Design choices for productive, secure, data-intensive research at scale in the cloud

Alvaro Cabrejas Egea; Catalina A. Vallejos; Catherine Lawrence; Claire Austin; David Beavan; Diego Arenas; Evelina Gabasova; Franz Kiraly; Helen Sherwood-Taylor; Ian Carter

REVIEW 3 major objections 5 minor 49 references

Design choices for productive, secure, data-intensive research at scale in the cloud

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes that secure data research be organised around five sensitivity tiers, with a separate software-defined environment per work package, to maximise productivity while minimising risk.

desk verdict A well-structured, practical framework for tiered secure research environments; the unvalidated tier-classification step is the main soft spot, but it deserves serious referee attention. read the letter →

arxiv 1908.08737 v2 pith:TNMRICVP submitted 2019-08-23 cs.CR

Diego Arenas , Jon Atkins , Claire Austin , David Beavan , Alvaro Cabrejas Egea , Steven Carlysle-Davies , Ian Carter , Rob Clarke

show 17 more authors

James Cunningham Tom Doel Oliver Forrest Evelina Gabasova James Geddes James Hetherington Radka Jersakova Franz Kiraly Catherine Lawrence Jules Manser Martin T. O'Reilly James Robinson Helen Sherwood-Taylor Serena Tierney Catalina A. Vallejos Sebastian Vollmer Kirstie Whitaker

This is my paper · ORCID

classification cs.CR

keywords datasafehavenssensitivitytiersworkpackageclassificationsoftware-definedinfrastructuresecureresearchenvironmentsingressandegressgovernance

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is trying to establish a standard way to design secure research environments, so that data-intensive projects are not forced to choose between safety and speed. It proposes five sensitivity tiers—Tier 0 for fully open data, Tier 4 for data whose disclosure could threaten lives or national security—and recommends specific policies at each tier for data classification, data ingress and egress, software ingress, user access, device management, and analysis environments. The load-bearing operational claim is that software-defined infrastructure makes it feasible to instantiate a fresh, isolated environment for each work package, so the controls always match the sensitivity of the work actually being done. Classification is done on work packages, not datasets, because sensitivity changes as data is combined, anonymised, or analysed. A sympathetic reader would care because this gives research organisations a concrete, auditable template for operating data safe havens without either over-classifying, which pushes researchers to circumvent security, or under-classifying, which risks legal sanction and loss of public trust.

What carries the argument

The central machinery is a five-tier sensitivity model (Tier 0 open data; Tier 1 private but publishable; Tier 2 pseudonymised or non-personal data and low-impact confidential data; Tier 3 personal data and sensitive commercial or government data; Tier 4 data whose disclosure threatens safety or national security), paired with a classification flowchart that assigns a work package to a tier based on GDPR-style definitions of personal, pseudonymised, and anonymised data. The other half of the machinery is software-defined infrastructure: every environment is described as code and instantiated per project from scripts, so isolation and policy are auditable and reproducible. A management application, which has no authorisations of its own and drives infrastructure only through the logged-in user's forwarded credentials, implements the business processes—data ingress via time-limited write-only tokens, software ingress via an airlock review volume, and egress via formal reclassification as a new work package. Independent referees drawn from a college review classifications at Tier 2 and above and at egress, providing a check on the self-interest of both researchers and data providers.

What would settle it

A concrete test: deploy two equivalent data-science teams on the same tasks, one governed by this five-tier framework and one under a single high-security environment, and measure time-to-first-analysis, rate of attempted copy-out, and number of classification disputes. If the tiered framework does not reduce productivity loss without increasing incidents, the claim that it maximises productivity while minimising risk is not supported.

