In accordance with updated NIH policy (NOT-OD-25-159), all NIDDK-CR Requestors and Requesting Institutions will be required to attest to implementation of applicable NIST security controls (e.g., NIST SP 800-171 or equivalent ISO standards) before accessing or continuing access to NIH controlled-access data. Beginning April 1, 2026, users must attest to meeting these security standards to maintain eligibility for data access.

For institutions that are unable to meet the required security controls, NIDDK-CR can provide a secure cloud-based analytics workbench. This NIDDK-CR managed environment meets federal security requirements and allows approved users to analyze controlled-access data without downloading it to local systems. Requestors and Requesting Institutions will still be responsible for complying with other applicable data security and privacy policy expectations.

Additional details regarding the security attestation process and analytics workbench will be provided soon. Please contact NIDDK-CR Support with any questions.