NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 1

Managing Public Access to Results of Federally 

Funded Research

NIST O 5701.00

Effective Date: 6/26/2015

I. PURPOSE

This order describes requirements and responsibilities for managing public access to results of 

scientific research funded wholly or in part by NIST.

II. APPLICABILTY

This order applies to:

1,2

1. All NIST employees, including full- and part-time employees, temporary government 

employees, and special government employees, who record factual material commonly 

accepted in the scientific community as necessary to validate research findings as part of 

their employment. 

2. All NIST employees, including full- and part-time employees, temporary government 

employees, and special government employees, who publish scholarly and technical 

material, including data, as part of their employment.

3. All NIST associates engaged in research activities at or for NIST who record factual 

material commonly accepted in the scientific community as necessary to validate 

research findings, to the extent allowed by law and the terms of the associate's agreement.

 

1 A non-NIST organization that publishes scholarly and technical material, including data, through activities funded 

wholly or in part by NIST through a grant, cooperative agreement, contract, or other agreement, must manage public 

access to published scholarly and technical material, including data, as agreed to by NIST and that organization in 

the terms and conditions of the grant, cooperative agreement, contract, or other agreement between NIST and the 

non-NIST organization.

2

In cases where a NIST employee collaborates with an external researcher without an underlying written agreement, 

expectations for generating a DMP and providing public access to resulting data and/or code should be discussed at 

the outset of the collaboration. If NIST has the greater role in the project, the DMP should be generated by NIST in 

accordance with NIST policies. If the external researcher has the greater role and/or has intellectual property rights 

over the data and/or code, generation of the DMP and provision of public access to the data and/or code should 

follow their institution’s requirements. If the external researcher does not intend to provide public access but is 

agreeable to NIST providing access, OU management decides whether NIST will do so. This agreement should be 

obtained in writing. For more information, see NIST G5702.01, Guidance for Making Non-NIST Data Available 

Through NIST’s Data Management Infrastructure.
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 2

4. All NIST associates engaged in research activities at or for NIST who publish scholarly 

and technical material, that may include data, to the extent allowed by law and the terms 

of the associate's agreement,

5. All NIST employees involved in the awarding and/or oversight of NIST contracts, 

financial assistance awards, or other agreements.

6. All NIST employees involved in the drafting, negotiation, implementation and oversight 

of agreements under which NIST employees perform research for other parties.

III. REFERENCE

NIST P 5700.00 NIST Policy on Managing Public Access to Results of Federally Funded 

Research

IV. DEFINITIONS3,

Accepted Manuscript:

4

 The version of a journal article that has been accepted for publication 

in a journal. 

Data: Research data means the recorded factual material commonly accepted in the scientific 

community as necessary to validate research findings, but not any of the following: 

preliminary analyses, drafts of scientific papers, plans for future research, peer reviews, or 

communications with colleagues. This “recorded” material excludes physical objects (e.g., 

laboratory samples). Research data also does not include:

(i) Trade secrets, commercial information, materials necessary to be held confidential by a 

researcher until they are published, or similar information which is protected under law; 

and

(ii) Personnel and medical information and similar information the disclosure of which 

would constitute a clearly unwarranted invasion of personal privacy, such as information 

that could be used to identify a particular person in a research study. 5

For purposes of this order, NIST considers the contents of laboratory notebooks to be 

preliminary analyses.

Data Management Plan (DMP): A defined plan for the management of data that provides, at 

a minimum, a summary of activities for data generation, a summary of the types of data 

generated by the relevant activities, the plans for preservation of the generated data, and a 

description of the appropriate level of access for the generated data.

Digital Object Identifier (DOI): A string of characters used to identify an object such as an 

electronic document. A group of digital objects may be associated with a Persistent 

Identifier (see Persistent Identifier definition below).

 

3 All definitions are in the context of this directive and are listed in alphabetical order. In cases where a definition is 

adopted from a reference, the reference is cited in a footnote.

4 National Information Standards Organization, Journal Article Versions (JAV): Recommendations of the 

NISO/ALPSP JAV Technical Working Group, 2008. 

