#  1\. Introduction

This deliverable will set out the second version of the data management plan
(DMP) for the COMPACT project. A DMP is a key element of good data management,
which is especially important in the COMPACT context, as all Horizon
2020-funded projects from 2017 onward are required to contain a DMP.  1
Alongside open access publications, open access research data contributes to
achieving open science.  2

The DMP is applicable to data, needed to validate the results presented in
scientific publications. It is part of the European Commission’s Open Research
Data (ORD) Pilot, which was launched as a general project requirement in 2017.
According to the Commission’s website, the pilot aims to ‘improve and maximise
access to and re-use of research data generated by Horizon 2020’. It balances
between openness and protection of scientific information, commercialisation
and intellectual property rights (IPRs), as well as privacy and security
concerns.  3

A previous version of this document, entitled D2.6 Data management plan (v1),
was drawn up in M6 of the project (October 2017), and set out the basic
principles of data management in COMPACT. The current report has been updated
to reflect the advances and current status of data management in the project.

Following the reviewers’ comments, this document was revised in May 2019\. Its
follow-up version, the final iteration of the DMP (D2.9), will nevertheless be
provided alongside this document in order to reflect the final strategy for
data management in COMPACT.

The DMP for COMPACT is based on the European Commission’s Guidelines on FAIR
Data Management in Horizon 2020  4  and the COMPACT Grant Agreement.  5  It
defines which data will be open by detailing the types of data generated by
the project, its accessibility for verification and re-use, exploitation, as
well as its curation and preservation.

In order to implement the open research data principle, the DMP sets out the
following information:

  * The handling of research data during and after the end of the project, 

  

  * What data will be collected, processed and/or generated, 

  

  * Which methodology and standards will be applied, 

  

  * Whether data will be shared/made open access and 

  

  * How data will be curated and preserved (including after the end of the project). 

  

Sections 2 to 6 of this document will cover the different DMP components,
based on the outline suggested in the Guidelines. They are based on input from
the following partners: AIT, CINI, INOV and KUL, as indicated in the relevant
sections.

#  2\. Data summary

##  2.1. AIT

**What is the purpose of the data collection/generation and its relation to
the objectives of the project?**

The data collection within COMPACT is part of the psychological studies, the
humanfactor profiling and the awareness methods. The purpose of data
collection is scientific, i.e. contributing to an understanding of workers’
security-related behaviour and of how it can be influenced.

In particular, the psychological studies and the human factor profiling survey
measure knowledge about cyber security, taking into account the work-related
variables (i.e., time pressure, decision-making autonomy), IT-skills,
organizational variables (i.e., security climate) and demographic information
(i.e. gender, age, tenure). In addition, we collect qualitative data based on
interviews and observations when applying and evaluating the developed
awareness methods Investigators Diary and Sectopia.

Analyses are made based on aggregated (not individual) data. This data will be
published and then made available through open access.

**What types and formats of data will the project generate/collect?**

The data collected are responses to an online survey (Human Factor Profiling)
and logfiles of the developed game (Sectopia).

**Will you re-use any existing data and how?**

Data will be used for scientific publications. For that purpose, data will be
anonymized and analysed in an aggregated way.

**What is the origin of the data?**

Data is empirical data collected by applying research methods like
questionnaires, interviews, or observations.

**What is the expected size of the data?**

The expected size of the data depends on the number of participants. Overall
there will be less than 500 employees taking part in the studies.

**To whom might it be useful ('data utility')?**

This data is useful as it has potential to increase the understanding of
security-related behaviour within the scientific community. As a consequence,
when this scientific knowledge is transferred into public (within the project,
as well as) this will support making organisations more resilient against
cybercrime.

##  2.2. CINI

**What is the purpose of the data collection/generation and its relation to
the objectives of the project?**

Within the COMPACT Project, CINI is in charge of the development of an
advanced Security Information and Event Management (SIEM) system endowing
LPAs’ organisation with real-time monitoring capabilities. SIEM services
receive log files, which represent records of events that are occurring in an
organization’s system and network when a user attempts to authenticate him- or
herself in order to access the system or a system task is executed (such as
starting a service or shutting down the system, etc.). The content/records of
these log files, which are related to computer security information, will then
be analysed and used to investigate malicious activities. A particular alarm
or event is generated in relation to the particular detected attack.

