Research Security and International Engagements

Objective: Implement robust cybersecurity practices to protect digital research data and infrastructure from unauthorized access, theft, or damage. This includes securing networks, systems, and data storage against cyber threats.

NSPM-33 Directive to Federal Agencies - Federal agencies should require the following from research organizations:

• Provide regular cybersecurity awareness training for authorized users of information systems, including in recognizing and responding to social engineering threats and cyber breaches.

• Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

• Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

• Verify and control/limit connections to and use of external information systems.

• Control any non-public information posted or processed on publicly accessible information systems.

• Identify information system users, processes acting on behalf of users, or devices.

• Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

• Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

• Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

• Provide protection of scientific data from ransomware and other data integrity attack mechanisms.

• Identify, report, and correct information and information system flaws in a timely manner.

• Provide protection from malicious code at appropriate locations within organizational information systems.

• Update malicious code protection mechanisms when new releases are available.

• Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

UCR’s Implementation plan

Objective: Establish policies and training to mitigate risks associated with international travel by researchers. This might involve guidance on securing devices, awareness of espionage tactics, and protocols for reporting suspicious activities.

NSPM-33 Directive to Federal Agencies - Federal agencies should require that research organizations:

• Maintain international travel policies for faculty and staff traveling for organization business, teaching, conference attendance, research purposes, or any offers of sponsored travel that would put a person at risk. 

• Include an organizational record of covered international travel by faculty and staff and,

• As appropriate, a disclosure and authorization requirement in advance of international travel, security briefings, assistance with electronic device security (smartphones, laptops, etc.), and preregistration requirements.

International travel policies and procedures must include: 

• Maintenance of an organizational record of covered international travel by covered individuals engaged in federally funded R&D. 

• A disclosure and authorization requirement in advance of international travel. 

• Mandatory applicable security briefings, and advice regarding electronic device security (e.g., smartphones, laptops) prior to covered international travel, or to travel including electronic devices utilized for federally funded R&D or bought with Federal funding.

UCR’s Implementation plan

Objective: Covered research organizations must implement research security training as a component of research security programs required for qualifying organizations in accordance with NSPM-33. 

NSPM-33 Directive to Federal Agencies - Agencies should require that, as part of their research security programs, research organizations provide training to relevant personnel on research security threat awareness and identification, including insider threat training where applicable. Research organizations should consider incorporating relevant elements of research security into existing training on responsible and ethical conduct of research for faculty and students. In addition to periodic training, research organizations should conduct tailored training in the event of a research security incident. 

Covered research organizations must incorporate the below elements of research security into existing training programs, such as training on responsible and ethical conduct of research, and must provide training at initial orientation for new personnel as well as regular refresher training. Covered research organizations must maintain the ability to certify that personnel have completed the required training for the purposes of Federal R&D award applications as mandated by the CHIPS and Science Act.   

Research security training must be regularly updated and include components such as research security threat awareness, identification, and insider threats. Training should be tailored to appropriate personnel, such as faculty, staff, and students. Covered research organizations must annually certify their training meets requirements. Training programs must include instruction in the following areas: 

1. Understanding why research security is important for the U.S. R&D enterprise and what constitutes foreign interference. 

2. The importance of non-discrimination as a guiding principle of U.S. research security policy. 

3. Disclosure policy and how it is used, particularly with regard to conflicts of interest and conflicts of commitment.

 4. Identifying, managing, and mitigating risk, particularly in the context of foreign talent programs and insider threats. 

5. Proper use of funds. 

6. The value of and challenges with international collaboration 

7. Responsible international travel practices. 

8. Basic cybersecurity hygiene and data protection practices, including recognition of and response to social engineering threats and cyber breaches. 

9. Intellectual property and data protection requirements and best practices. 

10. Insider Threat Awareness and Identification: Develop programs to educate employees on recognizing and reporting potential insider threats. This should include regular training on the signs of suspicious behavior and procedures for confidential reporting.

11. Foreign Visitors: Screening and Vetting: Conducting thorough vetting and background checks on foreign visitors and researchers to prevent unauthorized transfer of technology and information.

In the event of a research security breach finding, covered research organizations must conduct tailored training related to the finding as a component of the organization’s response, and keep a record of such trainings for affected individuals. 

As of May 1, 2025, proposals submitted to the Department of Energy (DOE) must include individual and institutional certification that covered individuals have completed research security training within the previous 12 months.