5 2 C.F.R. §200.315 (e)(3)
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 3

Discoverability: the ability of a piece of content or information to be found.

Final Published Article: The “version of record;”

4

published or to be published by a 

publisher or the publisher’s authoritative copy of the final manuscript, including all 

modifications resulting from the journal’s review process, copyediting, stylistic edits, and 

formatting.

govinfo: A service of the United States Government Publishing Office (GPO) that provides 

free public access to official publications from all three branches of the Federal Government.

The govinfo service, which has replaced GPO’s Federal Digital System (FDsys), serves as 

NIST’s repository for NIST Technical Series publications as well as other papers that have 

not been reviewed through an external publisher’s peer-review process (e.g., conference 

proceedings, reports).

Metadata: Standardized descriptive values that explain, locate, or enable the retrieval of data 

or publications. (See, for example, https://project-open-data.cio.gov/v1.1/schema/.) This does 

not include domain metadata which provides the user with common understanding of the 

meaning or semantics of the data, to ensure correct and proper use and interpretation of the 

data by its owners and users.

NIST Editorial Review Board (ERB): The NIST ERB is a Standing Administrative 

Committee as defined in NIST O 1005.00, NIST Administrative Committees.

NIST Editorial Review System (ERS): The NIST ERS is the program through which 

manuscripts are reviewed and approved prior to submission by the author to a publisher.

NIST Enterprise Data Inventory (EDI): A searchable system containing a comprehensive 

listing of NIST datasets with associated metadata, including an indication of whether they 

may be made publicly available (i.e., release is permitted by law, regulation and policy, 

subject to all privacy, confidentiality, security, and other valid requirements) and whether 

they are currently available to the public. 

NIST Public Access Archive System: See definitions of PubMed Central and govinfo.

NIST Scholarly and Technical Publications: Publications, including final published articles 

and the NIST Technical Series publications, which describe the results of NIST technical 

activities.

NIST Technical Series Publications: NIST scholarly and technical publications published by 

or for NIST; click here for the page.

Open Access: Freely available online access to a scholarly or technical publication.

Persistent Identifier: (PID): A unique name or label for a digital object or digital resource 

that is independent of its physical location or current ownership, thus ensuring permanent 

access to the data or publication even if the resource is moved or renamed.

PubMed Central (PMC): NIST’s repository for peer-reviewed publications beginning 

October 1, 2015; maintained by the National Institutes of Health. 
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 4

V. REQUIREMENTS

1. Data

a. Data Management Plans (DMPs). The requirements stated below are the minimum 

requirements for DMPs. A NIST Organizational Unit (OU) or Office may expand 

these requirements to meet the needs of activities within that OU or Office or across 

OUs or Offices. 

NIST OU Directors and Office Directors are responsible for ensuring that DMPs are 

developed and maintained for all data generated in their respective OU or Office. 

Responsibility for the development and maintenance of the DMPs may be delegated

as determined by the OU Director or Office Director. 

In cases where multiple OUs or Offices share a common data-generating activity, the 

Director of the OU or Office with the greatest role in directing the activity, i.e., the 

champion, will determine whether to develop one DMP or multiple DMPs specific to 

that activity in a manner determined by the champion.

An OU Director or Office Director must ensure that development and maintenance of 

DMPs is included in performance plans for NIST employees within their OU or 

Office who have those responsibilities. 

All research data generated that results from activities funded wholly or in part by 

NIST must be covered by a relevant DMP. These plans must contain, at a minimum, 

the following elements:

• Summary of activities: a brief explanation of activities that generate data. 

• Data types and classification: a summary of the data types generated by the 

identified activities. Data should be categorized, at a minimum, according to the 

data categories presented in the NIST Data Taxonomy and Actions/Consequences 

for Data Categories, provided in Appendix A of this Order, as applicable.