**What types and formats of data will the project generate/collect?**

SIEM systems come with multiple adapters, which receive data/events from
different sources, such as Operating System (OS) log files (in proprietary or
open formats) or Commercial Off The Shelf (COTS) products for logical and
physical security monitoring, including: Windows registries, Wireshark,
Nessus, Nikto, Snort, Ossec, Argus, Cain & Abel, OpenNMS, Nagios, CENTEROS,
Ganglia, Milestone, openHAB, IDenticard, FieldAware, and CIMPLICITY.

The format of the generated data is JSON and it is stored in an Elasticsearch
analytics engine.

**Will you re-use any existing data and how?**

Currently, existing LPA data is not used to develop/test the SIEM. However, if
needed, we plan to use existing anonymized data stored into the archives of
some LPAs that are involved in the project.

**What is the origin of the data?**

The data collected and analysed by the SIEM system originates from testing
activities carried out at pilot sites (LPAs involved within the project) and
will rely on the collection and analysis of log files of the LPAs
participating in the COMPACT project.

**What is the expected size of the data?**

At this stage of the project, it is not possible to predict the amount of the
data that will be processed and stored, because it highly varies depending on
the number, type and frequency of the monitored data sources.

**To whom might it be useful ('data utility')?**

The data collected by the SIEM system can be useful to other technical
partners that are in charge of the development of COMPACT tools and services,
such as a risk assessment tool or personalization of training courses for
LPAs’ employees, etc.. The data could be useful to other research groups
working on similar research, as well as for testing alternative SIEM
solutions.

##  2.3. INOV

**What is the purpose of the data collection/generation and its relation to
the objectives of the project?**

During the COMPACT project, INOV will collect data to test and demonstrate its
Business process intrusion detection system (BP-IDS). This data collection is
related with the project objective “SO3: Lower the entry barrier to timely
detection and reaction to cyberthreats”, and may occur during the tasks: “Task
4.3 Threat intelligence and monitoring Component”; “Task 4.5 Integration of
solutions in a unified platform”; “Task 5.1 Validation and Demonstration
scenarios”; “Task 5.2 Trials Setup”; and “Task 5.3 Pilot execution and
demonstration”.

**What types and formats of data will the project generate/collect?**

It is not definitive in this phase, since the data to be collected is still
being defined. However, it is foreseen that INOV technology will at least
collect three types of information: documentation, operational data; and
statistical data. The documentation will be collected before the trials, and
composed of data produced by CMA that explains the business processes in place
in their municipality. The operational data will be collected during the
trials by monitoring the interactions between the IT systems present in the
CMA IT infrastructure and its database, but it will only be processed within
the IT infrastructure of CMA. While, the statistical data will be collected by
INOV after the trials to evaluate the performance of BP-IDS during the trials.

**Will you re-use any existing data and how?**

From the three datasets that have been identified only the documentation will
be reused based on what was provided by CMA during the trials.

Datasets containing documentation and statistical data collected during trials
will be reused in scientific publications. Specifically, documentation reused
in these publications was obtained from COMPACT public deliverables (D5.1
Validation and Demonstration

scenarios, D5.2 – Trial setup, and D5.3 - Pilot execution and demonstration
report), and contains business processes descriptions employed in the
municipality and a testbed description identical to what was used for the
experiments detailed in the trials execution and demonstration report.
Moreover, in terms of statistical data, although presented as aggregated form
in D5.3 - Pilot execution and demonstration report, the scientific
publications use the same statistical data that supports the analysis
presented in D5.3 - Pilot execution and demonstration report.

**What is the origin of the data?**

It has not been completely defined, the datasets need to be specified first to
respond to this question. However, at this stage the three datasets chosen
will be collected from the CMA. Specifically, the documentation will be based
on the archive documents of CMA, the operational data based on the data
produced on this LPA’s computers, and the statistical data will be produced
based on the deployments of BP-IDS tool in the IT infrastructure of CMA.

