Federal Agency Risk Reviews of Fundamental Research Projects
Pursuant to federal laws and NSPM-33, federal research agencies are implementing processes to conduct risk-based security reviews of fundamental research projects during the award proposal stage.
The purpose of this guidance is to make University researchers aware of these processes, describe how federal agencies seek to mitigate potential risks identified in the risk review process, and to inform researchers of the key risk areas that federal agencies may focus on.
Topics on this page:
Timing of review
In conducting risk-based security reviews, federal agencies seek to identify potential research security risks after proposal submission and prior to selecting a proposal for award.
Information reviewed by federal agencies
Federal agencies review researcher disclosures forms, particularly the Biosketch and Current and Pending (Other) Support forms, to assess potential research security risks. In addition, agencies may review open-source materials, such as publicly available CVs, publicly available research publications, and publicly available patent search tools to identify potential risks.
If risks identified by the federal agency are, in the agency鈥檚 judgment, sufficiently high, the University and researcher may potentially mitigate the risks identified by the federal agency through development of a 鈥渞isk mitigation plan.鈥
Risk mitigation plan and process
As part of the review and risk mitigation processes, the applicable federal agency may request that the University and researcher provide additional information about the potential risks that the agency has identified. After the information gathering process, the federal agency may require that the University and researcher submit a risk mitigation plan to address the agencies concerns.
Risk mitigation plans require the University and the researcher(s) to take additional security measures that are not typically required by a federal research award. As federal agencies continue to implement risk-based security processes, it may be increasingly common for researchers to be involved in the risk mitigation plan process.
Some of the risk mitigation strategies that could be included in a risk mitigation plan are:
- Mandatory additional training,
- International travel reporting,
- Reporting suspicious inquiries relating to the research,
- Termination of international collaborations,
- Replacing individuals on the research project deemed a security risk,
- Required resignation or confirmation of disassociation from entities of concern,
- Periodic security communications,
- Expanded reporting requirements,
- Tailored conflict of interest or commitment management plans, and / or
- Information sequestration.
Agency risk factors
The chart below provides a general overview of the risk factors considered by federal agencies. To learn more about agency-specific risk review processes, click on the applicable agency below.
锘緼驳别苍肠测 | Risk Factor 1 | Risk Factor 2 | Risk Factor 3 | Risk Factor 4 | Risk Factor 5 | Co-authorship with other institutions / individuals considered in risk assessment? |
---|---|---|---|---|---|---|
DoD (including DARPA) | Foreign Talent Recruitment Program participation | Funding from FCOCs | Patent applications or patens filed outside the U.S. | Affiliations with organizations on U.S. restricted party lists | N/A | Yes |
Army Research Lab | Foreign Talent Recruitment Program participation | Affiliations / associations with entities on U.S. restricted part lists | Funding, conflict of interests, conflict of commitment, involving a strategic competitor | Affiliation, association, or collaboration with a foreign institution or person from a strategic competitor | N/A | Yes |
NSF | Active appointments, positions, and research support from U.S. restricted parties (including participation in a malign foreign talent recruitment program) | Nondisclosure of appointments, activities, and sources of research support | Potential foreseeable national security applications of research | N/A | N/A | No |
NIH | Foreign Talent Recruitment Program participation | Undisclosed / incompletely disclosed foreign funding | Undisclosed / incompletely disclosed foreign affiliations with foreign institutions or entities | N/A | N/A | No, subject to other NIH requirements |
DOE | Ties to malign foreign talent recruitment programs | Certain foreign funding sources | Concerning behaviors associated with patenting | Ties to foreign entities or collaborators on restrict party lists | Whether the research is in a critical / emerging area, project will have access to critical infrastructure, and proximity to a military installation | Unknown at this time |
Agency overviews
In May 2025, the Department of Defense (DoD) released the (the DoD Decision Matrix). The decision matrix is in effect for proposals submitted after May 9, 2025. The document updates DoD鈥檚 , published in 2023.
The DoD Matrix is 鈥渁 guide to assist DoD Components and program managers in reviewing fundamental research proposals for potential conflicts of interest and conflicts of commitment.鈥
The DoD Decision Matrix听contains four risk factors that inform mitigation decisions:
- Participation in foreign talent recruitment programs (with current participation in a malign foreign talent recruitment program prohibited),
- Current or prior funding from 鈥渇oreign countries of concern鈥 (FCOCs), which are defined as China, Russia, North Korea, and Iran,
- Filing a patent in an FCOC or on behalf of an FCOC-connected entity, in a non-FCOC country without disclosure, or co-patent applications with individuals or organizations on U.S. restricted party lists, and
- Affiliations with organizations on U.S. restricted party lists, as well as co-authorship with individuals affiliated with organizations on U.S. restricted party lists.
