Secure Configuration Guide

1. Accounts and administration

The CGC does not provide a customer organizational administrator role. You create and manage your own account — see Sign up for the CGC and Account settings. The highest customer privilege on the platform is project Admin.

• Accounts should belong to named individuals. Do not share your credentials.
• When a member leaves your organization or project, a project administrator should remove them from your projects; users can manage or close their own account from Account settings.
• Administrative functions above the project level (account management and monitoring) are performed by Velsera staff through an internal administrative console and are covered by the platform’s FedRAMP security controls. Contact Support for organizational requests.

2. Applicability of FedRAMP guide elements

   FedRAMP’s Secure Configuration Guide rules cover several categories of guidance. The following records which elements apply to the CGC and why:

These determinations are recorded in the platform’s FedRAMP Certification Package.

3. Authentication

   • You can log in with an eRA Commons account or a dedicated CGC account — see Sign up for the CGC.
   • eRA Commons logins are authenticated by the identity provider, which applies its own multi-factor authentication.
   • Platform-level multi-factor authentication is not offered on the CGC. Users should use eRA Commons/RAS login for multi-factor authentication.
   • Passwords for CGC accounts are screened against lists of common and breached passwords at sign-up.

4. Project permissions

   New project members receive permissions set by the project Admin/Owner. “Read” is the minimal permission granted. When adding a member, Write, Copy and Execute are pre-selected by default — review these and grant only what the member needs before saving.

• Grant members only the permissions they need for their role in the project.
• Read shows file names and metadata only. Copy lets a member view file content and download files. Write allows modifying and deleting project files and workflows. Execute runs analyses billed to the project. Admin can change other members’ permissions and add members.

Procedures: Set permissions

5. Data download and export controls

   • File downloads are unrestricted by default. The download restriction can only be chosen when a project is created and cannot be reverted — enable it for projects holding controlled-access data. To cover Data Studio as well, also block network access.
   • Write access to a volume allows exporting files out of the platform. Grant it only to members authorized to move data off the platform.

6. Secure defaults

7. Reporting a security issue

   If you believe you have found a security vulnerability or suspect your account has been compromised, contact Velsera Security immediately at [email protected].

8. Change log

   Date	Change
   Until 2026-08-16	Guidance previously distributed across individual documentation pages.
   2026-08-16	Revised version; aligned content as per template, determinations and security contact added.