{"id":12232,"date":"2025-01-14T11:50:32","date_gmt":"2025-01-14T16:50:32","guid":{"rendered":"https:\/\/www.rochester.edu\/university-research\/?page_id=12232"},"modified":"2026-04-01T10:13:11","modified_gmt":"2026-04-01T14:13:11","slug":"federal-agency-risk-reviews","status":"publish","type":"page","link":"https:\/\/www.rochester.edu\/university-research\/compliance\/research-security\/federal-agency-risk-reviews\/","title":{"rendered":"Federal Agency Risk Reviews of Fundamental Research Projects"},"content":{"rendered":"","protected":false},"excerpt":{"rendered":"","protected":false},"author":76,"featured_media":0,"parent":3082,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-12232","page","type-page","status-publish","hentry"],"acf":{"lead_in":"","display_title":"","subtitle":"","call_to_action":"","hero_image_placement":"no_image","hero_media":"images","hero_pattern_option":"","hero_video":"","hero_image_landing":"","hero_image_landing_two":"","hero_image_landing_three":"","content_modules":[{"acf_fc_layout":"text","anchor":"","css_class":"pb-0 pt-15","title":"","content":"Pursuant to federal laws and NSPM-33<\/a>, federal research agencies are implementing processes to conduct risk-based security reviews of fundamental research projects during the award proposal stage.\r\n\r\nThe purpose of this guidance is to make University researchers aware of these processes, describe how federal agencies seek to mitigate potential risks identified in the risk review process, and to inform researchers of the key risk areas that federal agencies may focus on.","background_color":"#ffffff","width":"width-medium"},{"acf_fc_layout":"table_of_contents","anchor_id":"","css_classes":"","title":"","content":"","bg_color":"#ffffff","layout":"standard_width","image":"","call_to_action":"","aceppted_headings":["h2"],"ignored_headings":""},{"acf_fc_layout":"text","anchor":"","css_class":"","title":"

Timing of review<\/h2>","content":"In conducting risk-based security reviews, federal agencies seek to identify potential research security risks after proposal submission and prior to selecting a proposal for award<\/strong>.","background_color":"#f4f4f4","width":"width-medium"},{"acf_fc_layout":"text","anchor":"","css_class":"","title":"

Information reviewed by federal agencies<\/h2>","content":"Federal agencies review researcher disclosures forms, particularly the Biosketch and Current and Pending (Other) Support forms, to assess potential research security risks. In addition, agencies may review open-source materials, such as publicly available CVs, publicly available research publications, and publicly available patent search tools to identify potential risks.\r\n\r\nIf risks identified by the federal agency are, in the agency\u2019s judgment, sufficiently high, the University and researcher may potentially mitigate the risks identified by the federal agency through development of a \u201crisk mitigation plan.\u201d","background_color":"#ffffff","width":"width-medium"},{"acf_fc_layout":"text","anchor":"","css_class":"","title":"

Risk mitigation plan and process<\/h2>","content":"As part of the review and risk mitigation processes, the applicable federal agency may request that the University and researcher provide additional information about the potential risks that the agency has identified. After the information gathering process, the federal agency may require that the University and researcher submit a risk mitigation plan to address the agencies concerns.\r\n\r\nRisk mitigation plans require the University and the researcher(s) to take additional security measures that are not typically required by a federal research award. As federal agencies continue to implement risk-based security processes, it may be increasingly common for researchers to be involved in the risk mitigation plan process.\r\n\r\nSome of the risk mitigation strategies that could be included in a risk mitigation plan are:\r\n
    \r\n \t
  1. Mandatory additional training,<\/li>\r\n \t
  2. International travel reporting,<\/li>\r\n \t
  3. Reporting suspicious inquiries relating to the research,<\/li>\r\n \t
  4. Termination of international collaborations,<\/li>\r\n \t
  5. Replacing individuals on the research project deemed a security risk,<\/li>\r\n \t
  6. Required resignation or confirmation of disassociation from entities of concern,<\/li>\r\n \t
  7. Periodic security communications,<\/li>\r\n \t
  8. Expanded reporting requirements,<\/li>\r\n \t
  9. Tailored conflict of interest or commitment management plans, and \/ or<\/li>\r\n \t
  10. Information sequestration.<\/li>\r\n<\/ol>","background_color":"#f4f4f4","width":"width-medium"},{"acf_fc_layout":"accordion_new","anchor_id":"","classes":"","title":"

