June 12, 2023
NATIONAL INSTITUTES OF HEALTH (NIH)
This guidance serves as Notice for the extramural community on recent policy changes made for the Small Business Innovation Research Program (SBIR) and the Small Business Technology Transfer Program (STTR). This Notice implements additional disclosure requirements and post-award reporting requirements for small business concerns (SBCs) for covered relationships. In addition, this serves as notification of NIH’s due diligence program to assess security risks and denial of award when foreign relationships or commitments with countries of concern pose a significant risk as provided in the SBIR and STTR Extension Act of 2022 under these programs. This policy serves as an update to Section 18. Grants to For-Profit Organizations of the NIH Grants Policy Statement (GPS), and will be incorporated in an updated publication. In addition, the NIH Application Guide has been updated to reflect instructions for submission of required documentation.
The SBIR and STTR Extension Act of 2022 (the Act), signed into law by President Biden on September 30, 2022, reauthorized the SBIR program, the STTR program, and related pilot programs through September 30, 2025.
The Act includes major changes to the SBIR and STTR programs, including:
Foreign countries of concern are defined in the Act as the People’s Republic of China, the Democratic People’s Republic of North Korea, the Russian Federation, the Islamic Republic of Iran, or any other country determined to be a country of concern by the U.S. Secretary of State. An up-to-date list of countries determined to be countries of concern by the Secretary of State will be maintained and accessible on SBA’s Required Disclosures of Foreign Affiliations or Relationships webpage.
In response to the passing of the Act, the U.S. Small Business Administration (SBA) has issued a form, Required Disclosures of Foreign Affiliations or Relationships to Foreign Countries (referred to as the “disclosure form” hereafter) that will be administered by federal agencies to identify and assess the risk of covered foreign relationships for SBC applicants applying for SBIR and STTR funding. The final form can be found on the NIH website.
This policy applies to all competing applications for funding under the NIH, CDC, and FDA SBIR and STTR programs submitted for due dates on or after September 5, 2023.
Each SBC applying for the SBIR and STTR programs under the NIH, CDC, and FDA is required to disclose all funded and unfunded relationships with foreign countries, using the disclosure form, for all owners and covered individuals. A “covered individual” is defined as all senior key personnel identified by the SBC in the application (i.e., individuals who contribute to the scientific development or execution of a project in a substantive, measurable way). Applicants must include the following information on the disclosure form:
Upon request, applicants will submit the completed disclosure form via the Just-In-Time (JIT) process described in the NIH GPS section 2.5.1 Just-in-Time Procedures. The disclosure form and any additional agency-specific information must be submitted electronically using the Just-in-Time feature in the eRA Commons. Applicants must continue to comply with NIH Other Support disclosure requirements as provided in Section 2.5.1. SBC applicants applying to CDC and FDA will follow each agency’s policies for submitting additional documents during the pre-award process. Applicants may be required to provide similar information on the disclosure form that is also submitted as a part of the other support reporting for senior/key personnel identified in the application. Applicants that do not submit the completed disclosure form during the JIT process will not be considered for funding.
SBIR/STTR n otices of funding opportunities and terms and conditions of award will be updated to reflect the policy above.
Due Diligence Program to Assess Security Risks
NIH, CDC, and FDA have implemented a due diligence program designed to assess security risks posed by applicants. The due diligence program will assess the cybersecurity practices, patent analysis, employee analysis, and foreign ownership of an SBC seeking an award, including the financial ties and obligations of the SBC and employees of the SBC to a foreign country, foreign person, or foreign entity. After reviewing the application, including JIT elements and the disclosure form, NIH, CDC, and FDA may request the SBC provide copies of any contractual or financial obligation or other agreement specific to a business arrangement, or joint venture-like arrangement with an enterprise owned by a foreign state or any foreign entity in effect during the 5-year period (calendar year) preceding submission of the proposal. NIH, CDC, and FDA may decline to move forward with an award based on security risks determined during the assessment. NIH, CDC, and FDA will not issue an award prior to completing the assessment process.
Denial of Awards
Applicants and recipients are encouraged to consider whether their entity’s relationships with foreign countries of concern will pose a security risk. Prior to issuing an award, NIH, CDC, and FDA will determine whether the SBC submitting the application:
A finding of foreign involvement with countries of concern will not necessarily disqualify an applicant. Final award determinations will be based on the above finding of foreign involvement and whether the applicant’s involvement falls within any of the following risk criteria, per the Act:
Generally, NIH, CDC, and FDA will not provide SBC applicants the opportunity to address any identified security risks prior to award. NIH, CDC, and FDA will not issue an award under the SBIR/STTR program if the covered relationship with a foreign country of concern identified in this guidance is determined to fall under any of the criteria provided.
Post-Award Reporting Requirements
Recipients are responsible for monitoring their relationships with foreign countries of concern post-award, for any changes that may impact previous disclosures. SBCs receiving an award under the SBIR/STTR program are required to submit an updated disclosure form to report any of the following changes to NIH, CDC, and FDA throughout the duration of the award:
Regular, annual updates are required at the time of all SBIR/STTR annual, interim, and final Research Performance Progress Reports (RPPRs). For changes that occur between RPPR submissions, updated disclosure forms are required within 30 days of any change in ownership, entity structure, covered individual, or other substantive changes in circumstance, as described above. Recipients will be required to upload these updated disclosures using the Additional Materials (AM) tool in eRA Commons. System enhancements to facilitate these uploads are underway, with an anticipated deployment in calendar year 2024.The RPPR Instruction Guide will be updated to reflect this process.
If the recipient reports a covered foreign relationship that meets any of the risk criteria prohibiting funding described in this guidance, NIH, CDC, and FDA may deem it necessary to terminate the award for material failure to comply with the federal statutes, regulations, or terms and conditions of the federal award. Refer to Section 8.5.2 Remedies for Noncompliance or Enforcement Actions: Suspension, Termination, and Withholding of Support for more information. Recipients are encouraged to monitor their covered foreign relationships post-award and avoid entering into relationships, both funded and unfunded, that may pose a security risk and jeopardize their ability to retain their award.
Agency Recovery Authority and Repayment of Funds
An SBC will be required to repay all amounts received from NIH, CDC, and FDA under the award if either of the following determinations are made upon assessment of a change to their disclosure:
The repayment requirements and procedures provided in Section 8.5.4 Recovery of Funds of the NIH GPS apply and may also be subject to additional noncompliance and enforcement actions as described in Section 8.5.2 of the GPS. Recipients are required to follow the repayment procedures provided in the Guidance for Repayment of Grant Funds to the NIH.
For all inquiries concerning the NIH SBIR and STTR program requirements please contact:
SEED (Small business Education and Entrepreneurial Development)
Office of Extramural Research
For general NIH grants policy-related inquiries, please contact:
Division of Grants Policy
Office of Policy for Extramural Research Administration (OPERA)
For NIH system related inquiries, please contact:
Systems Policy Branch, Division of Grants Systems Integration
For inquiries concerning CDC’s SBIR and STTR program requirements, please contact:
CDC Office of Grants Services, Office of Financial Resources
For inquiries concerning FDA’s SBIR and STTR program requirements, please contact:
Office of Finance, Budget, Acquisitions, and Planning