This document is intended for officials at academic institutions and scientific organizations whose investigators are granted access under the NIH Genomic Data Sharing (GDS) Policy to controlled-access human genomic and phenotypic data that are maintained in NIH-designated data repositories.1 It provides an outline of the NIH’s expectations for the management and protection of NIH controlled-access data transferred to and maintained by institutions whether in their own institutional data storage systems or in cloud computing systems.2 Although controlled-access data do not contain direct identifiers, the data are sensitive and must be protected. The principles governing access and use of such data are outlined in the GDS Policy and individual Data Use Certification (DUC) Agreements that investigators submit as part of the process of requesting access to controlled access data. This process is intended to ensure that NIH controlled-access genomic and phenotypic data are kept secure and no one other than users approved by NIH is able to access the data.