Watch

Extended reading notes

Core claim

The paper's central claim is that the right unit of security design is not the dataset but the work package—a phase of research with a specific outcome, intended analyses, and expected outputs—and that work packages should be assigned to one of five sensitivity tiers. At each tier, a specific combination of controls (who can bring data in, how software enters, how results leave, what devices and networks can connect, and what physical space access happens in) should be configured separately and independently for each project. The authors argue that with software-defined infrastructure, a new isolated environment can be scripted for every work package, meaning that a project can move from identifiable personal data at Tier 3 to anonymised data at Tier 2 simply by instantiating a new environment and transferring the derived data through a formal reclassification process. On this view, security is not a single fortress but a set of tiered rooms, each with its own door, and the management process—including independent referees for high tiers and a web application that acts only with forwarded user credentials—is what keeps the doors correctly labelled.

Load-bearing premise

Everything rests on the organisation already having a software-defined infrastructure platform, running in a certified secure data centre, that can script the creation of isolated virtual machines, storage, and virtual networks for each project; without that precondition, no per-project tiered environment can be instantiated.

Editorial extensions

If this is right

A research organisation can run many projects simultaneously at different tiers, giving each work package exactly the controls it needs rather than forcing all sensitive work through one maximum-security procedure.
Because environments are instantiated from scripts and processes are logged in the management application, an external auditor can see, for each project, which tier was assigned, who approved it, and what entered and left the environment.
Any data leaving a secure environment is treated as a new work package and reclassified, so publishing outputs or moving derived data to a lower tier becomes a formal, referee-checked event instead of a casual copy-out.
Software for high tiers can be supplied through internal package mirrors—full at Tier 2, whitelisted at Tier 3 and above—so researchers retain modern tooling without opening the environment to the internet.
The gap between Tier 2 and Tier 3 is where the model does most of its work: it is the boundary at which devices must become managed, networks restricted, physical spaces secured, and copy-paste disabled.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An implication the authors leave implicit is that the framework could be turned into a quantitative benchmark: a productivity-drag coefficient per tier, measured as time-to-first-analysis, would let organisations test whether their tier policies achieve the stated balance; the framework predicts a sharp step between Tier 2 and Tier 3.
The work-package ontology suggests a natural extension to persistent data facilities: the model currently deletes datasets when projects end, but the same tier machinery could later support many-to-many dataset-environment relationships by composing tiered environments rather than reclassifying entire facilities.
A testable extension would be to apply the framework in a static on-premises data centre that cannot script per-project isolation; the authors' own assumptions imply that such a site could not deliver the productivity benefits or auditability, which would pin down how much of the value comes from the tiers versus the software-defined infrastructure.
The paper notes that no output-checking guidelines exist for complex machine-learning models; a concrete follow-up would be to develop egress criteria for trained models and synthetic datasets, building on the referee-review process the paper proposes.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is a genuinely useful design proposal, not a research result. It should be peer-reviewed, but with the expectation that the authors add an evaluation plan and address the classification-confidence problem.

What is new: they don't just propose high-level safe haven charters; they specify five tiers, and for each tier, concrete controls covering data classification, ingress/egress, software ingress, user devices, connectivity, and analysis environment. The work-package-level classification (instead of dataset-level) and per-project software-defined environments are both sensible and fairly original; the referee college is a thoughtful complement to existing practice. The paper is grounded in UK government classifications, GDPR, and ISO 27001, and it is unusually honest about assumptions: it states the need for SDI/ISO27001 in §1.2.3, excludes data-centre/organisational security, and explicitly defers the reference implementation. The citations cover UKSeRP, Secure Lab, ONS, CASD, DataSHIELD, GA4GH, etc. The missing Five Safes is a real oversight in related literature, worth adding, but not damaging.

The main soft spot is the classification step. The whole risk/productivity argument rests on assigning work packages to tiers correctly. The paper uses 'absolute/strong/weak confidence' in re-identification risk with no operational definitions, no calibration, no validation, and no inter-rater discussion. That matters because they themselves say over- and under-classification are major drivers of productivity loss and risk, and they cite Rocher et al. showing re-identification is often easier than expected. In practice, Tier 2 versus Tier 3 is a consequential decision: Tier 2 allows open devices and policy-only copy-paste restrictions, while Tier 3 requires managed devices and enforced copy-paste blocking. If classifiers overestimate confidence, sensitive data ends up in Tier 2. The paper would be stronger with a calibration procedure, a worked example, or even a protocol for documenting confidence. This is not fatal to the framework—any tiering scheme requires judgment—but the 'maximise productivity and minimise risk' phrasing overstates what is currently demonstrated.

