White House Issues New Security Rules for Federally Funded Research

In July, the White House published long-awaited guidelines aimed at ensuring research institutions take adequate measures to protect federally funded research from theft or misappropriation. The guidelines will require institutions receiving $50 million or more per year in federal R&D funding to operate suitable research security programs. The programs must cover four main areas:

Research: Institutions must implement a security training program for researchers, with individuals taking either the training modules developed by the National Science Foundation, future training programs developed by federal agencies, or training developed internally. The training must include examples of “known improper or illegal transfer” of R&D, while also conveying the value of international collaboration in research.

Foreign travel: Institutions must implement periodic training for researchers who travel internationally, as well as report where researchers travel, in cases where funding agencies deem this reporting necessary. The government has not yet created a training resource for international travel but plans to do so.

Export control: Researchers who participate in projects involving export-controlled technologies, like those with potential military applications, must complete training developed by the Commerce Department or developed internally that covers specific topics.

Cybersecurity: Higher education institutions must implement a cybersecurity program consistent with a forthcoming resource from the National Institute of Standards and Technology.

The guidelines are meant to help researchers navigate a world characterized by “fierce military and economic competition,” wrote Arati Prabhakar, the director of the White House Office of Science and Technology, in a preface to the guidelines. Prabhakar said the guidelines aim to ensure research institutions “recognize the altered global landscape and fulfill their responsibilities as the first line of defense against improper or illicit activity.”

“We know that members of the R&D community are still acclimating to the changes in geopolitics,” Prabhakar added. “Many of the actions that researchers were encouraged to undertake only a decade ago, including collaborations with the People’s Republic of China, are now being recognized for the risks they may present.”

Federal agencies now have six months to submit their implementation plans to OSTP and the Office of Management and Budget, with their final policies taking effect no more than six months later. Institutions will have up to 18 months to comply.

OSTP produced the guidelines in response to a presidential memorandum on research security issued at the end of the Trump administration and carried forward by the Biden administration.

OSTP has received criticism from Congress for how long it has taken to produce the final guidance, given that it published the draft version in February 2023 — a delay, Prabhakar told Congress, that stemmed from the time it took to address public feedback about undue administrative burden. The final guidance drops several requirements included in the draft version.

Tobin Smith, the senior vice president for government relations and public policy at the Association of American Universities, said the final guidelines are an improvement over the draft, but he worries that agencies will vary in how they implement the guidelines.

“This is much better than what we saw in February 2023 — we have much fewer concerns. It provides a great deal of flexibility to our institutions, which we appreciate,” Smith said in an interview. “My only worry is that, instead, agencies will now use that flexibility to add their own additional requirements on, and that will make it hard for our institutions to comply and more costly and burdensome if we end up in a situation where there isn’t harmonization.”