**What is the expected size of the data?**

It is difficult to estimate the size of the data at this stage, because the
size of the data highly varies on the network protocols or the files
monitored.

**To whom might it be useful ('data utility')?**

The principal beneficiary of the operational data will be CMA that will use
the tools developed to monitor threats against their IT infrastructure. INOV
will use it for adapting BP-IDS for LPAs, more specifically to the IT
infrastructure of CMA. The operational data could also be useful to technical
partners of the COMPACT project, that require live data to adapt their
technical solutions to LPA environments. Operational data, that can be most
useful by third parties for their own research interests (e.g., validation
scenarios for GDPR enforcement tools), may contain personal data and is kept
within CMA IT infrastructure with no foreseen methods to make data available.

The statistical data collected by INOV, will be evaluated, and if considered
of interest to the research community (mainly in the scope of open access to
validate INOV scientific results) will be made available by INOV (after
receiving CMA authorization to make data available).

#  3\. FAIR data

Under Horizon 2020’s principle of open access to data, research data must be
FAIR: findable, accessible, interoperable and reusable. This will contribute
to the use of data in future research.  6

In order to be **Findable** :

  * F1. (meta)data are assigned a globally unique and eternally persistent identifier. 

  

  * F2. data are described with rich metadata. 

  

  * F3. (meta)data are registered or indexed in a searchable resource. 

  

  * F4. metadata specify the data identifier. 

  

In order to be **Accessible** :

  * A.1. (meta)data are retrievable by their identifier using a standardized communications protocol. 

  

  * A1.1. the protocol is open, free, and universally implementable. 

  

  * A1.2. the protocol allows for an authentication and authorization procedure, where necessary. 

  

  * A2. metadata are accessible, even when the data are no longer available. 

  

In order to be **Interoperable** :

  * I1. (meta)data use a formal, accessible, shared, and broadly applicable language for knowledge representation. 

  

  * I2. (meta)data use vocabularies that follow FAIR principles. 

  

  * I3. (meta)data include qualified references to other (meta)data. 

  

In order to be **Re-usable** :

  * R1. meta(data) have a plurality of accurate and relevant attributes. 

  

  * R1.1. (meta)data are released with a clear and accessible data usage license. 

  

  * R1.2. (meta)data are associated with their provenance. 

  

  * R1.3. (meta)data meet domain-relevant community standards. 

  

Answering the following questions will contribute towards compliance with the
FAIR data standards. The answers are provided in a comprehensive manner, not
on a yes/no basis.

##  3.1. Making data findable, including provisions for metadata

###  3.1.1. AIT

**Are the data produced and/or used in the project discoverable with metadata,
identifiable and locatable by means of a standard identification mechanism
(e.g.**

**persistent and unique identifiers such as Digital Object Identifiers)?**

No.

**What naming conventions do you follow?**

Not applicable.

**Will search keywords be provided that optimize possibilities for re-use?**

No.

**Do you provide clear version numbers?**

No.

**What metadata will be created? In case metadata standards do not exist in
your discipline, please outline what type of metadata will be created and
how.**

No metadata will be created. The data created within the psychological studies
are aggregated statistical data (e.g., means, standard deviations) as well as
aggregated qualitative data (e.g., interpreted data from sources like
interviews or observations) about employees’ perceptions of security-related
behaviour.

###  3.1.2. CINI

**Are the data produced and/or used in the project discoverable with metadata,
identifiable and locatable by means of a standard identification mechanism
(e.g.**

**persistent and unique identifiers such as Digital Object Identifiers)?**

Not defined yet. However, if the Zenodo Repository will be adopted as a
platform for data storage and sharing, the data will be persistently
identified through DOIs. Anyway, further actions will be performed to generate
metadata for making data accessible.

**What naming conventions do you follow?**

Data will be provided with a timestamp and an identifier. The identifier will
be either the “queryname” in case of aggregated monitoring results, or the
“source” name in case of raw data. To describe the data and their meaning, we
refer to the “Glossary of Key Information Security Terms” provided by NIST  7
or, the SANS Glossary of Security Terms  8  .

