Research Security Program Certification Deadlines (2026–27)

As of November 2, 2026, no federal research agency has published the final research security program policy that starts the clock on institutional certification, so there is no confirmed agency-by-agency certification deadline yet. Universities above the NSPM-33 funding threshold will get up to 18 months from each agency’s effective date to certify a program covering cybersecurity, foreign travel security, research security training and export control training. Meanwhile, the individual pieces that are already enforced, such as research security training certifications at NSF, DOE, USDA, NIH and NASA, mean most R1 institutions are certifying parts of the program on every proposal today, and a GRC platform such as Compyl can hold the controls and evidence for all of it in one place.

The status picture changed in 2025: NIH announced that covered institutions would have to certify a research security program for applications submitted on or after January 25, 2026, then rescinded that policy on September 29, 2025 because the implementation date “had not been finalized.” By March 2026, the Council on Governmental Relations reported that “no federal agency has yet promulgated a fully integrated, comprehensive research security program,” with cybersecurity the largest unresolved piece. And as of an October 2, 2026 review by the Association of College and University Auditors, five of the six largest research funders already require research security training certification at proposal, while DoD’s requirement was still pending.

Last updated November 2, 2026.

Key takeaways

• The “July 2026” date that circulated widely was always an estimate. The real deadline is 18 months after each agency’s own policy takes effect, and no agency has published that final policy yet.
• The program has four required elements: cybersecurity, foreign travel security, research security training and export control training. Agencies may add more.
• Training certification is already live: DOE (May 1, 2025), NSF (October 10, 2025, updated December 2, 2025), USDA (December 31, 2025), NIH (May 25, 2026) and NASA (August 5, 2026).
• Cybersecurity is the element most likely to slip, because the NIST resource it points to (NIST IR 8481) has not been finalized. The draft protocols overlap heavily with NIST SP 800-171 basic requirements.
• Institutions that build the program now, with named owners and evidence that already exists, will be able to certify within weeks of an agency announcement instead of scrambling for 18 months.

When do universities have to certify a research security program?

Under the OSTP guidelines issued July 9, 2024, each federal research agency had six months to submit an implementation plan to OSTP and OMB, and its updated policy takes effect no later than six months after the plan is finalized. Covered institutions then have “not more than 18 months after the effective date” of that agency’s policy to implement the requirements and certify.

When the guidelines came out, COGR projected that the 18-month windows would close somewhere between July 2026 and January 2027, depending on when each agency acted. As BakerHostetler noted in March 2026, “by July 2026” was a representative date, not a universal one. In practice, the agencies have not yet published the final program standard, so the clocks have not started. Institutions are planning against different internal targets: UW–Madison prepared to certify as early as July 1, 2026, while Emory’s August 2026 status update lists January 2027 as its current compliance date.

Research security program requirements by agency (master table)

This table lists only dates we verified against an agency notice or an institutional summary of one. “Not yet announced” means we found no published date as of November 2, 2026.

Two caveats. First, institutional summaries disagree on a few dates (for example, USDA’s effective date appears as October 10, 2025, December 31, 2025 and February 15, 2026 across different university pages), so confirm against the award terms you actually sign. Second, covered populations differ by agency. For the wider set of 2027 dates your security and privacy teams are tracking, see our 2027 compliance deadline calendar.

What is the legal basis for the research security program requirement?

NSPM-33 (January 2021)

National Security Presidential Memorandum 33, signed in January 2021, directed agencies to standardize disclosure rules and required research institutions above a funding threshold to certify that they operate a research security program. Its original threshold was more than 50 million dollars a year in federal science and engineering support in each of the previous two fiscal years. The National Science and Technology Council issued implementation guidance in January 2022.

The OSTP guidelines (July 9, 2024)

The final OSTP guidelines refined that threshold. A covered institution is an institution of higher education, FFRDC or nonprofit research institution receiving more than 50 million dollars in federal R&D funding annually, in fiscal year 2022 constant dollars, measured as a three-year average of obligations reported in NSF’s federal funding surveys. A University Affiliated Research Center counts as part of its university. Certification is a written or electronic attestation that the institution “meets the relevant research security program requirements,” though the government-wide collection system has not been finalized.

The CHIPS and Science Act (2022)

The CHIPS and Science Act does not itself set an institutional program certification deadline, which is why searches for a “CHIPS Act research security certification deadline” come up empty. It adds two certifications that stack on top of the program: Section 10634 requires research security training for covered individuals within 12 months before an application, with an institutional certification, and Section 10632 requires senior/key personnel to certify they are not party to a malign foreign talent recruitment program, at proposal and annually (as NIH’s notice cites them). Section 10229 is the source of the NIST cybersecurity resource that the program’s cybersecurity element points to.

