In August 2026 the Department of War gave 30 institutions two weeks to audit their foreign collaborations. This checklist covers what to review, how to assess export-control exposure, and what a mitigation plan needs to hold up.
Proof you know your covered people, that disclosures match the record, that ties to listed entities were screened, and why you decided what you did.
The August 2026 Defense audits gave institutions two weeks to respond.
Work the nine-item checklist below before anyone asks.
A research security audit asks whether your institution knows its researchers' foreign appointments, funding and collaborations, whether they were disclosed, whether any involve listed entities or talent programs, and what you decided and why. It also checks the program around them: travel, training, export controls and cybersecurity.
The Department of War ordered 30 academic institutions to audit their collaborations with foreign entities of concern and assess exposure of sensitive and export-controlled research, in two weeks, with future funding eligibility tied to the response.
Defense components now spot-check every mitigated award and at least 25% of other fundamental research awards, and review a sample of research grants annually under the FY2025 NDAA.
USW(R&E) memo, January 2026 · FY2025 NDAA §226
Research security program certification for institutions above $50 million a year in federal science and engineering support is arriving agency by agency, into 2027.
NSPM-33; OSTP research security program guidelines, July 2024
Before an audit, be able to show nine things: who is covered on which awards, disclosures reconciled with the public record, collaborations screened against government lists, talent program checks, institutional partnerships, travel records, training records, export-control exposure, and a documented decision for every finding.
List the covered individuals on every active and pending federal award, with the sponsor, the award, and whether it is Defense-funded fundamental research.
Can you produce this list in a day?Compare each Current and Pending (Other) Support and Biographical Sketch against the researcher's publications, acknowledged funders, profiles and appointments. Omissions are the most common finding.
Is every foreign appointment and source of support on the form?Affiliations, co-authors' affiliations, co-patents, funders, subawardees and visiting scholars, against the Section 1286 list and the other federal lists in the 2026 DoW decision matrix, over a five-year look-back.
Which collaborations touch a listed entity, and since when?Programs rebrand and stop advertising. Look for the arrangement: a foreign appointment with pay or titles, promised resources, recruitment duties, or terms the researcher can't end.
Has every covered individual certified, and does the record agree?Foreign gifts and contracts, joint institutes, and any program tied to a Confucius Institute or its successors, which the August 2026 audits named explicitly.
Covered international travel, with disclosures, approvals, briefings and debriefs on file, and any concern a debrief raised followed to a decision.
Research security training completion for every covered individual on proposals that require the certification, and export control training for people on controlled work.
Use the review sequence below with your export control office.
For every finding: what was found, what was decided, the mitigation, who approved it, and when. A decision you can't document is one an auditor won't credit.
Would the same facts get the same decision from a different reviewer?Assess export-control exposure in six steps: confirm which projects really qualify as fundamental research, classify the controlled items and data involved, map which people can access them, track what leaves the institution through shipments, travel and remote access, screen the parties on the other side, and check that technology control plans are followed.
Check the award terms first.
EAR or ITAR, item by item.
Foreign persons, deemed exports.
Shipments, travel, remote access.
Against restricted-party lists.
A technology control plan, followed.
Results of fundamental research, ordinarily published and shared broadly, are generally outside export controls. Publication restrictions, sponsor approval of results, or limits on who may participate in the award terms can remove that status. Start with every award and agreement that has them.
Determine whether equipment, software, technical data or materials are controlled under the Export Administration Regulations or the International Traffic in Arms Regulations, and under which classification. The research topic alone doesn't answer this; the specific item or data does.
Releasing controlled technology to a foreign person in the United States can be a deemed export. Identify who works with controlled items or data, their citizenship status, and whether a license or exception covers them.
Equipment shipped abroad, laptops and data carried on travel, and cloud or remote access from overseas are all exports. Tie this to the travel record.
Sponsors, collaborators, vendors and recipients against restricted-party lists, including the Entity List, before anything is shared or shipped.