As of October 1, 2025, for proposals submitted to the National Science Foundation (NSF), each individual identified as a senior/key person must certify that they have completed the requisite research security training that meets the requirements specified in Item 2 of Important Notice No. 149 within 12 months prior to proposal submission.

UCR's Implementation Plan

UCR has launched the following eCourse module that satisfies the research security training requirement. This eCourse module is accessible to all UCR’s staff, faculty and students via the Learning Management System (LMS)

• Research Security at the University of California

Objective: Ensure that all personnel involved in research are trained on export control laws and regulations. This includes understanding what information, technologies, and materials are subject to export controls and the implications for research collaborations.

NSPM-33 Directive to Federal Agencies - Agencies should require that research organizations conducting R&D that is subject to export control restrictions provide training to relevant personnel on requirements and processes for reviewing foreign sponsors, collaborators and partnerships, and for ensuring compliance with Federal export control requirements and restricted entities lists.

UCR's Implementation Plan

UCR has launched the following eCourse module that satisfies the research security training requirement. This eCourse module is accessible to all UCR’s staff, faculty and students via the Learning Management System (LMS)

• Export Control: The Basics

In compliance with individual sponsor requirements, certain collaborations and/or affiliations with foreign as well as domestic entities or individuals must be disclosed in proposals and reports. Such collaborations may include exchanges of staff, materials, data, funding, or other significant activity which could result in joint authorship.

Failure to fully disclose foreign/domestic collaborations, affiliations, and resources in funding applications and other documents can have serious consequences, and may endanger UCR’s eligibility for future federal funding.

When a Principal Investigator approves a Proposal in Kuali PD and a proposal is then submitted to a federal agency, the PI is certifying that all information is complete and accurate to the best of his or her knowledge, and failure to disclose may lead to charges of providing fraudulent information. In some cases, failure to disclose has led to criminal charges against individual researchers.

Please contact the Contract and Grant Officer assigned to your department if you have any questions on disclosure requirements. The policies of the various agencies are not consistent and are being continuously modified. The disclosure policies of some key agencies are summarized below:

• National Institutes of Health
• National Science Foundation
• Department of Defense
• Department of Energy
• National Aeronautics and Space Administration

For disclosure policies of other federal research sponsors, please review the program announcements and proposal preparation guides, and contact the Contract and Grant Officer assigned to your department with any questions.

Conflicts of Interest 

• Principal Investigators on sponsored research agreements and others who share responsibility for the design, conduct, or reporting of research supported by the National Science Foundation and all other federal agencies other than PHS (see below), must disclose personal financial interests, both U.S. and foreign, that may reasonably appear to be affected by the work performed under the sponsored project. This includes salary, consulting payments, honoraria, royalty payments, dividends, loans from the entity, equity interests, or intellectual property interests in the form of a patent, patent application, or copyright of software assigned to any entity other than the UC Regents.
• Principal Investigators on sponsored research agreements and others who share responsibility for the design, conduct or reporting of research supported by the Public Health Service (including the National Institutes of Health), must disclose personal financial interests that reasonably appear to be related to their UCR responsibilities. Financial interests include income, honoraria, royalty payments for use or sale of patented or copyrighted intellectual property owned by an individual or organization other than the UC Regents, equity, and travel reimbursed by or directly purchased for the individual. While there are some exclusions for U.S. government and institutions of higher education, all financial interests in foreign institutions must be disclosed.
• Principal Investigators seeking research support through contracts, grants, gifts and material transfer agreements from non-governmental sources (for-profit and non-profit) and others who share responsibility for the design, conduct or reporting of the research, or who are the recipients of gifts for research, must disclose financial interests in the sponsor under State of California, UC, and UCR conflict of interest policies and procedures. This includes all foreign sponsors including governmental and non-governmental. 

Forms, policies and procedures, and other guidance concerning disclosure of conflict of interest in research can be seen on the Office of Research Compliance website.