A second, smaller point: the Tier 2 policy of 'copy-paste forbidden by policy but not enforced' seems in tension with the authors' own workaround-breach assumption. They argue convenience makes workaround breach likely, so blocking by policy only at Tier 2 may need more defence.

Overall: the paper is a well-organised, pragmatic contribution for research infrastructure teams. It does not need to be empirically validated to be worth publication as a design pattern, but the central claims of productivity and risk need a stated evaluation path. I would send it to review and ask the authors to add a validation section or at least a clear threat-model discussion around classification.

Referee Report

3 major / 5 minor

Summary. This design/position paper proposes a policy and process framework for secure data science research environments. It defines five sensitivity tiers (Tier 0–4) and, for each tier, specifies recommended controls for data classification, data and software ingress/egress, user access, user device management, and analysis environments. The key architectural recommendation is the use of software-defined infrastructure to instantiate an independent, isolated environment for each project (work package). The framework is grounded in UK government security classifications, GDPR, ISO 27001, and a review of existing secure research platforms. The paper does not provide an implementation or empirical evaluation; it states that a reference implementation will be described in a future paper.

Significance. If the framework were adopted, it would give research organisations a standardised and auditable template for operating data safe havens, addressing a gap the authors identify in current technical guidance. The paper makes useful design contributions: classifying work packages rather than datasets, separating the role of independent Referee, using per-project software-defined environments, and specifying concrete controls at each tier. These are sensible synthesising proposals. However, the paper is unvalidated: the abstract's hope to 'maximise researcher productivity and minimise risk' is not supported by any measurement or comparison, and the core classification mechanism relies on uncalibrated human judgment. The framework's value is therefore conditional on the reliability of that judgment.

major comments (3)

[§4.2.1, §3.2–§3.4, Figure 2] The tier assignment procedure depends on subjective confidence levels ('absolute', 'strong', 'weak') about re-identification risk, with no operational definitions, no calibration method, and no evidence of inter-rater agreement. Section 1.2.2 states that over- and under-classification are major drivers of both productivity loss and security risk. Consequently, the framework's central risk-minimisation claim rests on an unvalidated human judgment step. The authors should either ground these confidence levels in a measurable disclosure-risk procedure (e.g., based on statistical disclosure control methods) or explicitly scope the framework's claims to organisations that can demonstrate classifier calibration, and discuss how to mitigate the consequences of misclassification.
[§3.3, §11.10] At Tier 2, copy-paste out of the environment is 'forbidden by policy, but not enforced by configuration', and open devices are permitted. This combination is hard to reconcile with the paper's own assessment that the most significant risk at Tier 2 is 'mistakenly believing data is anonymised, when in fact re-identification might be possible'. If that belief is wrong, the policy-only control will not prevent data exfiltration to an open device. The design should either enforce copy-paste restrictions technically at Tier 2, require managed devices at Tier 2, or add a third intermediate tier that provides a technical boundary for pseudonymised data when confidence is not absolute.
[§1.2.3, §13] The framework's feasibility depends entirely on the availability of software-defined infrastructure offering scripted instantiation in an ISO 27001-compliant data centre. While the authors explicitly scope this as an assumption, the paper does not discuss any fallback or migration path, which limits its practical applicability. The paper would be improved by a section characterising the minimal infrastructure requirements and the consequences of partial availability, since a large part of the claimed benefit rests on this precondition.

minor comments (5)

[§11.8] There is a typo: 'Refeee' should be 'Referee'.
[§3] In the sentence beginning 'The question as towhether', 'towhether' should be 'to whether'.
[§9] 'a side range of common data science software' should be 'a wide range'.
[References, ref [41]] The reference [41] contains 'WGovernment' in the title; it should be 'Government'.
[References, ref [44]] Reference [44] has a mangled author list: 'Hendrickx-Julien M. Rocher, Luc' should be formatted as 'Rocher, L., Hendrickx, J.M., de Montjoye, Y.-A.'

