decorative image
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
decorative image
Secure .gov websites use HTTPS
A lock ( ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
seed logo
FAQs NIH Staff Contact & Help

Foreign Disclosure and Risk Management

Last modified 4/14/2026

Congress requires Federal agencies to establish a due diligence program to assess security risks posed by applicants. Read below to learn more about foreign disclosure requirements, the due diligence program, and review foreign risk case studies.

Details of the SBIR and STTR Foreign Disclosure and Risk Management Pre-award and Post-Award Requirements can be found in NOT-OD-23-139, NOT-OD-24-029 and NOT-OD-25-102.

Quick Links

Disclosure Requirements Regarding Ties to Foreign Countries

Applicants to the SBIR and STTR programs are required to disclose all funded and unfunded relationships with foreign countries, using the Required Disclosures of Foreign Affiliations or Relationships to Foreign Countries Form (hereafter referred to as the SBIR STTR Foreign Disclosure Form), for all owners and covered individuals.

Submission is Required!

Applicants who do not submit the completed SBIR STTR Foreign Disclosure Form during the JIT process will not be considered for funding.

A “covered individual” is defined as all individuals who 

  • contributes in a substantive, meaningful way to the scientific development or execution of the SBIR and STTR project; or 
  • are identified by the small business in the application as senior key personnel. 

Upon request, applicants will submit the completed disclosure form via the Just-In-Time (JIT) process. Applicants to the Parent Announcements with primary assignments to CDC and FDA will follow each agency’s policies for submitting additional documents during the pre-award process.

Due Diligence Program to Assess Security Risks

HHS has implemented a due diligence program designed to assess security risks by applicants.  

NOTE: The review of the security risks is separate from the merit review process. 

Applicants and recipients are encouraged to consider whether their entity’s relationships with foreign countries of concern will pose a security risk. Prior to issuing an award, HHS will conduct a foreign risk assessment to determine whether the small business submitting the application meets the denial criteria as directed in S.3971 Small Business Innovation and Economic Security Act.

Assessment will include:

Legislative RequirementRISK ASSESSMENT
Cybersecurity Practices of the Small Business ConcernForeign IP activity (within 1 year) indicative of business operations in a foreign country of concern OR does not have a documented cybersecurity and information safeguarding program for all covered individuals with access to project systems, research, and/or data that includes initial and recurring training, OR maintains weak IT security protocols that create risk of compromise, OR is using prohibited information technology systems or services to include FCOC-controlled IT, OR has not applied additional technical and administrative security controls consistent with the data's sensitivity.
 
Patent Analysis Patent application(s) or patent(s) based on research funded by the U.S. Government that were filed within the last 5 years in a foreign country of concern prior to filing in the U.S. or filed on behalf of a foreign country of concern connected entity 
Employee AnalysisParty to a malign foreign talent recruitment program (defined by section 10638 of the Research and Development, Competition, and Innovation Act; Public Law 117-167)
Foreign Ownership (including Financial Ties & Obligations)

Active (ongoing) partnership or a controlling equity, joint venture, and/or subsidiary in a foreign country of concern

Active (ongoing) foreign financial obligations with a foreign country of concern, person residing in a foreign country of concern, or an entity affiliated with a country of concern 

Foreign AffiliationsRecent affiliation (within 1 year) with an entity or research institution affiliated with a foreign country of concern
Investment RelationshipsActive (ongoing) investment relationship with an individual or entity in a foreign country of concern
Technology Licensing Agreements or Joint VenturesActive (ongoing) technology licensing agreement or joint venture with an individual or entity in a foreign country of concern
Business RelationshipsActive (ongoing) business relationship between a covered individual, owner, or other key personnel of a small business concern and an individual or entity in a foreign country of concern

NIH, CDC, FDA, ACL, and ARPA-H may decline to move forward with an award based on security risks determined during the assessment. An award will not be issued prior to completing the assessment process.

Denial of Awards

HHS cannot make an award under the SBIR or STTR program if it is determined the small business concern submitting the proposal or application has any of the following: 

Small business concern (SBC) applicants or offerors and covered individuals are responsible for monitoring their involvement with foreign countries of concern for affiliations that fall in these risk categories. 