The Army Research Lab (ARL) maintains its own research security . Risk ratings run from High to Low in each of the four risk factor categories:
- Foreign talent program participation,
- Affiliations or associations with entities on U.S. restricted party lists,
- Indications of conflict of interest, conflict of commitment, or patterns of direct funding from a strategic competitor or country with a history of targeting U.S. research or technology, and
- Indicators of affiliation, association, or collaboration with a foreign institution, person, or entity from a strategic competitor.
Of note, the ARL risk matrix considers co-authorships and panel participation at a conference with foreign entities/institutions as 鈥渃ollaboration.鈥 ARL has communicated that for any ongoing collaboration with institutions, persons, or entities from a 鈥渟trategic competitor,鈥 a risk mitigation plan must include assurances that the researcher鈥檚 collaborations have or will terminate.
DARPA maintains a in accordance with the DoD 2023 Memo.
In June 2024, the National Science Foundation (NSF)听听the Trusted Research Using Safeguards and Transparency () framework, which will guide NSF in assessing grant proposals for potential national security risks. NSF intends to use information provided in proposal submissions and elsewhere to assess risk on a project-by-project basis. NSF鈥檚 TRUST decision tree will include three branches:
- assessing active appointments, positions, and research support from U.S. restricted parties (including participation in a malign foreign talent recruitment program),
- identifying instances of nondisclosure of appointments, activities, and sources of research support, and
- potential foreseeable national security applications of the research.
NSF will use this analysis to determine whether risk mitigation or management may be required for a project.
NSF began piloting the TRUST framework to quantum-related proposals in October 2024.
In August 2024, the National Institutes of Health (NIH) released a 鈥溾 (the NIH Decision Matrix).
The NIH Decision Matrix lists three risk factors:
- Participation in foreign talent recruitment programs,
- Undisclosed or incompletely disclosed foreign funding, and
- Undisclosed or incompletely disclosed foreign affiliations with foreign institutions or entities.
The NIH Decision Matrix reminds institutions and researchers that NIH has long required applicants to comply with disclosure requirements that relate to foreign influence issues. These include disclosure of Current and Pending (Other) support to assess scientific, budgetary or commitment overlap, improper disclosure or management of financial conflicts of interest, and approval of 鈥渇oreign components鈥 of research.
The NIH Decision Matrix also provides a list of generally allowable activities that are unrelated to NIH-funded work and don鈥檛 otherwise present concerns with overlaps, financial conflict of interest, or undisclosed foreign components. These activities might include lectures, teaching, letters of recommendation, advisory boards, peer review, and foreign honors. Researchers may also participate in foreign research grants and/or foreign employment (excluding prohibited malign foreign talent recruitment programs) and must disclose all domestic and foreign research activities to NIH and submit copies of foreign grants, agreements, and contracts to NIH.
The Department of Energy (DoE) has created an (RTES). RTES supports DoE鈥檚 programs in 鈥渄ue diligence reviews and risk mitigation.鈥
As described in a , DOE will use RTES risk factors as guidelines, understanding that reviews require flexibility to evaluate threats, vulnerabilities, and consequences. For individuals on DOE-funded proposals or projects, DOE may assess ties to malign foreign talent recruitment programs, certain foreign funding sources (both monetary and in-kind), certain concerning behaviors associated with patenting (e.g., transferring to foreign entities after filing), and ties to foreign entities or foreign collaborators on specified lists or with specified characteristics.
In addition to reviews of individuals, DOE will also assess risk factors associated with entities associated with proposals and projects, including foreign ownership or control, criminal or regulatory issues, the supply chain for any sensitive equipment/supplies, and ties to entities on specified lists. While foreign ownership or control is not applicable to the University, it may be a factor for other entities who may potentially participate in the project (such as potential subawardees).
DOE notes that if the risk indicators are present on a proposed or existing project, consideration will be given to whether the project falls within a critical and emerging technology area, whether the project will have physical or cyber access to critical infrastructure, and any project work with proximity to a military installation.
Reach out
Contact
If you have been contacted by a federal agency in connection a risk review of a fundamental research project proposal, please contact your ORPA Research Administrator and the University鈥檚 Research Security Officer (joe.doyle@rochester.edu).