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the framework is a design proposal grounded in external standards and prior practice, and its central claims are stated as objectives rather than derived predictions.

full rationale

This paper is a policy and process design proposal, not a derivation from fitted data or formal equations. The central claim, that the five-tier framework will 'maximise researcher productivity and minimise risk', is presented explicitly as an aspiration ('we hope to maximise...'), not as a result derived from the framework's own definitions. The tier definitions are stipulated design choices informed by UK government classifications, GDPR, ISO 27001, and existing secure research environments (UKSeRP, Secure Lab, CASD, etc.); they do not reduce to the paper's conclusions by construction. The classification process in Section 4 uses subjective confidence terms ('absolute confidence', 'strong confidence', 'weak confidence'), but these are thresholds in a proposed procedure, not parameters fitted to data that are then renamed as predictions. The paper's self-references, such as the MARU project (Section 1.2.3) and the Turing Institute's own environment, are cited as context and experience rather than as load-bearing proof of the framework's effectiveness. The reader's skepticism about uncalibrated confidence judgments is a legitimate correctness and implementation-risk concern, but it is not circularity: the paper does not claim to have validated those judgments. The external precondition of software-defined infrastructure is explicitly scoped as an assumption (Section 1.2.3). No circular step can be exhibited from the text, and the paper is self-consistent as a design recommendation rather than a predictive or fitted model.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

No numeric parameters are fitted to data; the framework is qualitative. No new physical or conceptual entities are introduced; the five tiers, roles, and volumes are organizational constructs defined within the paper, not novel entities requiring independent falsifiable evidence.

assumptions (5)

domain assumption Availability of a software-defined infrastructure provision offering in an ISO 27001-compliant data centre and organisation, supporting scripted instantiation of virtual machines, storage, and secure virtual networks.
Stated in Section 1.2.3 as an assumption. The entire per-project instantiation model depends on this capability.
ad hoc to paper The five sensitivity tiers and their mapping to UK government classifications and GDPR categories are sufficient to represent the sensitivity of research work packages.
Section 3 defines tiers based on UK government classifications and GDPR; the choice of five tiers and their boundaries is a design decision not derived from a formal risk model.
domain assumption A work package, rather than a dataset, is the correct unit for classification, and its sensitivity can be determined by consensus among Investigator, Dataset Provider Representative, and Referee.
Sections 2.2 and 4.1.2 establish classification as an ongoing consensual process; the framework presumes the parties can reach agreement and that classification accurately reflects re-identification risk.
domain assumption Per-project isolated environments prevent cross-project data leakage and mitigate workaround breach.
Sections 1.2.3 and 2.3 rely on instantiation of a different, independent environment per project; no evidence is provided that this isolation holds in practice across the specified tiers.
domain assumption Threat actors at Tier 3 and Tier 4 have bounded capabilities as described, and the specified controls are proportionate to those threats.
Sections 3.4 and 3.5 define threat profiles (hacktivists and criminals at Tier 3, state actors at Tier 4), and Sections 5 to 11 map controls to these profiles without a formal threat model or validation.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Design choices for productive, secure, data-intensive research at scale in the cloud." pith.science (2026). https://pith.science/paper/TNMRICVP