    Agency risk factors<\/h2>","description":"The chart below provides a general overview of the risk factors considered by federal agencies. To learn more about agency-specific risk review processes, click on the applicable agency below.\r\n\r\n[ninja_tables id=\"12252\"]","background":"plain","background_color":"#ffffff","style":"row_blank","expand":"yes","accordions":[{"acf_fc_layout":"title","sub_heading":"Agency overviews"},{"acf_fc_layout":"accordion","accordion_title":"Department of War\/Department of Defense (DoW) (including Army Research Lab and DARPA)","icon":"","row_content":"In March 2026, the Department of War \/ Department of Defense (DoW) released the 2026 Department of War Component Decision Matrix to Inform Fundamental Research Proposal Mitigation Decisions<\/a> (the DoW Decision Matrix).\r\n\r\nThe DoW Decision Matrix is \u201can aid to help DoW Components make informed decisions regarding risk mitigation measures for fundamental research projects.\u201d\r\n\r\nThe DoD Decision Matrix\u00a0<\/em>contains four risk factors that inform mitigation decisions:\r\n
      \r\n \t
    1. Participation in foreign talent recruitment programs (with current participation in a malign foreign talent recruitment program prohibited),<\/li>\r\n \t
    2. Current or prior funding from \u201cforeign countries of concern\u201d (FCOCs), which are defined as China, Russia, North Korea, and Iran,<\/li>\r\n \t
    3. Filing a patent in an FCOC or on behalf of an FCOC-connected entity, in a non-FCOC country without disclosure, or co-patent applications with individuals or organizations on U.S. restricted party lists, and<\/li>\r\n \t
    4. Active collaborations with institutions or entities on a \u201cProhibited Entity List,\u201d indicators of prior affiliations with an entity on any Prohibited Entity List, as well as co-authorship with individuals affiliated with organizations on any Prohibited Entity List.<\/li>\r\n<\/ol>\r\nNotably, DoW components are prohibited from approving a research proposal if there is an \u201cactive collaboration<\/strong>\u201d for the specific purpose of fundamental research between a covered individual<\/strong> (i.e. the PI or other Senior \/ Key Personnel identified in the proposal) and any academic institution or entity, or employee of such entity, on the current \u201cProhibited Entity Lists<\/strong>.\u201d","accordion_anchor":""},{"acf_fc_layout":"accordion","accordion_title":"Army Research Lab","icon":"","row_content":"The Army Research Lab (ARL) maintains its own research security risk assessment program<\/a>. Risk ratings run from High to Low in each of the four risk factor categories:\r\n
        \r\n \t
      1. Foreign talent program participation,<\/li>\r\n \t
      2. Affiliations or associations with entities on U.S. restricted party lists,<\/li>\r\n \t
      3. Indications of conflict of interest, conflict of commitment, or patterns of direct funding from a strategic competitor or country with a history of targeting U.S. research or technology, and<\/li>\r\n \t
      4. Indicators of affiliation, association, or collaboration<\/strong> with a foreign institution, person, or entity from a strategic competitor.<\/li>\r\n<\/ol>\r\nOf note, the ARL risk matrix considers co-authorships and panel participation at a conference with foreign entities\/institutions as \u201ccollaboration.\u201d ARL has communicated that for any<\/strong> ongoing collaboration with institutions, persons, or entities from a \u201cstrategic competitor,\u201d a risk mitigation plan must include assurances that the researcher\u2019s collaborations have or will terminate.","accordion_anchor":""},{"acf_fc_layout":"accordion","accordion_title":"DARPA","icon":"","row_content":"DARPA maintains a fundamental research-risk-based security process<\/a> in accordance with the DoD 2023 Memo.","accordion_anchor":""},{"acf_fc_layout":"accordion","accordion_title":"National Science Foundation","icon":"","row_content":"In June 2024, the National Science Foundation (NSF)\u00a0announced<\/strong><\/a>\u00a0the Trusted Research Using Safeguards and Transparency (TRUST<\/strong><\/a>) framework, which will guide NSF in assessing grant proposals for potential national security risks. NSF intends to use information provided in proposal submissions and elsewhere to assess risk on a project-by-project basis. NSF\u2019s TRUST decision tree will include three branches:\r\n