• Preservation: a plan for storage and maintenance of the data generated by the 

identified activities, in both the short-term and long-term (if relevant). Data 

should be preserved, at a minimum, according to the preservation consequence 

levels defined in the NIST Data Taxonomy and Actions/Consequences for Data 

Categories, provided in Appendix A of this Order, as applicable, and in 

accordance with applicable records retention requirements.

• Review, Discoverability, and Access: a plan describing whether and how the data 

generated by the identified activities will be reviewed and made available to the 

public and how the metadata describing it will be entered into the NIST 

Enterprise Data Inventory (EDI). The plan should describe any known access 

restrictions for the data and/or metadata, if appropriate. Data should be made 

discoverable, at a minimum, according to the discoverability consequence levels 
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 5

defined in the NIST Data Taxonomy and Actions/Consequences for Data 

Categories, provided in Appendix A, as applicable. 

b. NIST Enterprise Data Inventory (EDI). All metadata for NIST data, as applicable,

must be entered into the NIST EDI based on the discovery consequence levels (see

Appendix A, Section III.3. of this Order) and OU or Office guidance.

2. NIST Scholarly and Technical Publications. All NIST scholarly and technical 

publications with a publication date of October 1, 2015 or later must be submitted to the

appropriate NIST public access archive system (see Section IV. Definitions) no later than 

12 months following publication.

VI. RESPONSIBILITIES

NIST Director 

a) Controls and manages NIST’s Policy and Order on Managing Public Access to 

Results of Federally Funded Research.

b) Ensures coordination of the management of public access to results of federally 

funded research with non-NIST organizations, as applicable.

Associate Director for Laboratory Programs (ADLP)

a) Implements and provides oversight for maintenance of, and compliance with, NIST’s 

Policy and Order on Managing Public Access to Results of Federally Funded 

Research.

b) Ensures the availability of appropriate resources for managing public access to results 

of federally funded research.

c) Reviews, approves, and evaluates the effectiveness of NIST OU and Office plans for 

managing public access to results of federally funded research

d) Coordinates collaboration and cooperation on implementation of the NIST’s Policy 

and Order on Managing Public Access to Results of Federally Funded Research 

across NIST and with the Department of Commerce and other federal agencies.

e) With the Associate Director for Management Resources (ADMR) and the Associate 

Director for Innovation and Industry Services (ADIIS), coordinates with relevant 

OUs and Offices in their infrastructure planning and implementation to promote 

interoperability across NIST.

f) Oversees the activities of the Directors of the Operating Units within the ADLP 

Directorate in supporting NIST’s Policy and Order on Managing Public Access to 

Results of Federally Funded Research, as applicable.

Associate Director for Management Resources

a) Facilitates the provision of NIST-level infrastructure to manage public access to 

results of federally funded research.
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 6

b) Ensures the development and deployment of training, awareness, and outreach 

activities pertaining to the management of public access to results of federally funded 

research.

c) With the ADLP and ADIIS, coordinates with relevant OUs and Offices in their 

infrastructure planning and implementation to promote interoperability across NIST.

d) Oversees the activities of the Chief Information Officer and the Directors of the 

Information Services Office and Office of Acquisition and Agreements Management 

in supporting NIST’s Policy and Order on Managing Public Access to Results of 

Federally Funded Research, as applicable.

Associate Director for Innovation and Industry Services

a) Oversees the activities of the Directors of the Advanced Manufacturing National 

Program Office, the Baldrige Performance Excellence Program, the Economic 

Analysis Office, the Hollings Manufacturing Extension Partnership Program, the 

Technology Innovation Program, and the Technology Partnerships Office in 

supporting NIST’s Policy and Order on Managing Public Access to Results of 

Federally Funded Research, as applicable.

Chief Information Officer (CIO)

a) Manages NIST-level information technology infrastructure to support NIST’s 

provision of public access to results of federally funded research.

b) Ensures that the NIST EDI is available to NIST employees and that NIST inventory 

records are provided to the Department of Commerce and government-wide 

inventories in the necessary format, per Office of Management and Budget 

requirements.

c) Supports NIST OU Directors’ and Office Directors’ responsibilities (see Section 

VI.8. of this Order), as applicable.

