Research security case management

Research security case management, from flag to signed decision.

A flag is where your office's work starts. SYSWERX Cases carries every flagged researcher from triage to a signed decision: every finding settled, every request tracked, and a record your office can defend to faculty, counsel and sponsors years from now.

What a research security case has to hold

Track it. Document it. Defend it.

A research security office has to review researchers consistently and show how each decision was made. Most offices start with spreadsheets, shared drives and email. That holds until someone asks how a decision was made, who approved it, and whether the file has changed since.

Track

Who is flagged, and who is on it.

Every flagged researcher, whether a case is open, who owns it, what is waiting on whom, and what is overdue.

Document

What was found, and what was said.

Each finding and how it was settled, every request to the researcher and their answer, and every referral to another office, with names and dates.

Defend

How the office decided.

The outcome, the written rationale, who proposed it and who approved it, and proof that the record hasn't changed since.

How SYSWERX Cases works

From triage to sign-off, step by step.

Cases works from the same cited record as the screening, so each finding starts from the evidence behind it.

01 Triage

Nothing flagged slips through.

  • Researchers on your roster who are flagged, with no open case, wait in a triage queue.
  • Open, overdue, escalated and unassigned cases are counted at the top.
  • A shared board by stage: to review, in review, escalated, awaiting approval.
  • Lead, Analyst and Viewer roles, assignments, @mentions and in-app notifications. Emails say something needs attention, never what.
Cases Eastbrook University · Research Security · 5 open
5
Open
2
Overdue
1
Escalated
3
Needs triage
3 researchers flagged without an open casefrom your monitoring roster · click to review
To review1
Wren Halvorby
ELEVATED2d
In review2
Helen Achterhof
MODERATE1d overdue
🔒 Marcus Ordale
HIGHAUOct 11
Escalated1
Dana Vellacourt
HIGHAU3d overdue
Awaiting approval1
Tomas Lindqvarn
ELEVATEDLUOct 7
Sample case board · fictional researchers
02 Settle the findings

Every finding, settled one by one.

  • Each item from the latest screening becomes a finding on the case: an appointment, a funder, a talent program, a tie to a listed entity.
  • Settle each as disclosed, not disclosed, not the subject, resolved, or no concern, with a note and a name.
  • Documents on file for the researcher sit with the case: disclosures, appointment letters, and their answers.
Findings 2 of 6 settled
Harbin Institute of Technology Critical
ORCID invited position · on 7 papers
Visiting professorship (2022 to present) is on ORCID and on 7 papers; not on the 2025 Current & Pending.
Not disclosed
Northwestern Polytechnical University Critical
On two 2024–2025 papers · not on ORCID
Under review
National Natural Science Foundation of China State
8 acknowledging works
Disclosed
Sample case · fictional researcher
03 Requests and referrals

Ask the researcher. Bring in other offices.

  • Ask the researcher for an updated Current & Pending (Other) Support through a private upload link. The link can't open the case.
  • Refer to Export Control, counsel, Sponsored Programs, COI or Research Integrity, with a due date. Overdue items are called out.
  • A secure link lets a reviewer in another office read the case file until the link expires. Their answer lands on the case.
Requests & referrals 2 waiting · 1 overdue
● WaitingReferral →Export Control
Export-control review
Sent Oct 2 · due Oct 15
Mark received
● OverdueRequest →Dana Vellacourt
Updated Current & Pending (Other) Support
Sent Sep 24 · due Oct 4 · 2 days overdue
Mark received
● ReceivedReferral →Office of General Counsel
Legal review of the appointment letter
Sent Sep 26 · answered Oct 1 through a secure link
Sample case · fictional researcher
04 Decide

A decision your office can explain.

  • Closing a case takes an outcome and a written rationale.
  • Two-Lead sign-off when your policy calls for it: one Lead proposes, a second approves, and nobody approves their own proposal.
  • A mitigation plan keeps working after sign-off: measures with owners and due dates, and a date to review the case again.
Decision & sign-off
Outcome
Mitigation plan in place
Visiting appointment disclosed; conditions on lab access and travel.
Sign-off rule
Two Leads for serious outcomes
Proposed by one Lead, approved by a second.
Rationale · required to close

Visiting appointment confirmed from the 2022 letter and now disclosed. No current funding from the appointing institution. Lab access and travel conditions agreed with Export Control and the researcher.

