Research Security: NIH Action Needed to Strengthen Foreign Interference Risk Management

What GAO Found The National Institutes of Health (NIH) funds extramural research through awards to universities and other institutions. Implementation of federal research security requirements helps safeguard this research from foreign interference, including misappropriation and unauthorized access by foreign countries and entities. NIH implemented 14 of the 15 federal research security requirements GAO reviewed that address: (1) disclosure, (2) malign foreign talent recruitment programs, (3) research security training and programs, and (4) collaboration and information sharing. These requirements apply across federal research agencies and include actions NIH must take, as well as requirements it must impose on grant applicants, recipients, and specified individuals. For the remaining requirement concerning certification by certain recipient institutions that they have established and operate research security programs, NIH is working with an interagency group to implement the requirement. NIH relies heavily on self-reported information disclosed by researchers and institutions to identify and manage foreign interference risks and generally does not verify such disclosures using sources outside those required during pre-award risk assessments unless it receives a foreign interference allegation. Additionally, NIH does not require disclosure of all past affiliations, and foreign component disclosures are only required when the collaboration involves the performance of a signi