Research Security Policy

Revision Date: September 25, 2026

Responsible Office: URA Compliance & Training

PDF

Policy Statement 

The University of Chicago aims to ensure that all research activities performed by its researchers reflect the university’s primary goals of education, research, and scholarly inquiry, conducted in a rigorous and open manner. To that end, researchers should be transparent in their compliance with all applicable policies and guidelines, including those at the university level and sponsor level. This research security policy provides clarity surrounding the compliance requirements expected of researchers. 

 

Purpose 

In January 2021, the White House issued a National Security Presidential Memorandum (NSPM-33) intended to strengthen protections of United States Government-supported research and development against foreign government interference and exploitation. The CHIPS and Science Act of 2022 codified certain research security program elements, requiring funding agencies to update grantmaking rules and policies to ensure covered research institutions receiving federal research funding implement a compliant research security program. 

Subsequently, federal funding agencies have begun implementing and enforcing these new program elements for covered institutions, such as UChicago. This Research Security Policy is designed to meet the current requirements of the federal funding agencies, anticipating any additional agency implementation to be in alignment, and additionally aims to meet the requirements set forth in other federal guidance pertaining to research security, such as the CHIPS and Science Act of 2022. 

 

Applicability 

This policy applies to all covered individuals (defined below). 

 

Policy Ownership 

Responsible Office: URA Research Compliance and Training

Originally issued: 2/20/2025 

Current version effective date: 9/25/2026 

Last Updated: 9/25/2026 

 

Definitions 

Term

 Definitions
Covered Individual

As defined by federal guidelines, an individual who: a) contributes in a substantive, meaningful way to the scientific development or execution of a research and development project proposed to be carried out with a research and development award from a Federal research agency; and b) is designated as a covered individual by the Federal research agency concerned. 
MFTRP 

Malign Foreign Talent Recruitment Program. The University of Chicago adopts the full definition as set forth in the CHIPS and Science Act of 2022. 

However, in brief, an MFTRP is a program, position, or activity sponsored by an entity in a Foreign Country of Concern involving compensation or remuneration in exchange for obligations or activities which are antithetical to U.S. interests (such as unauthorized transfer of IP developed under a federal research award). 
Foreign Country/Countries of Concern (FCOC)  FCOC shall be understood to have the same meaning as set forth in the CHIPS and Science Act of 2022: China, Iran, North Korea, and Russia. Researchers should note that a number of federal agencies maintain their own country lists which may be more extensive. 

 

Policy:  

The University of Chicago is committed to facilitating a culture of compliance with respect to research security. As such, the University undertakes to: 

  • Maintain and update this policy in accordance with the changing federal compliance landscape. 
  • Operate a cybersecurity program aligned with the cybersecurity resource to be developed by NIST (as of the date of this policy, such resource is not yet available). 
  • Make applicable trainings available for the UChicago community, including: 
  • Export control training 
  • Research security training 
  • Maintain a record of covered individuals’ completion of required trainings and provide adequate notice to covered individuals who have not fulfilled the training requirements. 
  • Provide guidance to University personnel regarding matters relating to research security. 
  • Engage with funding agencies to implement measures to mitigate potential risk associated with specific projects as deemed necessary by such agencies. 
  • Certify to federal funding agencies the University’s, and its covered individuals’, compliance with all applicable training, reporting, and disclosure requirements. 

The University of Chicago additionally expects its researchers to emulate this commitment to compliance, serving to further its goals of transparent and open scientific inquiry. Therefore, covered individuals are required to: 

  • In accordance with the University’s COI and COC policies, disclose to the University any affiliation or relationship with outside foreign entities, including any associated contracts for such affiliation, regardless of whether any remuneration is part of the relationship. 
  • Not participate in any MFTRP. Individuals may consult with University Research Administration for assistance determining if a program is or is not an MFTRP. 
  • For each federal award on which the covered individual is named, certify non-participation in MFTRPs at the time of application and at certain intervals after the award is made, if and as required by the applicable funding agency. 
  • Cooperate with University and funding agencies to mitigate research security risks identified by the University or applicable funding agency. 
  • Maintain awareness of cybersecurity best practices and report any suspicious activity to the University’s IT Security. 
  • Complete the University’s designated Research Security Training (RST), or University-approved alternative, within the twelve-month period immediately prior to applying for new federal awards. Individuals who have first completed RST may utilize the University’s Refresher course in subsequent years. 
  • If a covered individual is engaged in research involving export-controlled technologies, complete the University’s export control training,. 
  • Report to the University any suspected compromise of research security, such as unauthorized transfer of intellectual property to a foreign entity, particularly within a FCOC. 
  • For any federal award for which the covered individual is PI, ensure other individuals paid from and performing on that federal award are in compliance with all requirements herein, including completion of Research Security Training as applicable and non-participation in MFTRPs. 
  • Cooperate with the University in any investigation of a research security matter. 
  • Disclose all foreign collaborations on federal awards, whether or not funds are expended on the foreign collaboration, to University Research Administration (URA) so URA can screen for research security and determine compliance obligations to the federal sponsor. 
  • Discontinue work pertaining to a federally-funded project with certain foreign individuals or institutions if and when deemed necessary by either URA or the federal sponsor. Determinations by URA will be made only when there is a clear research security risk, such as the foreign institution’s presence on a U.S. restricted party list. 

Covered individuals who receive any funding from the National Institutes of Health (NIH) shall additionally be required to: 

  • Report to the NIH, as part of their Other Support documentation, all resources made available to that covered individual in support of and/or related to all of their research endeavors, in accordance with the NIH definitions and policies (linked below). 
  • Complete training related to Other Support disclosures, to be met by completing the University’s Research Security Training. 

As scrutiny on research security and foreign influence increases, researchers are advised to proactively disclose other planned foreign collaborations and co-authorships, international travel, and other international engagements with University Research Administration (URA) prior to the engagement taking place. URA can screen any foreign individuals and institutions to determine whether they are on any U.S. restricted party lists, and help determine whether other research security risks are present, to minimize the potential impact to the researcher’s federal funding portfolio, even when the proposed foreign engagement is not directly related to a federal award. 

Consequences of Non-Compliance 

Due to the importance of maintaining security of the U.S. RD enterprise, the University or covered individuals may be penalized by the federal government if non-compliance is discovered. Penalties may include termination of federal awards and contracts, suspension or debarment from eligibility for federal funding, and/or suspension or denial of Title IV funds. Therefore, the University takes compliance with this policy very seriously, and covered individuals may be subject to the ordinary disciplinary process of the University if they fail to fully comply with any element of this Research Security Policy. Additionally, depending on the nature of non-compliance, they may be subject to criminal sanctions, civil liability, or both, under law. 

 

Procedures

 

Related Information 

Related Policies: 

Regulatory Links: 

 

Contacts 

The following individuals can address questions regarding this Policy: 

Title/Office Email Phone
Katy Jones-Luckey, University Research Administration  kathrynjones@uchicago.edu  773-702-2918 
Rachel Talentino, Senior Director, Research Compliance rtalentino@uchicago.edu  

 

Policy URL 

https://ura.uchicago.edu/policy-library/research-security-policy