Director, Information Services Office

a) Works with the Office of Information Systems Management (OISM) to ensure

implementation and operation of the NIST EDI.

b) Manages creation and maintenance of persistent identifiers for data and NIST 

Technical Series Publications.

c) Provides consultation and educational materials for NIST employees on:

a. managing data and providing public access to results of federally-funded research, 

including use of the NIST EDI, and 

b. the NIST review process, as applicable, for results of federally funded research 

that are intended for dissemination in any media in accordance with Directive P 

1800 Review of Fundamental Research Communications.
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 7

d) Facilitates search and access to metadata for NIST data or final published articles or 

NIST Technical Series Publications for the public.

e) Supports NIST OU Directors’ and Office Directors’ responsibilities (see Section 

VI.8. of this Order), as applicable.

Director, Office of Acquisition and Agreements Management (OAAM)

a) Works with the Directors of NIST OUs and Offices to ensure that grants, cooperative 

agreements, contracts, and other agreements through which NIST funds activities,

wholly or in part, include requirements for managing data and publications, as 

specified in the terms and conditions of the grant, cooperative agreement, contract, or 

other agreement with the non-NIST organization, consistent with the NIST Policy and 

Order for Managing Public Access to Results of Federally Funded Research.

OU Director or Office Director

a) Implements ADLP-approved plan to manage public access to results of activities 

funded wholly or in part by NIST within their OU or Office.

b) Works with other offices, e.g., OISM and the Information Services Office, to manage 

public access to results of activities funded wholly or in part by NIST.

c) Reviews data to ensure that no personally or business identifiable information is 

present and that appropriate protective measures are in place prior to making data 

publicly available; authority to carry out this responsibility may be delegated to the 

Division Chief or equivalent, per Directive P 1800 Review of Fundamental Research 

Communications.

d) Ensures that their OU or Office prioritizes the discoverability (based on the discovery 

consequence levels in Appendix A, Section III.3. of this Order) and publication of 

applicable OU or Office datasets based on stakeholder needs and availability of 

resources.

Supervisory Employee within an OU or Office within the ADLP Directorate

a) Ensures activities under their direction comply with their OU or Office plans to 

manage public access to results of federally funded research. 

b) Ensures employees under their supervision meet employee-level requirements of their

OU or Office plans to manage public access to results of federally funded research.

c) Works with OAAM to ensure that grants, cooperative agreements, contracts, and 

other agreements through which NIST funds activities, wholly or in part, include 

requirements for managing data and publications, as specified in the terms and 

conditions of the grant, cooperative agreement, contract, or other agreement with the 

non-NIST organization, consistent with the NIST Policy and Order for Managing 

Public Access to Results of Federally Funded Research.

Non-Supervisory Employee within ADLP Directorate
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 8

a) Complies with the employee-level requirements of their OU or Office plans to 

manage public access to results of federally funded research: prepares and executes

DMPs as specified by the OU or Office plans to manage public access to results of 

federally funded research, and as applicable,

a. provides metadata for NIST data to the NIST EDI or other publicly available 

repositories, as applicable, 

b. if data are tagged as available to the public in the EDI, provides data in open 

formats via publicly available repositories or upon request and to the extent 

feasible, directly to the requestor, free of charge unless otherwise excepted (e.g., 

some Standard Reference Data), and

c. provides publications dated October 1, 2015 and later to the appropriate NIST 

public access archive system no later than 12 months following publication.

b) Works with OAAM to ensure that grants, cooperative agreements, contracts, and 

other agreements through which NIST funds activities, wholly or in part, include 

requirements for managing data and publications, as specified in the terms and 

conditions of the grant, cooperative agreement, contract, or other agreement with the 

non-NIST organization, include requirements for managing data and publications 

consistent with the NIST Policy and Order for Managing Public Access to Results of 

Federally Funded Research.