@misc{pith2026190808737,
  author       = {Pith},
  title        = {Pith review of: Design choices for productive, secure, data-intensive research at scale in the cloud},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TNMRICVP}},
  note         = {Machine review of arXiv:1908.08737}
}

read the original abstract

We present a policy and process framework for secure environments for productive data science research projects at scale, by combining prevailing data security threat and risk profiles into five sensitivity tiers, and, at each tier, specifying recommended policies for data classification, data ingress, software ingress, data egress, user access, user device control, and analysis environments. By presenting design patterns for security choices for each tier, and using software defined infrastructure so that a different, independent, secure research environment can be instantiated for each project appropriate to its classification, we hope to maximise researcher productivity and minimise risk, allowing research organisations to operate with confidence.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 48 canonical work pages

[1]

Cyberessentials Plus

National Cyber Security Centre. Cyberessentials Plus . https://www.cyberessentials.ncsc.gov.uk/, 2019. Ac- cessed: 16.05.2019

work page 2019
[2]

ISO/IEC 27001:2013(E): Information technology — Security tech- niques — Information security management systems — Re- quirements

International Organization for Standardization. ISO/IEC 27001:2013(E): Information technology — Security tech- niques — Information security management systems — Re- quirements. https: //www.iso.org/standard/54534.html,

work page 2013
[3]

The social licence for research: why care.data ran into trouble

Pam Carter, Graeme T Laurie, and Mary Dixon-Woods. "The social licence for research: why care.data ran into trouble". Journal of medical ethics, 41(5):404–409, 2015

work page 2015
[4]

OpenStack marketplace private clouds

Openstack. OpenStack marketplace private clouds . https://www.openstack.org/marketplace/hosted-private- clouds/, 2019. 16.05.2019

work page 2019
[5]

MARU Project: Security in the Cloud

The Alan Turing Institute. MARU Project: Security in the Cloud. https: //www.turing.ac.uk/research/research- projects/security-cloud, 2019. Accessed: 02.07.2019

work page 2019
[6]

The Clinical Tri- als Processor

Radiological Society of North America. The Clinical Tri- als Processor. https: //bit.ly/2NgM8ln, 2019. Accessed: 04.06.2019

work page 2019
[7]

The extensible neuroimaging archive toolkit—an informatics platform for managing, exploring, and sharing neuroimaging data

DS Marcus, T .R. Olsen Olsen, M Ramaratnam, and R.L. Buckner. "The extensible neuroimaging archive toolkit—an informatics platform for managing, exploring, and sharing neuroimaging data". Neuroinformatics, 5:11– 33, 2007

work page 2007
[8]

Vanderbilt University Institute of Imaging Science Center for Computational Imaging XNAT: A mul- timodal data archive and processing environment

RL Harrigan, BC Yvernault, BD Boyd, SM Damon, KD Gib- ney , BN Conrad, NS Phillips, BP Rogers, Y Gao, and BA Landman. "Vanderbilt University Institute of Imaging Science Center for Computational Imaging XNAT: A mul- timodal data archive and processing environment". Neu- roimage, 124(Pt B):1097–1101, 2016. Page 21 of 23 PREPRINT ARTICLE - PRE-SUBMISSION Fo...

work page 2016

Show all 49 references

[9]

The UK Secure eResearch Platform for public health research: a case study

Kerina Helen Jones, David Vincent Ford, Simon Ellwood- Thompson, and Ronan Anthony Lyons. "The UK Secure eResearch Platform for public health research: a case study". The Lancet, 388:S62, 2016

2016
[10]

UKSeRP Brochure

SAIL Databank. UKSeRP Brochure. https://bit.ly/2z7bsC2,
[11]

Dementias Platform UK

Medical Research Council. Dementias Platform UK . https://www.dementiasplatform.uk, 2019. Accessed: 24.09.2018

2019
[12]

elec- tronic Data and Research Innovation Service

Information Services Division Scotland. elec- tronic Data and Research Innovation Service . https://www.isdscotland.org/Products-and- Services/EDRIS/, 2018. Accessed: 16.05.2019

2018
[13]

Secure Data Lab

UK Data Service. Secure Data Lab . https://www.ukdataservice.ac.uk/use-data/secure- lab/about.aspx, 2019. Accessed: 16.05.2019

