DOE Expands Security Reviews for SBIR/STTR Applicants Through 2031

The U.S. Department of Energy (DOE) has expanded cybersecurity and research-security due diligence for applicants to its Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs. The framework operates under the Small Business Innovation and Economic Security Act of 2026, which extends the statutory framework through September 30, 2031. For small businesses and research partners competing for DOE support, security documentation is therefore part of the proposal-readiness picture—not merely a post-selection compliance issue. The extended timeframe makes the requirements relevant beyond a single funding round, although the specific submission instructions described here apply to the identified FY 2025 solicitation round.

DOE reviews can address both an applicant’s cybersecurity practices and a broader set of research-security risks. The stated areas of review include foreign affiliations, ownership, investment, licensing, joint ventures, and connections to restricted parties. These topics can require coordination across technical, legal, finance, and corporate leadership functions. Companies should be prepared to identify relevant relationships and provide consistent, supportable information; the announcement does not specify that every applicant will face identical inquiries or establish a particular outcome for any individual review.

A material submission change applies to the FY 2025 Phase II Release 2 Applied Science round. Applicants must submit a body of evidence and requirements reporting rather than the usual cybersecurity self-assessment. That distinction matters for proposal planning: teams should verify the applicable solicitation instructions, assign responsibility for assembling evidence, and avoid assuming that a completed standard self-assessment will satisfy the round’s requirements. The source does not enumerate the exact contents or format of the evidence package, so applicants should rely on DOE’s official application materials for those details.

For GovCon teams, the expanded review creates an early diligence and documentation task across the SBIR/STTR pursuit lifecycle. Small businesses may need to map ownership and investment relationships, review relevant licenses and joint ventures, and coordinate disclosures concerning foreign affiliations or restricted-party connections. Prime contractors, research partners, and advisers supporting applicants should also account for these review areas when helping structure teaming arrangements or prepare application materials. The law’s extension through September 30, 2031 signals that research-security considerations will remain relevant to DOE small-business research awards over multiple years, while the precise requirements may vary by opportunity and agency guidance.

• DOE has expanded cybersecurity and research-security due diligence for SBIR/STTR applicants.
• The Small Business Innovation and Economic Security Act of 2026 extends the statutory framework through September 30, 2031.
• Reviews can cover cybersecurity practices, foreign affiliations, ownership, investment, licensing, joint ventures, and restricted-party connections.
• The FY 2025 Phase II Release 2 Applied Science round requires a body of evidence and requirements reporting instead of the usual cybersecurity self-assessment.
• Applicants should review the specific solicitation instructions to determine the evidence package’s required content and format.
• Pursuing companies should coordinate cybersecurity, legal, finance, and corporate records so disclosures are accurate and consistent.
• Teams should assess foreign relationships and ownership information early enough to address potential documentation needs during proposal preparation.
• The extended statutory timeframe makes these diligence considerations relevant to DOE small-business research awards beyond the specified FY 2025 round.