Key Dates

Related Announcements

• November 14, 2023 - Clarification of Implementation of the NIH SBIR and STTR Foreign Disclosure Pre-award and Post-Award Requirements. See Notice NOT-OD-24-029
• February 23, 2023 - Notice of Change to Minimum Performance Standards for SBIR and STTR Applicants . See NOT-OD-23-092.

Issued by

NATIONAL INSTITUTES OF HEALTH (NIH)

CENTER FOR DISEASE CONTROL AND PREVENTION (CDC)

U.S. FOOD AND DRUG ADMINISTRATION (FDA)

Purpose

This guidance serves as Notice for the extramural community on recent policy changes made for the Small Business Innovation Research Program (SBIR) and the Small Business Technology Transfer Program (STTR). This Notice implements additional disclosure requirements and post-award reporting requirements for small business concerns (SBCs) for covered relationships. In addition, this serves as notification of NIH’s due diligence program to assess security risks and denial of award when foreign relationships or commitments with countries of concern pose a significant risk as provided in the SBIR and STTR Extension Act of 2022 under these programs. This policy serves as an update to Section 18. Grants to For-Profit Organizations of the NIH Grants Policy Statement (GPS), and will be incorporated in an updated publication. In addition, the NIH Application Guide has been updated to reflect instructions for submission of required documentation.

Background

The SBIR and STTR Extension Act of 2022 (the Act), signed into law by President Biden on September 30, 2022, reauthorized the SBIR program, the STTR program, and related pilot programs through September 30, 2025.

The Act includes major changes to the SBIR and STTR programs, including:

• increased minimum performance standards (refer to NOT-OD-23-092),
• disclosure requirements regarding ties to foreign countries,
• a requirement for federal agencies that manage SBIR and STTR programs to establish a due diligence program to assess security risks posed by applicants, and
• denial of award and recovery authority provisions when ties to foreign countries of concern pose a significant risk.

Foreign countries of concern are defined in the Act as the People’s Republic of China, the Democratic People’s Republic of North Korea, the Russian Federation, the Islamic Republic of Iran, or any other country determined to be a country of concern by the U.S. Secretary of State. An up-to-date list of countries determined to be countries of concern by the Secretary of State will be maintained and accessible on SBA’s Required Disclosures of Foreign Affiliations or Relationships webpage.

In response to the passing of the Act, the U.S. Small Business Administration (SBA) has issued a form, Required Disclosures of Foreign Affiliations or Relationships to Foreign Countries (referred to as the disclosure form hereafter) that will be administered by federal agencies to identify and assess the risk of covered foreign relationships for SBC applicants applying for SBIR and STTR funding. The final form can be found on the NIH website.

Applicability

This policy applies to all competing applications for funding under the NIH, CDC, and FDA SBIR and STTR programs submitted for due dates on or after September 5, 2023.

Policy

Each SBC applying for the SBIR and STTR programs under the NIH, CDC, and FDA is required to disclose all funded and unfunded relationships with foreign countries, using the disclosure form, for all owners and covered individuals. A covered individual is defined as all senior key personnel identified by the SBC in the application (i.e., individuals who contribute to the scientific development or execution of a project in a substantive, measurable way). Applicants must include the following information on the disclosure form:

• the identity of all owners and covered individuals of the SBC who are a party to any malign foreign talent recruitment program;
• the existence of any parent company, joint venture, or subsidiary of the SBC that is based in or receives funding from, any foreign country of concern;
• any current or pending contractual or financial obligation or other agreement specific to a business arrangement, or joint venture-like arrangement with an enterprise owned by a foreign state or any foreign entity;
• whether the SBC is wholly owned in a foreign country;
• any venture capital or institutional investment and if the investing entity has a general partner or any other individual holding a leadership role who has a foreign affiliation with any foreign country of concern;
• any technology licensing or intellectual property sales or transfers to a foreign country of concern during the 5-year period preceding submission of the proposal;
• any foreign business entity, offshore entity, or entity outside the United States related to the SBC;
• any owners, officers, or covered individuals that have a foreign affiliation with a research institution located in a foreign country of concern; and
• information technology and information safeguarding plans.

Upon request, applicants will submit the completed disclosure form via the Just-In-Time (JIT) process described in the NIH GPS section 2.5.1 Just-in-Time Procedures. The disclosure form and any additional agency-specific information must be submitted electronically using the Just-in-Time feature in the eRA Commons. Applicants must continue to comply with NIH Other Support disclosure requirements as provided in Section 2.5.1. SBC applicants applying to CDC and FDA will follow each agency’s policies for submitting additional documents during the pre-award process. Applicants may be required to provide similar information on the disclosure form that is also submitted as a part of the other support reporting for senior/key personnel identified in the application. Applicants that do not submit the completed disclosure form during the JIT process will not be considered for funding.

SBIR/STTR n otices of funding opportunities and terms and conditions of award will be updated to reflect the policy above.