2019
[14]

Annual Report on ONS Research Support and Data Access, 2017-18

Ofﬁce for National Statistics. Annual Report on ONS Research Support and Data Access, 2017-18 . https://bit.ly/2NqCkW5, 2018. Accessed: 16.05.2019

2017
[15]

IAB website

Institut für Arbeitsmarkt (Germany). IAB website . https://fdz.iab.de/en.aspx, 2017. Accessed: 16.05.2019

2017
[16]

CASD website

Centre d’accès sécurisé aux données(France). CASD website. https://www.casd.eu/en/, 2019. Accessed: 16.05.2019

2019
[17]

International Data Ac- cess Network

International Data Access Network. International Data Ac- cess Network . https: //idan.network/, 2019. Accessed: 16.05.2019

2019
[18]

data.world catalog

data.world. data.world catalog. https://data.world, 2019. Accessed: 24.09.2018

2019
[19]

AnalytiXagility Digital Research Environment

Aridhia. AnalytiXagility Digital Research Environment . https://www.aridhia.com/library/what-is-a-digital- research-environment/, 2019. Accessed: 24.09.2018

2019
[20]

Apache Ranger

Apache Foundation. Apache Ranger . https://ranger.apache.org, 2018. Accessed: 24.09.2018

2018
[21]

Cloudera Enterprise Data Hub

Cloudera. Cloudera Enterprise Data Hub . https://www.cloudera.com/products/sdx.html, 2018. Accessed: 24.09.2018

2018
[22]

Sensitive Data Redaction

Cloudera. Sensitive Data Redaction . https:// www.cloudera.com/documentation/enterprise/ 5-4-x/topics/sg_redaction .html, 2019. Accessed: 24.09.2018

2019
[23]

Azure Security and Compliance Blueprint - HIPAA /HITRUST Health Data and AI , 2018

Microsoft Azure. Azure Security and Compliance Blueprint - HIPAA /HITRUST Health Data and AI , 2018. URL https://docs.microsoft.com/en-us/azure/ security/blueprints/azure-health?WT.mc_id= aiucovvu-acom-dahouldi. Accessed: 16.05.2019

2018
[24]

DataSHIELD– new directions and dimensions

Rebecca C Wilson, Oliver W Butters, Demetris Avraam, James Baker, Jonathan A Tedds, Andrew Turner, Madeleine Murtagh, and Paul R Burton. "DataSHIELD– new directions and dimensions". Data Science Journal, 16 (21):1–21, 2017

2017
[25]

ELIXIR Beacons to facilitate sharing of genomics data in Europe

ELIXIR. ELIXIR Beacons to facilitate sharing of genomics data in Europe . https: //elixir-europe.org/news/elixir- beacons-facilitate-sharing-genomics-data-europe, 2017. Accessed: 16.05.2019

2017
[26]

BS ISO /IEC 27002:2013: Information technology — Security Techniques — Code of practice for information security controls

International Organization for Standardization /British Standards Institution. BS ISO /IEC 27002:2013: Information technology — Security Techniques — Code of practice for information security controls . https://www.iso.org/standard/54533.html, 2013. Ac- cessed: 16.05.2019

2013
[27]

General Data Protection Regulation (GDPR), 2018

European Union. General Data Protection Regulation (GDPR), 2018 . https: //gdpr-info.eu/, 2018. Accessed: 17.05.2018

2018
[28]

National Data Guardian for Health and Social Care

UK Government. National Data Guardian for Health and Social Care . https://www.gov.uk/government/organisations/national- data-guardian, 2019. Accessed: 16.05.2019

2019
[29]

Data Security and Protection Toolkit

NHS Digital. Data Security and Protection Toolkit . https://www.dsptoolkit.nhs.uk, 2019. Accessed: 16.05.2019

2019
[30]

