The Council on Governmental Relations (COGR) surveyed 82 member institutions to assess their experiences with Department of Defense (DoD) requirements for risk-based security reviews and mitigation plans in fundamental research. The majority of respondents were public universities, with a significant portion also conducting export-controlled and classified research. Approximately half of the institutions reported receiving at least one request for a risk mitigation plan, with most requests originating from the Army/Army Research Laboratory. The survey revealed that DoD frequently failed to provide clear reasons for plan requests, creating challenges for institutions in understanding and meeting expectations. Furthermore, the majority of institutions noted that DoD did not supply draft templates, compelling them to develop mitigation plans independently, which proved to be time-consuming—commonly requiring between 11 and more than 21 hours for development, and four to six weeks for negotiation and finalization.
Required elements within these plans often included international travel reporting, threat awareness training, restrictions or reporting of certain foreign collaborations, and vigilance regarding foreign operatives. While most institutions were able to successfully negotiate acceptable plans with DoD, about one-third faced difficulties, sometimes resulting in an inability to finalize research awards. Notably, when plans were rejected, institutions rarely received clear explanations or formal notifications from DoD components. The survey’s conclusions underscore the commitment of research institutions to address security risks and mitigate foreign influence but highlight the need for enhanced communication, including the provision of plan templates and clearer rationale for required measures, to streamline compliance and facilitate successful research partnerships with the DoD.
