Account Requests
IMPACT is a distributed data and tools repository for cyber risk R&D that is enabled by a centralized policy framework. You may only access these data and tools with an IMPACT account. Accounts are needed to address operational, technical and administative costs and challenges that impede sustainable and scalable data sharing. They also facilitate trust between providers and seekers that legitimate R&D is being undertaken.
Researchers affiliated with a valid organization, in a DHS-approved location, and who are pursuing legitimate R&D may be granted access to IMPACT data and tools. In addition, organizations that provide or host data and tools for researchers may hold accounts.

DHS approved locations are listed here.
Click the "Login" button on the top of our home page and follow the instructions to submit an account request.

Read more about account requests here.
All applications for access to IMPACT are processed by the IMPACT Coordinating Center (ICC), which reviews each account request against account approval criteria.

Foreign applications for accounts are reviewed by that country's IMPACT Approval Coordinator (IAC).
Your account is based on your affiliation with a valid organization that conducts cyber risk R&D. A representative of that organization must vouch for you as an employee or as someone associated with the company's research efforts, and that your proposed research would be approved under its auspices. Make sure your account request includes a valid authorized representative; you may not list yourself as the authorization representative of your organization.
Your account is valid for as long as you continue to access the IMPACT portal or are associated with your organization. If your account is idle for 12 months, the ICC will disable it. If your account is disabled, you can re-establish the account by contacting the ICC. If you leave your organization, your account will be disabled and you must apply for a new account under your new organization.
IMPACT accounts and use of the data and tools are free.
The information collected in the IMPACT portal, including user information, is secured through multi-tiered security protocols, including a firewall and secure socket layer (SSL) certificate. The system authenticates IDs and passwords before allowing access. Access to your information is limited to the ICC and hosts and providers of data/tools you request.
When completing the account request form, you will be asked to supply a preferred user name and a temporary password. For security reasons you will be required to change the password on your first log in.
Yes. Passwords must be at least 8 characters long. They can not contain any white space (spaces, tabs, etc.). They must contain at least one lowercase and one uppercase character.
If you have difficulty logging into the portal, email the ICC (Contact@ImpactCyberTrust.org) or call (USA) 1 800 957 6422 for assistance.
If you are a researcher, you will be able to apply for access to any of the datasets and tools listed in the data catalog. Also, you may post content to the Forum. You may also communicate with the portal administrators to report difficulties with, or suggestions about, the site.

If you are a Data/Tool Provider, you will be able to upload listings to the data catalog, perform administrative tasks to maintain the listings, engage in the Forum, and access details of all requests for your data/tools.

If you are a Data/Tool Host, you will be able perform administrative tasks related to hosting datasets/tools in the data catalog and access details of all requests for the data/tools you host.
After your account as a researcher is approved, you may apply for access to data by filling out the form provided on the portal. You will be given instructions on how to complete the request form; there are different instructions for accessing each class of data and tools.
Class is a designation chosen by a Provider to align data with terms and conditions for release and use. IMPACT has three classes: (1)Unrestricted (Non-Commercial, Commercial); (2) Quasi-Restricted (Non-Commercial, Commercial); and (3) Restricted. Each data and tool class has a corresponding approval mechanism and agreement.
IMPACT has two sharing approval mechanisms: One is a click-through Terms of Use (ToU) agreement between the ICC and the requester; the other is bilateral-signature-based Memorandum of Agreement (MoA) between the ICC and the requester. The class of data/tool you request determines the sharing mechanism you will use.
SUMMARY:

IMPACT currently uses three classes and associated sharing approval mechanisms and agreements: (1)Unrestricted (Non-Commercial, Commercial) via a click-through ToU; (2) Quasi-Restricted (Non-Commercial, Commercial) via a click-through ToU; and (3) Restricted via an MoA between the Researcher and ICC.

All Unrestricted data and tools may be used by approved Researchers without the approval of the relevant Provider(s). All Quasi-Restricted data and tools may only be used by Researchers upon the approval of the relevant Provider(s) and ICC. Restricted data requires approval by the relevant Provider(s) and the ICC.

More detailed definition of classes:
  • Unrestricted: Data and Tools in this class are released upon request after the click-through terms are agreed to by the requester and subject to the ICC's validation, through its application review process, that the data/tool requested are reasonably consistent with the stated use for the data in the request and the researcher's agreeing to the ToU.

  • Unrestricted Non-Commercial: Data and tools in this class are released for non-commercial use upon request after the click-through terms are agreed to by the requester and subject to the ICC's ensuring, through its application review process, that the data/tool requested are reasonably consistent with the stated use in the request.

  • Quasi-Restricted: Data and tools in this class are released upon request after the click-through terms are agreed to by the requester and subject to both the ICC's ensuring, through its application review process, that the data/tool requested are reasonably consistent with the stated use in the request, and the relevant Providers' approving the request.