Charter for Safe Havens

Scottish Government. Charter for Safe Havens . https://www.gov.scot/publications/charter-safe- havens-scotland-handling-unconsented-data-national- health-service-patient-records-support-research- statistics/pages/3/, 2015. Accessed: 16.05.2019

2015
[31]

Guiding Principles for Data Linkage

Scottish Government. Guiding Principles for Data Linkage. https://www2.gov.scot/Resource/0040/00407739.pdf,
[32]

Genomic Data Toolkit

Global Alliance for Genomics and Health. Genomic Data Toolkit. https: //www.ga4gh.org/genomic-data-toolkit/,
[33]

Framework for Responsible Sharing of Genomic and Health-Related Data, 2017

Global Alliance for Genomics and Health. Framework for Responsible Sharing of Genomic and Health-Related Data, 2017. URL https://ga4gh.edit.sanger.ac.uk/ genomic-data-toolkit/regulatory-ethics- toolkit/framework-for-responsible-sharing- of-genomic-and-health-related-data/#ima ...

2017
[34]

Data Use Ontology – the essentials (GitHub)

Multiple. Data Use Ontology – the essentials (GitHub) . https://github.com/EBISPOT/DUO, 2019. Accessed: 16.05.2019

2019
[35]

Consent codes: uphold- ing standard data use conditions

Stephanie OM Dyke, Anthony A Philippakis, Jordi Rambla De Argila, Dina N Paltoo, Erin S Luetkemeier, Bartha M Knoppers, Anthony J Brookes, J Dylan Spalding, Mark Thompson, Marco Roos, et al. "Consent codes: uphold- ing standard data use conditions". PLoS genetics, 12(1): e1005...

2016
[36]

Accessed: 16.05.2019

2019
[37]

Guidelines for Output Checking, 2017

Peter-Paul de Wolf (CBS) Steve Bond (ONS), Mau- rice Brandt (Destatis). Guidelines for Output Checking, 2017. URL https://ec.europa.eu/ eurostat/cros/system/files/dwb_standalone- document_output-checking-guidelines .pdf_en. Accessed: 20.11.2018

2017
[38]

UKAN, 2016

Mark Elliot, Elaine Mackey , Kieron O’Hara, and Caro- line Tudor.The anonymisation decision-making framework. UKAN, 2016. Page 22 of 23 PREPRINT ARTICLE - PRE-SUBMISSION For upload to arXiv.org

2016
[39]

Functional anonymisation: Personal data and the data environment

Mark Elliot, Kieron O’hara, Charles Raab, Christine M O’Keefe, Elaine Mackey , Chris Dibben, Heather Gowans, Kingsley Purdam, and Karen McCullagh. Functional anonymisation: Personal data and the data environment. Computer Law & Security Review, 34(2):204–221, 2018

2018
[40]

DataTags Research

Harvard School of Engineering and Ap- plied Sciences. DataTags Research . https://privacytools.seas.harvard.edu/datatags, 2014. Accessed: 16.05.2019

2014
[41]

WGovernment Security Classiﬁcations version 1.1

UK Cabinet Ofﬁce. WGovernment Security Classiﬁcations version 1.1 . https: //bit.ly/2xODCkq, 2018. Accessed: 03.06.2019

2018
[42]

What is personal data? https://ico.org.uk/for-organisations/guide-to- data-protection/guide-to-the-general-data-protection- regulation-gdpr/key-deﬁnitions/what-is-personal-data/,

Information Commissioner’s Ofﬁce. What is personal data? https://ico.org.uk/for-organisations/guide-to- data-protection/guide-to-the-general-data-protection- regulation-gdpr/key-deﬁnitions/what-is-personal-data/,
[43]

Guide to archiving personal data

National Archives. Guide to archiving personal data . http://www.nationalarchives.gov.uk/documents/information- management/guide-to-archiving-personal-data.pdf, 2018. Accessed: 17.06.2019

2018
[44]

What is a data trust? https://theodi.org/article/what-is-a-data-trust/, 2018

Open Data Institute. What is a data trust? https://theodi.org/article/what-is-a-data-trust/, 2018. Accessed: 03.06.2019

2018
[45]

The Spack Package Manager: Bringing Or- der to HPC Software Chaos

Todd Gamblin, Matthew LeGendre, Michael R. Collette, Gregory L. Lee, Adam Moody , Bronis R. de Supinski, and Scott Futral. "The Spack Package Manager: Bringing Or- der to HPC Software Chaos". In Proceedings of the In- ternational Conference for High Performance Computing, Netw...

