NSPM-33 — National Security Presidential Memorandum 33 on Research Security

Why does it matter?

NSPM-33 is the first government-wide research security policy, and it sets rules that reach every principal investigator, program officer, peer reviewer and intramural researcher in federally funded R&D (Sec. 4(b)(i)). It names the behaviors it targets, undisclosed foreign funding, undisclosed positions and participation in foreign government-sponsored talent recruitment programs, and attaches consequences up to termination of awards, debarment and civil or criminal penalties (Sec. 4(b)(ix)). The CHIPS and Science Act later gave the research security program and training requirements a statutory footing (Section 10634, 42 U.S.C. 19234).

Key benefits include:

• A threshold institutions can test

Sec. 4(g) sets the line at more than 50 million dollars per year in federal science and engineering support; the 2024 guidelines define a covered institution as an institution of higher education, FFRDC or nonprofit research institution above that line in FY 2022 constant dollars on a three-year average of NCSES survey data.

• Four named program elements

Cybersecurity, foreign travel security, research security training and export control training, each with a standardized way to certify it under Section II of the 2024 guidelines.

• Disclosure that is standardized across agencies

Sec. 4(b) requires disclosure of affiliations and employment, other support, foreign talent recruitment programs and positions and appointments, in two tiers, with annual updates and standardized forms (Sec. 4(b)(ii) to (vi)).

• Digital persistent identifiers

Sec. 4(b)(v) directs agencies to require researchers on federal grants to register with a service that provides a digital persistent identifier, so disclosures can be matched across agencies.

• Fairness built into the policy

The 2024 guidelines require agencies to ensure that research security requirements do not target, stigmatize or discriminate on the basis of race, ethnicity or national origin (Section III(1), CHIPS and Science Act Section 10637) and to give institutions flexibility and the least burden possible.

How does it work?

The memorandum itself works through funding agencies. Sec. 3 assigns roles: funding agencies require disclosure and set consequences, the Secretaries of State and Homeland Security vet foreign students and researchers, the DNI produces threat information and OSTP coordinates through the NSTC. Sec. 4(b)(iii) gives a disclosure table: Tier I (principal investigators and other key personnel, program officers, intramural funding recipients) disclose all four categories; Tier II (peer reviewers and advisory committee or panel members) disclose all but other support. Sec. 4(c)(ii) prohibits federal personnel who take part in the R&D enterprise from joining foreign government-sponsored talent recruitment programs, and Sec. 4(f) requires research security training for federal R&D personnel with an initial orientation and annual refreshers.

The January 2022 NSTC guidance addressed five areas: disclosure requirements and standardization, digital persistent identifiers, consequences for violations, information sharing and research security programs. Its research security program chapter (pp. 18 to 21) asked institutions to designate a research security point of contact with a public means of contact, to satisfy the cybersecurity element through fourteen basic safeguarding protocols from awareness training to periodic and real-time scans, to maintain a program description and provide it within 30 days of an agency request, and to comply within one year of the formal requirement. The 2024 OSTP memorandum supersedes that chapter in full.

The 2024 guidelines set the standardized requirement. Institutions of higher education certify that they will implement a cybersecurity program consistent with the CHIPS and Science Act Section 10229 resource within one year after NIST publishes it; other covered institutions follow another NIST or federal agency resource. Foreign travel security means periodic training, each covered individual at least once every six years, and a travel reporting program with an organizational record of international travel when an agency determines the risk warrants it. Research security training is met by the NSF modules at rst.nsf.gov or an institutional program; export control training by BIS training or an institutional program covering review of foreign sponsors, collaborators and partnerships.

Key Elements

• Definitions (Sec. 2)

Participants in the U.S. R&D enterprise; U.S. Government-supported R&D; conflict of interest; conflict of commitment; foreign government-sponsored talent recruitment program; Federal personnel; digital persistent identifier.

• Disclosure requirements (Sec. 4(b))

Affiliations and employment, other support including in-kind resources, foreign talent recruitment program participation with contracts on request, and positions and appointments; initial disclosure at hiring or proposal and annual updates; standardized forms and definitions across agencies.

• Consequences (Sec. 4(b)(ix))

Termination of employment, contract or award; removal of individuals from award work; ineligibility for review panels; suspension or debarment; suspension or denial of Title IV funds; civil and criminal penalties where laws apply.

• Limiting access (Sec. 4(c))

Policies to control and track access to government research facilities and to vet foreign visitors; a prohibition on federal personnel participating in foreign government-sponsored talent recruitment programs, with exemptions notified to the President.

• Vetting and information sharing (Sec. 4(d) and (e))

Risk-based visa vetting with seven information items, SEVIS reporting assessments and a feasibility study of a searchable database flagging Entity List connections; sharing of information about violators across funding agencies and with law enforcement.

• Research security program certification (Sec. 4(g))

Institutions above 50 million dollars per year in federal science and engineering support certify that they operate a program covering cybersecurity, foreign travel security, insider threat awareness and identification and, as appropriate, export control training.

• Covered institution and the four elements (2024 guidelines, Section II)

Institution of higher education, FFRDC or nonprofit research institution above the threshold in FY 2022 constant dollars; certification that the program includes cybersecurity, foreign travel security, research security training and export control training.

• Implementation timeline (2024 guidelines, Section IV)

Agency plans to OSTP and OMB within six months of July 9, 2024; agency policies effective no later than six months after finalized plans are submitted; institutions given no more than 18 months after the effective date of an agency's plan.

What does it cover?

NSPM-33 binds the executive departments and agencies it is addressed to, and through them the funding agencies' grantees, contractors and intramural researchers (Sec. 3 and 4). The research security program requirement applies to institutions above the 50 million dollar threshold, defined in 2024 as covered institutions: institutions of higher education, FFRDCs and nonprofit research institutions; agencies are encouraged, not required, to apply similar requirements to other organizations above the threshold (Section II). Disclosure requirements reach principal investigators, key personnel, program officers, peer reviewers, advisory panel members and intramural researchers (Sec. 4(b)(i)). Research involving classified information or controlled unclassified information remains subject to its own, stricter protocols (2022 guidance, p. 19).

What are its objectives?

Sec. 4 states that it is the policy of the United States to:

Enhance awareness of research security risks and protections across the R&D enterprise (Sec. 4(a)).

Strengthen disclosure requirements and processes for conflicts of interest and commitment (Sec. 4(b)).

Limit access to and participation in federal research facilities and programs where risk warrants (Sec. 4(c)).

Vet foreign students and researchers and share information about violators (Sec. 4(d) and (e)).

Train federal R&D personnel, require research security programs at large institutions and promote and protect international R&D cooperation (Sec. 4(f) to (h)).

Framework in Context

NSPM-33 sits with the CHIPS and Science Act of 2022, whose Section 10634 (42 U.S.C. 19234) requires research security training and whose Section 10637 bars discriminatory implementation; the 2024 OSTP guidelines are issued under both. The cybersecurity element points to the NIST resource for research institutions under CHIPS Section 10229, for which NIST IR 8481 was the initial public draft of August 31, 2023. Sec. 4(b)(vii) ties institutional transparency to Section 117 of the Higher Education Act, enforced by the Department of Education. NSF hosts the research security training modules and BIS the export control training. The mapping list below carries broader security and privacy frameworks that institutions often manage in the same program.

Common Framework Mappings

Research institutions usually run NSPM-33 obligations alongside the security and privacy frameworks that already cover their systems and data, so the mapping below lists the frameworks most often managed together.

Mapped frameworks include:

CIS Controls v8.1

CMMC 2.0

FERPA

FISMA

GDPR

HIPAA

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2