  • Quasi-Restricted Non-Commercial: Data and tools in this class are released for non-commercial use upon request after the click-through terms are agreed to by the requester and subject to both the ICC's ensuring, through its application review process, that the data/tool requested are reasonably consistent with the stated use in the request and the relevant Providers' approving the request.

  • Restricted: Data and tools in this class require the execution of a written MoA by the requester with the ICC and approval from the relevant Data Provider(s). The MoA may contain additional terms and conditions specific to the Provider.
Dataset Requests
Approved researchers who are conducting cyber security research in DHS-approved locations (the United States) may apply. Researchers authorized by selected international governments and organizations may also apply for datasets. This includes Canada, Australia, United Kingdom, Israel, Japan, the Netherlands, and Singapore.
The repository contains a mix of unrestricted, unrestricted non-commercial, quasi-restricted, quasi-restricted non-commercial and restricted datasets and tools. Use the data catalog to review listings of available datasets and tools in each class. Each listing contains metadata describing the dataset and the conditions for its use, which can range from an online click-through agreement to an MOA. Review the terms and conditions for each dataset and tool carefully before applying.
For restricted data and tools there are common terms and conditions on data use, and there may be additonal provisions that are set by the individual Providers. Details of these restrictions are included in a Memorandum of Agreement (MOA) and any attachments that will be sent to you when you apply for access. Researchers will be held accountable for all terms of use once access is provided.

For all Unrestricted and Quasi-restricted there are fewer terms and conditions, and researcher must agree to a click-through ToU before data can be shared.
The first step is to select the data and/or tool(s) you need and explain how they will be used in your R&D effort. Submit your request using the online form.
Yes. Your request "shopping cart" can include multiple data/tools within and across classes. When you "checkout" to process your requests, you will be presented with separate agreements and approval mechanisms that correspond to the relevant class.
If you request any unrestricted or quasi-restricted non-commercial data/tool, you will need to complete a click-through ToU. The ICC will authorize release of any unrestricted data when you complete the ToU. Release of any quasi-restricted data is contingent on the approval of the Provider. Once that is granted, the ICC will authorize release.

If you request restricted data/tools, your next step is to sign an MoA that may include special use conditions set by Data Providers. The MoA will be delivered to you in an email confirming that your application has been received by the ICC. These conditions will vary by dataset/tool, so review them carefully. The MoA(s) must be signed and returned to the ICC before your application will be reviewed.
You will need to provide enough information about your proposed research for the ICC and Provider to understand if you have selected the most appropriate data/tool for your project. The form asks for a brief synopsis of the work you intend to pursue. The synopsis must also describe the relevance to the dataset(s)/tool(s) you are requesting to your proposed research. For example, if your goal is to develop intrusion protection technology, do the datasets you requested align with that objective?
If you request any unrestricted data/tool, there is no review.

If you request any quasi-restricted data/tool, the relevant provider will review your application.

If you request a restricted data/tool, the ICC and relevant Provider will review your request.
This depends on the class of data/tool you are requesting.

The approval process for all unrestricted data and tools requires a brief interval of up to 24 hours for the ICC to ensure that your request is complete. The process for all quasi-restricted data can take longer, depending on the time it takes for the Provider to review the request. Restricted data/tools takes slightly longer because the Provider must review the request and an MoA must be signed by the Researcher and the ICC.
This also depends on the class of data/tool you are requesting. See also "Applications"

For all unrestricted requests, approval is instantaneous via a click-through agreement. Once you have agreed to all the terms, you are approved to receive the data after the ICC verifies your application is complete.

For all quasi-restricted requests, the Provider(s) must approve your request.

For restricted requests, the request must be approved by the ICC and the Data Provider(s).
How you get the data/tools for which you're approved depends on the delivery method provided by the Data/Tool Host. Transmission or access may be by removable media such as CD, DVD or disk by mail, FTP, email, HTTP/HTTPS, Remote Shells with SSH, or other web API. You will be advised by the Host which method they plan to use.

You should contact the Host, who is listed on the My Impact > My Requests page, to arrange delivery. You will need to log into the portal and navigate to the page to see this information.
Data Provider
IMPACT is interested in data and tools that can help researchers derive advanced knowledge, test and develop products and technologies, and prove the utility of research to deter, detect, protect and defend against cyber threats. For example, current dataset categories include Address Space Allocation, BGP Routing, Blackhole Address Space, DNS, IDS and Firewall, Infrastructure, Internet Topology, IP Packet Headers, Synthetically Generated Traffic Flow and Unsolicited Bulk Email data. Any dataset that is contributed should be reviewed by the provider's legal and/or ethical authority to ensure compliance with legal, regulatory, ethical and corporate policy obligations.