VI.DIRECTIVE OWNER

600 – Associate Director for Laboratory Programs

VII. APPENDICES

A. NIST Data Taxonomy and Actions/Consequences for Data Categories 

B. Revision History
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 9

APPENDIX A

NIST DATA TAXONOMY AND ACTIONS/CONSEQUENCES FOR DATA 

CATEGORIES

SUMMARY OF CONSEQUENCES

Definitions and details are provided in the body of this document, but a summary of 

requirements is provided here for the reader’s convenience.

DATA CATEGORY DMP PRESERVATION REVIEW DISCOVERABILITY

Published Results and 

Standard Reference Data 

(SRD)

Data Management Plan (DMP) required

Must be backed up 

using a 

tested/automated 

process

Must be reviewed in 

accordance with

requirements of 

NIST O 1801.00

and S 1801.02

Metadata must be 

registered in NIST's 

Enterprise Data 

Inventory and data 

made discoverable 

through data.gov

Publishable Results

Metadata must be 

registered in NIST’s 

Enterprise Data 

Inventory

Derived Data

None imposed by 

NIST

None imposed by 

NIST

None imposed by 

NIST

Working Data

I. PURPOSE

The purpose of this taxonomy is to define a collection of terms and concepts that describe classes 

and categories scientific data arising from unclassified research and programs funded wholly or 

in part by NIST6, as well as policy requirements, actions, and consequences that might apply to 

those categories as a result of requirements expressed in the Office of Science and Technology 

Policy (OSTP) Open Data Memorandum, OMB Memorandum M-13-13, and Executive 

 

6 A non-NIST organization that publishes scholarly and technical material, including data, through activities funded 

wholly or in part by NIST through a grant, cooperative agreement, contract, or other agreement, must manage public 

access to published scholarly and technical material, including data, as agreed to by NIST and that organization in 

the terms and conditions of the grant, cooperative agreement, contract, or other agreement between NIST and the 

non-NIST organization.
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 10

Order 13642. (See NIST Policy P 5700.00.) In the context of these requirements, research data is

defined as “the recorded factual material commonly accepted in the scientific community as 

necessary to validate research findings, but not any of the following: preliminary analyses, drafts 

of scientific papers, plans for future research, peer reviews, or communications with 

colleagues.”7

Although the categories in the NIST data taxonomy are arranged in a pyramid, they are not 

strictly hierarchical. Categories range from working data to standard reference data (SRD) (see

Figure 1). The goal of this document is to achieve a shared understanding of the data 

management space at NIST, not to make policy choices or to define requirements or recommend 

procedures. This vocabulary is intended to enable discussions among NIST management and

technical staff to support NIST’s data management Policy and Order.

Figure 1. Data pyramid describing the categories of NIST data, ranging from “Working 

Data” to “Published Results” and “Standard Reference Data (SRD)”

 

7 For purposes of this policy, NIST is adopting the definition of “research data” provided in 2 C.F.R. §200.315 

(e)(3). http://www.gpo.gov/fdsys/pkg/CFR-2014-title2-vol1/pdf/CFR-2014-title2-vol1-sec200-315.pdf

Derived Data

Working Data

Published

Results 

and SRD

Publishable Results
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 11

II. DATA CATEGORIES8

The main categories envisioned for NIST data have been arranged in the form of a “data 

pyramid,” (Figure 1) recognizing that in general the volume of data decreases as you move from 

the bottom of the pyramid toward the top. This is an oversimplification, and several competing

dimensions for characterizing and distinguishing data classes have been combined into this one 

view for reasons of simplicity and compactness. However, this simplified diagram (Figure 1) 

provides a useful breakdown of data classes for the narrow context of discussing data

management plans and NIST data curation and dissemination policies.

Several classes of data are described in the pyramid, with the following definitions:

1. Working Data

The digital equivalent of entering data in a laboratory notebook. Working data may be raw 

observational data that is acquired directly from an instrument or a measurement system, or 

digital values acquired or generated during experiments or simulations. In some cases the 

researcher responsible for generating the working data may determine that this data has 

immediate value and is worth preserving, or the researcher may expect that the data will have 

value after it has been manipulated or further evaluated, and the data has the potential to develop 

into a publication or will be used to draw conclusions. In other cases working data may be 

recognized as not appropriate for broader use in its present form. It may have value to the data 

producers and their collaborators, but it should be recognized that the data could be easily 

misinterpreted by people not closely involved in its production because some metadata and 

important facts about its status or acquisition are not readily available beyond the immediate 

research team (e.g., adequate metadata for re-purposing is not attached to the data itself, or 

expending resources to codify needed metadata is not justified, etc.). 