Conflicts of Commitment

• UCR faculty are required to seek prior approval for outside professional activities likely to create conflict of commitment concerns. This includes the conduct of research elsewhere, employment at another institution, and managerial or executive positions outside the University. Faculty are also expected to submit annual reports in which they disclose these kinds of activities, and any outside consulting, Board of Director memberships, industry workshops, and UC-compensated teaching above their regular course loads. (See APM 025 and 671)
• UCR faculty are required to complete annual reports of outside professional activities, both those likely to create conflict of commitment concerns (listed above), and other activities including additional University-compensated teaching such as UNEX courses and programs, other continuing education programs run by the University, and self-supporting UC degree programs; consulting or testifying as an expert or professional witness; providing outside consulting services or referrals or engaging in professional practice as an individual or through a single-member professional corporation or sole proprietorship; serving on a board of directors outside of the University; providing or presenting a workshop for industry; or providing outside consulting or compensated professional activities performed for entities such as the Los Alamos and Lawrence Livermore National Laboratories. (See APM 025 and 671)

Reports of outside professional activities (whether compensated or uncompensated) must include all foreign and domestic activities. UC Outside Activity Tracking System (OATS) has been developed to facilitate this reporting.

Contracts and Grants

Proposals for external support for sponsored research and other activities must be submitted to the sponsor through Sponsored Programs Administration (non-profit and government sponsors), the Corporate Sponsored Research Team in the Office of Technology Partnerships (for-profit sponsors), or the Clinical Trials unit within the office of Sponsored Programs Administration ( industry and investigator-initiated clinical trials). Information about foreign activity and potential export control issues should be noted in the Kuali PD. The above-named units also handle agreements for sharing of proprietary/confidential information, data use, material transfer, and other agreements with outside parties related to research that do not involve an exchange of funds.

Gifts

Gift support to UCR from foreign sources must be disclosed and accepted by University Advancement.

Other Agreements

Entering into other types of agreements with foreign entities also requires review. Please confer with the appropriate campus unit before initiating an agreement so that any potential issues and/or conflicts can be identified and managed.

• Honoraria and other personal service agreements (for non-UCR individuals): UCR Business and Financial Services
• International Academic Agreements and Memoranda of Understanding (MOUs): UCR International Affairs
• Visiting graduate researcher appointments: UCR Graduate Division
• Agreements related to the transfer of intellectual property: UCR Office of Technology Partnerships

Foreign Talent Recruitment Programs (FTRPs) typically provide U.S. academics with additional appointments, resources, and responsibilities. If participation in these programs involves establishment of an employee-employer relationship, the conduct of research or teaching, and/or acceptance of salary from another institution, invitations to join these programs must be disclosed to UCR as part of the prior approval process under Conflict of Commitment Policies (APM 025 and 671). Faculty must report effort committed to a Foreign Talent Program in annual reports required under the same Academic Personnel Policies.

Program participants are usually obligated to disclose intellectual property to the foreign institution with which they are affiliated. In most cases, these obligations conflict with existing obligations to UCR under the UC Patent Policy. Before agreeing to such requirements, faculty should confer with the Office of Technology Commercialization (contact: otc@ucr.edu).

In addition to obtaining prior approval under the Conflict of Commitment Policies referenced above, faculty should also confer with the Contract and Grant Officer assigned to your department prior to accepting such an appointment to ensure that the terms of participation do not conflict with other research sponsor policies. Additionally, SPA staff can provide guidance about how appointments and resources provided under a foreign talent program should be disclosed to research sponsors.

While many FTRPs are legitimate and have mutually beneficial purposes, some may require or incentivize activities that are contrary to regulations, policies, and core research values to attract and retain talent.  These are referred to as Malign FTRPs (MFTRP). 

Congress, the Federal Bureau of Investigation, and other government organizations view MFTRPs as threats to the integrity and security of the U.S. research enterprise. The CHIPS and Science Act of 2022 prohibit participation in a MFTRP by covered individuals involved with research and development awards from federal research agencies and directs those agencies to maintain policies that:

• require covered individuals to disclose all participation in FTRPs, and
• prohibit recipients of federal support from participating in any MFTRPs.

Therefore, faculty and researchers should carefully consider participation in FTRPs and seek assistance from the UCR’s Research Security Office to help determine if an FTRP is a MFTRP.

See UC’s Malign Foreign Talent Recruitment Program Prohibition for additional information.

UCR Insurance & Risk Management’s Travel Insurance website provides instructions on registering international travel, protecting electronic devices, and obtaining assistance while away from UCR. A University of California website contains additional general information and links to resources on traveling and working overseas.

