For founders pursuing Department SBIR or STTR funding, a strong technical concept, capable team, and credible commercialization plan remain essential. But under a newly updated federal framework, applicants should also be prepared to explain the relationships surrounding their company, team, and technology.
On July 15, 2026, the Department’s updated SBIR/STTR Foreign Risk Evaluation Program took effect. The program replaces the former Due Diligence Program and creates a clearer, more standardized process for assessing security risks before an award is made.
The framework is intended to reduce the risk of improper technology transfer and help small businesses recognize potential concerns involving foreign ownership, control, influence, or affiliation. It follows the April 13, 2026 reauthorization of the SBIR and STTR programs through the Small Business Innovation and Economic Security Act.
For applicants, the directive is clear: do not leave foreign-risk preparation until the end of the proposal process.
1. What Changed?
The Department redesignated its SBIR/STTR Due Diligence Program as the Foreign Risk Evaluation Program and introduced four principal updates:
- More standardized areas of risk assessment
- Clearer identification of the factors reviewers must evaluate
- Updated definitions of prohibited behaviors and affiliations
- Minimum response requirements when a company is denied because of a security risk
The accompanying 2026 Common Decision Matrix establishes minimum review actions for the applicant small business, its owners, key employees, and covered individuals. It also distinguishes between conditions that prohibit an award, risks that may require mitigation, and situations in which no mitigation is necessary.
2. What May Be Reviewed?
The review can extend beyond the proposal narrative. Department reviewers may consider the company’s ownership, people, intellectual property, finances, research partnerships, and outside relationships.
Cybersecurity
Applicants should be prepared to explain how the company protects research data, technical information, intellectual property, systems, and access to nonpublic materials.
Cybersecurity requirements can vary by solicitation. Review the current opportunity carefully rather than assuming that a response or certification used in a previous proposal will still apply.
Patents and Intellectual Property
Reviewers may examine patent applications, filing history, inventorship, co-ownership, co-applicants, licensing rights, and technology-transfer agreements.
Founders should know who developed the technology, who owns it, where related patents were filed, and whether another individual or organization has the right to use, license, or commercialize it.
Owners and Key Personnel
The evaluation may include foreign employment, academic appointments, research affiliations, professional roles, outside compensation, and participation in a malign foreign talent recruitment program.
This review can apply to owners, principal investigators, key employees, and other covered individuals who contribute meaningfully to the proposed research.
Foreign Ownership and Financial Relationships
Reviewers may examine investors, parent companies, subsidiaries, equity, debt, guarantees, surety obligations, revenue-sharing agreements, and joint ventures.
The issue is not simply whether a foreign relationship exists. The review considers whether that relationship creates control, significant influence, financial dependency, technology access, or involvement in company decision-making.
Research and Business Relationships
International universities, laboratories, collaborators, co-authors, co-inventors, suppliers, manufacturers, contractors, consultants, and licensing partners may also be relevant.
A legitimate international relationship is not automatically disqualifying. What matters is the access, rights, obligations, influence, dependency, or technology exposure created by the arrangement.
Restricted-Party Connections
The Department may also examine relationships with individuals or organizations appearing on specified U.S. government restricted-party lists.
Because these lists can change, applicants should rely on current screening information and the instructions in the active solicitation.
3. Not Every Finding Leads to Rejection
The Common Decision Matrix separates findings into three broad categories.
Prohibited factors prevent an award while the condition remains in place. These are statutory or policy-based restrictions and generally cannot be resolved through explanation alone.
Risks requiring mitigation may be manageable if the reviewing component determines that sufficient safeguards can be implemented. Mitigation could involve restructuring a relationship, limiting access, ending a dependency, modifying contractual rights, or taking another government-approved action.
No mitigation required applies when no meaningful concern is identified or when a relationship is sufficiently limited or incidental.
This distinction is important. An international connection is not automatically a reason for rejection. At the same time, disclosure alone does not make every relationship acceptable. The parties involved, degree of control, financial dependency, access to technology, and overall security risk still matter.
4. Review More Than Current Relationships
The Common Decision Matrix applies a five-year lookback to several important risk factors, measured from the solicitation closing date.
Applicants may need to review former foreign appointments, prior research collaborations, earlier patent filings, expired licensing agreements, past financial arrangements, previous co-authorships, and earlier participation in malign foreign talent recruitment programs.
Reconstructing this history can take time, particularly when several founders, researchers, investors, or affiliated companies are involved. Begin the review well before the submission deadline.
5. What Founders Should Do Now
Start by documenting the company’s owners, investors, parent companies, subsidiaries, affiliates, voting rights, board rights, and joint ventures.
Review foreign equity, debt, guarantees, surety obligations, revenue-sharing arrangements, and operational dependencies. Ask founders, principal investigators, key employees, and other covered individuals to document relevant foreign employment, appointments, research funding, compensation, professional affiliations, and talent-program participation.
Create a complete inventory of patents, pending applications, co-inventors, co-applicants, licensing agreements, and technology-transfer arrangements. Identify international collaborators, suppliers, manufacturers, consultants, contractors, universities, laboratories, and licensing partners.
Finally, compare the information across the proposal, required disclosure forms, résumés, professional biographies, patent records, publications, ownership documents, company website, and public professional profiles.
Federal law requires SBIR/STTR applicants to disclose specified information about their investments and foreign ties, and SBA provides a common disclosure template. Agency procedures may still vary, so applicants must follow the active solicitation and current submission instructions.
The Bottom Line
The Foreign Risk Evaluation Program is now an important part of Department SBIR/STTR award readiness.
Founders should not assume that every international relationship creates a problem. They should understand those relationships well enough to explain who is involved, what rights or access exist, whether foreign control or dependency is present, and how the relationship affects the company’s technology.
Start early. Review the applicable five-year history. Resolve inconsistencies. Disclose accurately. Follow the current solicitation.
A strong technical proposal remains essential. Under the new framework, responsible management of the relationships surrounding that technology is also part of being ready for an award.
Learn More
Foreign Risk Evaluation Program
https://www.defensesbirsttr.mil/FRE/
SBA: Required Disclosures of Foreign Affiliations or Relationships
https://www.sbir.gov/foreign_disclosures
SBA: SBIR/STTR Policy Directives
https://www.sbir.gov/about/policies
Small Business Innovation and Economic Security Act, Public Law 119-83
https://www.govinfo.gov/app/details/PLAW-119publ83
Department SBIR/STTR Program Information
https://www.defensesbirsttr.mil/SBIR-STTR/
Current Department SBIR/STTR Funding Opportunities
https://www.defensesbirsttr.mil/SBIR-STTR/Opportunities/
Defense SBIR/STTR Innovation Portal
https://www.dodsbirsttr.mil/
This article is provided for general educational purposes and does not constitute legal, export-control, cybersecurity, contracting, eligibility, or application-specific advice.