2. Derived Data

Underpins the conclusions provided in a publication or report. Derived data comes from 

working data that has been manipulated, analyzed, processed, or evaluated in some way. The 

data must have passed some minimal (perhaps ad hoc) evaluation and be considered by the 

responsible researcher (typically the data producer) to be ready for the next steps in the workflow 

or project/product development effort.

 

8 The data taxonomy that was originally published with O 5701.00 included two additional 

categories: reference data, which applied to special databases that were outside the definition of 

SRD in the SRD Act of 1968, and resource data, which was data that NIST used to underpin a 

position or decision. P.L. 114-239 redefined SRD in 2017, thus allowing the elimination of 

‘reference data’ from the triangle. Resource data comprised data that NIST or someone else 

might publish. If NIST publishes it, it can be categorized as ‘published.’ If someone else 

publishes it, we cannot impose consequences.
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 12

3. Publishable Results

All final or summary results that comply with relevant NIST policies (e.g., SI units, uncertainty 

statements), that have been reviewed internally and approved by an appropriate NIST authority, 

and that could be published either in a scientific publication or as a standalone data product.

4. Published Results and Standard Reference Data (SRD)

Results that are publishable and have been made available to the public after review and 

approval by the necessary NIST organizational authorities. Published results may be Standard 

Reference Data, contained in another type of database, or provided in a paper or on a website.

III. ACTION/CONSEQUENCE LEVELS

While the section on Data Categories is intended to define a variety of classes or grades of data 

that exist at NIST, this section defines corresponding requirements or consequences that should 

be considered when formulating data policy. As explained earlier, the purpose of this taxonomy 

document is not to impose these consequences or required actions on the categories, but merely 

to provide a vocabulary that simplifies discussion of assigning such requirements to various 

categories. Expressions of NIST data policy (e.g., NIST Directives, Guidance Memoranda, OU 

policies, etc.) should contain statements that map these consequence levels onto specific 

categories. Incorporating this taxonomy document as a reference into policy documents that 

delineate such mappings will simplify those statements of policy and reduce their ambiguity.
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 13

1. Preservation Consequence Levels Defined

Consistent with NIST Administrative Manual Subchapter 2.06 Records Management,9the NIST 

Records Retention Schedule10 for Scientific and Technological Records,11 and the General 

Records Schedule12 for Input Records, Output Records, and Electronic Copies,13 the following 

preservation consequence levels correspond to the Data Categories in the data pyramid (See 

Figure 2):

1. No preservation requirements imposed by NIST; individual user is responsible,

2. Data must be backed up using a tested/automated process (i.e., proof that restoration is 

possible).14

Figure 2. Mapping preservation consequence levels onto the NIST data categories.

 

9 http://inet.nist.gov/mando/directives/206.cfm

10 http://inet.nist.gov/mando/nist-records-schedule.cfm

11 http://inet.nist.gov/mando/services/upload/Items-25-32-Scientific-and-Technological-Records.pdf

12 http://www.archives.gov/records-mgmt/grs.html

13 http://www.archives.gov/records-mgmt/grs/grs04-3.pdf

14 The data is backed up periodically, but the backup frequency is left unspecified and commercial backup 

technologies such as CommVault Simpana data protection software are employed, OR the data is backed up at the 

level of OISM Central File Services Tier 2, OR the data is backed up at the level of OISM Central File Services 

Tier 1, OR the data is backed up and preserved via the Enterprise Data Inventory.
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 14

2. Review Consequence Levels Defined

The following review consequence levels correspond to the Data Categories in the data pyramid 

(See Figure 3.):

1. No additional review requirements,

2. Must be reviewed in accordance with NIST O 1801.00 and S 1801.02.

Figure 3. Mapping review consequence levels onto the NIST data categories.
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 15

3. Discoverability Consequence Levels Defined

The following discoverability consequence levels correspond to the Data Categories in the data 

pyramid (See Figure 4.):

1. No discoverability requirements,

2. Metadata must be entered in the NIST Enterprise Data Inventory,

3. Metadata in the NIST Enterprise Data Inventory is made publicly accessible.

Figure 4. Mapping discoverability consequence levels onto the NIST data categories.