If an award cannot be made due to a security risk, HHS will advise the small business concern that a security risk was found that required denial of award and indicate which category listed above necessitated the denial. HHS will not provide applicants with the opportunity to address any identified security risks prior to award. 

Receipt of an award decision denying an application due to an identified security risk does not prohibit the small business concern from being eligible for an award in a subsequent award cycle.

Foreign Risk Case Studies

NIH has observed several concerns regarding foreign research security risks in previous grant applications and contract proposals. The scenarios below have been developed using observations from real cases.

  • A U.S. company applied for an SBIR grant with Dr. Smith as a Principal Investigator. 
  • As Principal Investigator, Dr. Smith is a covered individual on the application. 
  • The foreign risk assessment found that Dr. Smith had been named in a malign foreign talent recruitment program in 2019 in a foreign country of concern. 
  • The foreign risk assessment found no evidence of termination of the involvement in the malign foreign talent recruitment program.

Result: The award was denied because the small business concern had a covered individual who is party to a malign foreign talent recruitment program. The small business concern (SBC) receives the following information about its denial:

  • The SBC has an owner or covered individual that is party to a malign foreign talent recruitment program.

  • Dr. Jones is a co-founder of a U.S. company that is applying for an NIH SBIR grant.
  • Dr. Jones is an NIH-supported faculty member at a U.S. university and a co-investigator on the application.  
  • The SBIR STTR Foreign Disclosure Form submitted for the SBIR application disclosed that Dr. Jones' U.S. Company has an office located in a foreign country of concern.
  • The foreign risk assessment found confirmation of the office. 

Result: The award was denied because the small business concern was operating an office in a foreign country of concern. The small business concern (SBC) receives the following information about its denial: 

  • The SBC has a business entity, parent company, or subsidiary located in a foreign country of concern (FCOC). 

  • Dr. Johnson, a researcher at a U.S. institution partnering with a U.S. company, is collaborating on the company's latest SBIR application to NIH. 
  • As an individual who contributes in a substantive and meaningful way to the proposed SBIR project, Dr. Johnson is a covered individual.
  • The foreign risk assessment finds that, in addition to Dr. Johnson’s work with the U.S. small business applicant on proteomics research, Dr. Johnson is also an honorary professor at a university in a foreign country of concern.
  • The Small Business Innovation and Economic Security Act of 2026 defines a foreign affiliation as “a funded or unfunded academic, professional, or institutional appointment or position with a foreign government or government-owned entity, whether full-time, part-time, or voluntary (including adjunct, visiting, or honorary).”

Dr. Johnson’s honorary professorship meets the definition of a foreign affiliation.

Result: The award was denied because the covered individual has a foreign affiliation with a research institution in a foreign country of concern that presents a security concern. The small business concern (SBC) receives the following information about its denial:

  • The SBC has an owner or covered individual that has a foreign affiliation with a research institution in a foreign country of concern (FCOC).

  • A small business, Ultrasound Technology LLC, proposes to collaborate with U.S.-based academic researcher, Dr. Moher, as a subject matter expert as part of its small business application requesting funds to develop a novel ultrasound technology.
  • Dr. Moher does not have a teaching or research appointment with any academic institutions in foreign countries of concern; however, she has a research collaboration relating to the application of novel diagnostic testing using ultrasound devices with researchers at an institution in a foreign country of concern.
  • Dr. Moher has been a coauthor on academic papers with her research collaborators within the last year, which were funded by an institution in a foreign country of concern.
  • As a collaborator on Ultrasound Technology LLC’s application, Dr. Moher would have access to proprietary, U.S. Government-funded small business research that could benefit her academic collaborations. 
  • It is known that the government of the foreign country of concern has, in the past, accessed the contents of emails sent to academics at institutions within the country of concern in order to gain information about innovations, technologies, and other discoveries.

Result: The award was denied because a covered individual has a foreign affiliation and in-kind financial ties with a research institution located in a foreign country of concern. The small business concern (SBC) receives the following information about its denial: 

  • The SBC has an owner or covered individual that has a foreign affiliation with a research institution in a foreign country of concern (FCOC).