**Will search keywords be provided that optimize possibilities for re-use?**

At this stage, we have not planned yet to provide keywords that optimize
possibilities for re-use.

**Do you provide clear version numbers?**

Not defined yet. It can happen that the gathered data will not be modified
after their collection, so only one version number will be provided.

**What metadata will be created? In case metadata standards do not exist in
your discipline, please outline what type of metadata will be created and
how.**

Not defined yet.

###  3.1.3. INOV

**Are the data produced and/or used in the project discoverable with metadata,
identifiable and locatable by means of a standard identification mechanism
(e.g. persistent and unique identifiers such as Digital Object Identifiers)?**

The data collected so far does not contain any metadata.

**What naming conventions do you follow?**

Not defined yet. INOV does not follow naming conventions for the data
collection. Thus, additional measures to convert data are necessary to make
data compatible with the naming conventions chosen.

**Will search keywords be provided that optimize possibilities for re-use?**

Not defined yet. The data collected is not structured. Thus, additional
measures to convert data are necessary to make data searchable through
keywords.

**Do you provide clear version numbers?**

Not defined yet. It is most likely that most of the data collected will not be
altered and that only one version will be created per data.

**What metadata will be created? In case metadata standards do not exist in
your discipline, please outline what type of metadata will be created and
how.**

Not defined yet, but due to the nature of the data collected the creation of
metadata will be very unlikely.

##  3.2. Making data openly accessible

###  3.2.1. AIT

**Which data produced and/or used in the project will be made openly available
as the default? If certain datasets cannot be shared (or need to be shared
under restrictions), explain why, clearly separating legal and contractual
reasons from voluntary restrictions.** Note that in multi-beneficiary projects
it is also possible for specific beneficiaries to keep their data closed if
relevant provisions are made in the consortium agreement and are in line with
the reasons for opting out. There has been no opt-out in the COMPACT project
yet.

The data collected within the project will be anonymised, thus it cannot be
linked to a specific person. All scientific publications will be made open
access and thus openly available.

**How will the data be made accessible (e.g. by deposition in a repository)?**

All scientific articles will be open access.

**What methods or software tools are needed to access the data?**

The data is stored as numeric values or strings. Data will be provided as csv
or Excel files.

**Is documentation about the software needed to access the data included?**

No, this is not needed.

**Is it possible to include the relevant software (e.g. in open source
code)?**

There is no need for that.

**Where will the data and associated metadata, documentation and code be
deposited? Preference should be given to certified repositories which support
open access where possible.**

All scientific articles will be open access.

**Have you explored appropriate arrangements with the identified repository?**

Not applicable.

**If there are restrictions on use, how will access be provided?**

There are no restrictions on use.

**Is there a need for a data access committee?**

No, there is no need for that.

**Are there well described conditions for access (i.e. a machine-readable
license)?**

There is no need for that.

**How will the identity of the person accessing the data be ascertained?**

The data collected within the project will be anonymised, thus it cannot be
linked to a specific person.

###  3.2.2. CINI

**Which data produced and/or used in the project will be made openly available
as the default? If certain datasets cannot be shared (or need to be shared
under restrictions), explain why, clearly separating legal and contractual
reasons from voluntary restrictions.** Note that in multi-beneficiary projects
it is also possible for specific beneficiaries to keep their data closed if
relevant provisions are made in the consortium agreement and are in line with
the reasons for opting out. There has been no opt-out in the COMPACT project
yet.

The data produced and/or used in the project will be made openly available by
default only after a pseudonymisation and/or anonymization process in order to
prevent from attributing the data to a specific person. This is the case, for
example, of the data regarding the USB usage in the CDA scenario.

**How will the data be made accessible (e.g. by deposition in a repository)?**

The data will be made accessible through a research data repository. The
consortium will take measures to enable third parties to access, mine,
exploit, reproduce, and disseminate the data free of charge.