Where controlled work exists, a technology control plan with physical and IT access controls, training, and periodic checks that the plan matches what happens in the lab.
This is a review sequence, not a classification method. Export classification and licensing decisions belong to your export control officer and counsel.
A defensible mitigation plan answers a specific finding, lists concrete measures each with an owner and a due date, is approved by someone with authority under a written policy, is acknowledged by the researcher, carries a date to review it again, and treats comparable findings the same way across cases.
Specific and sourced.
Each with an owner and a due date.
Under a written policy.
The researcher knows the terms.
A date to look again.
The plan names what was found, from which source, and which rule or policy it implicates. A generic plan applied to everyone is not a mitigation.
An updated disclosure, an appointment ended, a researcher removed from a project, separated data, restricted access, a technology control plan, or a scheduled check-in, each with an owner and a due date.
Who approved the plan and when, under which institutional policy, with a second approval where your policy calls for one.
A record that the researcher was told what is required, and agreed or responded.
Mitigated awards are now spot-checked every year. A review date, and evidence each measure was completed, are what a spot check looks for.
Comparable findings got comparable plans. Consistency across cases is what makes any one decision defensible.
Under NSPM-33, institutions receiving more than $50 million a year in federal science and engineering support certify that they maintain a research security program with four elements: cybersecurity, foreign travel security, research security training, and export control training. Each needs records an auditor can check.
Cybersecurity protocols for the systems that hold research data. Auditors ask: which protocols apply, to which systems, and who is responsible.
A travel policy, disclosure and authorization of covered international travel, briefings before, and debriefs after. Auditors ask: the register, and proof of briefings. Foreign travel security →
Training for covered individuals, now certified on proposals to several agencies under CHIPS and Science Act §10634. Auditors ask: completion records by person and date.
Export control training for people working on controlled research. Auditors ask: who is on controlled work, and their training records.
Program certification applies to institutions receiving more than $50 million a year in federal science and engineering support. Check each funding agency's implementation date. How SYSWERX supports NSPM-33 →
Short answers to the questions research security, sponsored programs and compliance offices ask most often about research security program checklist. Each answer is a summary for orientation; the statute, regulation or agency notice cited on this page has the final word.
Institutions receiving more than $50 million a year in federal science and engineering support, which certify to their funding agencies that they maintain one. Certification is arriving agency by agency into 2027.
Thirty institutions were ordered to audit their academic, financial and research collaborations with foreign entities of concern, including institutions on the Section 1286 list, assess exposure of sensitive and export-controlled research, and adopt mitigation up to ending partnerships, within two weeks.
Incomplete disclosure: a foreign appointment, position or source of support that appears on the public record but not on the researcher's Current and Pending (Other) Support.
The results of fundamental research are generally not subject to export controls, but restrictions in an award agreement can remove that status, and the equipment, software or data used in the work can still be controlled.
It answers a specific finding, lists concrete measures with owners and due dates, is approved under a written policy, is acknowledged by the researcher, has a review date, and matches how comparable cases were handled.
The August 2026 Department of War audit gave institutions two weeks. Plan to produce your covered-individual list, disclosure reconciliations, list screenings and case decisions on that kind of timeline.
This page summarizes federal law and policy for orientation and is not legal advice. Your sponsored programs office and counsel have the final word on what your institution certifies and how it complies.
What the OMB list means for institutions: the designation pathways, the timeline, and the supplier audit.
Read the guide →What the Defense Department's list is, what a listing triggers, and how to screen collaborators against it.
Read the guide →Each agency's talent program certification side by side: effective date, notice, who certifies and how.
Read the guide →What to review before an audit, how to assess export-control exposure, and what a defensible mitigation plan holds.
Read the guide →What the CHIPS and Science Act forbids, what it protects, and where talent programs show up on the record.
Read the guide →The four factors Defense program officers weigh for fundamental research proposals, explained.
Read the guide →All guides → New to the terms? The research security glossary →
We'll show your office how SYSWERX reconciles disclosures, screens collaborations, and keeps every finding and mitigation plan in a documented case.