In addition to the guidance above, additional considerations should also be applied by each OU 

and Office to prioritize the availability of datasets based on factors including stakeholder need, 

the reasonableness of effort required to make the data available, and other relevant factors.

IV. RELEVANCE OF THE NIST IT SYSTEM SECURITY PLANS

There is a very close relationship between NIST data and the information technology (IT) 

systems used to store, utilize, and exchange that data. Further, extensive NIST policy governing 

IT systems has already been defined, and NIST has numerous special publications and Federal 

Information Processing Standards (FIPS) for the benefit of the nation, pursuant to the Federal 
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 16

Information Security Management Act (FISMA) of 2002 and other legislation relative to 

information technology.

Federal law15 defines the three components of a widely accepted model for discussing 

information security, including both IT security and information assurance:

a. Integrity: guarding against improper information modification or destruction, including 

ensuring information nonrepudiation and authenticity; 

b. Confidentiality: preserving authorized restrictions on access and disclosure, including 

means for protecting personal privacy and proprietary information; and

c. Availability: ensuring timely and reliable access to and use of information.

This security model applies to information, information systems, and related resources (including 

user information such as research results), and therefore is much broader than just NIST data. 

However, these concepts are relevant to data generated by federally funded research.

FIPS Publication 19916 defines three levels of potential impact on organizations and individuals 

should there be a breach of security (i.e., in this context a loss of confidentiality, integrity, or 

availability of the data). The potential impact can be LOW, MODERATE, or HIGH if the loss of 

confidentiality, integrity, or availability could be expected to have a limited adverse effect, a 

serious adverse effect, or a severe/catastrophic effect on organizational operations, organizational 

assets, or individuals. These impact levels are clarified and amplified in FIPS 199. When 

federally funded research is intended for publication, its INTEGRITY and CONFIDENTIALITY 

impacts are LOW since the unauthorized modification or disclosure of the data would have a 

limited adverse effect on NIST operations, assets, and individuals. However, if the federally 

funded research contains business or personally identifiable information, proprietary 

information, or other sensitive information prior to publication, CONFIDENTIALITY is deemed 

MODERATE and therefore requires more stringent security controls. Business or personally 

identifiable information, proprietary information, or other sensitive information must never be 

published or otherwise made public. The data categorization and security controls must be 

documented within the respective NIST OU system security plan.

Preservation of records may be accomplished through various means. (NIST staff can see ‘How 

do I backup my data’ for more information.)

 

15 See 44 U.S.C § 3542 – Definitions.

16 FIPS 199, “Standards for Security Categorization of Federal Information and Information Systems,” NIST, 

February 2004, available at http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf.
NIST O 5701.00 Ver. 3 (Uncontrolled Copy in Print) Page 17

APPENDIX B

REVISION HISTORY 

Revision Date Responsible Person Description of Change

Initial 9/18/2014 Katherine Sharpless Initial release

Rev. .01 4/13/2015 Dan Cipra Formatting Changes Only

Rev. .02 6/18/2015 Dan Cipra Incorporated all of the DRB changes

Rev. 1.01 5/22/2017 Katherine Sharpless Changes made to Appendix A – removal 

of reference and resource data from the 

data taxonomy; added requirement that 

publishable data be preserved; added 

pointer to review requirements in NIST 

O 1801.00 and S 1801.02

Rev. 1.02 8/14/2019 Katherine Sharpless Clarified responsibilities for providing 

public access to results from 

collaborations