**What methods or software tools are needed to access the data?**  
  
<table>  
<tr>  
<th>

The best candidate tool for data sharing – at the time of this writing – is
ZENODO, an OpenAIRE/CERN compliant repository. Zenodo builds and operates a
simple and innovative service that enables researchers, scientists, EU
projects and institutions to share, preserve and showcase multidisciplinary
research results (data and publications), that are not part of the existing
institutional or subject-based repositories of the research communities.

Zenodo enables researchers, scientists, EU projects and institutions to:

• easily share the long tail of small research results in a wide variety of
formats, including text, spreadsheets, audio, video, and images across all
fields of science.

</th> </tr>  
<tr>  
<td>

•

</td>  
<td>

display the research results and receive credit by making the research results
citable and integrating them into existing reporting lines to funding agencies
like the European Commission.

</td> </tr>  
<tr>  
<td>

•

</td>  
<td>

easily access and reuse shared research results.

</td> </tr> </table>

**Is documentation about the software needed to access the data included?**

Yes, it is.

**Is it possible to include the relevant software (e.g. in open source
code)?**

It is possible, but not decided yet if open source code will be included.

**Where will the data and associated metadata, documentation and code be
deposited? Preference should be given to certified repositories which support
open access where possible.**

The consortium plans to deposit data in an OpenAIRE compliant research data
repository.

**Have you explored appropriate arrangements with the identified repository?**

If the consortium selects Zenodo as sharing and storage repository, then the
arrangements have been already identified and are described in the Zenodo
Terms Of Use. More details are available here:
_http://about.zenodo.org/terms/_

**If there are restrictions on use, how will access be provided?**

If the consortium selects Zenodo as sharing and storage repository, files may
be deposited under closed, open, or embargoed access. Files deposited under
closed access are protected against unauthorized access at all levels.
Contents deposited under an embargo status will be managed by the repository
that will restrict access to the data

until the end of the embargo period; at which time, the content will become
publically available automatically. More information is available here:
_http://about.zenodo.org/policies/_

**Is there a need for a data access committee?**

Not defined yet.

**Are there well described conditions for access (i.e. a machine-readable
license)?**

If the consortium selects Zenodo as sharing and storage repository, then this
information is available here:  _http://about.zenodo.org/policies/_

**How will the identity of the person accessing the data be ascertained?**

If the consortium selects Zenodo as sharing and storage repository, then
access to Zenodo’s content will be open to all, for non-military purposes
only. More information is available here:  _http://about.zenodo.org/terms/_ .

###  3.2.3. INOV

**Which data produced and/or used in the project will be made openly available
as the default? If certain datasets cannot be shared (or need to be shared
under restrictions), explain why, clearly separating legal and contractual
reasons from voluntary restrictions.** Note that in multi-beneficiary projects
it is also possible for specific beneficiaries to keep their data closed if
relevant provisions are made in the consortium agreement and are in line with
the reasons for opting out. There has been no opt-out in the COMPACT project
yet.

Not defined yet. However, since making data public may reveal CMA’s business
secrets (like detailed business processes specification, operative data with
personal data or sensitive information), data will be made available to a
restricted number of personnel only to avoid any risk to the detriment of CMA.

**How will the data be made accessible (e.g. by deposition in a repository)?**

Not defined yet. The data is stored and only accessible in computers located
on CMA headquarters. INOV will only have access to the information by using
the tool in closed premises.

**What methods or software tools are needed to access the data?**

To access the data, INOV will access the information when visiting
headquarters of CMA, or remotely by accessing through the VPN made available
by CMA. Either way, the information collected will remain in CMA’s premises.

**Is documentation about the software needed to access the data included?**

Not defined yet, but most likely it will not be available since it may
undermine CMA’s security methodology.

**Is it possible to include the relevant software (e.g. in open source
code)?**

Not defined yet.

**Where will the data and associated metadata, documentation and code be
deposited? Preference should be given to certified repositories which support
open access where possible.**

Not defined yet.

**Have you explored appropriate arrangements with the identified repository?**

Not defined yet.

**If there are restrictions on use, how will access be provided?**

Not defined yet.

**Is there a need for a data access committee?**

Not defined yet.