  • A small business applies for an SBIR grant to fund research and development on its flagship arthritis treatment technology.
  • The foreign risk assessment found the small business has an ongoing collaboration with a business that is controlled by an entity on the list of Chinese Military companies required under section 1260H of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021.

Result: The award was denied because the small business concern has a security risk due to a current affiliation with an entity, affiliated entity, or individual on a USG Entity List. The small business concern (SBC) receives the following information about its denial:

  • The SBC has a security risk connecting the small business concern to an entity, affiliated entity, or individual on a USG Entity List.

  • A small business applicant has no ownership or investments from foreign countries of concern.  
  • However, in the application, the small business proposed a contract with a company, ABC Company, to provide research services for its project.
  • ABC Company is a subsidiary of a business owned by an entity in a foreign country of concern. Collaborating with the subsidiary inadvertently exposes the small business’s intellectual property to potential exploitation by the parent company.

Result: The award was denied because the small business proposed a contract to a subsidiary of a company in a foreign country of concern that would formalize a foreign affiliation between a research institution and covered individuals. The small business concern (SBC) receives the following information about its denial:

  • The SBC has an owner or covered individual that has a foreign affiliation with a research institution in a foreign country of concern (FCOC). 
  • The SBC has a security risk that the Federal agency determines warrants a denial.

  • Dr. Anderson, the vice president of the company, is an inventor on patents developed with research funded by the U.S. Government.
  • The foreign risk assessment finds that some of Dr. Anderson's recent patents related to work funded by the U.S. Government have been filed in a foreign country of concern with a foreign company as the assignee prior to being filed in the U.S.
  • Further assessment finds Dr. Anderson is the co-owner of the foreign company in a foreign country of concern. 
  • It was determined from the timeline of patent filing dates that Dr. Anderson used U.S. Government funds to develop technology in a foreign country of concern.

Result: The award was denied because the small business concern has a business entity in a foreign country of concern and transferred intellectual property to a company located in a foreign country of concern. The small business concern (SBC) receives the following information about its denial:

  • The SBC has a business entity, parent company, or subsidiary located in an FCOC. 
  • The SBC has a security risk that the Federal agency determines warrants a denial. 

 

  • An applicant small business concern received an investment from a biomedical company headquartered in a foreign country of concern as part of an early-stage venture capital deal.
  • During foreign risk assessment, it was confirmed that these investments had taken place and that the affiliation between the small business concern and the foreign biomedical company was ongoing. 

Result: The award was denied because the small business has a foreign ownership originating from a foreign country of concern. The small business concern (SBC) receeives the following information about its denial: 

  • The SBC has an owner or covered individual that has a foreign affiliation with a research institution in a foreign country of concern (FCOC).

 

  • A small business, Acme LLC, applied for an SBIR grant to research production models on its assay kits for common infectious diseases.
  • Acme LLC has an established collaboration with a biomedical business in a foreign country of concern that indicates Acme LLC gives access to its technology research and development with the business, including language regarding sharing findings.
  • Foreign risk assessment determines there to be a risk of technology diversion to the biomedical business in an foreign country of concern and Acme LLC’s technology is exposed to potential unauthorized transfer.

Result: The award was denied because the small business had a technology licensing agreement with an entity in a foreign country of concern that created a security risk due to potential for technology diversion. The small business concern (SBC) receives the following information about its denial: 

  • The SBC has an owner or covered individual that has a foreign affiliation with a research institution in a foreign country of concern (FCOC).
  • The SBC has a security risk that the Federal agency determines warrants a denial.  

 

  • A small business applies for a grant and ensures it has documented cybersecurity protocols for safeguarding research, data, and access.
  • However, the small business uses information technology (IT) services provided by a company that is controlled by an entity in a foreign country of concern.
  • Data visible to the IT system is exposed to the foreign country of concern-controlled service provider and is at risk of unauthorized access and transfer.

Result: The award was denied because the small business concern had a cybersecurity risk due to vulnerabilities in IT systems and services. The small business concern (SBC) receives the following information about its denial:

  • The SBC has a security risk that the Federal agency determines warrants a denial. 