What are the four NSPM-33 research security program elements?

What are the NSPM-33 cybersecurity protocols?

The final cybersecurity standard is the open question. The 2024 guidelines tie it to the final version of NIST IR 8481, which as of COGR’s March 2026 report was still pending. A Federal Demonstration Partnership and EDUCAUSE working group took public comment on draft cybersecurity guidelines in October 2025 and sent a revised draft to the federal interagency working group.

Until that lands, most universities are building to the 14 baseline protocols from the 2022 implementation guidance. The University of Kansas publishes the full list with its mapped policies, adding a fifteenth line for controlled unclassified information. Nearly every protocol mirrors a NIST SP 800-171 basic requirement, which is why a single control set can serve both:

If your security team is deciding how far beyond this baseline to go, our comparison of NIST 800-53 and 800-171 explains where each framework fits.

Which related requirements stack on top of the program?

The program certification is one layer. Research compliance offices are also evidencing these requirements, several of which are already enforced:

• NIH research security training. Senior/key personnel on applications due on or after May 25, 2026 must have completed training within the prior 12 months, certified through the SciENcv biosketch, with the authorized organizational representative certifying for the institution on the application face page (NOT-OD-26-017).
• NIH controlled-access data security. Since January 25, 2025, approved users of NIH controlled-access genomic data must attest that their institution complies with NIST SP 800-171, including any third-party or cloud system they use (NOT-OD-24-157). A proposed broader controlled-access data policy would also require 800-171 compliance, per COGR’s March 2026 report.
• DOJ bulk sensitive data rule. The Data Security Program (28 CFR Part 202) took effect April 8, 2025, with due diligence, audit and reporting obligations from October 6, 2025. It has no academic exemption and restricts bulk transfers of human genomic, biometric and health data to countries of concern, which touches data-sharing agreements, MTAs and cloud vendors (CASRAI analysis).
• Malign foreign talent recruitment program prohibitions. NSF has barred participation by senior/key personnel since May 20, 2024, with AOR and individual certifications. NIH made current MFTRP parties ineligible to serve as senior/key personnel as of September 11, 2025.
• Disclosure and common forms. NSF moved to the common biosketch and current and pending support forms in SciENcv in 2024, NASA in October 2024, DOE in December 2025, and NIH for due dates on or after January 25, 2026, with ORCID iDs required (FDP status update). NIH also requires Other Support disclosure training from October 1, 2025 (NOT-OD-25-133), per Yale’s agency summary.

What does a real university program look like? The UW–Madison example

UW–Madison is a useful public reference. In October 2025, its Research Security and Export Control office and Office of Cybersecurity began assessing selected research data environments against 15 cybersecurity controls aligned with NSPM-33, plus five controls aligned with DoD’s CMMC program, which governs DoD-funded CUI work under separate contract terms. The first round covered about 20 environments, chosen partly by federal funding level, to finish by May 29, 2026, because the university expected that certification “may be required as soon as July 1, 2026.”

Two lessons carry over. Its CIO pointed out that “NSPM-33-aligned cybersecurity controls are not new for us,” since most were already required by campus policy; the new part is certifying them. And the work is ongoing: the university’s program page reports a second phase of assessments completed in July 2026 and a new 2026–2027 training course in its learning system.

How do you build and evidence a research security program?

Certification is an attestation, so the work is less about writing a policy and more about proving it. A practical sequence:

1. Name a program lead and owners. Assign each element to an accountable office, and record the decision so the attestation has a clear chain of responsibility.
2. Define the in-scope population. Build one roster of covered individuals from sponsored programs data, then flag each sponsor’s definition, since NIH, NASA and DOE cover different roles.
3. Map controls once. Map the 14 cybersecurity protocols to the controls you already run for NIST SP 800-171, GLBA, HIPAA and your campus security policy, so one test produces evidence for all of them.
4. Scope research environments. Inventory labs, research computing clusters and cloud workspaces that hold federally funded data, then assess them the way UW–Madison did.
5. Connect training to proposals. Auditors will test whether proposal routing blocks submissions when a covered person lacks current training.
6. Run the travel registry and export reviews as records, not emails. Pre-travel briefings, device issuance and foreign sponsor reviews should each leave a dated record.
7. Rehearse the attestation. Do a mock certification each term so the sign-off is a review of existing evidence.

The ACUA guidance for auditors is explicit about the training evidence: a current roster, completion records from every system that delivers training, reconciliation against the research administration system, and a test of the proposal-phase hard stop (ACUA, October 2026).

What happens if a university can’t certify?