**Are there well described conditions for access (i.e. a machine-readable
license)?**

Not defined yet.

**How will the identity of the person accessing the data be ascertained?**

Not defined yet.

##  3.3. Making data interoperable

###  3.3.1. AIT

**Are the data produced in the project interoperable, that is allowing data
exchange and re-use between researchers, institutions, organisations,
countries, etc. (i.e. adhering to standards for formats, as much as possible
compliant with available (open) software applications, and in particular
facilitating re-combinations with different datasets from different
origins)?**

As the produced data is based on specific empirical methods, it is
interoperable with further data stemming from the same methods. If a
scientific article is published and made open access, we can provide the data
for other researchers. The data can be provided within .xls or .csv files.

**What data and metadata vocabularies, standards or methodologies will you
follow to make your data interoperable?**

Not defined yet. That depends on the requirements of the journal.

**Will you be using standard vocabularies for all data types present in your
data set, to allow inter-disciplinary interoperability?**

Not defined yet.

**In case it is unavoidable that you use uncommon or generate project specific
ontologies or vocabularies, will you provide mappings to more commonly used
ontologies?**

Not applicable.

###  3.3.2. CINI

**Are the data produced in the project interoperable, that is allowing data
exchange and re-use between researchers, institutions, organisations,
countries, etc. (i.e. adhering to standards for formats, as much as possible
compliant with available (open) software applications, and in particular
facilitating re-combinations with different datasets from different
origins)?**

Yes.

**What data and metadata vocabularies, standards or methodologies will you
follow to make your data interoperable?**

The data format used to represent the data is JSON, a lightweight data-
interchange format supported by all modern programming languages.

**Will you be using standard vocabularies for all data types present in your
data set, to allow inter-disciplinary interoperability?**

Not defined yet.

**In case it is unavoidable that you use uncommon or generate project specific
ontologies or vocabularies, will you provide mappings to more commonly used
ontologies?**

Not defined yet.

###  3.3.3. INOV

**Are the data produced in the project interoperable, that is allowing data
exchange and re-use between researchers, institutions, organisations,
countries, etc. (i.e. adhering to standards for formats, as much as possible
compliant with available (open) software applications, and in particular
facilitating re-combinations with different datasets from different
origins)?**

No, most of the data collected is raw data with the formats originally
produced by CMA software monitored by BP-IDS during COMPACT trials. Also,
since the data is only being used throughout the project to validate BP-IDS,
the dataset collected is stored on database that follows a table schema
created specifically for BP-IDS.

**What data and metadata vocabularies, standards or methodologies will you
follow to make your data interoperable?**

Not defined yet.

**Will you be using standard vocabularies for all data types present in your
data set, to allow inter-disciplinary interoperability?**

Not defined yet.

**In case it is unavoidable that you use uncommon or generate project specific
ontologies or vocabularies, will you provide mappings to more commonly used
ontologies?**

Not defined yet.

##  3.4. Increase data re-use (through clarifying licenses)

###  3.4.1. AIT

**How will the data be licensed to permit the widest re-use possible?**

The re-use possibilities depend on the journal that will be chosen for
submission (preference would be co-submission the data alongside to the
manuscript that has been submitted).

**When will the data be made available for re-use? If an embargo is sought to
give time to publish or seek patents, specify why and how long this will
apply, bearing in mind that research data should be made available as soon as
possible.**

The scientific data will be shared when an article is accepted and published
in a scientific journal.

**Are the data produced and/or used in the project useable by third parties,
in particular after the end of the project? If the re-use of some data is
restricted, explain why.**

Anonymised scientific data that is published in a scientific journal can be
re-used by other researchers for scientific purposes.

**How long is it intended that the data remains re-usable?**

This depends on the policies of the chosen scientific journal.

**Are data quality assurance processes described?**

Not defined yet.

###  3.4.2. CINI

**How will the data be licensed to permit the widest re-use possible?**

If the consortium chooses Zenodo as data sharing platform, the data will be
made available according to the Zenodo Open Access policies.