Mitigation plan 3 measures · 1 done
● DoneDisclosure update
Updated Current & Pending (Other) Support filed
Owner: Dana Vellacourt · done Oct 3
● In progressTechnology control plan
Lab access reviewed with Export Control
Owner: Export Control · due Nov 14
● PlannedTravel conditions
Briefing before any visit to the appointing institution
Owner: Research Security · before travel
Review the case again on Apr 6, 2027 · the case is flagged when it's due
Sample case · fictional researcher
05 Defend

A case file that proves itself.

  • Every change is recorded in a tamper-evident chain your team can verify with one click.
  • The case file carries the findings, requests, referrals, decision, rationale, signature blocks and the audit result.
  • The case package is one download: the case file, every document on file, and a fingerprint for each file so anyone can check a copy.
Audit trail Verify
✓Verified — 10 chained entries since Sep 6, 2026
Fingerprint 733e6909eb60b9b63f08aa028ac770c8822b8a7543d5c6cc8123823c42df2d01
Opened
#1 · 2f8a…c41e
Sep 15
Finding settled
#4 · 91d0…77ab
Sep 28
Referral sent
#7 · b3e6…09f2
Oct 2
Proposed
#9 · 5c1d…e8a7
Oct 5
Approved
#10 · 733e…2d01
Oct 6

Each entry carries the fingerprint of the one before it. Edit, delete or reorder any entry and the chain breaks.

Case package one .zip download
PDF
Case file · Dana Vellacourt
Findings, requests, referrals, decision, rationale, signature blocks, audit result
Confidential
DIR
Documents · 4 files
Current & Pending (2025) · Appointment letter (2022) · Updated Current & Pending (2026) · Export Control memo
TXT
Fingerprints
A SHA-256 fingerprint for every file, and how to check a copy
Sample case · fictional researcher
Built for sensitive reviews

Need to know, enforced by the server.

Research security cases touch careers, funding and reputations. Who can see a case is decided on the server, not by hiding a button.

Restricted cases

Only the people named on it.

Mark a sensitive case restricted and name who may see it. The case owner and your Leads always can. For everyone else on the team it doesn't appear on the board, and its documents won't open.

Monitoring

New facts land on the case.

The roster is screened again on a schedule set by risk, and whenever the watchlist changes. Each new screening shows on the case timeline, and alerts say what changed.

Foreign travel

Travel concerns, in the same file.

With Program, a travel debrief that raises a concern goes to the researcher's case in one click, so the travel record and the review stay together.

Program reporting

Show the program works.

My Institution watches the whole roster, shows exposure by department, and exports a one-page program summary, plus a roster and case log, for leadership. The summary names no researcher.

Why not a spreadsheet?

Spreadsheets track cases. They can't defend them.

The questionSpreadsheets and emailSYSWERX Cases
Who's flagged without a case?Whoever remembers to check the list.A triage queue fills itself from your monitoring roster.
What did the researcher disclose, and when?Somewhere in an inbox or a shared drive.The request, the upload and the date, on the case.
Who approved the decision?A reply-all, if anyone kept it.A named Lead, a written rationale and, when your policy calls for it, a second Lead's approval.
Has the record changed since?No way to tell.Verify the audit chain with one click.
Can counsel have the file?Someone assembles it by hand.One case package: the case file, every document, and a fingerprint for each.
Questions offices ask

Research security case management, answered.

What is research security case management?

It's how a research security office carries a concern about a researcher from the first flag to a documented decision: what was found, what the researcher was asked, which offices weighed in, what was decided and why, and who approved it. It's how an office shows that its reviews are consistent and its decisions are documented.

Does a flag mean the researcher did something wrong?

No. A flag is a reason to look, not a finding. Screening output is a preliminary prioritization aid. The case is where your office checks the facts, hears from the researcher, and decides. A clean result is never a clearance either.

Who can see a case?

Your team, by role: Leads decide, Analysts work cases, Viewers read. A restricted case opens only for the people named on it, its owner and your Leads. Email notifications say that something needs attention, never what.

What does the researcher see?

Only what your office sends: a request, and a private upload link for their documents. The link can't open the case.

Can we share a case with counsel or another office?

Yes. Send a referral with a secure link that opens the case file until it expires, or download the case file or the full case package. The referral and the answer are recorded on the case.

How does it fit NSPM-33?

Every case ends in a documented decision with its findings, rationale and approvals, and My Institution rolls them up into a program summary for leadership. How SYSWERX supports NSPM-33 →

Get started

See a case go from flag to signed decision.

Bring a researcher you'd review anyway. We'll open the case, settle the findings, and show you the case file it produces.