Information Sheet

Information Sheet for Research Study

Principal Investigator: Julie Haney, National Institute of Standards and Technology (NIST)

Study Title: Organizational Cybersecurity Attitudes and Practices Survey

Study Site(s): Online survey

You are invited to participate in a research study. Your participation is voluntary. This document explains information about this study. You should read the information below and ask questions about anything that you do not understand. A researcher will be able and available to answer your questions.

PURPOSE

The purpose of this study is to understand what various cybersecurity stakeholder groups think about the role of people and human behavior in the overall cybersecurity of organizations. This study will help NIST develop cybersecurity standards and guidance.

We are asking you to take part in this research study because you are an adult (18+ years of age) who is fluent in English and: 1) works part- or full-time job in an organization and regularly uses a computer as part of your job or 2) is researcher or practitioner working in human factors, human-computer interaction, or related fields.

PARTICIPANT INVOLVEMENT

If you decide to take part in this study, you will be asked to complete an online survey. The survey is expected to take about 15 minutes to complete. During the survey, you will be asked about your own role in your organization and your thoughts about organizational cybersecurity practices, attitudes, and the involvement of different employee roles in cybersecurity. You will not be compensated for your participation.

CONFIDENTIALITY

The members of the research team, NIST Research Protections Office (RPO) to include the Institutional Review Board (IRB), and the Office for Human Research Protections (OHRP) may access the data. The IRB reviews and monitors research studies to protect the rights and welfare of you, the research subject. This study has undergone an ethics review by the NIST Research Protections Office to ensure compliance with United States (U.S.) Federal Policy for the Protection of Human Subjects (The Common Rule), codified by the Department of Commerce at 15 C.F.R. Part 27.

The study also meets the University of Oulu’s criteria for ethics in research.

Your responses will be anonymized. Any identifiers will be removed so that the data is not associated or linked back to you by anyone, including the researchers.

The data collected will be used and stored for future use. When the results of the research are published or discussed in conferences, presentations, journals, or online data repositories, no identifiable information will be used

POSSIBLE RISKS

This research is considered to be minimal risk. That means that the risks associated with this study are the same as what you face every day. There are no known additional risks to those who take part in this study. There is a very small risk that someone who is not authorized could get access to the data. However, data will be anonymized and not linked back to you. Data will be stored on protected computers and servers. Data will be retained per NIST record-keeping requirements for five (5) years after the study is closed.

INVESTIGATOR CONTACT INFORMATION

If you have any questions about this study, please contact Julie Haney at julie.haney@nist.gov.

RPO/ IRB CONTACT INFORMATION

If you have any questions about your rights as a research participant, please contact the NIST Research Protections Office and/or Institutional Review Board at 301-975-5445 or email rpoffice@nist.gov.

You should only decide to participate if the following is true for you:

I understand the above description of the research and the risks and benefits associated with my participation as a research subject. I understand that by proceeding to the next page, I am choosing to take part in this research voluntarily with this survey.

If you are a U.S. Federal Government employee and are participating during work hours, you should only decide to participate if the following is also true for you:

I understand I am responsible for assuring I have approval to participate in this research as a part of my official duties.

DO NOT SIGN THIS INFORMATION SHEET.

PLEASE KEEP IT FOR YOUR RECORDS.

2