Due Diligence Program to Assess Security Risks

NIH, CDC, and FDA have implemented a due diligence program designed to assess security risks posed by applicants. The due diligence program will assess the cybersecurity practices, patent analysis, employee analysis, and foreign ownership of an SBC seeking an award, including the financial ties and obligations of the SBC and employees of the SBC to a foreign country, foreign person, or foreign entity. After reviewing the application, including JIT elements and the disclosure form, NIH, CDC, and FDA may request the SBC provide copies of any contractual or financial obligation or other agreement specific to a business arrangement, or joint venture-like arrangement with an enterprise owned by a foreign state or any foreign entity in effect during the 5-year period (calendar year) preceding submission of the proposal. NIH, CDC, and FDA may decline to move forward with an award based on security risks determined during the assessment. NIH, CDC, and FDA will not issue an award prior to completing the assessment process.

Denial of Awards

Applicants and recipients are encouraged to consider whether their entity’s relationships with foreign countries of concern will pose a security risk. Prior to issuing an award, NIH, CDC, and FDA will determine whether the SBC submitting the application:

• has an owner or covered individual that is party to a malign foreign talent recruitment program;
• has a business entity, parent company, or subsidiary located in the People’s Republic of China or another foreign country of concern; or
• has an owner or covered individual that has a foreign affiliation with a research institution located in the People’s Republic of China or another foreign country of concern.

A finding of foreign involvement with countries of concern will not necessarily disqualify an applicant. Final award determinations will be based on the above finding of foreign involvement and whether the applicant’s involvement falls within any of the following risk criteria, per the Act:

• interfere with the capacity for activities supported by NIH, CDC, or FDA to be carried out;
• create duplication with activities supported by NIH, CDC, or FDA;
• present concerns about conflicts of interest;
• were not appropriately disclosed to NIH, CDC, or FDA;
• violate Federal law or terms and conditions of NIH, CDC, or FDA; or
• pose a risk to national security.

Generally, NIH, CDC, and FDA will not provide SBC applicants the opportunity to address any identified security risks prior to award. NIH, CDC, and FDA will not issue an award under the SBIR/STTR program if the covered relationship with a foreign country of concern identified in this guidance is determined to fall under any of the criteria provided.

Post-Award Reporting Requirements

Recipients are responsible for monitoring their relationships with foreign countries of concern post-award, for any changes that may impact previous disclosures. SBCs receiving an award under the SBIR/STTR program are required to submit an updated disclosure form to report any of the following changes to NIH, CDC, and FDA throughout the duration of the award:

• any change to a disclosure on the disclosure form;
• any material misstatement that poses a risk to national security; and
• any change of ownership, change to entity structure, or other substantial change in circumstances of the SBC that NIH, CDC, and FDA determine poses a risk to national security.

Regular, annual updates are required at the time of all SBIR/STTR annual, interim, and final Research Performance Progress Reports (RPPRs). For changes that occur between RPPR submissions, updated disclosure forms are required within 30 days of any change in ownership, entity structure, covered individual, or other substantive changes in circumstance, as described above. Recipients will be required to upload these updated disclosures using the Additional Materials (AM) tool in eRA Commons. System enhancements to facilitate these uploads are underway, with an anticipated deployment in calendar year 2024.The RPPR Instruction Guide will be updated to reflect this process.

If the recipient reports a covered foreign relationship that meets any of the risk criteria prohibiting funding described in this guidance, NIH, CDC, and FDA may deem it necessary to terminate the award for material failure to comply with the federal statutes, regulations, or terms and conditions of the federal award. Refer to Section 8.5.2 Remedies for Noncompliance or Enforcement Actions: Suspension, Termination, and Withholding of Support for more information. Recipients are encouraged to monitor their covered foreign relationships post-award and avoid entering into relationships, both funded and unfunded, that may pose a security risk and jeopardize their ability to retain their award.

Agency Recovery Authority and Repayment of Funds

An SBC will be required to repay all amounts received from NIH, CDC, and FDA under the award if either of the following determinations are made upon assessment of a change to their disclosure:

• the SBC makes a material misstatement that NIH, CDC, and FDA determine poses a risk to national security; or
• there is a change in ownership, change in entity structure, or other substantial change in circumstances of the SBC that NIH, CDC, and FDA determine poses a risk to national security.

The repayment requirements and procedures provided in Section 8.5.4 Recovery of Funds of the NIH GPS apply and may also be subject to additional noncompliance and enforcement actions as described in Section 8.5.2 of the GPS. Recipients are required to follow the repayment procedures provided in the Guidance for Repayment of Grant Funds to the NIH.

Inquiries

Please direct all inquiries to:

For all inquiries concerning the NIH SBIR and STTR program requirements please contact:

SEED (Small business Education and Entrepreneurial Development)
Office of Extramural Research
SEEDinfo@nih.gov

For general NIH grants policy-related inquiries, please contact:

Division of Grants Policy
Office of Policy for Extramural Research Administration (OPERA)
GrantsPolicy@OD.NIH.gov

For NIH system related inquiries, please contact:

Systems Policy Branch, Division of Grants Systems Integration
OPERA
operasystemspolicy@nih.gov

For inquiries concerning CDC’s SBIR and STTR program requirements, please contact:

CDC Office of Grants Services, Office of Financial Resources
OGSPolicy@cdc.gov

For inquiries concerning FDA’s SBIR and STTR program requirements, please contact:

Kimberly Pendleton
CGMO/Director
Office of Finance, Budget, Acquisitions, and Planning
Kimberly.Pendleton@fda.hhs.gov