If you are interested in providing data/tools to IMPACT, fill out this form and email it to the ICC at Contact@ImpactCyberTrust.org.
Providers who hold accounts on the IMPACT portal can make entries in the dataset or tools catalog by two methods: By bulk import following an XML schema provided on the My Datasets/Tools page; or by manual entry using a form on the page (a Provider account is required to access either page).
You can retire a dataset/tool from the catalog using the same tools described above. This will eliminate any further access to that dataset/tool. Researchers who have already been granted access and are using the dataset/tool will not be affected.
Yes.

If you provide any unrestricted data, you agree to allow access to any authorized researcher by the fact that you labeled the data/tool unrestricted.

In the case of any quasi-restricted or restricted item, you will be asked to approve each application for the data/tool before it is approved for release.
For any unrestricted item: Approval is granted after the researcher completes and agrees to a Terms of Use Agreement (ToU) online.

For any quasi-restricted item- Each dataset/tool request is passed to you to review and approve before access is granted. This will be done using the portal to notify you of an application and to record your decision.

For restricted items- Each dataset/tool request is reviewed by the ICC and you before access is granted. Approvals are handled through the IMPACT portal. If someone requests your data/tool, you will receive an email from the portal asking you to log in to the My Data/Tools page, review the application and indicate whether to allow access to the tool or sub-categories of data. You may approve the full request or partial list of sub-categories requested. Once the decision is recorded, the researcher is notified of the result.
Common terms and condictions for all restricted data/tools are included in a Memorandum of Agreement (MoA) that the researcher must sign with the ICC before access to restricted items is granted. You may specify any additional terms of use, publication permissions and other restrictions that apply. These will appear as attachments to the researcher MoA.

By classifying data as unrestricted, unrestricted non-commercial, quasi-restricted or quasi-restricted non-commercial, you convey that there are no other special conditions on use than are imposed by the ICC.
Researchers must agree to meet all requirements for use of the item when they apply for access. If the item is restricted and a MoA has been signed between the Provider and the ICC, and the ICC and researcher, a provider may pursue legal action against any researcher who is in violation of this agreement. Such legal disputes should managed between the provider and the researcher in accordance with the terms in those agreements.

The ICC has procedures to ensure that the terms in click-through agreements and MoAs are complied with, and can terminate researcher use of data or a tool if it has reason to believe that the terms are being violated.
Only researchers located in DHS-approved international locations may participate in IMPACT. Before these researchers can be granted access to the IMPACT portal, they must first be approved by an authorized IMPACT Approval Coordinator (IAC) in their country. The IAC reviews the researcher's account request, using the same protocol the ICC uses for U.S. organizations, and notifies the ICC of its decision to approve or reject the organization. If the IAC approves the researcher, the ICC will grant an account on the portal and the approved researchers may apply for access. Dataset requests from international researchers are handled in the same manner as U.S. requests.
Researchers
You can request a dataset/tool by completing all the steps required to apply for unrestricted, quasi-restricted or restricted data and submitting your request to the IMPACT Coordinating Center (ICC) for processing.

A request starts with a search of our metadata catalog, where you will select the dataset(s)/tool(s) of interest to you.

You may browse our catalog from the Home page but you must have an account to request items.

If the data/tools is classified as unrestricted, you must complete the Terms of Use (ToU) click-through agreement to complete your request.

If the data/tool is classified as quasi-restricted, you must complete the ToU but access is delayed until the provider approves.

If the data/tool is classified as restricted, you must complete a dataset/tool request form and sign a Memorandum of Agreement (MoA) agreeing to terms of use. The Provider and ICC must review and approve your request and the ICC must execute the MoA before you can get access.
You may request as many datasets/tools as are necessary to complete your work. However, your requests will be processed according to the agreement-approval mechanism associated with your item(s). See also "Account Requests"
No. You can request multiple datasets/tools from within or across classes, on the same form, and can even include datasets for different research projects. The explanations for how the datasets will be used can be combined into one entry in the Request Reason text box.
If you are not approved for all the items you request, you will only be allowed access to those for which you are approved. You may reapply for any datasets/tools for which you were not approved, keeping in mind that if the research synopsis is the same, it will likely not be approved.
Review and approval can take up to approximately one week from the time you return the signed MoA to the ICC.
You will receive the data/tool in the manner specified by the designated Host, which is listed in the metadata for each dataset/tool. Once you are approved, the Host is notified and will contact you directly to make arrangements for transmission or access.
You are allowed access to approved datasets for 12 months from the date your application is approved. Tools access is a minimum of 12 months and may extend longer as indicated in the relevant Agreement.
If you need more time with the data/tool, you may apply for an extension of the time period. You will receive an application for extension in an email prior to the expiration date or you may request one from the ICC.
At the conclusion of your use of approved datasets/tools, you must delete/destroy/expunge the data/tool from your system and submit a Certificate of Disposal. You will receive the certificate in an email prior to the expiration date.