2015
[46]

R: A Language and Environment for Sta- tistical Computing

R Core Team. R: A Language and Environment for Sta- tistical Computing . R Foundation for Statistical Com- puting, Vienna, Austria, 2018. URL https://www.R- project.org/

2018
[47]

Pass- word administration for system owners

National Cyber Security Centre. Pass- word administration for system owners . https://www.ncsc.gov.uk/collection/passwords/updating- your-approach, 2019. Accessed: 17.07.2019. Page 23 of 23

2019
[49]

Estimating the success of re-identiﬁcations in incomplete datasets using generative models

Hendrickx-Julien M. Rocher, Luc and Yves-Alexandre de Montjoye. "Estimating the success of re-identiﬁcations in incomplete datasets using generative models". Nature Communications, 10(1):3069, 2019

2019
[2019]

Accessed: 17.06.2019

2019

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Cyberessentials Plus

National Cyber Security Centre. Cyberessentials Plus . https://www.cyberessentials.ncsc.gov.uk/, 2019. Ac- cessed: 16.05.2019

work page 2019

[2] [2]

ISO/IEC 27001:2013(E): Information technology — Security tech- niques — Information security management systems — Re- quirements

International Organization for Standardization. ISO/IEC 27001:2013(E): Information technology — Security tech- niques — Information security management systems — Re- quirements. https: //www.iso.org/standard/54534.html,

work page 2013

[3] [3]

The social licence for research: why care.data ran into trouble

Pam Carter, Graeme T Laurie, and Mary Dixon-Woods. "The social licence for research: why care.data ran into trouble". Journal of medical ethics, 41(5):404–409, 2015

work page 2015

[4] [4]

OpenStack marketplace private clouds

Openstack. OpenStack marketplace private clouds . https://www.openstack.org/marketplace/hosted-private- clouds/, 2019. 16.05.2019

work page 2019

[5] [5]

MARU Project: Security in the Cloud

The Alan Turing Institute. MARU Project: Security in the Cloud. https: //www.turing.ac.uk/research/research- projects/security-cloud, 2019. Accessed: 02.07.2019

work page 2019

[6] [6]

The Clinical Tri- als Processor

Radiological Society of North America. The Clinical Tri- als Processor. https: //bit.ly/2NgM8ln, 2019. Accessed: 04.06.2019

work page 2019

[7] [7]

The extensible neuroimaging archive toolkit—an informatics platform for managing, exploring, and sharing neuroimaging data

DS Marcus, T .R. Olsen Olsen, M Ramaratnam, and R.L. Buckner. "The extensible neuroimaging archive toolkit—an informatics platform for managing, exploring, and sharing neuroimaging data". Neuroinformatics, 5:11– 33, 2007

work page 2007

[8] [8]

Vanderbilt University Institute of Imaging Science Center for Computational Imaging XNAT: A mul- timodal data archive and processing environment

RL Harrigan, BC Yvernault, BD Boyd, SM Damon, KD Gib- ney , BN Conrad, NS Phillips, BP Rogers, Y Gao, and BA Landman. "Vanderbilt University Institute of Imaging Science Center for Computational Imaging XNAT: A mul- timodal data archive and processing environment". Neu- roimage, 124(Pt B):1097–1101, 2016. Page 21 of 23 PREPRINT ARTICLE - PRE-SUBMISSION Fo...

work page 2016