**When will the data be made available for re-use? If an embargo is sought to
give time to publish or seek patents, specify why and how long this will
apply, bearing in mind that research data should be made available as soon as
possible.**

At this stage of the project, it is not possible to predict when the date will
be made available for re-use.

**Are the data produced and/or used in the project useable by third parties,
in particular after the end of the project? If the re-use of some data is
restricted, explain why.**

Anonymised data will be usable by third parties.

**How long is it intended that the data remains re-usable?**

We intend to store data and make it re-usable for an appropriate period of
time according to the key guidelines established by the following regulations:

Directive (EU) 2016/1148 of the European Parliament and of the Council of 6
July 2016 concerning measures for a high common level of security of network
and information systems across the Union (NIS Directive)

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 on the protection of natural persons with regard to the processing
of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation)

**Are data quality assurance processes described?**

Not defined yet.

###  3.4.3. INOV

**How will the data be licensed to permit the widest re-use possible?**

Not defined yet.

**When will the data be made available for re-use? If an embargo is sought to
give time to publish or seek patents, specify why and how long this will
apply, bearing in mind that research data should be made available as soon as
possible.**

Not defined yet.

**Are the data produced and/or used in the project useable by third parties,
in particular after the end of the project? If the re-use of some data is
restricted, explain why.**

Not foreseeable at this stage.

**How long is it intended that the data remains re-usable?**

For the duration of the project.

**Are data quality assurance processes described?**

Not defined yet.

#  4\. Allocation of resources – the whole consortium

According to the Horizon 2020 rules, costs related to open access to research
data are eligible for reimbursement during the duration of the project under
the conditions defined in the COMPACT Grant Agreement, in particular Articles
6 and 6.2.D.3.  9  These are direct costs, related to subcontracting of
project tasks, such as subcontracting the open access to data.

**What are the costs for making data FAIR in your project?**

Within the COMPACT project, AIT has a budget for making accepted scientific
articles open access. The originally planned amount for making data FAIR is
10.000 EUR. Currently, two journal articles have been submitted and will be
funded from the reserved budget if the articles are going to be accepted. CINI
and INOV do not foresee any data management costs to make data FAIR.

**How will these be covered? Note that costs related to open access to
research data are eligible as part of the Horizon 2020 grant (if compliant
with the Grant Agreement conditions).**

AIT has reserved the necessary financing for open access costs in its budget
under "other costs".

**Who will be responsible for data management in your project?**

A specific role, namely the Data Protection Officer (DPO), has been created by
the COMPACT project to address data management issues at consortium-level.
Salvatore D’Antonio from CINI has been appointed as DPO and is responsible for
the coordination of the interactions between the consortium and the Data
Protection Authorities (DPAs) located in partners’ countries. The DPO is the
common interface of the COMPACT consortium towards external entities and
bodies dealing with data protection and management. DPO is also in charge of
supporting and coordinating the activities performed by the Data Controllers
that have been appointed by each COMPACT partner. The role of local Data
Controller is to implement the data protection and management policies each
LPA has defined. This means that the storage and management of the data
locally collected is under control and responsibility of each Data Controller.

**Are the resources for long term preservation discussed (costs and potential
value, who decides and how what data will be kept and for how long)?**

Not defined yet.

#  5\. Data security

###  5.1.1. AIT

**What provisions are in place for data security (including data recovery as
well as secure storage and transfer of sensitive data)?**

The data is only stored internally within AIT facilities, which provide state
of the art IT security. State of the art IT security measures and company
policies mitigate most of the risk of an illegitimate access. Firewalls (to
prevent illegitimate access from outside) and a rights-based-file system (to
prevent illegitimate access from inside) are the countermeasures against this
risk.

**Is the data safely stored in certified repositories for long term
preservation and curation?**

The data is only stored internally within AIT facilities, which provide state
of the art IT security. If the scientific data will be published, it will be
made open access. Again, this depends on the journal.

###  5.1.2. CINI

**What provisions are in place for data security (including data recovery as
well as secure storage and transfer of sensitive data)?**

Regarding security, all of the data collected will be stored into a database
only accessible to authenticated users on the partner’s premises. Regarding
data recovery, database backups will be stored on premises and only accessible
to CINI. Sensitive data will never be transferred outside LPA premises, unless
it has been previously anonymised.

