USC Facebase IV Craniofacial Development and Dysmorpholoy Data Management and Integration Hub (FaceBase IV))

About This Grant

PROJECT SUMMARY / ABSTRACT FaceBase is an NIH-supported data resource that curates and distributes craniofacial and dental research data to the international scientific community, including controlled-access human-subject datasets governed under the NIH Genomic Data Sharing policy. Recent NIH policy (NOT-OD-24-157 and the accompanying Security Best Practices for Controlled-Access Data Repositories) requires all NIH-supported controlled-access data repositories to attest to compliance with NIST Special Publication 800-53 Revision 5 at the Moderate baseline, with attestation deadlines beginning in 2025 and continuing through 2026. In parallel, NIH expects integration with its Researcher Auth Service (RAS) to provide federated, GA4GH-compliant identity and authorization for researchers accessing controlled data across NIH-supported repositories. Neither requirement existed when the parent FaceBase IV award was reviewed and funded, and neither is achievable within the parent budget. This administrative supplement supports the focused, time-bounded program of work required to bring FaceBase into compliance with these new requirements and to preserve uninterrupted access to its controlled-access datasets for the craniofacial research community. The work is performed by USC Information Sciences Institute research software engineers in partnership with an external contractor specializing in NIST SP 800-53 compliance for federally-funded research data systems. The contractor facilitates production of compliance artifacts — the System Security Plan, the Plan of Action and Milestones, and supporting documentation — while USC ISI engineers perform the technical hardening of the FaceBase platform and the RAS integration engineering. The supplement period of performance is seven months, running from June 1, 2026 through December 31, 2026. During Months 1 to 3 (June through August 2026) the team will define the FaceBase authorization boundary, perform a gap analysis against the 800-53 Moderate baseline, implement the highest-priority technical and operational controls, and produce drafts of the System Security Plan and Plan of Action and Milestones. During Months 4 to 7 (September through December 2026) the team will finalize the System Security Plan and Plan of Action and Milestones, deliver the attestation submission package to NIH by the September 2026 deadline, advance the RAS technical integration on the NIH Center for Information Technology onboarding timeline, begin remediation of items captured in the Plan of Action and Milestones, and stand up the continuous monitoring activities the System Security Plan commits to. Because the underlying Deriva data management platform supports multiple NIH-funded data resources, the documentation patterns, software components, and lessons learned developed under this supplement will be released to benefit other NIH controlled-access repositories facing the same compliance obligation.