Travel to certain embargoed or sanctioned destinations such as Cuba, Iran, Syria, Sudan, or North Korea requires advance review and in some instances licenses from the U.S. Department of Treasury, Office of Foreign Assets Control. International travelers are encouraged to visit the International Travel block of UCR's Export Control website for travel information and to contact the Export Control Office exportcontrol@ucr.edu if you plan to undertake such travel. 
 

The UCR Office of Technology Commercialization (OTC) is responsible for seeking patent and/or copyright protection (as appropriate) and licensing UCR intellectual property. This is essential in protecting IP against theft or other improper use by international parties.

Under the UC Patent Policy, all UCR employees, and certain individuals that use UCR research facilities or receive gift, grant, or contract research funding are required to promptly disclose to OTC all inventions that they conceive and/or reduce to practice during the timeframe in which they are a UCR employee or use such facilities or funding. For clarity, such disclosure obligation is broad and requires disclosure regardless of where or in what capacity (e.g., includes inventions made during a consultancy) the inventor was working at the time the invention was made. See information on submitting an invention report to OTC

When visitors are on the UCR campus, appropriate safeguards must be in place to prevent unauthorized access to unpublished research results, third party proprietary information, laboratory facilities, and IT resources. In most cases, visiting researchers are required to execute a Visiting Scientist Agreement – please contact OTC with any questions. Certain visa petitions may require the host department at UCR to submit an Export Control Compliance Attestation form to confirm that the visitor will not be performing research on any technology in violation of the export control regulations, or will otherwise have improper access to controlled equipment, technology, or information.

• The NIH (National Institutes of Health) research security program is a set of policies and procedures designed to protect the integrity of NIH-funded research from foreign interference and exploitation. It aligns with the broader National Security Presidential Memorandum 33 (NSPM-33), which aims to standardize disclosure requirements and establish research security programs at institutions receiving significant federal funding. These programs focus on areas like cyber security, foreign travel security, insider threat awareness, and export control training.
  • Notice NOT-OD-25-133
  • Foreign Interference 

• The NSF is a leading agency in research security. They have established a "Research on Research Security Program" (RoRS) to study and improve understanding of the factors influencing research security. They also provide resources and training on research security.
• The Research on Research Security Program (RoRS)
• Important Notice No. 149: Updates to NSF Research Security Policies

• The DoD, through the National Defense Authorization Act for Fiscal Year 2019, established an initiative to work with academic institutions to limit foreign influence on DoD-funded research.
• Federal Research Security Policies: Background and Issues for Congress
• Academic Research Security

• The DOE is focused on Research, Technology, and Economic Security (RTES) risks in financial assistance and loan activities. They require annual research security training for covered individuals and have specific requirements related to foreign nationals involved in research.
• Research, Technology & Economic Security (RTES)

• NIST has a Research Security Office that contributes to the development of security standards and best practices for federally funded research. The NIST research security team has developed a robust research security program that provides tools to help balance the risks of international engagement with the benefits for both internal NIST research projects and external, NIST-funded research projects.
• Safeguarding International Science: Research Security Framework
• NIST: CHIPS Technology Protection Guidebook

• leads the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. The agency connects its stakeholders in industry and government to each other and to resources, analyses, and tools to help them fortify their cyber, communications, and physical security and resilience, which strengthens the cybersecurity posture of the nation.   
• CISA is at the center of the exchange of cyber defense information and defensive operational collaboration among the federal government, and state, local, tribal and territorial (SLTT) governments, the private sector, and international partners. The agency has two primary operational functions. First, CISA is the operational lead for federal cybersecurity, charged with protecting and defending federal civilian executive branch networks in close partnership with the Office of Management and Budget, the Office of the National Cyber Director, and federal agency Chief Information Officers and Chief Information Security Officers. Second, CISA is the national coordinator for critical infrastructure security and resilience, working with partners across government and industry to protect and defend the nation’s critical infrastructure.
• Cybersecurity Best Practices

• NSA conducts leading-edge research to advance U.S. intelligence and national security capabilities by inventing, developing, and applying advancements in science and emerging technologies.
• Advancing Intelligence through Science

• Supplement 3 to part 732, “Know Your Customer” The Department of Commerce uses this concept as a foundational tenet of an export control program. Beyond export controls, the concept also has utility for conducting research security or other types of international engagement reviews performed at the campus.
• BIS created this compendium of resources to assist institutions in Export Compliance. It includes useful vetting resources.
• Export Compliance Resource for Academic Institutions