An institution that cannot attest by its agency deadline is out of compliance with that agency’s research security requirement. BakerHostetler lists the practical exposure as False Claims Act liability for institutions and individuals, sponsor audits and enforcement, loss of funding eligibility and reputational damage. The bigger near-term risk is the opposite problem: certifying something you cannot evidence. Every proposal already carries training and MFTRP certifications signed by an authorized organizational representative, and those statements are tested in audits today.

If you are not ready when an agency sets its date, document a gap assessment, a remediation plan with owners and dates, and compensating controls. That record is the same material the eventual attestation needs.

How Compyl supports research security programs

Compyl works with research universities and academic medical centers that have to run one security program across decentralized colleges, labs and campuses. Instead of a separate spreadsheet for NSPM-33, Compyl maps one control library across the frameworks a university already answers to, including NIST SP 800-171, FERPA, the GLBA Safeguards Rule, HIPAA, PCI DSS v4.0.1 and NIST CSF. The research security cybersecurity protocols sit on the same controls, so an access review or vulnerability scan collected once counts toward 800-171, GLBA and the research security attestation.

• One control library, many frameworks. Map the 14 NSPM-33 protocols to existing 800-171 and campus controls and test once.
• Evidence that collects itself. 125+ integrations are included, with transparent evidence logic so a research security officer can see exactly why a control passes.
• Training and travel records as evidence. Attach training completion exports, travel registry records and export control reviews to the program element they prove, with owners and due dates.
• Vendor risk for research data. Assess cloud and SaaS providers that touch genomic or health data, which matters under the DOJ bulk data rule and NIH’s 800-171 attestation for third-party systems.
• Risk in dollars. Quantify research environment risk with FAIR to brief the VP for research, cabinet or board.
• Dedicated single-tenant environment for each customer, which matters when the GRC system itself holds sensitive research security records.

See how Compyl fits a campus program on our higher education page, compare options in our guide to the best GRC platforms for higher education, or request a demo to walk through a research security control map.

Frequently asked questions

What are the NSPM-33 research security program requirements?

Covered institutions must operate and certify a research security program with four elements: cybersecurity, foreign travel security, research security training and export control training. The July 2024 OSTP guidelines define each element, and agencies may add requirements of their own.

When do universities have to certify a research security program?

Institutions get up to 18 months after each agency’s research security program policy takes effect. As of November 2, 2026, no agency has published that final policy, so no certification deadline is confirmed. NIH’s January 25, 2026 date was rescinded in September 2025.

Is there a CHIPS Act research security certification deadline?

The CHIPS and Science Act does not set an institutional program deadline. It requires research security training certification under Section 10634 and malign foreign talent recruitment program certifications under Section 10632, both of which agencies already enforce at proposal.

Which institutions are covered by the research security program requirement?

Institutions of higher education, FFRDCs and nonprofit research institutions receiving more than 50 million dollars a year in federal R&D funding, measured as a three-year average in fiscal year 2022 constant dollars under the OSTP guidelines. NSPM-33’s original wording used the previous two fiscal years.

What are the research security program requirements by agency (NSF, NIH, DOE, DoD, NASA)?

Training certification is in force at DOE (May 1, 2025), NSF (October 10, 2025), USDA (December 31, 2025), NIH (May 25, 2026) and NASA (August 5, 2026). DoD’s training requirement is pending, though it issued a January 2026 research security memo and a March 2026 decision matrix. No agency has set the institutional program certification date.

What cybersecurity controls does NSPM-33 require?

The final standard will follow NIST IR 8481, which is not yet final. Most universities are building to the 14 protocols from the 2022 implementation guidance, such as access limits, authentication, malware protection, flaw remediation and ransomware protection, which closely mirror NIST SP 800-171 basic requirements.

Does NIH require NIST SP 800-171?

For controlled-access genomic data, yes. Since January 25, 2025, approved users must attest that their institution, and any third-party or cloud system they use, complies with NIST SP 800-171 under NOT-OD-24-157.

What evidence do auditors expect for research security training?

A current roster of covered individuals, completion records within the prior 12 months from every training system, a crosswalk of course content to required topics, reconciliation against research administration data and proof that proposal routing blocks submissions without current training.

What happens if a university cannot certify its research security program?

It risks eligibility for new awards from the agency that set the deadline, sponsor audits and False Claims Act exposure if a certification proves inaccurate. A documented gap assessment and remediation plan is the best interim position.

What software helps universities manage research security compliance?

GRC platforms that map controls across frameworks help most, because the research security cyber protocols overlap with NIST SP 800-171, GLBA and HIPAA controls universities already run. Compyl maps one control library across those frameworks and tracks evidence, owners and training records in a dedicated single-tenant environment.