OSTP Releases Research Security Guidance

On July 9, 2024 The White House Office of Science and Technology Policy (OSTP) released Guidelines for Research Security Programs at Covered Institutions. Recommendations aim to protect American research interests without exacerbating discrimination, prejudice, or xenophobia. The guidance is directed to higher education and nonprofit research institutions as well as research and development centers that receive over $50 million per year in federal funding.  

Although there is language in the memorandum recognizing the need for cross border collaboration in science and technology, the scientific community is concerned about potential unintended consequences on international partnerships.  

The requirements relate to (1) cybersecurity, (2) foreign travel security, (3) research security training, and (4) export control training.  

• Institutions must implement a cybersecurity program consistent with the resources provided in the CHIPS and Science Act (NIST IR 8481: Cybersecurity for Research: Findings and Possible Paths Forward.)  

• Individuals engaged in foreign travel must undergo training at least once every six years and all travel must be reported.  

• Institutions can meet the research training requirements by mandating completion of NSF training modules. Otherwise, an alternate training course can be used if it (1) provides explicit examples of behaviors that have resulted in illegal transfer of government supported R&D and (2) communicates the importance of US research participation in global discovery and leadership. 

• Individuals at covered institutions must complete export control training. This can include trainings administered by the Bureau of Industry and Security of the Department of Commerce or trainings developed by the institution that adhere to the Directorate of Defense Trade Controls at the Department of State. Alternatively, individuals can complete any training that complies with US export control and compliance requirements and requirements for reviewing foreign sponsors, collaborators, and partnerships.  

Focus is on competition with the People’s Republic of China (PRC), noting that the PRC has “exploited international research collaboration by undermining values – such as transparency, accountability, and reciprocity – in order to advance its strategic objectives and military modernization.” 

The July 9th version differs substantially from the draft released in February 2023. 

A notable difference from the February 2023 version is the considerable flexibility provided to institutions. The OSTP directs agencies to allow for expansion or integration of current research safety protocols rather than requiring a complete overhaul. The language is also much less prescriptive and instead provides broad recommendations that can be satisfied in a number of ways. Yet, the memorandum retains significant power for the federal agencies to alter and update requirements at their discretion. 

Federal research agencies have six months from July 9, 2024, the date of issue, to submit details of their plans for updating research safety policies to the Office of Management and Budget (OMB) and OSTP. After these plans go into effect, covered institutions have 18 months to implement their requirements.