Security Risk Management: SBIR/STTR

DOE conducts a review of risk separately from the merit review and can elect not to fund applications that present unacceptably high foreign risks. DOE has implemented the following changes as part of its implementation of its due diligence program. 

• In FY 2023, DOE amended its review of risk in its SBIR/STTR Funding Opportunity Announcements to address the new requirements associated with evaluation of foreign risks. In addition, it required all applicants to include a disclosure of foreign relationships in their applications. 
• In FY 2024, DOE extended the scope of its review of risk to include cybersecurity practices of Phase II applicants. Phase II applicants will be required to submit a cybersecurity self-assessment. More details on this cybersecurity self-assessment will be included in the Phase II Funding Opportunity Announcement. Phase I awardees are encouraged to prepare for this self-assessment by leveraging available resources to improve their cybersecurity practices in advance of submitting a Phase II application. Many of the practices needed for a small business to meet a passing threshold of a cyber checklist are free or provided in the costs of commercial-grade IT services. Examples of services and training are included below and can also be found on the Cybersecurity Resources for Small Business Web page.  

  • NIST Cybersecurity Framework Small Business Quick Start Guide: 

     https://www.nist.gov/itl/smallbusinesscyber

  • NIST SP 800-171 Rev.3 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

     https://csrc.nist.gov/pubs/sp/800/171/r3/final

  • Cybersecurity Maturity Model Certification (CMMC): 

    https://dodcio.defense.gov/CMMC/Model/

  • CISA Cross-Sector Cybersecurity Performance Goals: 

    https://www.cisa.gov/cross-sector-cybersecurity-performance-goals

  • CISA has an excellent Cyber Essential Starter Kit:  

    https://www.cisa.gov/resources-tools/resources/cisa-cyber-essentials-starter-kit

  • NIST has a useful publication that discusses the Fundamentals of Small Business Information Security:

    https://csrc.nist.gov/pubs/ir/7621/r1/final

  • The FBI Internet Crime Complaint Center (IC3) provides information about the latest and most harmful cyber threats and scams: 

    https://www.ic3.gov  

• The SBIR Extension Act of 2022 required agencies to assess cybersecurity practices, patent analysis, employee analysis, and foreign ownership, including financial ties to foreign countries, individuals, or entities. The Small Business Innovation and Economic Security Act of 2026 (S.3971) expanded the list to also include foreign affiliations of covered individuals, owners, or other key personnel with entities in a foreign country of concern (FCOC); investment relationships with individuals or entities in an FCOC; technology licensing agreements or joint ventures with individuals or entities in an FCOC; and business relationships between key personnel and individuals or entities in an FCOC. 

  A new provision further requires agencies to examine any relationship between the applicant and any entity or individual on the eight sanctions and restricted party lists: 

  The UFLPA Entity List (Department of Homeland Security) 

  The Non-SDN Chinese Military-Industrial Complex Companies List (Department of Treasury, OFAC) 

  The Section 889 Prohibition List (Department of War) 

  The 1260H Chinese Military Companies list (Department of War) 

  The Military End User List (Department of Commerce, BIS) 

  The Entity List (Department of Commerce, BIS) 

  The Covered List of Equipment and Services (FCC) 

  The Withhold Release Orders and Findings List (CBP) 

Small businesses are encouraged to carry out their own due diligence to address risks associated with loss of their intellection property. These activities can include proper vetting of employees, investors, and business partners in addition to adherence to good cybersecurity practices. The National Counterintelligence and Security Council has provided the following bulletins that provides useful guidance for protecting emerging technologies from foreign risks. 

• Safeguarding our Innovation 
• Secure Innovation  

Small Business Innovation Research (SBIR)/ Small Business Technology Transfer (STTR) cybersecurity due diligence is more than a compliance checkpoint. It helps protect federally funded R&D, intellectual property, sensitive information, and the small business’s ability to transition technology into the U.S. marketplace.

View the Cybersecurity Due Diligence webpage to learn more. 

Please send your questions/feedback to csduediligence@doe.gov.