Getting started with computing and storage for highly sensitive data
The High Security Zone (HSZ) supports research projects that involve controlled-access, regulated, or otherwise highly sensitive data. This environment provides secure computing and storage that meet institutional and regulatory requirements for working with sensitive research data.
Access to High Security Zone resources is project-based and must be initiated by an eligible Principal Investigator (PI).
What data is permitted in the High Security Zone?
The High Security Zone is required for projects involving:
- Controlled-access research data (e.g., dbGaP, NDA)
- Regulated data (e.g. FERPA)
- Personally identifiable information (PII)
- Controlled Unclassified Information (CUI)
- Export-controlled or ITAR-restricted data
Different systems within the HSZ support different data types. Some highly regulated data (such as CUI or export-controlled data) requires additional isolation and cannot be processed on all HSZ systems.
Not sure how your data is classified?
Review UVA’s data protection standards and data sensitivity matrix for more detailed information or contact Research Computing for guidance.
What systems are available in the High Security Zone?
The High Security Zone includes secure virtual machines and high-performance computing resources designed to support both interactive and large-scale analysis of highly sensitive data.
Secure Virtual Machines (Ivy)
Ivy provides secure virtual machines designed for working with highly sensitive research data. Ivy VMs support interactive analysis, data preparation, and day-to-day project workflows in an environment that meets heightened security requirements.
Projects use Ivy to work directly with sensitive data, run interactive tools, and collaborate with approved team members. Storage for the project is mounted directly to the virtual machine, allowing data to be accessed consistently across secure systems.
Some Ivy Linux virtual machines also serve as a secure entry point to high-performance computing resources, enabling projects to move from interactive work to large-scale analysis when needed.
Access to Ivy is project-based and managed through additional security requirements.
What can you do on Ivy?
- Work interactively with sensitive data in a secure environment
- Prepare, clean, and analyze datasets
- Use tools such as JupyterLab, RStudio, and desktop-based applications
- Collaborate with approved project members
Learn more about Ivy virtual machines
High Performance Computing Rio
Rio is a secure high-performance computing system designed for large-scale analysis of highly sensitive research data. It is used for projects that require significant compute capacity and meet strict security and compliance requirements.
Access to Rio is project-based and requires an Ivy Linux virtual machine, which serves as the secure login point to the system.
Projects involving Controlled Unclassified Information (CUI ) or export-controlled data cannot use Rio at this time.
What you can do on Rio:
- Run compute-intensive analyses and simulations on sensitive datasets
- Schedule jobs that run in the background and complete over time
- Process large datasets that exceed the capacity of an interactive system
Storage in the High Security Zone
High Security Zone storage is tightly integrated with Ivy and Rio to support secure data access.
- Each project receives High Security standard storage by default
- Additional project storage may be requested for larger or performance-sensitive workloads
- All HSZ storage is encrypted and access-controlled
- Storage access is automatically managed based on project membership
How access works
Access to the High Security Zone includes additional requirements beyond standard research computing to protect highly sensitive research data.
Access is provisioned only after all of the following are met:
- A PI initiates the project and submits the request
- Project members may be added at the time of a new project request. A project page in our Services App is used to manage project members and find a general overview of the project.
- Required institutional approvals are in place (for example, IRB or regulatory review)
- Each project member completes all required security training and agreements
These steps ensure that highly sensitive research data is accessed and handled in compliance with University and regulatory requirements.
Ready to request?
Step 1: Confirm approvals and requirements
Before requesting HSZ resources, ensure the following are complete:
- Required institutional approvals (e.g., IRB, regulatory review)
- Any project-specific data use agreements
- Identification of all project collaborators
Step 2: Complete required security training
All HSZ users must complete High Security Awareness Training (HSAT) before access is granted to the High Security Virtual Private Network (HSVPN). Training is brief and can be completed online.
Complete High Security Awareness Training
Users with HSVPN access must complete the HSAT each academic year (July 1 - June 30) or access to the HSVPN will be revoked.
Users working with CUI data must complete additional training. This is done through the Office of Research Data Security.
Step 3: Understand high security access requirements
Access to High Security Zone systems requires additional security controls to protect sensitive research data.
These include:
- Completion of required security training
- Multi-factor authentication (MFA)
- High Security VPN (HSVPN) access
- Compliance checks on personal devices (Opswat)
Users in the Health System should work with HIT to configure their devices for HSVPN compliance.
You don’t need to complete these steps before submitting a request. After your request is approved, you’ll receive step-by-step instructions tailored to your role and the systems you’ll use.
Step 4: Submit your request
Once prerequisites are met, submit the appropriate request for your project:
- Ivy virtual machine request
- Rio HPC access request (via Ivy Linux VM)
Additional storage can be requested after the project is provisioned. You’ll be asked to provide project details and approval documentation.
What to expect next
Provisioning
Requests are reviewed to verify eligibility, process necessary billing information, and verify IRB if required. Provisioning timelines may vary based on approvals.
Access confirmation
You’ll receive an email confirming access and outlining the next steps for connecting to secure systems.
Ongoing management
Use the Services App to manage project membership. PIs can request to add or remove members to the project through the application.
This environment provides secure computing and storage that meet institutional and regulatory requirements for working with sensitive research data.