 

  • A U.S. company submits an SBIR application with Dr. Ross as Principal Investigator.
  • Dr. Ross received a PhD in 2003 from an institution located in a foreign country of concern, is a citizen and former resident of the foreign country of concern, and regularly visits family that still resides in the foreign country of concern.
  • Dr. Ross does not have any current affiliations with institutions or companies located in the foreign country of concern.
  • The foreign risk assessment confirmed that neither the company nor Dr. Ross have any current foreign affiliations. 
  • Foreign risk assessment does not find any other security risks consistent with the Small Business Innovation and Economic Security Act of 2026. 

Result: The award can be made as foreign risk assessment did not find any other security risks consistent with the Small Business Innovation and Economic Security Act of 2026.

 

  • A small business applicant submits an application that includes matching funding and resources from a large multinational pharmaceutical company.
  • The large multinational company is not organized in a foreign country of concern, nor is most of its business based in a foreign country of concern. The small business investigated the ownership and affiliations of the company and verified that the large multinational company was not affiliated with a foreign government or known entity of a foreign country of concern.
  • The small business discloses the partnership and support in the Just In Time (JIT) Other Support documentation, including clear justification for why the support does not overlap with what is requested in the application.   

Result: The award can be made because the support did not overlap with the work proposed in the application and the affiliated business was not based, predominately based, nor affiliated with foreign government in a foreign country of concern, and the relationship did not present any other security concerns. 

 

  • A small business is interested in applying for an STTR grant. In preparing application materials and performing internal due diligence for security risks, the PI discovers that a company the small business currently partners with is owned by an entity in a foreign country of concern.
  • Before applying for an STTR, the small business completely terminates its affiliation with the company.
  • In the STTR application, the small business submits a Foreign Disclosure Form and avows that the affiliation and all connections to the original company have been terminated as of a particular date.
  • The small business and all covered personnel have no other security risks.

Result: The award can be made because the small business concern does not have a current affiliation with an entity in a foreign country of concern and foreign risk assessment did not find any other security risks consistent with the Small Business Innovation and Economic Security Act of 2026. 


Post-Award Monitoring and Reporting Requirements

Per NOT-OD-25-102, effective immediately, the SBIR and STTR Foreign Disclosure and Risk Management Requirements may be applied to all active SBIR and STTR awards regardless of the due date the competing application was submitted. 

Recipients are responsible for monitoring their relationships with foreign countries of concern post-award, for any changes that may impact previous disclosures. Companies receiving an award under the SBIR or STTR program are required to submit an updated SBIR STTR Foreign Disclosure Form to report any of the following changes throughout the duration of the award:

  • any change to a disclosure on the SBIR STTR Foreign Disclosure Form;
  • any material misstatement that poses a risk to national security; and
  • any change of ownership, change to entity structure, or other substantial change in circumstances that may pose a risk to national security.

Regular, annual updates are required at the time of all SBIR/STTR annual, interim, and final Research Performance Progress Reports (RPPRs). For changes that occur between RPPR submissions, updated disclosure forms are required within 30 days of any change in ownership, entity structure, covered individual, or other substantive changes in circumstance, as described above.

Recipients with active awards that did not undergo foreign risk assessment at the time of their original application may be required to disclose all funded and unfunded relationships with foreign countries, using the Required Disclosures of Foreign Affiliations or Relationships to Foreign Countries Form.

Recipients are encouraged to monitor their foreign relationships post-award and avoid entering into relationships, both funded and unfunded, that may pose a security risk and jeopardize their ability to retain their award.

Agency Recovery Authority and Repayment of Funds

A company will be required to repay all amounts received from an award if either of the following determinations are made upon assessment of a change to their disclosure:

  • the company makes a material misstatement that NIH, CDC, FDA, ACL, ARPA-H determine poses a risk to national security; or
  • there is a change in ownership, change in entity structure, or other substantial change in circumstances of the small business that NIH, CDC, FDA, ACL, or ARPA-H determine poses a risk to national security.

For more information about Foreign Disclosure and Risk Management, please see our Foreign Disclosure and Risk Management FAQs.

National Institutes of Health
Bethesda, MD 20892

Stay in the Loop

Subscribe to our mailing list for updates on deadlines and important information.

Site Map

Fraud, Waste and Abuse

HHS Vulnerability Disclosure | Technical Issues: E-mail OER Webmaster