, revised 2016-09-30]
• Secure Standalone Desktop Data Security Policy [issued 2017-10-17

POLICY STATEMENT

The CCSS Regulated Research Environment must use Data Use Agreements and Cornell University policies to protect research data deemed confidential and/or restricted by laws and regulations. This policy applies to all research data physically housed within the CCSS auspices regardless of its storage medium (e.g., disk drive, electronic tape, CD, DVD, external drive, paper, fiche, etc.) or form (e.g., text, graphic, video, audio, etc.).

The CCSS Research IT Director is a Security Liaison for the CCSS Regulated Research Environment.

POLICY REQUIREMENTS

CCSS Regulated Research Environment researchers and support staff must understand and carry out their data security responsibilities to comply with the stipulations of the Data Provider’s Agreement(s), including laws and regulations referenced therein, and Cornell’s Institutional Review Board for Human Participant Research, Office of Sponsored Programs, and official university policies.

This policy applies regardless of the research’s source of funding.

The Process to Identify and Assess Security Risks:

Access Control Policy 

Policy Volume: RD
Chapter: AC‐1
Responsible Executive: CCSS Secure Data Services Manager
Responsible Office: Cornell Center for Social Sciences (CCSS)
Originally Issued: 2015-12-01, revised 2023-11-30.
Revised: 2016-09-30, 2018-12-18, 2020-10-06, 2023-02-28, 2023-11-30

POLICY STATEMENT

To comply with the information security terms outlined in Data Use Agreements (DUAs) and National Institute of Standards and Technology (NIST) 800-171 information security guidelines, CCSS Regulated Research Environment must limit system and network access to authorized users.

This policy covers all stages in the user access life cycle, including authorizing access, granting initial access, updating access privileges as user roles change, and removing user accounts for users no longer requiring access.

REASON FOR POLICY

CCSS Regulated Research Environment believes that protecting data resources requires authorized users' responsible handling of information technology and data. CCSS Regulated Research Environment researchers, system administrators, and data custodians must strictly control access to information resources under their direction or ownership

POLICY REQUIREMENTS

These guidelines address establishing procedures before account provisioning and the effective implementation of access authorization, account provisioning, change in status, unsuccessful login attempts, session lockout, account expiration, account re‐enabling, record keeping, and account de-provisioning.

Before Account Provisioning:
 

Sharing, Transmission, and Distribution of Restricted Data

Policy Volume: RD
Responsible Executive: CCSS Secure Data Services Manager
Responsible Office: Cornell Center for Social Sciences
(CCSS) Issued: 2020-10-01, revised 2023-11- 30.

NOTE: This policy replaces these previous policies:

• Sharing, Transmission, and Distribution of Restricted Data [issued 2015-05-11, revised 2016-09-30, 2017-11-09, 2019-04-18, 2023-03-30, 2023-11-30]
• Secure Standalone Desktop – Sharing, Transmission, and Distribution of Restricted Data [issued 2017-09-17

POLICY STATEMENT

This policy is to establish secure standards for restricted data sharing, transmission, and distribution.

POLICY REQUIREMENTS

For this document’s purpose, restricted data relates to any nonpublic data protected by regulations, laws, policies, and/or contractual access restrictions defined by a Data Use Agreement (DUA). The Regulated Research Environment operated by the Cornell Center for Social Sciences (CCSS), as the Data Custodian of these data, along with the authorized research team (Researcher), must adhere to the conditions set forth by the Data Provider in a signed DUA and this policy.

Sharing:
The Researcher is authorized to access only the restricted data residing within the folders (and subfolders) on the CCSS Regulated Research Environment computing system per their DUA to maintain the security and confidentiality of the encompassed data. Providing unauthorized users with credentials to access CCSS Regulated Research Environment computing systems is forbidden.

Restricted Data Security Breach Reporting and Response

Policy Volume: RD
Responsible Executive: CCSS Secure Data Services Manager
Responsible Office: Cornell Center for Social Sciences
(CCSS) Issued: 2020-10-06

NOTE: This policy replaces these previous policies:

• CRADC Restricted Data Security Breach Reporting and Response Policy [issued 2015-07-15, revised 2016-09-30, 2019-04-18, 2023-03-27, 2023-11-30]
• Secure Standalone Desktop – Restricted Data Security Breach Reporting and Response Policy [issued 2017-09-17]

POLICY STATEMENT

This policy outlines procedures for reporting and responding to restricted information security breaches.  It includes determining the affected systems, compromised restricted data, impacted data specifics, and actions required for forensic investigation and legal compliance.

POLICY REQUIREMENTS

The Cornell Center for Social Sciences (CCSS) Regulated Research Environment is committed to compliance with restricted data security requirements.  For this document's purpose, restricted data relates to any nonpublic data protected by regulations, laws, policies, and/or contractual access restrictions as defined by a Data Use Agreement (DUA).  The CCSS Regulated Research Environment, as the Data Custodian of these data, along with the authorized research team (Researcher), must adhere to the conditions set forth by the Data Provider in a signed DUA and this policy.

The Cornell Center for Social Sciences (CCSS) Research IT Director serves as a Security Liaison for the CCSS Regulated Research Environment. 

Reporting:
According to Cornell University Policy 5.4.2, Reporting Electronic Security Incidents, the Researcher is responsible for immediately notifying the CCSS Security Liaison or CCSS Data Custodians of unauthorized access to restricted data or any other information security risk or restricted data compromise.

Response:

After receiving a data security breach notification, the CCSS Security Liaison, CCSS Secure Data Services Manager, and System Administrator will immediately convene to review the report.  The CCSS Security Liaison will notify the Cornell University Information Technology Security Officer (ITSO) about the security incident after the initial review (Cornell University Policy 5.4.2, Reporting Electronic Security Incident).

Process Steps:

1. Identify:
   1. the nature of the incident to the best of one's knowledge.
   2. the data involved.
   3. the Data Provider contact information.
   4. the systems involved and remove them from the network if applicable.
   5. applicable policies, regulations, and/or laws involved.
2. Recovery and Response
   1. Contact the Cornell University IT Security Office for assistance in forensics.
   2. Secure the system and preserve it without change.
   3. If deemed necessary, the Security Office will alert the Cornell University Data‐Loss Incident Response Team.
   4. Resolve the situation.
3. Communicate
   1. Contact the Office of Sponsored Programs (OSP).
   2. The OSP will contact the Data Provider to inform them of the current situation.
   3. If required, notify individuals of data theft.
4. Document
   1. Create an incident report.
   2. Document lessons learned.
   3. Update necessary documentation.

Contacts

If you have questions about specific issues regarding this Data Destruction and Return of Restricted Data Policy, call the following offices:

Data Destruction and Return of Restricted Data

Policy Volume: RD
Responsible Executive: CCSS Secure Data Services Manager
Responsible Office: Cornell Center for Social Sciences
Issued: 2020-10-07 Revised 2023-02-28.