What are a university's obligations under DCSA when faculty research produces classified or export-controlled records?

When faculty research touches national security work, a university can become a cleared contractor under the Defense Counterintelligence and Security Agency (DCSA), which administers the National Industrial Security Program (NISP). That status carries concrete recordkeeping obligations that records and information governance staff should understand, even if the day-to-day security work sits with a facility security officer (FSO).

Safeguarding Classified Records

If a project generates classified material, the institution must protect those records according to its security agreement and the NISP operating manual. In practice this means:

• Marking documents and media with the correct classification level and any control notices.
• Storing classified records only in approved containers, spaces, or accredited information systems.
• Limiting access to personnel with the appropriate clearance and a genuine need to know.
• Maintaining accountability records that track who holds, transmits, or destroys classified material.

Classified records remain government information. The university typically cannot unilaterally declassify them; classification and downgrading decisions follow the originating agency’s authority and the executive order framework overseen by the Information Security Oversight Office.

Export-Controlled and CUI Records

Some research does not produce classified material but still generates export-controlled technical data (under ITAR or the EAR) or Controlled Unclassified Information (CUI). These records carry their own handling, access, and dissemination limits. CUI must be marked, safeguarded, and shared only as the category permits, and export-controlled data may be restricted from access by foreign nationals absent a license.

Practical Recordkeeping Steps

• Identify, at award or project intake, whether work may yield classified, export-controlled, or CUI records.
• Apply retention and disposition rules that match the sponsor’s requirements rather than ordinary academic schedules; do not destroy or release such records without authorization.
• Keep audit trails for creation, transfer, and destruction so the institution can demonstrate compliance during DCSA reviews.
• Coordinate FOIA or public-records requests carefully, since classified and export-controlled material is generally exempt from release.

The core principle is stewardship, not ownership. The university holds these records on behalf of the government and must safeguard and dispose of them under federal rules. To learn more, see the declassification topic hub.