Implementation of NIH Research Security Policies
Notice Number:
NOT-OD-25-154
https://grants.nih.gov/grants/guide/notice-files/NOT-OD-25-154.html
Purpose:
Research Security Program Policy:
In alignment with the OSTP memorandum, NIH will require two-part compliance for both covered institutions and individuals as outlined below:
1. Covered institutions (i.e., participants in the U.S. R&D enterprise receiving federal science and engineering support "in excess of $50 million per year"). Covered institutions will certify to the NIH that the institution has established and operates a research security program. Each research security program must include elements relating to (1) cybersecurity; (2) foreign travel security; (3) research security training; and (4) export control training, as appropriate.
2. Covered individuals (i.e., each individual identified as a senior/key person). Covered individuals will certify that they have completed the requisite research security training that meets the research security training requirements within 12 months prior to application submission.
Compliance will be effective for applications submitted on or after January 25, 2026. NIH is participating with NSF other Federal research agencies to develop resources for each of the required elements and to develop a centralized process for recipients to certify compliance. NIH will issue more information on the central certification process as it becomes available.
Please refer to the full notice linked above for further details.
Should you have any questions, please contact the Office of Sponsored Programs.