**Is the data safely stored in certified repositories for long term
preservation and curation?**

It is not definitive in this phase.

###  5.1.3. INOV

**What provisions are in place for data security (including data recovery as
well as secure storage and transfer of sensitive data)?**

Regarding security, all the data collected will be stored on a database only
accessible to authenticated users on the partner premises. Regarding the data
recovery, database backups will be stored on premises and only accessible to
INOV.

**Is the data safely stored in certified repositories for long term
preservation and curation?**

It is not definitive in this phase, but it is not expected to store the
collected data in a repository.

#  6\. Ethical and legal aspects

**Are there any ethical or legal issues that can have an impact on data
sharing? These can also be discussed in the context of the ethics review. If
relevant, include references to ethics deliverables and ethics chapter in the
Description of the Action (DoA).**

Addressing legal and ethics challenges is an important part of the COMPACT
work plan. As already indicated in the Section 5 of the Description of the
Action, special attention has been paid to these issues since the very
beginning of the project. A legal partner (KUL) forms part of the consortium,
handling guidance and providing relevant expertise. Internal ethics controls
in COMPACT include setting up an internal ethics committee and defining
checklists for project compliance, as per Task 1.4. The consortium has also
appointed an ethics and privacy manager.

Moreover, a dedicated work package (WP8) deals specifically with ethics
requirements, such as notifications to competent data protection authorities
(POPD - Requirement No. 4), authorisation for use of non-public data (POPD -
Requirement No. 5) and details on preventing the misuse of research findings
(M - Requirement No. 6). All these requirements have been duly met by relevant
partners.

SELP, or security, ethics, legal and privacy, is one of the building blocks of
setting up COMPACT products. Specific tasks have been allocated to deal with
SELP aspects of COMPACT (T2.5, T3.4), especially research ethics, privacy
rights and data protection regime under the GDPR. Nevertheless, a DMP is on
principle not part of general GDPR compliance due to the latter’s slightly
different scope of application. Namely, the GDPR applies to processing of
personal data. Personal data are defined in Art. 4(1) of the GDPR as any
information relating to an identified or identifiable natural person (‘data
subject’). Open research data, on the other hand, can be any kind of data
resulting from research, whether personal, pseudonymised (which are still
personal data), anonymised formerly personal data, but also data from
(chemical) lab trials, industrial data or any kind of data that have no
connection to an individual person, thus falling wholly outside the scope of
the GDPR.

However, should personal data be used as part of the DMP, they will be
anonymised, or if that is not possible, they will be pseudonymised according
to the current state of the art, and the additional information necessary for
re-identifying the individual will be kept separately (according to Art. 4(5)
of the GDPR). Pseudonymisation is a permissible measure for data protection in
research, according to Art. 89; nevertheless, if possible, further
identification should not be possible. Moreover, for personal data processed
in the context of COMPACT trials, relevant controller-processor agreements for
data sharing will be concluded between end users and technology partners.

**Is informed consent for data sharing and long term preservation included in
questionnaires dealing with personal data?**  
  
<table>  
<tr>  
<th>

Informed consent forms & information sheets – updated to reflect the GDPR
requirements

The internal ethics committee has provided COMPACT partners with informed
consent forms and information sheets, updated to reflect the new GDPR
requirements. The information requirements are laid down in Art. 13 and 14.
Accordingly, the information sheets give research participants information
about, inter alia:

  * Purposes of data collection, data processing and data analysis 

  

  * Types of personal data processed 

  

  * Transfer of their personal data between their employer/LPA and the relevant technical partner(s), involved in the trials 

  

  * The rights they have as data subjects, and information on how to exercise them - The period for which the data will be stored 

  

The participants will receive the information sheet together with informed
consent forms before they start trials. They have the right to withdraw from
research at any time without any adverse consequences.

</th> </tr> </table>

#  7\. Other

**Do you make use of other national/funder/sectorial/departmental procedures
for data management? If yes, which ones?**

Not defined yet.