IT Policy and Security

NIH staff and affiliates only

The information security policies are geared towards users inside the NIH network. If you need any information related to information security policies please contact nihisaopolicy@mail.nih.gov. If you have questions about general IT policies please contact nihciocommunications@mail.nih.gov.

NIH information security and policy

Explore NIH policies, standards, and guidance that support secure, compliant, and effective use of technology across the NIH enterprise. Use these resources to understand requirements, best practices, and governance for NIH information systems and services.

NIH Enterprise Architecture Policy

Portfolio management framework and requirements

NIH Smart Card Authentication

Portfolio management framework and requirements

NIH Network Device Standard

Requirements for PIV card access and authentication

NIH security training

Access NIH's official Information Security Training portal to complete required cybersecurity and privacy awareness courses. Find training resources for NIH staff, contractors, and public users to help protect sensitive information and support a secure research environment.

Explore tools and platforms

Health and Human Services IT policies

HHS Policy for Information Technology Portfolio Management

Portfolio management framework and requirements

HHS Enterprise Performance Life Cycle (EPLC) Policy

IT project lifecycle management standards

HHS Policy for Rules of Behavior for Use of Information and IT Resources

Acceptable use and behavior standards

Accessibility Standards

Section 508: Digital accessibility at NIH

HHS Section 508 and Accessibility of Technology Policy

Resources and guidance for Section 508 compliance

Contact Us

General IT Policy

Email: nihciocommunications@mail.nih.gov
Phone: 301-496-1168

Information Security Policy 

Email: nihisaopolicy@mail.nih.gov